* [PATCH 7.2 000/713] 7.2.4-rc1 review
@ 2026-09-04 4:49 Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 001/713] drm/amd/display: Skip Update HDCP Config In Transition State Greg Kroah-Hartman
` (723 more replies)
0 siblings, 724 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 7.2.4 release.
There are 713 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 7.2.4-rc1
Tzung-Bi Shih <tzungbi@kernel.org>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: scan: Do not combine resources that overlap completely
Injae Ryou <injaeryou@gmail.com>
selftests/mm: fix on-fault-limit false failure under sudo-rs
Zhan Xusheng <zhanxusheng1024@gmail.com>
udf: Fix i_lenExtents truncation on 32-bit kernels
Thomas Gleixner <tglx@kernel.org>
timer: Keep debugobjects state consistent in migrate_timer_list()
Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
Bradley Morgan <include@grrlz.net>
taskstats: fix cpumask parsing cutting off the last character
Jann Horn <jannh@google.com>
smack: fix cred UAF in smack_file_send_sigiotask()
Bradley Morgan <include@grrlz.net>
signal: avoid shared siginfo namespace rewrites
Helge Deller <deller@gmx.de>
sticon/parisc: Detect default STI graphics card for console output
Oleg Nesterov <oleg@redhat.com>
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
Myeonghun Pak <mhun512@gmail.com>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Xu Rao <raoxu@uniontech.com>
zloop: truncate finished zones to zone capacity
Zi Yan <ziy@nvidia.com>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
Maoyi Xie <maoyixie.tju@gmail.com>
w1: ds28e17: reject an oversize length on an I2C block read
Chengfeng Ye <nicoyip.dev@gmail.com>
vsock/virtio: flush works in dependency order
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: mt76: mt7996: validate default EEPROM firmware size
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
Bryam Vargas <hexlabsecurity@proton.me>
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt7925: cancel mlo_pm_work on stop
Bryam Vargas <hexlabsecurity@proton.me>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Yuhang.chen <yhchen312@gmail.com>
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
Dawei Feng <dawei.feng@seu.edu.cn>
wifi: rtw88: pci: fix resource leak on failed NAPI setup
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Fabio Estevam <festevam@nabladev.com>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Breno Leitao <leitao@debian.org>
mm/kmemleak: report RCU-tasks quiescent states during the scan
Breno Leitao <leitao@debian.org>
mm/kmemleak: stop the task stack scan early when interrupted
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - avoid stale fallback key after set_secret failure
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - clean up and improve ECDH comments
Vinicius Costa Gomes <vinicius.gomes@intel.com>
crypto: iaa - unmap dst before software fallback on decompress
Xiang Mei <xmei5@asu.edu>
fuse: copy request headers via a stack buffer for io-uring
Joanne Koong <joannelkoong@gmail.com>
fuse: decouple fuse_ring creation from ent registration
Fan Wu <fanwu01@zju.edu.cn>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Dawei Feng <dawei.feng@seu.edu.cn>
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Perform Dynamic Address Assignment on resume
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Restore STDBR and EXTBR registers on resume
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Reset the controller on resume
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Reconfigure the DATBAS register on re-attach
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Follow the reset deassert order used in probe
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Clean DATBAS register on detach
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Check that the transfer is valid before accessing it
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix potential UAF in i3c_device_uevent()
Maoyi Xie <maoyixie.tju@gmail.com>
i3c: master: svc: bound IBI payload to the requested max_payload_len
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix info leak and UAF in device unregister path
Runyu Xiao <runyu.xiao@seu.edu.cn>
i3c: master: adi: initialize the lock before enabling interrupts
Adrian Hunter <adrian.hunter@intel.com>
i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
Jianyun Gao <jianyungao89@gmail.com>
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
Jianyun Gao <jianyungao89@gmail.com>
dm-pcache: fix implicit u8 truncation of gc_percent in message handler
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: only hand out initialized cache segments
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: detect a cycle in the last-kset chain during replay
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: clamp the tail kset read to the segment data region
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: bound the persisted tail-position offset
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: validate on-media seg_num against the cache device size
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: validate kset key_num and intra-segment bounds
Bryam Vargas <hexlabsecurity@proton.me>
dm-pcache: validate geometry fields from on-disk cache_info
Haotian Zhang <vulab@iscas.ac.cn>
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix a crash if allocation of per-cpu data fails
Nathan Chancellor <nathan@kernel.org>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Eliot Courtney <ecourtney@nvidia.com>
rust: num: reject Bounded::shr overshifts at build time
Zhang Heng <zhangheng@kylinos.cn>
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
Denis Batishchev <ii343hbka@gmail.com>
ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
Ajrat Makhmutov <rauty@altlinux.org>
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
Eckhart Mohr <e.mohr@tuxedocomputers.com>
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
Takashi Iwai <tiwai@suse.de>
ALSA: virmidi: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: serial-u16550: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: portman2x4: Check card index validity at probe
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
Takashi Iwai <tiwai@suse.de>
ALSA: mts64: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: mpu401: Check card index validity at probe
Xu Rao <raoxu@uniontech.com>
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
Baul Lee <baul.lee@xbow.com>
ALSA: FCP: do not copy out an uninitialised init response
Baul Lee <baul.lee@xbow.com>
ALSA: bcd2000: clear the URB pointers on disconnect
Takashi Iwai <tiwai@suse.de>
ALSA: aloop: Check card index validity at probe
Baul Lee <baul.lee@xbow.com>
ALSA: 6fire: bound the MIDI event length from the device
Abdun Nihaal <nihaal@cse.iitm.ac.in>
mfd: sm501: Fix potential memory leaks during remove
Ali Ahmet Memis <ali@iusegentoo.com>
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
Thomas Richard <thomas.richard@bootlin.com>
mfd: cgbc: Fix teardown ordering in cgbc_remove()
Can Peng <pengcan@kylinos.cn>
hwrng: stm32 - Fix runtime PM cleanup on registration failure
Zhiling Zou <zhilinz@nebusec.ai>
seg6: reset IP6CB after IPv6 decapsulation
Norbert Szetei <norbert@doyensec.com>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Breno Leitao <leitao@debian.org>
net: fix spurious TX timeout after dev_activate()
Zhiling Zou <zhilinz@nebusec.ai>
net: cap advertised IP tunnel headroom
Bryam Vargas <hexlabsecurity@proton.me>
net/smc: unregister the connection before draining the rx tasklet
Hidayath Khan <hidayath@linux.ibm.com>
net/smc: stop killed, freed and out_of_sync sharing a byte
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
Hidayath Khan <hidayath@linux.ibm.com>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Hidayath Khan <hidayath@linux.ibm.com>
net/smc: fix socket refcount leak in smc_switch_conns()
Bryam Vargas <hexlabsecurity@proton.me>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
Glenn Judd <gmj@meta.com>
net/mlx5e: do not HW-GRO coalesce small frames
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Count packets dropped on RX refill failure
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Avoid double-accounting netif_rx() drops
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Fix TX busy and drop handling
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Reject oversized TX buffers
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Fail TX enqueue when the QP link is down
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Recycle TX entries before client callbacks
Fan Ye <fy15309206903@gmail.com>
net: thunderbolt: Mark the connection down when bringing it up fails
Fan Ye <fy15309206903@gmail.com>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
net: ravb: serialize PTP clock teardown
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
net: ravb: avoid dereferencing an invalid PTP clock
Christian Marangi <ansuelsmth@gmail.com>
net: phylink: correctly validate returned PCS in phylink_inband_caps
Ruoyu Wang <ruoyuw560@gmail.com>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: fix flow mask use-after-free on flow deletion
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
net: mctp: hold a reference to the route device in mctp_route_lookup()
Zihan Xi <zihanx@nebusec.ai>
net: l2tp: do not propagate multicast notification errors
Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
net: ipa: fix stalled modem TX queue after runtime resume
Runyu Xiao <runyu.xiao@seu.edu.cn>
net: ibm: emac: mal: fix NAPI locking
Joe Damato <joe@dama.to>
net: bnxt: ring the doorbell when SW USO exits early
Ahmad Fatoum <a.fatoum@pengutronix.de>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
Asim Viladi Oglu Manizada <manizada@pm.me>
net: tun: bound receive headroom
Fabio Porcedda <fabio.porcedda@gmail.com>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Aleksandr Khromov <haa@amicon.ru>
slip: fix use-after-free in sl_sync()
Weiming Shi <bestswngs@gmail.com>
xdp: fix zero-copy frame layout
Alexandra Winter <wintera@linux.ibm.com>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Corey Minyard <corey@minyard.net>
ipmi:msghandler: Cancel work cleanly on an error
Seiji Nishikawa <snishika@redhat.com>
ipmi: si: Fix NULL pointer dereference after failed registration
Yuho Choi <dbgh9129@gmail.com>
ipmi: Remove all sysfs files on registration failure
Yousef Alhouseen <alhouseenyousef@gmail.com>
ipmi: ipmb: validate write message length
Kuan-Wei Chiu <visitorckw@gmail.com>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
io_uring/query: cap user size passed to copy_struct_to_user
Hui Su <sh_def@163.com>
io_uring/waitid: avoid siginfo copy during ring teardown
Hui Su <sh_def@163.com>
io_uring/waitid: honor task_work cancellation
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: pass validated element count to package parsers
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: advance elem past consumed array elements
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
Bryam Vargas <hexlabsecurity@proton.me>
platform/chrome: sensorhub: Bound the EC-reported sensor number
Thorsten Blum <thorsten.blum@linux.dev>
platform/x86: think-lmi: Fix current password length check
Thorsten Blum <thorsten.blum@linux.dev>
platform/x86: think-lmi: Free system certificate signatures
Thorsten Blum <thorsten.blum@linux.dev>
platform/x86: think-lmi: Fix certificate thumbprint sysfs output
Hilgad Montelo <hilgad.montelo@gmail.com>
platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
Julian Haarmann <julian.haarmann@student.kit.edu>
platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
Ma Ke <make_ruc2021@163.com>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
Abdun Nihaal <nihaal@cse.iitm.ac.in>
platform/x86: int1092: Fix potential memory leak in sar_probe()
Krishna Chomal <krishna.chomal108@gmail.com>
platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Return error during profile addition
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Validate parameter for frequency and priority
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Validate parameter for core power state
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Validate max level for set feature
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Validate logical CPU id and clos id
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Use PP level enable mask
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Just allow 2 bits for SST feature enable
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Add a NULL check for sst_inst[]
Fan Wu <fanwu01@zju.edu.cn>
mmc: via-sdmmc: stop card-detect handling on probe failure
Fan Wu <fanwu01@zju.edu.cn>
mmc: via-sdmmc: cancel card-detect work on remove
HyeongJun An <sammiee5311@gmail.com>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
HyeongJun An <sammiee5311@gmail.com>
platform/x86: ISST: Validate level in perf mask ioctls
HyeongJun An <sammiee5311@gmail.com>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
Peiyang He <peiyang_he@smail.nju.edu.cn>
iommufd: Fix UAF in selftest IOPF reporting
Shuai Xue <xueshuai@linux.alibaba.com>
iommufd: Release current IOAS on xa_store() failure
Shuai Xue <xueshuai@linux.alibaba.com>
iommufd: Avoid locking internal accesses during unmap
Shuai Xue <xueshuai@linux.alibaba.com>
iommupt: Return zero for invalid iova_to_phys() ranges
Kevin Tian <kevin.tian@intel.com>
iommu/vt-d: Force requesting ACS when tboot is enabled
Kevin Tian <kevin.tian@intel.com>
iommu/vt-d: Fix no_iommu to disable platform opt-in
Peiyang He <peiyang_he@smail.nju.edu.cn>
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
Shameer Kolothum <skolothumtho@nvidia.com>
iommu/arm-smmu-v3: Manage teardown with devm
Robin Murphy <robin.murphy@arm.com>
iommu/arm-smmu-v3: Add HAFT support for SVA
Nicolin Chen <nicolinc@nvidia.com>
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
Shuai Xue <xueshuai@linux.alibaba.com>
iommu/sva: Set handle->dev before the SVA handle is visible
Weimin Xiong <xiongwm2026@163.com>
iommu/msm: Unwind probe state on registration failure
Shuai Xue <xueshuai@linux.alibaba.com>
iommu/amd: Put PCI device after handling PPR faults
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Warn on writes to kernel-exclusive config space regions
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Use file_ns_capable() when checking config space read access
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
Farhan Ali <alifm@linux.ibm.com>
PCI/MSI: Enable memory decoding before restoring MSI-X messages
Darshit Shah <darnshah@amazon.de>
PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER
Max Lee <max.lee@canonical.com>
PCI/ASPM: Avoid L0s for Realtek RTS525A
Lukas Wunner <lukas@wunner.de>
PCI/AER: Fix mapping of errors to agent & layer
Lukas Wunner <lukas@wunner.de>
PCI/AER: Emit TLP Log only for unmasked errors
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Fix read byte order in pci_read_legacy_io()
Tim Harvey <tharvey@gateworks.com>
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
Ali Tariq <alitariq45892@gmail.com>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
Ali Tariq <alitariq45892@gmail.com>
PCI: plda: Fix use-after-free of event IRQs during teardown
Ali Tariq <alitariq45892@gmail.com>
PCI: starfive: Fix resource leaks on error paths in host_init()
Ronald Claveau <linux-kernel-dev@aliel.fr>
PCI: meson: Fix GPIO state while requesting PERST#
Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Naman Jain <namjain@linux.microsoft.com>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Propagate partial completion length across ERP recovery
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Do not complete a failed ESE read as successful
Karl Mehltretter <kmehltretter@gmail.com>
s390/percpu: Fix MVIY_PERCPU() with older binutils
Thomas Richter <tmricht@linux.ibm.com>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
Jianing Li <m13940358460@163.com>
power: supply: max17040: synchronize work cancellation on suspend
Jianing Li <m13940358460@163.com>
power: supply: max17040: drop incorrect I2C functionality check
Jianing Li <m13940358460@163.com>
power: supply: max17040: propagate register read errors
Fan Wu <fanwu01@zju.edu.cn>
power: supply: ucs1002: fix use-after-free on remove
Maoyi Xie <maoyixie.tju@gmail.com>
power: supply: twl4030_charger: cancel workers via devm
Fan Wu <fanwu01@zju.edu.cn>
power: supply: rt9455: quiesce delayed work before teardown
HyeongJun An <sammiee5311@gmail.com>
power: supply: qcom_battmgr: terminate the strings from firmware
Fan Wu <fanwu01@zju.edu.cn>
power: supply: qcom_battmgr: fix use-after-free
Xu Rao <raoxu@uniontech.com>
power: supply: pf1550: enable charging when battery profile exists
Fan Wu <fanwu01@zju.edu.cn>
power: supply: lp8788-charger: fix use-after-free on remove
Fan Wu <fanwu01@zju.edu.cn>
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
Jameson Thies <jthies@google.com>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Bryam Vargas <hexlabsecurity@proton.me>
power: supply: cros_usbpd-charger: bound the EC-reported port count
Fan Wu <fanwu01@zju.edu.cn>
power: supply: charger-manager: register regulators before exposing sysfs
Ma Ke <make_ruc2021@163.com>
power: supply: bq25890: Fix power_supply reference leak
Fan Wu <fanwu01@zju.edu.cn>
power: supply: bq256xx: drain usb_work before freeing the charger
Fan Wu <fanwu01@zju.edu.cn>
power: supply: bq24257: fix use-after-free on remove
Jun Yang <junvyyang@tencent.com>
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Jun Yang <junvyyang@tencent.com>
sctp: distinguish sequence zero from wildcard in reconf lookup
Weiming Shi <bestswngs@gmail.com>
sctp: fix NULL deref on untransmitted RECONF completion
Hyunwoo Kim <imv4bel@gmail.com>
sctp: drop a chunk if its transport was removed
Hyunwoo Kim <imv4bel@gmail.com>
sctp: stop processing a packet once its association is deleted
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: reject a read that transferred too few bytes
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: fix host memory disclosure on R2T for a read command
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
Myeonghun Pak <mhun512@gmail.com>
nvme-pci: disable controller on admin queue IRQ setup failure
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme: zero the discard fallback page
Ewan D. Milne <emilne@redhat.com>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Oscar Ou <oscarou@synology.com>
lockd: fix swapped arguments in nlmsvc_match_ip()
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
lockd: fix NULL dereference on lockowner allocation failure
Olga Kornievskaia <okorniev@redhat.com>
lockd: fix NLMv4 GRANTED_MSG handling
Michael Bommarito <michael.bommarito@gmail.com>
lockd: pin next file across nlm_inspect_file lock-drop
Yifei Gao <gyf161023@gmail.com>
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
Ruoyu Wang <ruoyuw560@gmail.com>
i2c: mxs: fix DMA channel leak on probe error
Cong Nguyen <congnt264@gmail.com>
hwmon: (max6621) fix temperature clamp range
Cong Nguyen <congnt264@gmail.com>
hwmon: (max6621) fix negative temperature offset and crit readings
Alexander Graf <graf@amazon.com>
dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G
Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
ASoC: codecs: aw88261: only check PLL and clock state at power-up
Christopher Tolang <christophertolang@gmail.com>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
Karl Mehltretter <kmehltretter@gmail.com>
arm64: proton-pack: Restore the nospectre_bhb command-line option
Karl Mehltretter <kmehltretter@gmail.com>
arm64: compat: Fix decrementing LDM/STM alignment emulation
HyeongJun An <sammiee5311@gmail.com>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
Norbert Szetei <norbert@doyensec.com>
openvswitch: only skb_tx_error() a packet we are about to drop
Yuqi Xu <xuyuqiabc@gmail.com>
openvswitch: Fix CT limit teardown use-after-free
Ali Ahmet Memis <ali@iusegentoo.com>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Zhan Xusheng <zhanxusheng1024@gmail.com>
ocfs2: fix readdir position truncation on 32-bit kernels
Matthias Goergens <matthias.goergens@gmail.com>
ocfs2: fix cached cluster count after suballocator reclaim
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
Doruk Tan Ozturk <doruk@0sec.ai>
ocfs2: validate directory-index entry counts when reading metadata
Ibrahim Hashimov <security@auditcode.ai>
ocfs2: validate rl_used against rl_count in refcount block validator
Bryam Vargas <hexlabsecurity@proton.me>
ocfs2: validate lengths in dlm_mig_lockres_handler
Bryam Vargas <hexlabsecurity@proton.me>
ocfs2: bound namelen in dlm_migrate_request_handler
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: always run deallocs on copy-on-write completion
Zhiling Zou <zhilinz@nebusec.ai>
orangefs: skip leading spaces before parsing client debug masks
Yifei Gao <gyf161023@gmail.com>
orangefs: fix double-free of trailer_buf on readdir copy failure
Shibo Zhu <3499129952@qq.com>
PM: sleep: Unblock runtime PM when device prepare fails
Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
ring-buffer: Stop remote reader update when page swap fails
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Free cpu_buffer::free_page with subbuf_order
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
regulator: qcom-refgen: correct the regulator type to CURRENT
WenTao Liang <vulab@iscas.ac.cn>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
WenTao Liang <vulab@iscas.ac.cn>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
Yuhang Pan <242270054@hdu.edu.cn>
RDMA/uverbs: Guard legacy bundles without method_elm
Jason Gunthorpe <jgg@ziepe.ca>
RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
Norbert Szetei <norbert@doyensec.com>
RDMA/ucma: Lock the handler in ucma_write_cm_event()
Norbert Szetei <norbert@doyensec.com>
RDMA/ucma: Lock the handler in ucma_set_ib_path()
Abhijit Gangurde <abhijit.gangurde@amd.com>
RDMA/ionic: Embed counter driver data in rdma_counter allocation
Brett Creeley <brett.creeley@amd.com>
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
Fan Wu <fanwu01@zju.edu.cn>
RDMA/cxgb4: Cancel reg_work before freeing device on remove
Vaibhav Nagare <nagarevaibhav@gmail.com>
qede: Fix NULL pointer dereference in TPA fragment processing
Abdifatah Suruur <suruurism@gmail.com>
ptp: vmclock: prevent read-only mappings from becoming writable
Johan Hovold <johan@kernel.org>
remoteproc: scp: Fix device reference leak on failed lookup
Nam Cao <namcao@linutronix.de>
riscv: unaligned: stop using kthread for check_vector_unaligned_access()
Peixin Xie <peixin.xie@linux.spacemit.com>
riscv: acpi: Handle LPI architectural context loss flags
Guidong Han <2045gemini@gmail.com>
RISC-V: KVM: Fix PMU event info array size overflow
Aurelien Jarno <aurelien@aurel32.net>
riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage
Aurelien Jarno <aurelien@aurel32.net>
riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage
Aurelien Jarno <aurelien@aurel32.net>
riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage
Aurelien Jarno <aurelien@aurel32.net>
riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
Aurelien Jarno <aurelien@aurel32.net>
riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
Fabio Estevam <festevam@nabladev.com>
arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
Fabio Estevam <festevam@nabladev.com>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
Quentin Schulz <quentin.schulz@cherry.de>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
Quentin Schulz <quentin.schulz@cherry.de>
arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
Michael Scott <mike.scott@oss.qualcomm.com>
arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
Jianping Li <jianping.li@oss.qualcomm.com>
arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap
Oren Klopfer <oklopfer37@gmail.com>
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
Chunkai Deng <chunkai.deng@oss.qualcomm.com>
rpmsg: glink: smem: order FIFO read after availability check
Linkai Gong <gonglinkai@kylinos.cn>
scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
Petr Vaganov <p.vaganov@ideco.ru>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Tejun Heo <tj@kernel.org>
sched_ext: Keep kick_sync waiting on the rq's own CPU
Tejun Heo <tj@kernel.org>
sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
Tao Cui <cuitao@kylinos.cn>
sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
Tejun Heo <tj@kernel.org>
sched_ext: Fix inverted ops.core_sched_before() invocation
fangqiurong <fangqiurong@kylinos.cn>
sched_ext: Fix exit_task leak on fork failure during enable
fangqiurong <fangqiurong@kylinos.cn>
sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
Tejun Heo <tj@kernel.org>
sched_ext: Count rq lock releases in rq->scx.lock_drop_seq
Tejun Heo <tj@kernel.org>
sched_ext: Fix rq->core_pick corruption under core scheduling
Tejun Heo <tj@kernel.org>
sched_ext: Fix this_rq() assumptions in dispatch kfuncs
Tejun Heo <tj@kernel.org>
sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return
Tejun Heo <tj@kernel.org>
sched/core: Make core-sched flips wait for in-flight selections
Tejun Heo <tj@kernel.org>
sched/core: Handle pick_task() releasing the rq lock
Cong Nguyen <congnt264@gmail.com>
media: staging/ipu7: fix async notifier UAF on probe error path
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: media: tegra-video: vi: fix probe failure on skipped last port
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: media: tegra-video: fix of_node_put() on VIP parse errors
Wentao Guan <guanwentao@uniontech.com>
wifi: mt76: mt7925: cancel pending mlo_pm_work
Doruk Tan Ozturk <doruk@0sec.ai>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
David Lee <david.lee@trailofbits.com>
udf: reject VAT indexes equal to the entry count
Chuck Lever <cel@kernel.org>
svcrdma: Validate Read chunk positions before reconstruction
Chuck Lever <cel@kernel.org>
svcrdma: Use svc_xprt_put to free listener on create failure
Chris Mason <clm@meta.com>
svcrdma: Reject Write/Reply chunks with segcount 0
Chuck Lever <cel@kernel.org>
svcrdma: Reject Read lists that exceed the page budget
Chuck Lever <cel@kernel.org>
svcrdma: Reject oversized Read segments at decode time
Chuck Lever <cel@kernel.org>
svcrdma: Reject inline replies that overflow the pull-up buffer
Chuck Lever <cel@kernel.org>
svcrdma: Reject connection when transport allocation fails
Chris Mason <clm@meta.com>
svcrdma: Fix unmatched rn_unregister on failed accept
Chris Mason <clm@meta.com>
svcrdma: Fix pcl_for_each_segment for empty chunks
Chris Mason <clm@meta.com>
svcrdma: Fix offset arithmetic in read_chunk_range
Chuck Lever <cel@kernel.org>
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
Chuck Lever <cel@kernel.org>
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
SUNRPC: wait for in-flight client TLS handshake callback
Chuck Lever <cel@kernel.org>
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
Chuck Lever <cel@kernel.org>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
Chris Mason <clm@meta.com>
SUNRPC: reject duplicate CREDS_VALUE options
Chris Mason <clm@meta.com>
sunrpc: init gssp_lock before publishing proc entry
Chris Mason <clm@meta.com>
SUNRPC: harden gss_unwrap_resp_priv length checks
Chris Mason <clm@meta.com>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
Chris Mason <clm@meta.com>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
Luxiao Xu <rakukuip@gmail.com>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
Chris Mason <clm@meta.com>
SUNRPC: fix gssx_dec_option_array error path bugs
Jeff Layton <jlayton@kernel.org>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
Chuck Lever <cel@kernel.org>
SUNRPC: close backchannel before destroying callback service
Chuck Lever <cel@kernel.org>
SUNRPC: Check svc pool percpu counter allocation
Jeff Layton <jlayton@kernel.org>
SUNRPC: always drain cache_cleaner before destroying a cache_detail
Ameer Hamza <ameer.hamza@truenas.com>
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
Jeff Layton <jlayton@kernel.org>
sunrpc: route to a populated pool in svc_pool_for_cpu()
Chris Mason <clm@meta.com>
SUNRPC: svcauth_gss: enforce krb5 token minimum length
Chris Mason <clm@meta.com>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
Chris Mason <clm@meta.com>
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Felix Gu <ustc.gu@gmail.com>
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
Jiacheng Yu <yujiacheng3@huawei.com>
params: fix charp corruption on allocation failure
Dave Airlie <airlied@redhat.com>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
Stanislaw Gruszka <stf_xl@wp.pl>
module/kallsyms: fix nextval for data symbol lookup
Harshit Varu <harshitvaru666@gmail.com>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Qing Ming <a0yami@mailbox.org>
mpls: reload header after pskb_may_pull()
Thiébaud Weksteen <tweek@google.com>
module: validate string table section types
Coly Li <colyli@fygo.io>
md: do overflow check for sb->bblog_shift in super_1_load()
Yunye Zhao <yunye.zhao@linux.alibaba.com>
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
Bryam Vargas <hexlabsecurity@proton.me>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
Günther Noack <gnoack@google.com>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
Yuyang Huang <sigefriedhyy@gmail.com>
ipv6: use RCU iterator to dump route exceptions
Andrea Mayer <andrea.mayer@uniroma2.it>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
Zhiling Zou <zhilinz@nebusec.ai>
ip6_gre: fix hardware header length for NBMA tunnels
Zhiling Zou <zhilinz@nebusec.ai>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
Zhiling Zou <zhilinz@nebusec.ai>
ip: orphan prefetched skbs before multicast forwarding
Anton Danilov <littlesmilingcloud@gmail.com>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Max Kellermann <max.kellermann@ionos.com>
jbd2: check need_resched() when skipping busy checkpoint buffers
Max Kellermann <max.kellermann@ionos.com>
jbd2: bound shrinker scans by examined checkpoint buffers
Pratyush Yadav (Google) <pratyush@kernel.org>
kho: fix size calculation in kho_preserved_memory_reserve()
Hui Su <sh_def@163.com>
kasan: fix cache shrink race with CPU hotplug
Ibrahim Abdelkader <iabdelka@qti.qualcomm.com>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Valentin Kindschi <valentin.kindschi@fiveco.ch>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Xin Chen <xin.chen2@oss.qualcomm.com>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Valentin Kindschi <valentin.kindschi@fiveco.ch>
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: RFCOMM: serialize security confirmation handling
Hang Nan <2122295973@qq.com>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Gongwei Li <ligongwei@kylinos.cn>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Lorenzo Stoakes (ARM) <ljs@kernel.org>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Terry Bowman <terry.bowman@amd.com>
cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
Alison Schofield <alison.schofield@intel.com>
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Dave Jiang <dave.jiang@intel.com>
cxl/mce: Make the MCE notifier per-region
Zhenhao Wan <whi4ed0g@gmail.com>
cxl/features: bound fwctl command payload to the input buffer
Hui Su <sh_def@163.com>
cpufreq: schedutil: Fix rate limit overflow
Haoxiang Li <haoxiang_li2024@163.com>
cpufreq: apple-soc: Fix OPP table cleanup
Kuan-Wei Chiu <visitorckw@gmail.com>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
Bryam Vargas <hexlabsecurity@proton.me>
dm array: reject an array block whose value size is not the caller's
Bryam Vargas <hexlabsecurity@proton.me>
dm array: validate array block headers on read
Ilya Krutskih <devsec@tpz.ru>
dm raid1: reserve space for NUL-terminator in build_constructor_string()
liyouhong <liyouhong@kylinos.cn>
dm-era: fix shadowed superblock leak on take-snap failure
Mikulas Patocka <mpatocka@redhat.com>
dm-io: report non-retryable errors separatedly
Keith Busch <kbusch@kernel.org>
dm-io: clone the source bio instead of copying its biovec
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
Jia Zhu <zhujia.zj@bytedance.com>
buffer: avoid tail commit walk for uptodate folios
Daniel Borkmann <borkmann@iogearbox.net>
bpf: Disable preemption in __bpf_get_stack
Vineet Gupta <vineet.gupta@linux.dev>
bpf, x86: Fix per-CPU address resolution into an extended register
Joe Damato <joe@dama.to>
bnxt_en: Write doorbell when linearizing skb fails
Jiangshan Yi <yijiangshan@kylinos.cn>
bnx2x: fix double free in bnx2x_init_firmware() error path
HyeongJun An <sammiee5311@gmail.com>
Bluetooth: eir: Fix OOB read in eir_get_service_data()
Junjie Cao <junjie.cao@intel.com>
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
Christoph Zwerschke <cito@online.de>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christoph Zwerschke <cito@online.de>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
胡连勤 <hulianqin@vivo.com>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Keith Busch <kbusch@kernel.org>
block: validate user space vectors during extraction
Junjie Cao <junjie.cao@linux.dev>
backlight: aw99706: Honor the core blank state in update_status()
Junjie Cao <junjie.cao@linux.dev>
backlight: aw99706: Fix DT property names to match binding
Hongyan Xu <getshell@seu.edu.cn>
auxdisplay: charlcd: cancel backlight work on registration failure
Niklas Cassel <cassel@kernel.org>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Ethan Nelson-Moore <enelsonmoore@gmail.com>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
Matt Turner <mattst88@gmail.com>
alpha: marvel: Fix lock ordering in init_io7_irqs()
Matt Turner <mattst88@gmail.com>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: TAD: Add locking around AML evaluations
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: scan: Avoid registering platform devices with resource overlaps
Anirudh Prasad <icarus@a0rg.com>
ACPI: pfr_update: fix stack buffer overflow in query_capability()
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Skip desired_perf read in cppc_get_perf()
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
TanZheng <tanzheng@kylinos.cn>
ACPI: APEI: GHES: fix ARM section length accounting after header
Nirmoy Das <nirmoyd@nvidia.com>
ACPI: APEI: Fix ERST timeout unit conversion
Terry Bowman <terry.bowman@amd.com>
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
ZhaoJinming <zhaojinming@uniontech.com>
accel/rocket: Fix error path handling in rocket_job_run()
Shuvam Pandey <shuvampandey1@gmail.com>
accel/rocket: initialize job domain before cleanup paths
Muhammad Bilal <meatuni001@gmail.com>
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
Guillaume Morin <guillaume@morinfr.org>
hugetlb: only adjust reservation during unmapping if mapcount is 0
Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
Youngjae Kwon <yjkwon0026@snu.ac.kr>
fsnotify: Fix stale object mask after concurrent mark updates
Tien Sung Ang <tien.sung.ang@altera.com>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Marek Czernohous <marek@czernohous.de>
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Randy Dunlap <rdunlap@infradead.org>
fonts: fixup font.h kernel-doc warnings
Myeonghun Pak <mhun512@gmail.com>
fbdev: uvesafb: unregister connector callback on init failure
Hui Su <sh_def@163.com>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
Florian Fuchs <fuchsfl@gmail.com>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Runyu Xiao <runyu.xiao@seu.edu.cn>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
Yemu Lu <prcups@krgm.moe>
fat: restore original value when fat_ent_write failed
Chengfeng Ye <nicoyip.dev@gmail.com>
fanotify: fix use-after-free of file range info
Jan Kara <jack@suse.cz>
ext2: Fix lost inode updates for IS_SYNC inodes
Nikhil Gurudasani <nikhilgurudasani314@gmail.com>
erofs: skip sufficiently large global buffers when resizing
Jinjie Ruan <ruanjinjie@huawei.com>
entry: Fix seccomp bypass after ptrace with TSYNC
Ard Biesheuvel <ardb@kernel.org>
efivarfs: Rate limit statfs() handler
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: show filename encryption options
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: release message context on send failure
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: reject too-small tag 70 packets
HanQuan <eilaimemedsnaimel@gmail.com>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: pass packet set buffer size to parser
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: hold msg ctx list lock when cleaning daemon queue
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: fix tag 11 packet exact-fit size check
Pengpeng Hou <pengpeng@iscas.ac.cn>
eCryptfs: bound the packet-length peek to the user buffer
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: verify run length exceeding volume boundary
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: validate non-resident attribute offsets
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: reject invalid MFT LCNs from boot sector
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: reject invalid empty mapping pairs
Bryam Vargas <hexlabsecurity@proton.me>
ntfs: bound the free-cluster bitmap scan to the volume
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: bound page_lcns[] index by the log record
Samuel Page <sam@bynar.io>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Xiang Mei <xmei5@asu.edu>
fs/ntfs3: validate dirty page table on log replay
Deepanshu Kartikey <kartikey406@gmail.com>
eventfs: Initialize ei->children and ei->list in init_ei()
Guangshuo Li <lgs201920130244@gmail.com>
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
Guangshuo Li <lgs201920130244@gmail.com>
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HyeongJun An <sammiee5311@gmail.com>
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
HyeongJun An <sammiee5311@gmail.com>
HID: intel-thc-hid: intel-quickspi: validate report size before copy
Jiangshan Yi <yijiangshan@kylinos.cn>
HID: mcp2221: validate report size in mcp2221_raw_event()
Jiangshan Yi <yijiangshan@kylinos.cn>
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
Jiangshan Yi <yijiangshan@kylinos.cn>
HID: mcp2221: stop device IO before hid_hw_stop
Baul Lee <baul.lee@xbow.com>
HID: universal-pidff: stop the device when force-feedback init fails
Doruk Tan Ozturk <doruk@0sec.ai>
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
Haoxiang Li <haoxiang_li2024@163.com>
HID: sensor: custom: Fix field sysfs group cleanup on failure
Xu Rao <raoxu@uniontech.com>
HID: roccat: free buffered reports when destroying device
Ibrahim Hashimov <security@auditcode.ai>
HID: picolcd: clamp eeprom debugfs read to bytes actually received
Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
HID: corsair-void: Check size of status and firmware events before reading them
Andre Eikmeyer <dev@deq.rocks>
HID: apple: preserve keyboard backlight across T2 resume
Bryam Vargas <hexlabsecurity@proton.me>
smb: client: restore the data_offset bound in is_valid_oplock_break()
Bryam Vargas <hexlabsecurity@proton.me>
smb: client: reject a tree connect response whose byte count is too small
Fredric Cover <fredric.cover.lkernel@gmail.com>
smb: client: harden DFS cache against invalid target hints
Frank Sorenson <sorenson@redhat.com>
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
Frank Sorenson <sorenson@redhat.com>
smb: client: fix ALIGN() overflow in symlink_data() error context loop
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
ksmbd: only rebind the reopened file's own oplock on durable reconnect
Fredric Cover <fredric.cover.lkernel@gmail.com>
smb: client: clear ce->tgthint in free_tgts()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
Jiangshan Yi <yijiangshan@kylinos.cn>
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
Frank Sorenson <sorenson@redhat.com>
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
Frank Sorenson <sorenson@redhat.com>
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Frank Sorenson <sorenson@redhat.com>
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
Frank Sorenson <sorenson@redhat.com>
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
Frank Sorenson <sorenson@redhat.com>
cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
audit: avoid dropping live tree ref on fsnotify rule autoremove
Qu Wenruo <wqu@suse.com>
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
btrfs: fix extent map leak in NOCOW direct I/O write
Guanghui Yang <3497809730@qq.com>
btrfs: drop recovered reloc root refs on recovery failure
Matthew Brown <matthew@bargrove.com>
ceph: fix leaked inode reference on writeback abort at umount
Max Kellermann <max.kellermann@ionos.com>
ceph: do not repeat ceph_trim_dentries() if no progress possible
Michael Bommarito <michael.bommarito@gmail.com>
ceph: cap delegated inode count in ceph_parse_deleg_inos()
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound xattr value length in __build_xattrs()
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound num_export_targets array for mds info v2/v3
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound copied dentry name length in NFS export get_name
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
Max Kellermann <max.kellermann@ionos.com>
ceph: force a cap message when a deferred revoke can't be acked immediately
Xiubo Li <xiubo.li@clyso.com>
ceph: fix UAF in check_new_map() on session freed during unlock
Xiubo Li <xiubo.li@clyso.com>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
libceph: reject buckets with mismatched CRUSH ids
Michael Bommarito <michael.bommarito@gmail.com>
libceph: validate OSD extent maps before cursor advance
Jeff Layton <jlayton@kernel.org>
nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update
Chuck Lever <cel@kernel.org>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
Chuck Lever <cel@kernel.org>
NFSD: Prevent client use-after-free during delegation revoke
Chuck Lever <cel@kernel.org>
NFSD: Prevent client use-after-free during admin state revocation
Chuck Lever <cel@kernel.org>
NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
Chuck Lever <cel@kernel.org>
NFSD: Prevent lock owner use-after-free during client teardown
Jeff Layton <jlayton@kernel.org>
nfsd: revoke copy-notify stateids before dropping their reference
Jeff Layton <jlayton@kernel.org>
nfsd: release OPEN-decoded posix ACLs via op_release
Jeff Layton <jlayton@kernel.org>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
Robbie Ko <robbieko@synology.com>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Robbie Ko <robbieko@synology.com>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
Jeff Layton <jlayton@kernel.org>
nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
Jeff Layton <jlayton@kernel.org>
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
Jeff Layton <jlayton@kernel.org>
nfsd: initialize DRC hash table before registering shrinker
Jeff Layton <jlayton@kernel.org>
nfsd: initialize copy-notify stateid before publishing it
Chris Mason <clm@meta.com>
nfsd: hold rcu across localio cmpxchg retry
Chris Mason <clm@meta.com>
nfsd: gate nfs3 setacl by argp->mask
Chuck Lever <cel@kernel.org>
nfsd: gate nfs2 setacl by argp->mask
Jeff Layton <jlayton@kernel.org>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
Jeff Layton <jlayton@kernel.org>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Jeff Layton <jlayton@kernel.org>
nfsd: fix version mismatch loops in nfsd_acl_init_request()
Jeff Layton <jlayton@kernel.org>
nfsd: fix UAF in async copy cancel and shutdown
Jeff Layton <jlayton@kernel.org>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
Jeff Layton <jlayton@kernel.org>
nfsd: fix reply size estimate for GET_DIR_DELEGATION
Jeff Layton <jlayton@kernel.org>
nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
NeilBrown <neil@brown.name>
nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
Chris Mason <clm@meta.com>
nfsd: fix partial-write detection in nfsd_direct_write
Nikol Kuklev <nikolk202@gmail.com>
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
Jeff Layton <jlayton@kernel.org>
nfsd: fix nfsd_file leak on inter-server COPY setup failure
Jeff Layton <jlayton@kernel.org>
nfsd: fix netlink dumpit error handling for rpc_status_get
Jeff Layton <jlayton@kernel.org>
nfsd: fix layout fence worker double-reference race
Jeff Layton <jlayton@kernel.org>
nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
Jeff Layton <jlayton@kernel.org>
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
Jeff Layton <jlayton@kernel.org>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
Chris Mason <clm@meta.com>
nfsd: fix cpntf publish race in nfs4_init_cp_state
Jeff Layton <jlayton@kernel.org>
nfsd: fix clock domain mismatch in clients_still_reclaiming()
Jeff Layton <jlayton@kernel.org>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
NeilBrown <neil@brown.name>
nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
Jeff Layton <jlayton@kernel.org>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
Jeff Layton <jlayton@kernel.org>
nfsd: don't free session slots that are still in use
Jeff Layton <jlayton@kernel.org>
nfsd: defer vfree of compound ops to fix rpc_status UAF
Jeff Layton <jlayton@kernel.org>
nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
Jeff Layton <jlayton@kernel.org>
nfsd: dedup nfs4_client_to_reclaim inserts
Chris Mason <clm@meta.com>
nfsd: convert nfsd_net boolean flags to unsigned long flags word
Jeff Layton <jlayton@kernel.org>
nfsd: clear opcnt on compound arg release to prevent OOB read
Jeff Layton <jlayton@kernel.org>
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
Jeff Layton <jlayton@kernel.org>
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
Jeff Layton <jlayton@kernel.org>
nfsd: check client ownership when cancelling a copy-notify stateid
Chris Mason <clm@meta.com>
nfsd: cap decoded POSIX ACL count to bound sort cost
Jeff Layton <jlayton@kernel.org>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Jeff Layton <jlayton@kernel.org>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
Jeff Layton <jlayton@kernel.org>
nfsd: add filehandle match check to nfsd4_delegreturn()
Jeff Layton <jlayton@kernel.org>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
Jeff Layton <jlayton@kernel.org>
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
Jeff Layton <jlayton@kernel.org>
nfsd: validate symlink target length in NFSv4 CREATE
Jeff Layton <jlayton@kernel.org>
nfsd: validate sockaddr length per family in listener_set
Jeff Layton <jlayton@kernel.org>
nfsd: validate nseconds in TIME_DELEG decode paths
Chris Mason <clm@meta.com>
nfsd: size fh_verify server sockaddr slot by xpt_locallen
Zhenghang Xiao <kipreyyy@gmail.com>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
Chuck Lever <cel@kernel.org>
nfsd: sample writeback error cursor before async COPY loop
Jeff Layton <jlayton@kernel.org>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
Jeff Layton <jlayton@kernel.org>
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
Chuck Lever <cel@kernel.org>
nfsd: Reset write verifier when async COPY writeback fails
Chris Mason <clm@meta.com>
nfsd: release path refs on follow_down() error
Jeff Layton <jlayton@kernel.org>
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
Jeff Layton <jlayton@kernel.org>
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
Tim Menninger <tmenninger@everpuredata.com>
pNFS: Fix EBUSY check in pnfs_layout_need_return
Junrui Luo <moonafterrain@outlook.com>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Chris Mason <clm@meta.com>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
Mike Snitzer <snitzer@kernel.org>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Michael Bommarito <michael.bommarito@gmail.com>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Scott Mayhew <smayhew@redhat.com>
NFSD: fix up error returned by write_threads()
Chuck Lever <cel@kernel.org>
NFSD: Fix off-by-one in DRC bucket pruning limit
Chuck Lever <cel@kernel.org>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
Chuck Lever <cel@kernel.org>
NFSD: check truncate permission under inode lock
Nate Prodromou <nate@prodromou.com>
NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
Chris Mason <clm@meta.com>
NFS/localio: fix ref leak on nfs_uuid_add_file failure
Longlong Xia <xialonglong@kylinos.cn>
zsmalloc: account for handle size in class lookup
Sergey Senozhatsky <senozhatsky@chromium.org>
zram: validate deflate params
Sergey Senozhatsky <senozhatsky@chromium.org>
zram: set default primary compressor in zram_destroy_comps()
Longlong Xia <xialonglong@kylinos.cn>
zram: fix out-of-bounds access in writeback_store()
Longlong Xia <xialonglong@kylinos.cn>
zram: fix out-of-bounds access in read_block_state()
Ibrahim Hashimov <security@auditcode.ai>
ubifs: fix out-of-bounds read in signature length check
Jason Yang <jason98166@gmail.com>
phy: rockchip-samsung-dcphy: fix out-of-range max_register
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
Abdurrahman Hussain <abdurrahman@nexthop.ai>
of: fix out-of-bounds read in of_alias_scan() stem parser
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: fix out-of-bounds write in FWHT encoder
Weigang He <geoffreyhe2@gmail.com>
media: cec: stm32: prevent out-of-bounds write on RX overflow
Vincent Mailhol <mailhol@kernel.org>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Karl Mehltretter <kmehltretter@gmail.com>
KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
i3c: renesas: Fix out-of-bounds access for newdevs mask
Xingrui Li <baka9@bakabaka9.tech>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Daisuke Matsuda <matsuda@preferred.jp>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Terry Bowman <terry.bowman@amd.com>
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
Neill Kapron <nkapron@google.com>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
Yun Zhou <yun.zhou@windriver.com>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Joshua Crofts <joshua.crofts1@gmail.com>
usb: gadget: midi2: remove default configfs groups on teardown
Myeonghun Pak <mhun512@gmail.com>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
Sonali Pradhan <sonalipradhan@google.com>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Huang Wei <huangwei@kylinos.cn>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: thunderbolt: Disable work before freeing tbt on remove
Xu Yang <xu.yang_2@nxp.com>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
Xu Rao <raoxu@uniontech.com>
usb: typec: hd3ss3220: fix VBUS regulator error message
Johan Hovold <johan@kernel.org>
USB: phy: fsl-usb: fix missing static keywords
Fan Wu <fanwu01@zju.edu.cn>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Pei Xiao <xiaopei01@kylinos.cn>
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
Francesco Lavra <flavra@baylibre.com>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: greybus: hid: fix SET_REPORT return value
Karl Mehltretter <kmehltretter@gmail.com>
serial: imx: serialize imx_uart_ports[] lifetime
Hans Verkuil <hverkuil+cisco@kernel.org>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
James Kim <james010kim@gmail.com>
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
powerpc/powermac: fix OF node refcount
Bryam Vargas <hexlabsecurity@proton.me>
misc: nsm: bound the device-reported response length
Xu Yang <xu.yang_2@nxp.com>
device property: fix infinite loop in fwnode_for_each_child_node()
Chun-Yi Lee <jlee@suse.com>
debugfs: Fix lockdown check for mmap_prepare
Prasanna Kumar T S M <ptsm@linux.microsoft.com>
cdx: Fix double free when sysfs file creation fails
Hui Su <sh_def@163.com>
tracing: Fix use-after-free with same-name named triggers
Deepanshu Kartikey <kartikey406@gmail.com>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
tracing: Fix retry exhaustion in simple ring buffer reader swap
Vincent Donnefort <vdonnefort@google.com>
tracing: Fix logged instance name on creation failure
Hui Su <sh_def@163.com>
tracing: Fix crash passing ERR_PTR to kthread_stop()
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
tracing/user_events: Clear copied tracing state before fork duplication
Sanman Pradhan <psanman@juniper.net>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
Roger Pau Monne <roger@xenproject.org>
x86/xen: fix init of balloon stats again
Kiryl Shutsemau (Meta) <kas@kernel.org>
x86/tdx: Fix zero-extension for 32-bit port I/O
Kiryl Shutsemau (Meta) <kas@kernel.org>
x86/tdx: Fix off-by-one in port I/O handling
Kiryl Shutsemau (Meta) <kas@kernel.org>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
Yao Zi <me@ziyao.cc>
x86/locking: Use sfence for wmb() if SSE is available
Joy H.J. Lee <rkr0k0r@gmail.com>
tools/compiler: match glibc 2.42 definition of __attribute_const__
Ridong Chen <chenridong@xiaomi.com>
mm: vmscan: fix node reclaim ignoring swappiness parameter
Johannes Weiner <hannes@cmpxchg.org>
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
Vlastimil Babka (SUSE) <vbabka@kernel.org>
mm: page_alloc: move capture_control to the page allocator
Johannes Weiner <hannes@cmpxchg.org>
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
Johannes Weiner <hannes@cmpxchg.org>
mm: mempolicy: fix automatic numa balancing for shmem
Guopeng Zhang <zhangguopeng@kylinos.cn>
mm: memcontrol: update state_local when flushing NMI stats
Guopeng Zhang <zhangguopeng@kylinos.cn>
mm: memcg: stop reclaim when a limit update is superseded
Guopeng Zhang <zhangguopeng@kylinos.cn>
mm: memcg-v1: fix memsw and TCP failcnt accounting
Guopeng Zhang <zhangguopeng@kylinos.cn>
mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
Johannes Weiner <hannes@cmpxchg.org>
mm: compaction: support non-movable compaction for pageblock requests
Hao Jia <jiahao1@lixiang.com>
mm/zswap: fix global shrinker when memory cgroup is disabled
Breno Leitao <leitao@debian.org>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
Artem Lytkin <iprintercanon@gmail.com>
mm/vmalloc: make vm_struct.nr_pages an unsigned long
Shengming Hu <hu.shengming@zte.com.cn>
mm/slub: prevent pfmemalloc objects from entering the barn
Li Xiasong <lixiasong1@huawei.com>
mm/slub: fix missing debugfs entries for caches created before sysfs init
Dev Jain <dev.jain@arm.com>
mm/rmap: use huge_ptep_get() in try_to_migrate_one()
Dev Jain <dev.jain@arm.com>
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
Hyunwoo Kim <imv4bel@gmail.com>
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
Dev Jain <dev.jain@arm.com>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb
Ye Liu <ye.liu@linux.dev>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
Alexander Graf <graf@amazon.com>
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
Arvind Yadav <arvind.yadav@intel.com>
mm/migrate_device: clear stale mapping after freeing swapcache
Dev Jain <dev.jain@arm.com>
mm/migrate: use huge_ptep_get() in remove_migration_pte()
Breno Leitao <leitao@debian.org>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
Kairui Song <kasong@tencent.com>
mm/mglru: fix and remove redundant unevictable folio handling
Usama Arif <usama.arif@linux.dev>
mm/mempolicy: skip non-present PMDs when queueing folios
Usama Arif <usama.arif@linux.dev>
mm/madvise: skip device-private PMDs in cold and pageout walks
Breno Leitao <leitao@debian.org>
mm/kmemleak: avoid soft lockup when scanning task stacks
Muchun Song <muchun.song@linux.dev>
mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
Muchun Song <muchun.song@linux.dev>
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
Muchun Song <muchun.song@linux.dev>
mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages
Zi Yan <ziy@nvidia.com>
mm/huge_memory: use folio's memcg inside __folio_split()
Usama Arif <usama.arif@linux.dev>
mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd
David Hildenbrand (Arm) <david@kernel.org>
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
Breno Leitao <leitao@debian.org>
mm, swap: ratelimit bad swap entry reports
Youngjun Park <youngjun.park@lge.com>
mm, swap: don't free a hibernation slot that is in the swap cache
Jordan R Abrahams-Whitehead <ajordanr@google.com>
include/linux/list.h: mark list_add and __list_add as __always_inline
Hyunwoo Kim <imv4bel@gmail.com>
apparmor: fix out-of-bounds write when null terminating a label vec
Jann Horn <jannh@google.com>
apparmor: fix cred UAF caused by begin_current_label_crit_section()
Chengfeng Ye <nicoyip.dev@gmail.com>
KEYS: trusted: Fix TPM teardown ordering
Miguel Ojeda <ojeda@kernel.org>
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
Miguel Ojeda <ojeda@kernel.org>
kbuild: rust: preserve unreachable traps with inline helpers
Gary Guo <gary@garyguo.net>
rust: cfi: disable function merging if CFI is enabled
Younes Akhouayri <git@younes.io>
rust: num: restrict bool conversion to unsigned Bounded
Miguel Ojeda <ojeda@kernel.org>
objtool/rust: add one more `noreturn` Rust function
Nikolai Grlica <nikolai@nikolaigrlica.dev>
rust: kernel: list: fix incorrect pop_back example comment
Miguel Ojeda <ojeda@kernel.org>
rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
Danilo Krummrich <dakr@kernel.org>
rust: devres: ensure revocation is complete before device finishes unbinding
Danilo Krummrich <dakr@kernel.org>
rust: devres: fix race between concurrent revokers
Younes Akhouayri <git@younes.io>
rust: dma: return zero for Coherent reads past EOF
Miguel Ojeda <ojeda@kernel.org>
rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: prevent dead_code warning from warn_on!'s flags constant
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: fix warn_on macro build error on UML
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: skip arch-specific asm in `testlib` builds
Antoni Boucher <bouanto@zoho.com>
rust: kbuild: disambiguate `zerocopy` for `rusttest`
Miguel Ojeda <ojeda@kernel.org>
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
timers/itimer: Zero-init old itimerval before copy to userspace
Ke Sun <sunke@kylinos.cn>
rust: fmt: fix {:p} printing stack addresses
Gaurav Batra <gbatra@linux.ibm.com>
powerpc/pseries/iommu: switch to Default DMA window during kdump
Chen Linxuan <me@black-desk.cn>
pidfd: hold exec_update_lock around namespace ioctl
Vivek Parikh <vivek.parikh@breachx.ai>
ovl: fix double end_creating() on the casefold-mismatch path
Baokun Li <libaokun@linux.alibaba.com>
fs: fix user path of nested backing files
Felix Yan <felixonmars@archlinux.org>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
WenTao Liang <vulab@iscas.ac.cn>
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
Matt Turner <mattst88@gmail.com>
alpha: don't leak hardware-fabricated FP exception bits to user space
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: time: fix as_micros_ceil() rounding near i64::MAX
Christoph Hellwig <hch@lst.de>
iomap: don't free integrity payload that doesn't exist
Matt Turner <mattst88@gmail.com>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
Fangzhi Zuo <jerry.zuo@amd.com>
drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
Jerry Zuo <jerry.zuo@amd.com>
drm/amd/display: hide Apple Studio Display secondary tile
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Fix subbuf resize race with ring buffer readers
Boris Burkov <boris@bur.io>
btrfs: write-protect folios during data writeback
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Sort MBDRC register defaults
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Sort ADMAIF register defaults
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Fix the MIXER enable default value
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Fix the I2S enable default value
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: tegra210_mixer: sort the register default table
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: tegra210_i2s: sort the Tegra264 register default table
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: tegra210_i2s: sort the register default table
Fangzhi Zuo <Jerry.Zuo@amd.com>
drm/amd/display: Skip Update HDCP Config In Transition State
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +-
Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +-
Makefile | 17 +-
arch/alpha/include/uapi/asm/fpu.h | 8 +-
arch/alpha/kernel/pci-sysfs.c | 6 +-
arch/alpha/kernel/sys_marvel.c | 25 +-
arch/alpha/kernel/traps.c | 6 +-
arch/alpha/math-emu/math.c | 88 ++++-
arch/arm/Kconfig | 2 +-
arch/arm64/boot/dts/qcom/kodiak.dtsi | 9 +-
arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +-
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 +
arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +-
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +-
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +-
.../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -
.../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 +
arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +-
arch/arm64/kernel/compat_alignment.c | 4 +-
arch/arm64/kernel/proton-pack.c | 9 +-
arch/arm64/kvm/vgic/vgic-v2.c | 3 +-
arch/openrisc/kernel/entry.S | 43 ++-
arch/powerpc/kernel/pci-common.c | 9 +-
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
arch/powerpc/platforms/pseries/iommu.c | 23 +-
arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts | 4 +-
arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts | 4 +-
arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts | 4 +-
arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts | 4 +-
arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts | 4 +-
arch/riscv/include/asm/acpi.h | 19 +
arch/riscv/kernel/unaligned_access_speed.c | 19 +-
arch/riscv/kvm/vcpu_pmu.c | 14 +-
arch/s390/include/asm/percpu.h | 4 +-
arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++----
arch/x86/coco/tdx/tdx.c | 10 +-
arch/x86/include/asm/barrier.h | 2 +-
arch/x86/include/asm/insn-eval.h | 36 ++
arch/x86/kvm/emulate.c | 26 +-
arch/x86/net/bpf_jit_comp.c | 2 +-
block/bio.c | 56 ++-
block/blk-map.c | 2 +-
block/fops.c | 2 +-
block/genhd.c | 1 +
drivers/accel/rocket/rocket_job.c | 32 +-
drivers/acpi/acpi_platform.c | 45 ++-
drivers/acpi/acpi_tad.c | 46 ++-
drivers/acpi/apei/erst.c | 2 +-
drivers/acpi/apei/ghes.c | 52 ++-
drivers/acpi/cppc_acpi.c | 24 +-
drivers/acpi/pfr_update.c | 45 +--
drivers/ata/libata-scsi.c | 28 +-
drivers/auxdisplay/charlcd.c | 21 +-
drivers/base/arch_numa.c | 12 +
drivers/base/power/main.c | 1 +
drivers/base/property.c | 19 +-
drivers/block/zloop.c | 3 +-
drivers/block/zram/backend_deflate.c | 10 +-
drivers/block/zram/zram_drv.c | 14 +-
drivers/bluetooth/btrtl.c | 13 -
drivers/bluetooth/btusb.c | 14 +
drivers/bluetooth/hci_bcm.c | 1 +
drivers/bluetooth/hci_bcm4377.c | 1 +
drivers/bluetooth/hci_h5.c | 4 +-
drivers/bluetooth/hci_intel.c | 1 +
drivers/bluetooth/hci_ldisc.c | 2 +-
drivers/bluetooth/hci_serdev.c | 2 +-
drivers/cdx/cdx.c | 7 +-
drivers/char/hw_random/stm32-rng.c | 10 +-
drivers/char/ipmi/ipmb_dev_int.c | 5 +-
drivers/char/ipmi/ipmi_msghandler.c | 4 +
drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +-
drivers/clocksource/timer-nxp-pit.c | 4 +-
drivers/clocksource/timer-sun4i.c | 2 +-
drivers/cpufreq/apple-soc-cpufreq.c | 36 +-
drivers/cpufreq/cppc_cpufreq.c | 2 +-
drivers/crypto/atmel-ecc.c | 46 +--
drivers/crypto/intel/iaa/iaa_crypto_main.c | 27 +-
drivers/cxl/core/features.c | 8 +-
drivers/cxl/core/mbox.c | 8 -
drivers/cxl/core/mce.c | 27 +-
drivers/cxl/core/pmem.c | 10 +-
drivers/cxl/core/ras.c | 1 -
drivers/cxl/core/ras_rch.c | 27 +-
drivers/cxl/core/region.c | 43 +--
drivers/cxl/cxl.h | 11 +-
drivers/cxl/cxlmem.h | 2 -
drivers/cxl/pci.c | 1 -
drivers/cxl/pmem.c | 2 +-
drivers/fpga/altera-cvp.c | 10 +-
drivers/fpga/stratix10-soc.c | 21 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 79 ++++
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 28 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 +
drivers/gpu/drm/amd/display/dc/dc_types.h | 1 +
drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +-
drivers/hid/hid-apple.c | 18 +-
drivers/hid/hid-corsair-void.c | 17 +
drivers/hid/hid-mcp2221.c | 17 +-
drivers/hid/hid-picolcd_debugfs.c | 9 +
drivers/hid/hid-roccat.c | 13 +-
drivers/hid/hid-sensor-custom.c | 9 +-
drivers/hid/hid-sensor-hub.c | 46 ++-
drivers/hid/hid-sony.c | 4 +-
drivers/hid/hid-universal-pidff.c | 4 +-
.../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 +
.../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +-
.../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 +
.../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +-
.../intel-quickspi/quickspi-protocol.c | 19 +-
.../intel-quickspi/quickspi-protocol.h | 2 +-
drivers/hsi/controllers/omap_ssi_core.c | 6 +
drivers/hwmon/max6621.c | 8 +-
.../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +-
drivers/hwtracing/ptt/hisi_ptt.c | 20 +-
drivers/i2c/busses/i2c-mxs.c | 5 +-
drivers/i3c/device.c | 2 +-
drivers/i3c/internals.h | 5 +
drivers/i3c/master.c | 18 +-
drivers/i3c/master/adi-i3c-master.c | 15 +-
drivers/i3c/master/renesas-i3c.c | 142 +++++---
drivers/i3c/master/svc-i3c-master.c | 10 +-
drivers/infiniband/core/ib_core_uverbs.c | 3 +
drivers/infiniband/core/ucma.c | 14 +-
drivers/infiniband/core/uverbs_main.c | 1 +
drivers/infiniband/core/uverbs_std_types_mr.c | 6 +-
drivers/infiniband/hw/cxgb4/device.c | 6 +
drivers/infiniband/hw/ionic/ionic_hw_stats.c | 95 +++--
drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 +-
drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +-
drivers/interconnect/core.c | 7 +-
drivers/iommu/amd/ppr.c | 3 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 24 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 65 +++-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 +
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +-
drivers/iommu/generic_pt/iommu_pt.h | 2 +-
drivers/iommu/intel/dmar.c | 15 +-
drivers/iommu/intel/iommu.c | 8 +-
drivers/iommu/intel/iommu.h | 2 +
drivers/iommu/iommu-sva.c | 2 +-
drivers/iommu/iommu.c | 2 +-
drivers/iommu/iommufd/device.c | 4 +-
drivers/iommu/iommufd/ioas.c | 2 +
drivers/iommu/iommufd/selftest.c | 31 +-
drivers/iommu/msm_iommu.c | 10 +-
drivers/mailbox/qcom-ipcc.c | 17 +-
drivers/md/dm-bufio.c | 10 +-
drivers/md/dm-era-target.c | 5 +
drivers/md/dm-integrity.c | 32 +-
drivers/md/dm-io.c | 96 +++--
drivers/md/dm-kcopyd.c | 10 +-
drivers/md/dm-log-userspace-base.c | 1 +
drivers/md/dm-log.c | 4 +-
drivers/md/dm-pcache/cache.c | 18 +
drivers/md/dm-pcache/cache.h | 21 ++
drivers/md/dm-pcache/cache_dev.c | 22 +-
drivers/md/dm-pcache/cache_gc.c | 10 +-
drivers/md/dm-pcache/cache_key.c | 32 +-
drivers/md/dm-pcache/cache_segment.c | 12 +-
drivers/md/dm-pcache/cache_writeback.c | 10 +-
drivers/md/dm-pcache/dm_pcache.c | 4 +-
drivers/md/dm-raid1.c | 26 +-
drivers/md/dm-snap-persistent.c | 4 +-
drivers/md/dm-stats.c | 6 +-
drivers/md/dm-switch.c | 2 +-
drivers/md/dm-verity-target.c | 2 +-
drivers/md/dm-writecache.c | 14 +-
drivers/md/md.c | 7 +
drivers/md/persistent-data/dm-array.c | 53 ++-
drivers/md/raid10.c | 2 +-
drivers/media/cec/platform/stm32/stm32-cec.c | 3 +-
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +-
drivers/media/v4l2-core/v4l2-dev.c | 14 +-
drivers/mfd/cgbc-core.c | 4 +-
drivers/mfd/qnap-mcu.c | 13 +-
drivers/mfd/sm501.c | 2 +
drivers/misc/nsm.c | 2 +-
drivers/mmc/host/via-sdmmc.c | 12 +-
drivers/net/dsa/realtek/rtl83xx.c | 4 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c | 4 +-
drivers/net/ethernet/ibm/emac/mal.c | 13 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 +
drivers/net/ethernet/nvidia/forcedeth.c | 4 +-
drivers/net/ethernet/qlogic/qede/qede.h | 8 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 +
drivers/net/ethernet/renesas/ravb.h | 3 +
drivers/net/ethernet/renesas/ravb_main.c | 9 +-
drivers/net/ethernet/renesas/ravb_ptp.c | 44 ++-
drivers/net/ipa/ipa_modem.c | 18 +-
drivers/net/ntb_netdev.c | 38 +-
drivers/net/phy/phylink.c | 2 +-
drivers/net/slip/slip.c | 11 +-
drivers/net/thunderbolt/main.c | 12 +
drivers/net/tun.c | 21 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +-
drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +-
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 +
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 11 +-
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 +
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 +
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 +-
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +-
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +-
drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +-
.../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +-
.../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +-
drivers/net/wireless/realtek/rtw88/pci.c | 4 +-
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
drivers/net/wireless/realtek/rtw89/core.h | 1 +
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +-
drivers/net/wireless/realtek/rtw89/pci.c | 13 +
drivers/net/wireless/realtek/rtw89/pci.h | 1 +
drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922de.c | 1 +
drivers/ntb/ntb_transport.c | 38 +-
drivers/nvdimm/label.c | 2 +-
drivers/nvme/host/core.c | 2 +-
drivers/nvme/host/fc.c | 2 +-
drivers/nvme/host/pci.c | 1 +
drivers/nvme/host/tcp.c | 45 ++-
drivers/of/base.c | 2 +-
drivers/pci/controller/dwc/pci-meson.c | 2 +-
drivers/pci/controller/pci-hyperv.c | 1 +
drivers/pci/controller/plda/pcie-plda-host.c | 52 ++-
drivers/pci/controller/plda/pcie-starfive.c | 13 +-
drivers/pci/msi/msi.c | 10 +
drivers/pci/pci-sysfs.c | 42 ++-
drivers/pci/pcie/aer.c | 29 +-
drivers/pci/pcie/portdrv.c | 2 +-
drivers/pci/proc.c | 16 +-
drivers/pci/quirks.c | 9 +-
drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +-
drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +-
drivers/platform/x86/amd/pmc/mp1_stb.c | 66 ++--
drivers/platform/x86/amd/pmc/pmc.c | 6 +-
.../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 -
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +-
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 +
.../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +-
.../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +-
.../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +-
.../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +-
.../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +-
.../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +-
drivers/platform/x86/hp/hp-wmi.c | 4 +
drivers/platform/x86/intel/int1092/intel_sar.c | 32 +-
drivers/platform/x86/intel/ishtp_eclite.c | 5 +-
.../x86/intel/speed_select_if/isst_tpmi_core.c | 80 ++++-
drivers/platform/x86/lenovo/think-lmi.c | 19 +-
drivers/platform/x86/lenovo/ymc.c | 8 +-
drivers/platform/x86/panasonic-laptop.c | 11 +-
drivers/power/supply/bq24257_charger.c | 16 +-
drivers/power/supply/bq256xx_charger.c | 29 +-
drivers/power/supply/bq25890_charger.c | 12 +
drivers/power/supply/charger-manager.c | 54 ++-
drivers/power/supply/cros_usbpd-charger.c | 17 +-
drivers/power/supply/lp8727_charger.c | 4 +-
drivers/power/supply/lp8788-charger.c | 2 +-
drivers/power/supply/max17040_battery.c | 32 +-
drivers/power/supply/pf1550-charger.c | 2 +-
drivers/power/supply/qcom_battmgr.c | 9 +-
drivers/power/supply/rt9455_charger.c | 21 +-
drivers/power/supply/twl4030_charger.c | 12 +-
drivers/power/supply/ucs1002_power.c | 6 +-
drivers/ptp/ptp_vmclock.c | 6 +
drivers/rapidio/devices/rio_mport_cdev.c | 10 +-
drivers/regulator/as3722-regulator.c | 1 -
drivers/regulator/max8998.c | 1 -
drivers/regulator/qcom-refgen-regulator.c | 4 +-
drivers/remoteproc/mtk_scp.c | 9 +-
drivers/rpmsg/qcom_glink_smem.c | 7 +
drivers/s390/block/dasd.c | 6 +-
drivers/s390/block/dasd_eckd.c | 40 ++-
drivers/s390/block/dasd_erp.c | 3 +
drivers/scsi/fnic/fip.c | 2 +-
drivers/scsi/scsi_lib.c | 2 +
drivers/staging/greybus/hid.c | 2 +-
drivers/staging/media/ipu7/ipu7-isys.c | 1 +
drivers/staging/media/tegra-video/vi.c | 9 +-
drivers/staging/media/tegra-video/vip.c | 10 +-
drivers/tty/serial/imx.c | 20 +-
drivers/usb/dwc2/gadget.c | 11 +-
drivers/usb/dwc3/gadget.c | 1 +
drivers/usb/gadget/function/f_fs.c | 14 +-
drivers/usb/gadget/function/f_midi2.c | 2 +
drivers/usb/gadget/function/f_tcm.c | 23 +-
drivers/usb/gadget/function/f_uvc.c | 7 +-
drivers/usb/gadget/function/u_audio.c | 24 +-
drivers/usb/gadget/function/uvc_video.c | 2 +-
drivers/usb/gadget/udc/at91_udc.c | 20 +-
drivers/usb/gadget/udc/snps_udc_plat.c | 5 +-
drivers/usb/phy/phy-fsl-usb.c | 52 +--
drivers/usb/phy/phy-fsl-usb.h | 6 +-
drivers/usb/typec/altmodes/thunderbolt.c | 2 +
drivers/usb/typec/hd3ss3220.c | 2 +-
drivers/usb/typec/tcpm/tcpci.c | 12 +-
drivers/usb/typec/ucsi/ucsi.c | 3 +-
drivers/video/backlight/aw99706.c | 10 +-
.../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +-
drivers/video/fbdev/pvr2fb.c | 4 +-
drivers/video/fbdev/ssd1307fb.c | 72 +++-
drivers/video/fbdev/uvesafb.c | 2 +
drivers/video/sticore.c | 22 +-
drivers/w1/slaves/w1_ds28e17.c | 8 +
drivers/xen/balloon.c | 29 +-
fs/backing-file.c | 2 +-
fs/btrfs/direct-io.c | 19 +-
fs/btrfs/extent_io.c | 31 ++
fs/btrfs/extent_io.h | 5 +
fs/btrfs/inode.c | 23 +-
fs/btrfs/ioctl.c | 23 +-
fs/btrfs/relocation.c | 31 +-
fs/buffer.c | 3 +
fs/ceph/addr.c | 11 +
fs/ceph/caps.c | 74 +++-
fs/ceph/dir.c | 10 +-
fs/ceph/export.c | 26 +-
fs/ceph/mds_client.c | 73 +++-
fs/ceph/mds_client.h | 1 +
fs/ceph/mdsmap.c | 11 +-
fs/ceph/super.h | 14 +
fs/ceph/xattr.c | 1 +
fs/debugfs/file.c | 3 +-
fs/ecryptfs/crypto.c | 2 +-
fs/ecryptfs/ecryptfs_kernel.h | 3 +-
fs/ecryptfs/keystore.c | 45 ++-
fs/ecryptfs/messaging.c | 11 +-
fs/ecryptfs/miscdev.c | 5 +-
fs/ecryptfs/super.c | 7 +
fs/efivarfs/super.c | 30 +-
fs/erofs/zutil.c | 2 +
fs/ext2/inode.c | 7 +-
fs/ext2/xattr.c | 4 +-
fs/fat/misc.c | 4 +
fs/fuse/dev.c | 8 +-
fs/fuse/dev.h | 2 +-
fs/fuse/dev_uring.c | 38 +-
fs/fuse/dev_uring_i.h | 5 +
fs/fuse/inode.c | 4 +-
fs/iomap/bio.c | 2 +-
fs/iomap/direct-io.c | 1 +
fs/jbd2/checkpoint.c | 28 +-
fs/lockd/clntproc.c | 3 +
fs/lockd/lockd.h | 2 +-
fs/lockd/svc.c | 4 +-
fs/lockd/svc4proc.c | 7 +-
fs/lockd/svcproc.c | 4 +-
fs/lockd/svcsubs.c | 107 ++++--
fs/nfs/callback.c | 4 +-
fs/nfs/nfs4client.c | 17 +-
fs/nfs/pnfs.c | 3 +-
fs/nfs_common/nfslocalio.c | 16 +-
fs/nfsd/filecache.c | 143 ++++----
fs/nfsd/flexfilelayoutxdr.c | 20 +-
fs/nfsd/localio.c | 8 +-
fs/nfsd/lockd.c | 6 +-
fs/nfsd/netns.h | 35 +-
fs/nfsd/nfs2acl.c | 52 +--
fs/nfsd/nfs3acl.c | 17 +-
fs/nfsd/nfs3proc.c | 40 +++
fs/nfsd/nfs4callback.c | 113 +++++-
fs/nfsd/nfs4layouts.c | 39 +-
fs/nfsd/nfs4proc.c | 225 ++++++++----
fs/nfsd/nfs4recover.c | 48 ++-
fs/nfsd/nfs4state.c | 399 ++++++++++++++++-----
fs/nfsd/nfs4xdr.c | 40 ++-
fs/nfsd/nfscache.c | 6 +-
fs/nfsd/nfsctl.c | 156 ++++++--
fs/nfsd/nfsfh.c | 12 +-
fs/nfsd/nfsproc.c | 7 +
fs/nfsd/nfssvc.c | 49 ++-
fs/nfsd/nfsxdr.c | 32 +-
fs/nfsd/state.h | 4 +-
fs/nfsd/trace.h | 18 +-
fs/nfsd/vfs.c | 39 +-
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 +-
fs/nilfs2/direct.c | 4 +-
fs/notify/fanotify/fanotify.c | 3 +-
fs/notify/fanotify/fanotify.h | 6 +-
fs/notify/fanotify/fanotify_user.c | 17 +-
fs/notify/inotify/inotify_user.c | 15 +-
fs/ntfs/attrib.c | 24 +-
fs/ntfs/lcnalloc.c | 7 +-
fs/ntfs/runlist.c | 48 +++
fs/ntfs/super.c | 12 +-
fs/ntfs3/frecord.c | 9 +
fs/ntfs3/fslog.c | 34 ++
fs/ocfs2/cluster/heartbeat.c | 150 ++++++--
fs/ocfs2/cluster/nodemanager.c | 6 +
fs/ocfs2/cluster/nodemanager.h | 1 +
fs/ocfs2/dir.c | 47 ++-
fs/ocfs2/dlm/dlmmaster.c | 6 +
fs/ocfs2/dlm/dlmrecovery.c | 9 +
fs/ocfs2/refcounttree.c | 47 ++-
fs/ocfs2/suballoc.c | 2 +-
fs/ocfs2/xattr.c | 5 +-
fs/orangefs/devorangefs-req.c | 1 +
fs/orangefs/orangefs-debugfs.c | 1 +
fs/overlayfs/dir.c | 1 -
fs/pidfs.c | 43 ++-
fs/smb/client/cifsfs.c | 15 +-
fs/smb/client/cifsfs.h | 1 +
fs/smb/client/cifssmb.c | 6 +
fs/smb/client/dfs_cache.c | 33 +-
fs/smb/client/file.c | 1 +
fs/smb/client/inode.c | 56 ++-
fs/smb/client/smb1misc.c | 3 +-
fs/smb/client/smb1ops.c | 2 +-
fs/smb/client/smb1transport.c | 35 +-
fs/smb/client/smb2file.c | 5 +-
fs/smb/client/smb2inode.c | 6 +-
fs/smb/client/smb2ops.c | 9 +-
fs/smb/client/trace.h | 3 +-
fs/smb/server/vfs_cache.c | 2 +-
fs/tracefs/event_inode.c | 7 +-
fs/ubifs/auth.c | 2 +-
fs/udf/inode.c | 2 +-
fs/udf/partition.c | 2 +-
include/linux/bio.h | 2 +-
include/linux/compaction.h | 3 +-
include/linux/dm-io.h | 6 +-
include/linux/entry-common.h | 3 +
include/linux/font.h | 4 +-
include/linux/hugetlb.h | 7 +
include/linux/list.h | 15 +-
include/linux/lockd/bind.h | 12 +-
include/linux/sunrpc/bc_xprt.h | 5 +
include/linux/sunrpc/svc_rdma_pcl.h | 2 +-
include/linux/uio.h | 10 +-
include/linux/usb/tcpci.h | 1 +
include/linux/vmalloc.h | 2 +-
include/net/ip_tunnels.h | 11 +-
include/net/sctp/structs.h | 2 +-
include/uapi/linux/landlock.h | 1 +
io_uring/query.c | 3 +
io_uring/waitid.c | 33 +-
kernel/auditfilter.c | 6 +-
kernel/bpf/bloom_filter.c | 19 +-
kernel/bpf/stackmap.c | 3 +
kernel/dma/contiguous.c | 16 +-
kernel/liveupdate/kexec_handover.c | 2 +-
kernel/module/kallsyms.c | 24 +-
kernel/module/main.c | 14 +-
kernel/params.c | 14 +-
kernel/pid.c | 31 --
kernel/reboot.c | 29 ++
kernel/sched/core.c | 49 ++-
kernel/sched/cpufreq_schedutil.c | 15 +-
kernel/sched/ext/ext.c | 342 +++++++++++++-----
kernel/sched/sched.h | 5 +-
kernel/signal.c | 4 +
kernel/taskstats.c | 3 +-
kernel/time/itimer.c | 2 +-
kernel/time/timekeeping.c | 8 +-
kernel/time/timer.c | 1 +
kernel/trace/ring_buffer.c | 202 +++++++----
kernel/trace/simple_ring_buffer.c | 4 +-
kernel/trace/trace.c | 6 +-
kernel/trace/trace_events.c | 2 +
kernel/trace/trace_events_hist.c | 4 +-
kernel/trace/trace_events_user.c | 3 +
lib/iov_iter.c | 9 +-
lib/ucs2_string.c | 2 +-
lib/xarray.c | 3 +
mm/compaction.c | 98 ++---
mm/gup.c | 10 +-
mm/huge_memory.c | 24 +-
mm/hugetlb.c | 38 +-
mm/hugetlb_vmemmap.c | 23 +-
mm/internal.h | 10 +-
mm/kasan/quarantine.c | 7 +-
mm/kmemleak.c | 77 ++--
mm/madvise.c | 4 +-
mm/memcontrol-v1.c | 6 +-
mm/memcontrol.c | 13 +
mm/mempolicy.c | 29 +-
mm/migrate.c | 8 +-
mm/migrate_device.c | 13 +
mm/mm_init.c | 10 +-
mm/page_alloc.c | 76 +++-
mm/page_owner.c | 10 +-
mm/page_vma_mapped.c | 8 +-
mm/pagewalk.c | 6 +-
mm/rmap.c | 31 +-
mm/slub.c | 80 +++--
mm/sparse-vmemmap.c | 4 +-
mm/swapfile.c | 15 +-
mm/vmalloc.c | 58 ++-
mm/vmscan.c | 40 +--
mm/zsmalloc.c | 11 +-
mm/zswap.c | 13 +-
net/bluetooth/eir.c | 3 +-
net/bluetooth/hci_conn.c | 3 +-
net/bluetooth/hci_core.c | 2 +-
net/bluetooth/hci_event.c | 7 +-
net/bluetooth/hci_sync.c | 2 +
net/bluetooth/iso.c | 8 +
net/bluetooth/rfcomm/core.c | 8 +-
net/ceph/osd_client.c | 30 ++
net/ceph/osdmap.c | 2 +
net/core/skbuff.c | 5 +-
net/core/xdp.c | 4 +-
net/ipv4/ip_tunnel.c | 2 +-
net/ipv4/ipip.c | 2 +-
net/ipv4/ipmr.c | 3 +
net/ipv6/exthdrs.c | 26 +-
net/ipv6/ip6_gre.c | 14 +-
net/ipv6/ip6_input.c | 1 +
net/ipv6/ip6_tunnel.c | 22 +-
net/ipv6/route.c | 2 +-
net/ipv6/seg6_local.c | 9 +
net/ipv6/sit.c | 2 +-
net/iucv/af_iucv.c | 2 +
net/l2tp/l2tp_netlink.c | 16 +-
net/mctp/route.c | 19 +-
net/mpls/af_mpls.c | 2 +
net/mptcp/syncookies.c | 1 +
net/openvswitch/conntrack.c | 128 ++++---
net/openvswitch/conntrack.h | 6 +-
net/openvswitch/datapath.c | 60 ++--
net/openvswitch/datapath.h | 8 +-
net/sched/sch_generic.c | 2 +-
net/sctp/inqueue.c | 7 +-
net/sctp/sm_sideeffect.c | 4 +
net/sctp/stream.c | 48 ++-
net/smc/af_smc.c | 3 +-
net/smc/smc.h | 6 +-
net/smc/smc_core.c | 27 +-
net/smc/smc_llc.c | 122 +++++--
net/smc/smc_rx.c | 11 +-
net/smc/smc_tx.h | 6 +-
net/smc/smc_wr.c | 6 +-
net/sunrpc/auth_gss/auth_gss.c | 6 +-
net/sunrpc/auth_gss/gss_krb5_unseal.c | 3 +
net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +-
net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 -
net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 -
net/sunrpc/auth_gss/gss_rpc_xdr.c | 15 +-
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/backchannel_rqst.c | 38 +-
net/sunrpc/cache.c | 7 +-
net/sunrpc/clnt.c | 22 +-
net/sunrpc/sunrpc_syms.c | 1 +
net/sunrpc/svc.c | 93 ++++-
net/sunrpc/xdr.c | 2 +-
net/sunrpc/xprtrdma/ib_client.c | 24 +-
net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +-
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 21 +-
net/sunrpc/xprtrdma/svc_rdma_rw.c | 52 ++-
net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-
net/sunrpc/xprtrdma/svc_rdma_transport.c | 69 +++-
net/sunrpc/xprtsock.c | 12 +-
net/vmw_vsock/virtio_transport.c | 2 +-
rust/Makefile | 6 +-
rust/kernel/bug.rs | 34 +-
rust/kernel/devres.rs | 25 +-
rust/kernel/dma.rs | 6 +-
rust/kernel/fmt.rs | 9 +-
rust/kernel/list.rs | 2 +-
rust/kernel/num/bounded.rs | 31 +-
rust/kernel/time.rs | 17 +-
scripts/Makefile.build | 3 +-
scripts/rust_is_available.sh | 14 +
scripts/rust_is_available_bindgen_libclang_22.h | 5 +
scripts/rust_is_available_test.py | 30 +-
security/apparmor/include/cred.h | 6 +-
security/apparmor/include/label.h | 6 +-
security/apparmor/include/task.h | 15 +-
security/apparmor/task.c | 27 ++
security/keys/trusted-keys/trusted_tpm1.c | 2 +-
security/landlock/errata/abi-1.h | 23 ++
security/landlock/fs.c | 41 ++-
security/smack/smack_lsm.c | 2 +-
sound/core/ump_convert.c | 1 +
sound/drivers/aloop.c | 6 +
sound/drivers/mpu401/mpu401.c | 6 +
sound/drivers/mts64.c | 6 +
sound/drivers/portman2x4.c | 6 +
sound/drivers/serial-u16550.c | 6 +
sound/drivers/virmidi.c | 6 +
sound/hda/codecs/realtek/alc269.c | 7 +-
sound/hda/codecs/realtek/alc662.c | 1 +
sound/hda/core/ext/stream.c | 4 +-
sound/pci/pcxhr/pcxhr.c | 14 +-
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/codecs/aw88261.c | 6 +-
sound/soc/codecs/aw88261.h | 6 -
sound/soc/tegra/tegra210_admaif.c | 210 +++++++----
sound/soc/tegra/tegra210_i2s.c | 24 +-
sound/soc/tegra/tegra210_i2s.h | 1 +
sound/soc/tegra/tegra210_mbdrc.c | 42 +--
sound/soc/tegra/tegra210_mixer.c | 10 +-
sound/usb/6fire/comm.c | 9 +-
sound/usb/bcd2000/bcd2000.c | 11 +-
sound/usb/fcp.c | 4 +-
tools/include/linux/compiler.h | 2 +-
tools/objtool/check.c | 2 +
tools/sched_ext/include/scx/compat.bpf.h | 12 +-
tools/sched_ext/include/scx/enum_defs.autogen.h | 1 -
tools/sched_ext/include/scx/enums.autogen.bpf.h | 3 -
tools/sched_ext/include/scx/enums.autogen.h | 1 -
tools/sched_ext/scx_qmap.bpf.c | 2 +-
tools/testing/selftests/mm/run_vmtests.sh | 2 +-
621 files changed, 7838 insertions(+), 3129 deletions(-)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 001/713] drm/amd/display: Skip Update HDCP Config In Transition State
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 002/713] ASoC: tegra210_i2s: sort the register default table Greg Kroah-Hartman
` (722 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurabindo Pillai, Fangzhi Zuo,
George Zhang, Alex Deucher, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <Jerry.Zuo@amd.com>
[ Upstream commit d5164580a99477dcfe15cea101b153b1e63f1535 ]
Transition state does not have a valid dm_stream_ctx that should skip
configuring HDCP routine. The routine is valid to go through only when
a valid stream is created.
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 28 +++++++++++++------
1 file changed, 20 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
index 4c164ae4a4f9c..8304e8897a3ed 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
@@ -535,15 +535,27 @@ static bool enable_assr(void *handle, struct dc_link *link)
static void update_config(void *handle, struct cp_psp_stream_config *config)
{
struct hdcp_workqueue *hdcp_work = handle;
- struct amdgpu_dm_connector *aconnector = config->dm_stream_ctx;
- int link_index = aconnector->dc_link->link_index;
- unsigned int conn_index = aconnector->base.index;
- struct mod_hdcp_display *display = &hdcp_work[link_index].display;
- struct mod_hdcp_link *link = &hdcp_work[link_index].link;
- struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index];
+ struct amdgpu_dm_connector *aconnector;
+ const struct dc *dc;
+ int link_index;
+ unsigned int conn_index;
+ struct mod_hdcp_display *display;
+ struct mod_hdcp_link *link;
+ struct hdcp_workqueue *hdcp_w;
struct dc_sink *sink = NULL;
bool link_is_hdcp14 = false;
- const struct dc *dc = aconnector->dc_link->dc;
+
+ aconnector = config->dm_stream_ctx;
+ if (!aconnector || !aconnector->dc_link)
+ return;
+
+ link_index = aconnector->dc_link->link_index;
+ display = &hdcp_work[link_index].display;
+ link = &hdcp_work[link_index].link;
+ hdcp_w = &hdcp_work[link_index];
+
+ conn_index = aconnector->base.index;
+ dc = aconnector->dc_link->dc;
if (config->dpms_off) {
hdcp_remove_display(hdcp_work, link_index, aconnector);
@@ -581,7 +593,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config)
link->dp.mst_enabled = config->mst_enabled;
link->dp.dp2_enabled = config->dp2_enabled;
link->dp.usb4_enabled = config->usb4_enabled;
- if (aconnector->dc_sink->sink_signal == SIGNAL_TYPE_HDMI_FRL)
+ if (sink && sink->sink_signal == SIGNAL_TYPE_HDMI_FRL)
link->hdmi.frl_enabled = config->frl_enabled;
display->adjust.disable = MOD_HDCP_DISPLAY_DISABLE_AUTHENTICATION;
link->adjust.auth_delay = 2;
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 002/713] ASoC: tegra210_i2s: sort the register default table
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 001/713] drm/amd/display: Skip Update HDCP Config In Transition State Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 003/713] ASoC: tegra210_i2s: sort the Tegra264 " Greg Kroah-Hartman
` (721 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Mark Brown,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 597273563d90d03fda852a29c3a76c41a22bf6ac ]
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit
fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA210_I2S_ENABLE (0x80) is listed after TEGRA210_I2S_CG (0x88) and
TEGRA210_I2S_TIMING (0xa4), so both it and TEGRA210_I2S_TIMING are
unreachable. regcache_reg_needs_sync() then cannot compare them against
their default and reports that a sync is needed, so they are written to
the device on every regcache_sync() even when they were never touched.
Sort the table by register address.
Fixes: c0bfa98349d1 ("ASoC: tegra: Add Tegra210 based I2S driver")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260805122748.13090-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_i2s.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/tegra/tegra210_i2s.c b/sound/soc/tegra/tegra210_i2s.c
index ff8c72fc38c5c..fd49d2d6ee498 100644
--- a/sound/soc/tegra/tegra210_i2s.c
+++ b/sound/soc/tegra/tegra210_i2s.c
@@ -23,9 +23,9 @@ static const struct reg_default tegra210_i2s_reg_defaults[] = {
{ TEGRA210_I2S_RX_CIF_CTRL, 0x00007700 },
{ TEGRA210_I2S_TX_INT_MASK, 0x00000003 },
{ TEGRA210_I2S_TX_CIF_CTRL, 0x00007700 },
+ { TEGRA210_I2S_ENABLE, 0x1 },
{ TEGRA210_I2S_CG, 0x1 },
{ TEGRA210_I2S_TIMING, 0x0000001f },
- { TEGRA210_I2S_ENABLE, 0x1 },
/*
* Below update does not have any effect on Tegra186 and Tegra194.
* On Tegra210, I2S4 has "i2s4a" and "i2s4b" pins and below update
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 003/713] ASoC: tegra210_i2s: sort the Tegra264 register default table
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 001/713] drm/amd/display: Skip Update HDCP Config In Transition State Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 002/713] ASoC: tegra210_i2s: sort the register default table Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 004/713] ASoC: tegra210_mixer: sort the " Greg Kroah-Hartman
` (720 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Mark Brown,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 82da8df388004af4540e930ab3de2ce5787207e7 ]
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit
fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA264_I2S_ENABLE (0x100), TEGRA264_I2S_RX_FIFO_WR_ACCESS_MODE (0x30)
and TEGRA264_I2S_TX_FIFO_RD_ACCESS_MODE (0xb0) are listed at the end of
the table, after TEGRA264_I2S_TIMING (0x130), which leaves 4 of the 9
entries unreachable. regcache_reg_needs_sync() then cannot compare them
against their default and reports that a sync is needed, so they are
written to the device on every regcache_sync() even when they were never
touched.
Sort the table by register address.
Fixes: b3354438d898 ("ASoC: tegra: I2S: Add Tegra264 support")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260805122748.13090-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_i2s.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/tegra/tegra210_i2s.c b/sound/soc/tegra/tegra210_i2s.c
index fd49d2d6ee498..e4d11518ff019 100644
--- a/sound/soc/tegra/tegra210_i2s.c
+++ b/sound/soc/tegra/tegra210_i2s.c
@@ -38,13 +38,13 @@ static const struct reg_default tegra210_i2s_reg_defaults[] = {
static const struct reg_default tegra264_i2s_reg_defaults[] = {
{ TEGRA210_I2S_RX_INT_MASK, 0x00000003 },
{ TEGRA210_I2S_RX_CIF_CTRL, 0x00003f00 },
+ { TEGRA264_I2S_RX_FIFO_WR_ACCESS_MODE, 0x1 },
{ TEGRA264_I2S_TX_INT_MASK, 0x00000003 },
{ TEGRA264_I2S_TX_CIF_CTRL, 0x00003f00 },
+ { TEGRA264_I2S_TX_FIFO_RD_ACCESS_MODE, 0x1 },
+ { TEGRA264_I2S_ENABLE, 0x1 },
{ TEGRA264_I2S_CG, 0x1 },
{ TEGRA264_I2S_TIMING, 0x0000001f },
- { TEGRA264_I2S_ENABLE, 0x1 },
- { TEGRA264_I2S_RX_FIFO_WR_ACCESS_MODE, 0x1 },
- { TEGRA264_I2S_TX_FIFO_RD_ACCESS_MODE, 0x1 },
};
static void tegra210_i2s_set_slot_ctrl(struct tegra210_i2s *i2s,
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 004/713] ASoC: tegra210_mixer: sort the register default table
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 003/713] ASoC: tegra210_i2s: sort the Tegra264 " Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 005/713] ASoC: tegra: Fix the I2S enable default value Greg Kroah-Hartman
` (719 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Mark Brown,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit f70bc276fc7f712ff5c8e995d5050558a3198df2 ]
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit
fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA210_MIXER_ENABLE (0x400) is the last entry of the table, after
TEGRA210_MIXER_PEAKM_RAM_CTRL (0x434), which makes it unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Sort the table by register address.
Fixes: 05bb3d5ec64a ("ASoC: tegra: Add Tegra210 based Mixer driver")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260805122748.13090-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_mixer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/tegra/tegra210_mixer.c b/sound/soc/tegra/tegra210_mixer.c
index a69774578d69f..8eb4e54b954b1 100644
--- a/sound/soc/tegra/tegra210_mixer.c
+++ b/sound/soc/tegra/tegra210_mixer.c
@@ -57,10 +57,10 @@ static const struct reg_default tegra210_mixer_reg_defaults[] = {
MIXER_TX_REG_DEFAULTS(3),
MIXER_TX_REG_DEFAULTS(4),
+ { TEGRA210_MIXER_ENABLE, 0x1 },
{ TEGRA210_MIXER_CG, 0x00000001},
{ TEGRA210_MIXER_GAIN_CFG_RAM_CTRL, 0x00004000},
{ TEGRA210_MIXER_PEAKM_RAM_CTRL, 0x00004000},
- { TEGRA210_MIXER_ENABLE, 0x1 },
};
/* Default gain parameters */
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 005/713] ASoC: tegra: Fix the I2S enable default value
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 004/713] ASoC: tegra210_mixer: sort the " Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 006/713] ASoC: tegra: Fix the MIXER " Greg Kroah-Hartman
` (718 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jon Hunter, Mark Brown, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
[ Upstream commit 53dd1c1de851280c71385f49a24715e5615c926c ]
Commit 4b05ccb17f92 ("regcache: Sort the local copy of an unsorted
reg_defaults array") exposed an issue in the Tegra I2S driver where the
register default for the TEGRA210_I2S_ENABLE is specified as 1, but the
hardware default is actually 0. After this commit was added the I2S
driver is no longer working and so fix this by correcting the default
value for this register and explicitly configuring the I2S_ENABLE
register when runtime resuming the I2S device.
The I2S_ENABLE register offset is different on Tegra264 devices than
other Tegra devices and so add a 'enable_reg' variable to the SoC data
structure to specify the offset for different SoC devices.
Fixes: c0bfa98349d1 ("ASoC: tegra: Add Tegra210 based I2S driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260821153734.158426-2-jonathanh@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_i2s.c | 20 +++++++++++++++++---
sound/soc/tegra/tegra210_i2s.h | 1 +
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/sound/soc/tegra/tegra210_i2s.c b/sound/soc/tegra/tegra210_i2s.c
index e4d11518ff019..fdcc5d62b720c 100644
--- a/sound/soc/tegra/tegra210_i2s.c
+++ b/sound/soc/tegra/tegra210_i2s.c
@@ -23,7 +23,7 @@ static const struct reg_default tegra210_i2s_reg_defaults[] = {
{ TEGRA210_I2S_RX_CIF_CTRL, 0x00007700 },
{ TEGRA210_I2S_TX_INT_MASK, 0x00000003 },
{ TEGRA210_I2S_TX_CIF_CTRL, 0x00007700 },
- { TEGRA210_I2S_ENABLE, 0x1 },
+ { TEGRA210_I2S_ENABLE, 0x0 },
{ TEGRA210_I2S_CG, 0x1 },
{ TEGRA210_I2S_TIMING, 0x0000001f },
/*
@@ -42,7 +42,7 @@ static const struct reg_default tegra264_i2s_reg_defaults[] = {
{ TEGRA264_I2S_TX_INT_MASK, 0x00000003 },
{ TEGRA264_I2S_TX_CIF_CTRL, 0x00003f00 },
{ TEGRA264_I2S_TX_FIFO_RD_ACCESS_MODE, 0x1 },
- { TEGRA264_I2S_ENABLE, 0x1 },
+ { TEGRA264_I2S_ENABLE, 0x0 },
{ TEGRA264_I2S_CG, 0x1 },
{ TEGRA264_I2S_TIMING, 0x0000001f },
};
@@ -201,9 +201,21 @@ static int tegra210_i2s_runtime_resume(struct device *dev)
}
regcache_cache_only(i2s->regmap, false);
- regcache_sync(i2s->regmap);
+ err = regcache_sync(i2s->regmap);
+ if (err)
+ goto err;
+
+ err = regmap_write(i2s->regmap, i2s->soc_data->enable_reg, I2S_EN);
+ if (err)
+ goto err;
return 0;
+
+err:
+ regcache_cache_only(i2s->regmap, true);
+ clk_disable_unprepare(i2s->clk_i2s);
+
+ return err;
}
static void tegra210_i2s_set_data_offset(struct tegra210_i2s *i2s,
@@ -1133,6 +1145,7 @@ static const struct tegra_i2s_soc_data soc_data_tegra210 = {
.regmap_conf = &tegra210_regmap_conf,
.i2s_cmpnt = &tegra210_i2s_cmpnt,
.max_ch = TEGRA210_I2S_MAX_CHANNEL,
+ .enable_reg = TEGRA210_I2S_ENABLE,
.tx_offset = TEGRA210_I2S_TX_OFFSET,
.i2s_ctrl_offset = TEGRA210_I2S_CTRL_OFFSET,
.fsync_width_mask = I2S_CTRL_FSYNC_WIDTH_MASK,
@@ -1144,6 +1157,7 @@ static const struct tegra_i2s_soc_data soc_data_tegra264 = {
.regmap_conf = &tegra264_regmap_conf,
.i2s_cmpnt = &tegra264_i2s_cmpnt,
.max_ch = TEGRA264_I2S_MAX_CHANNEL,
+ .enable_reg = TEGRA264_I2S_ENABLE,
.tx_offset = TEGRA264_I2S_TX_OFFSET,
.i2s_ctrl_offset = TEGRA264_I2S_CTRL_OFFSET,
.fsync_width_mask = TEGRA264_I2S_CTRL_FSYNC_WIDTH_MASK,
diff --git a/sound/soc/tegra/tegra210_i2s.h b/sound/soc/tegra/tegra210_i2s.h
index 42be2137342c4..82292f96ab367 100644
--- a/sound/soc/tegra/tegra210_i2s.h
+++ b/sound/soc/tegra/tegra210_i2s.h
@@ -150,6 +150,7 @@ struct tegra_i2s_soc_data {
const struct regmap_config *regmap_conf;
const struct snd_soc_component_driver *i2s_cmpnt;
unsigned int max_ch;
+ unsigned int enable_reg;
unsigned int tx_offset;
unsigned int i2s_ctrl_offset;
unsigned int fsync_width_mask;
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 006/713] ASoC: tegra: Fix the MIXER enable default value
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 005/713] ASoC: tegra: Fix the I2S enable default value Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 007/713] ASoC: tegra: Sort ADMAIF register defaults Greg Kroah-Hartman
` (717 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jon Hunter, Mark Brown, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
[ Upstream commit 5442b8093a2f94ecd4696b3875194be09e2676c5 ]
Commit 4b05ccb17f92 ("regcache: Sort the local copy of an unsorted
reg_defaults array") exposed an issue in the Tegra MIXER driver where
the register default for the TEGRA210_MIXER_ENABLE is specified as 1,
but the hardware default is actually 0. After this commit was added the
MIXER driver is no longer working and so fix this by correcting the
default value for this register and explicitly configuring the
MIXER_ENABLE register when runtime resuming the MIXER device.
Fixes: 05bb3d5ec64a ("ASoC: tegra: Add Tegra210 based Mixer driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260821153734.158426-3-jonathanh@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_mixer.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/sound/soc/tegra/tegra210_mixer.c b/sound/soc/tegra/tegra210_mixer.c
index 8eb4e54b954b1..96259a6cbc59b 100644
--- a/sound/soc/tegra/tegra210_mixer.c
+++ b/sound/soc/tegra/tegra210_mixer.c
@@ -57,7 +57,7 @@ static const struct reg_default tegra210_mixer_reg_defaults[] = {
MIXER_TX_REG_DEFAULTS(3),
MIXER_TX_REG_DEFAULTS(4),
- { TEGRA210_MIXER_ENABLE, 0x1 },
+ { TEGRA210_MIXER_ENABLE, 0x0 },
{ TEGRA210_MIXER_CG, 0x00000001},
{ TEGRA210_MIXER_GAIN_CFG_RAM_CTRL, 0x00004000},
{ TEGRA210_MIXER_PEAKM_RAM_CTRL, 0x00004000},
@@ -86,11 +86,15 @@ static int tegra210_mixer_runtime_suspend(struct device *dev)
static int tegra210_mixer_runtime_resume(struct device *dev)
{
struct tegra210_mixer *mixer = dev_get_drvdata(dev);
+ int err;
regcache_cache_only(mixer->regmap, false);
- regcache_sync(mixer->regmap);
+ err = regcache_sync(mixer->regmap);
+ if (err)
+ return err;
- return 0;
+ return regmap_write(mixer->regmap, TEGRA210_MIXER_ENABLE,
+ TEGRA210_MIXER_EN);
}
static int tegra210_mixer_write_ram(struct tegra210_mixer *mixer,
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 007/713] ASoC: tegra: Sort ADMAIF register defaults
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 006/713] ASoC: tegra: Fix the MIXER " Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 008/713] ASoC: tegra: Sort MBDRC " Greg Kroah-Hartman
` (716 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jon Hunter, Mark Brown, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
[ Upstream commit 18d48bfd1bc178da7cfc7a1be3eaa1c8cb10f05c ]
Commit 4b05ccb17f92 ("regcache: Sort the local copy of an unsorted
reg_defaults array") exposed an issue in the Tegra ADMAIF driver and now
the following warning is observed:
tegra210-admaif 290f000.admaif: Driver needs fixing: Unsorted
reg_defaults, sorting the copy
This warning occurs because register defaults in the structures
tegra186_admaif_reg_defaults and tegra264_admaif_reg_defaults are not
specified in ascending order which is required by regmap. Fix this by
sorting the register defaults according to their address. Note that in
order to do this it is necessary to split the macro ADMAIF_REG_DEFAULTS
into separate RX and TX macros to the RX and TX registers.
Fixes: f74028e159bb ("ASoC: tegra: Add Tegra210 based ADMAIF driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260821153734.158426-4-jonathanh@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_admaif.c | 208 ++++++++++++++++++++----------
1 file changed, 138 insertions(+), 70 deletions(-)
diff --git a/sound/soc/tegra/tegra210_admaif.c b/sound/soc/tegra/tegra210_admaif.c
index 7299c6bfcf158..87e898cc35e42 100644
--- a/sound/soc/tegra/tegra210_admaif.c
+++ b/sound/soc/tegra/tegra210_admaif.c
@@ -26,94 +26,162 @@
#define CH_RX_REG(reg, id) CH_REG(admaif->soc_data->rx_base, reg, id)
-#define REG_DEFAULTS(id, rx_ctrl, tx_ctrl, tx_base, rx_base, cif_ctrl) \
+#define RX_REG_DEFAULTS(id, rx_ctrl, rx_base, cif_ctrl) \
{ CH_REG(rx_base, TEGRA_ADMAIF_RX_INT_MASK, id), 0x00000001 }, \
{ CH_REG(rx_base, TEGRA_ADMAIF_CH_ACIF_RX_CTRL, id), cif_ctrl }, \
- { CH_REG(rx_base, TEGRA_ADMAIF_RX_FIFO_CTRL, id), rx_ctrl }, \
+ { CH_REG(rx_base, TEGRA_ADMAIF_RX_FIFO_CTRL, id), rx_ctrl }
+
+#define TX_REG_DEFAULTS(id, tx_ctrl, tx_base, cif_ctrl) \
{ CH_REG(tx_base, TEGRA_ADMAIF_TX_INT_MASK, id), 0x00000001 }, \
{ CH_REG(tx_base, TEGRA_ADMAIF_CH_ACIF_TX_CTRL, id), cif_ctrl }, \
{ CH_REG(tx_base, TEGRA_ADMAIF_TX_FIFO_CTRL, id), tx_ctrl }
-#define ADMAIF_REG_DEFAULTS(id, chip) \
- REG_DEFAULTS((id) - 1, \
+#define ADMAIF_RX_REG_DEFAULTS(id, chip) \
+ RX_REG_DEFAULTS((id) - 1, \
chip ## _ADMAIF_RX ## id ## _FIFO_CTRL_REG_DEFAULT, \
+ chip ## _ADMAIF_RX_BASE, \
+ chip ## _ADMAIF_CIF_REG_DEFAULT)
+
+#define ADMAIF_TX_REG_DEFAULTS(id, chip) \
+ TX_REG_DEFAULTS((id) - 1, \
chip ## _ADMAIF_TX ## id ## _FIFO_CTRL_REG_DEFAULT, \
chip ## _ADMAIF_TX_BASE, \
- chip ## _ADMAIF_RX_BASE, \
chip ## _ADMAIF_CIF_REG_DEFAULT)
static const struct reg_default tegra186_admaif_reg_defaults[] = {
- {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA186_ADMAIF_GLOBAL_BASE), 0x00000003},
- ADMAIF_REG_DEFAULTS(1, TEGRA186),
- ADMAIF_REG_DEFAULTS(2, TEGRA186),
- ADMAIF_REG_DEFAULTS(3, TEGRA186),
- ADMAIF_REG_DEFAULTS(4, TEGRA186),
- ADMAIF_REG_DEFAULTS(5, TEGRA186),
- ADMAIF_REG_DEFAULTS(6, TEGRA186),
- ADMAIF_REG_DEFAULTS(7, TEGRA186),
- ADMAIF_REG_DEFAULTS(8, TEGRA186),
- ADMAIF_REG_DEFAULTS(9, TEGRA186),
- ADMAIF_REG_DEFAULTS(10, TEGRA186),
- ADMAIF_REG_DEFAULTS(11, TEGRA186),
- ADMAIF_REG_DEFAULTS(12, TEGRA186),
- ADMAIF_REG_DEFAULTS(13, TEGRA186),
- ADMAIF_REG_DEFAULTS(14, TEGRA186),
- ADMAIF_REG_DEFAULTS(15, TEGRA186),
- ADMAIF_REG_DEFAULTS(16, TEGRA186),
- ADMAIF_REG_DEFAULTS(17, TEGRA186),
- ADMAIF_REG_DEFAULTS(18, TEGRA186),
- ADMAIF_REG_DEFAULTS(19, TEGRA186),
- ADMAIF_REG_DEFAULTS(20, TEGRA186)
+ ADMAIF_RX_REG_DEFAULTS(1, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(2, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(3, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(4, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(5, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(6, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(7, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(8, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(9, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(10, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(11, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(12, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(13, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(14, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(15, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(16, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(17, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(18, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(19, TEGRA186),
+ ADMAIF_RX_REG_DEFAULTS(20, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(1, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(2, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(3, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(4, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(5, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(6, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(7, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(8, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(9, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(10, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(11, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(12, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(13, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(14, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(15, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(16, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(17, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(18, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(19, TEGRA186),
+ ADMAIF_TX_REG_DEFAULTS(20, TEGRA186),
+ {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA186_ADMAIF_GLOBAL_BASE), 0x00000003}
};
static const struct reg_default tegra210_admaif_reg_defaults[] = {
- {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA210_ADMAIF_GLOBAL_BASE), 0x00000003},
- ADMAIF_REG_DEFAULTS(1, TEGRA210),
- ADMAIF_REG_DEFAULTS(2, TEGRA210),
- ADMAIF_REG_DEFAULTS(3, TEGRA210),
- ADMAIF_REG_DEFAULTS(4, TEGRA210),
- ADMAIF_REG_DEFAULTS(5, TEGRA210),
- ADMAIF_REG_DEFAULTS(6, TEGRA210),
- ADMAIF_REG_DEFAULTS(7, TEGRA210),
- ADMAIF_REG_DEFAULTS(8, TEGRA210),
- ADMAIF_REG_DEFAULTS(9, TEGRA210),
- ADMAIF_REG_DEFAULTS(10, TEGRA210)
+ ADMAIF_RX_REG_DEFAULTS(1, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(2, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(3, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(4, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(5, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(6, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(7, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(8, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(9, TEGRA210),
+ ADMAIF_RX_REG_DEFAULTS(10, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(1, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(2, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(3, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(4, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(5, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(6, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(7, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(8, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(9, TEGRA210),
+ ADMAIF_TX_REG_DEFAULTS(10, TEGRA210),
+ {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA210_ADMAIF_GLOBAL_BASE), 0x00000003}
};
static const struct reg_default tegra264_admaif_reg_defaults[] = {
- {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA264_ADMAIF_GLOBAL_BASE), 0x00000003},
- ADMAIF_REG_DEFAULTS(1, TEGRA264),
- ADMAIF_REG_DEFAULTS(2, TEGRA264),
- ADMAIF_REG_DEFAULTS(3, TEGRA264),
- ADMAIF_REG_DEFAULTS(4, TEGRA264),
- ADMAIF_REG_DEFAULTS(5, TEGRA264),
- ADMAIF_REG_DEFAULTS(6, TEGRA264),
- ADMAIF_REG_DEFAULTS(7, TEGRA264),
- ADMAIF_REG_DEFAULTS(8, TEGRA264),
- ADMAIF_REG_DEFAULTS(9, TEGRA264),
- ADMAIF_REG_DEFAULTS(10, TEGRA264),
- ADMAIF_REG_DEFAULTS(11, TEGRA264),
- ADMAIF_REG_DEFAULTS(12, TEGRA264),
- ADMAIF_REG_DEFAULTS(13, TEGRA264),
- ADMAIF_REG_DEFAULTS(14, TEGRA264),
- ADMAIF_REG_DEFAULTS(15, TEGRA264),
- ADMAIF_REG_DEFAULTS(16, TEGRA264),
- ADMAIF_REG_DEFAULTS(17, TEGRA264),
- ADMAIF_REG_DEFAULTS(18, TEGRA264),
- ADMAIF_REG_DEFAULTS(19, TEGRA264),
- ADMAIF_REG_DEFAULTS(20, TEGRA264),
- ADMAIF_REG_DEFAULTS(21, TEGRA264),
- ADMAIF_REG_DEFAULTS(22, TEGRA264),
- ADMAIF_REG_DEFAULTS(23, TEGRA264),
- ADMAIF_REG_DEFAULTS(24, TEGRA264),
- ADMAIF_REG_DEFAULTS(25, TEGRA264),
- ADMAIF_REG_DEFAULTS(26, TEGRA264),
- ADMAIF_REG_DEFAULTS(27, TEGRA264),
- ADMAIF_REG_DEFAULTS(28, TEGRA264),
- ADMAIF_REG_DEFAULTS(29, TEGRA264),
- ADMAIF_REG_DEFAULTS(30, TEGRA264),
- ADMAIF_REG_DEFAULTS(31, TEGRA264),
- ADMAIF_REG_DEFAULTS(32, TEGRA264)
+ ADMAIF_RX_REG_DEFAULTS(1, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(2, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(3, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(4, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(5, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(6, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(7, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(8, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(9, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(10, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(11, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(12, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(13, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(14, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(15, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(16, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(17, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(18, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(19, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(20, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(21, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(22, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(23, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(24, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(25, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(26, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(27, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(28, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(29, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(30, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(31, TEGRA264),
+ ADMAIF_RX_REG_DEFAULTS(32, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(1, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(2, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(3, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(4, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(5, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(6, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(7, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(8, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(9, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(10, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(11, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(12, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(13, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(14, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(15, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(16, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(17, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(18, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(19, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(20, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(21, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(22, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(23, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(24, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(25, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(26, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(27, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(28, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(29, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(30, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(31, TEGRA264),
+ ADMAIF_TX_REG_DEFAULTS(32, TEGRA264),
+ {(TEGRA_ADMAIF_GLOBAL_CG_0 + TEGRA264_ADMAIF_GLOBAL_BASE), 0x00000003}
};
static bool tegra_admaif_wr_reg(struct device *dev, unsigned int reg)
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 008/713] ASoC: tegra: Sort MBDRC register defaults
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 007/713] ASoC: tegra: Sort ADMAIF register defaults Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 009/713] btrfs: write-protect folios during data writeback Greg Kroah-Hartman
` (715 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jon Hunter, Mark Brown, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
[ Upstream commit abb5bed6f48d54d3b82724a430fd462579ecd876 ]
Commit 4b05ccb17f92 ("regcache: Sort the local copy of an unsorted
reg_defaults array") exposed an issue with the Tegra MBDRC driver and
now the following warning is observed:
tegra210-ope 2908000.processing-engine: Driver needs fixing: Unsorted
reg_defaults, sorting the copy
This warning occurs because register defaults in the structure
tegra210_mbdrc_reg_defaults are not specified in ascending order which
is required by regmap. Fix this by sorting the register defaults
according to their address. Note that in order to do this it is
necessary to replace the macro MBDRC_FILTER_REG_DEFAULTS with a per
register macro MBDRC_FILTER_PARAM_REG_DEFAULTS.
Fixes: 7358a803c778 ("ASoC: tegra: Add Tegra210 based OPE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260821153734.158426-5-jonathanh@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_mbdrc.c | 42 ++++++++++++++++----------------
1 file changed, 21 insertions(+), 21 deletions(-)
diff --git a/sound/soc/tegra/tegra210_mbdrc.c b/sound/soc/tegra/tegra210_mbdrc.c
index f5d4a93dd6f16..1d78b4c1cc885 100644
--- a/sound/soc/tegra/tegra210_mbdrc.c
+++ b/sound/soc/tegra/tegra210_mbdrc.c
@@ -20,33 +20,33 @@
#define MBDRC_FILTER_REG(reg, id) \
((reg) + ((id) * TEGRA210_MBDRC_FILTER_PARAM_STRIDE))
-#define MBDRC_FILTER_REG_DEFAULTS(id) \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_IIR_CFG, id), 0x00000005}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_IN_ATTACK, id), 0x3e48590c}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_IN_RELEASE, id), 0x08414e9f}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_FAST_ATTACK, id), 0x7fffffff}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_IN_THRESHOLD, id), 0x06145082}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_OUT_THRESHOLD, id), 0x060d379b}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_RATIO_1ST, id), 0x0000a000}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_RATIO_2ND, id), 0x00002000}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_RATIO_3RD, id), 0x00000b33}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_RATIO_4TH, id), 0x00000800}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_RATIO_5TH, id), 0x0000019a}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_MAKEUP_GAIN, id), 0x00000002}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_INIT_GAIN, id), 0x00066666}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_GAIN_ATTACK, id), 0x00d9ba0e}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_GAIN_RELEASE, id), 0x3e48590c}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_FAST_RELEASE, id), 0x7ffff26a}, \
- { MBDRC_FILTER_REG(TEGRA210_MBDRC_CFG_RAM_CTRL, id), 0x4000}
+#define MBDRC_FILTER_PARAM_REG_DEFAULTS(reg, val) \
+ { MBDRC_FILTER_REG(reg, 0), val}, \
+ { MBDRC_FILTER_REG(reg, 1), val}, \
+ { MBDRC_FILTER_REG(reg, 2), val}
static const struct reg_default tegra210_mbdrc_reg_defaults[] = {
{ TEGRA210_MBDRC_CFG, 0x0030de51},
{ TEGRA210_MBDRC_CHANNEL_MASK, 0x00000003},
{ TEGRA210_MBDRC_FAST_FACTOR, 0x30000800},
- MBDRC_FILTER_REG_DEFAULTS(0),
- MBDRC_FILTER_REG_DEFAULTS(1),
- MBDRC_FILTER_REG_DEFAULTS(2),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_IIR_CFG, 0x00000005),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_IN_ATTACK, 0x3e48590c),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_IN_RELEASE, 0x08414e9f),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_FAST_ATTACK, 0x7fffffff),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_IN_THRESHOLD, 0x06145082),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_OUT_THRESHOLD, 0x060d379b),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_RATIO_1ST, 0x0000a000),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_RATIO_2ND, 0x00002000),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_RATIO_3RD, 0x00000b33),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_RATIO_4TH, 0x00000800),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_RATIO_5TH, 0x0000019a),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_MAKEUP_GAIN, 0x00000002),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_INIT_GAIN, 0x00066666),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_GAIN_ATTACK, 0x00d9ba0e),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_GAIN_RELEASE, 0x3e48590c),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_FAST_RELEASE, 0x7ffff26a),
+ MBDRC_FILTER_PARAM_REG_DEFAULTS(TEGRA210_MBDRC_CFG_RAM_CTRL, 0x4000),
};
/* Default MBDRC parameters */
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 009/713] btrfs: write-protect folios during data writeback
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 008/713] ASoC: tegra: Sort MBDRC " Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 010/713] ring-buffer: Fix subbuf resize race with ring buffer readers Greg Kroah-Hartman
` (714 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Boris Burkov,
David Sterba, Matthew Schwartz, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <boris@bur.io>
commit 5376c9db45368eb210b4d71104ac00a59dc8b6e0 upstream.
commit 095be159f3eb ("btrfs: unify folio dirty flag clearing") replaced
the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a
plain folio_test_dirty() check. Besides clearing the dirty flag,
folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects
the shared mmap PTEs mapping the folio. Note that we still do call
folio_clear_dirty_for_io() later in submit_one_sector() when we clear
dirty on the last sector of the folio (the only sector for non-subpage
cases). But we lost this early call in extent_write_cache_pages().
Without the extra write-protection, a process with the file mmap-ed can
modify a sector while it is being used by writeback in a way that
expects a stable folio (checksumming, compressing, copying, etc...)
without faulting, which manifests as a handful of concrete bugs.
1. For large folios or subpage sectorsize, it is possible to submit a bio
which does not cover the whole folio. When this happens, we will have a
bio in flight for a folio that we have *not* called
folio_clear_dirty_for_io() on. If a task with an existing mmap-ed PTE
writes (without faulting..) in this window, it can result in
corruptions. If the write arrives while the checksumming or writing itself
is underway, this can result in an invalid checksum and later corruption
reports on read. If the write arrives after checksumming/writing is done
but before the last sector dirty is cleared, then the write is present
in page cache but doesn't affect the dirty tracking and will be lost
when the folio is fully finished being submitted and the dirty bit
is cleared. This results in losing the write even if fsync() is called.
2. For zoned submissions which are done in batch separate from the main
extent_writepage() loop, we also risk csum violations for those
submissions. Zoned writes are clamped to max_zone_append_size and are
not aligned with folios, so a submission can span two folios. The first
folio being processed in extent_write_cache_pages() will call
extent_write_locked_range() which will submit the partial range of the
next folio, while the rest of that folio could still be dirty. So
clearing dirty on the submitted sectors doesn't call
folio_clear_dirty_for_io() and we have the same issue. Since
extent_write_cache_pages() skips these batch submitted folios (they are
already marked for writeback from submission by the preceding folio), we
must add the extra write protection in lock_delalloc_folios().
3. For inline extents this will subtly risk losing writes that happen
after/while we copy the inline extent but before we clear dirty on
the folio.
4. For folios spanning EOF, mmap could tamper with the zeroed bytes past
EOF and cause them to be persisted where future faults would improperly
see them instead of zeros.
5. Finally, for compressed extents, we risk modifying the folios while we
work on compressing them which will result in corrupted compressed data.
Specifically, in run_delalloc_compressed() we queue up work to do
compress_file_range() in BTRFS_COMPRESSION_CHUNK_SIZE (512K) chunks which
will call btrfs_folio_clamp_clear_dirty() on the range. For non-subpage,
this will always clear the whole folio, safely. For subpage, we risk a
partial clear here as well. In particular, imagine a 2M folio broken up
into 512K chunks of work which might start compression work on one chunk
before all the chunks compress_file_range() workers have gotten far
enough to finish clearing all the dirty bitmaps of the folio and getting
to folio_clear_dirty_for_io(). Large folios on the edges of submission
ranges are similarly at risk to be only partly cleared.
This particular gap was introduced by a second patch in the same series:
commit a4ef54dbb576 ("btrfs: make extent_range_clear_dirty_for_io() to handle sector size < page size cases")
We cannot simply restore the call to folio_clear_dirty_for_io() because
that also drops the dirty flag off the folio which violates invariants
introduced for large folios by
commit 334509ce9d07 ("btrfs: use dirty flag to check if an ordered extent needs to be truncated")
and results in failing to invalidate clean folios past i_size, resulting
in deadlocks.
Therefore, to fix it, leave the existing semantics w.r.t. the folio's
dirty flag (to preserve the correct invalidate behavior) but ensure that
the other aspect of folio_clear_dirty_for_io(), folio_mkclean(), is run
on the folio when we lock it for writeback.
Finally, to help prevent similar regressions in the future, add a debug
warning that triggers at the known corruption sites if we have failed to
write protect the folio.
Assisted-by: LLM (debug, reproduce, research fix, review patch)
Fixes: 095be159f3eb ("btrfs: unify folio dirty flag clearing")
Fixes: a4ef54dbb576 ("btrfs: make extent_range_clear_dirty_for_io() to handle sector size < page size cases")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent_io.c | 31 +++++++++++++++++++++++++++++++
fs/btrfs/extent_io.h | 5 +++++
fs/btrfs/inode.c | 23 +++++++++++++++++------
3 files changed, 53 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index f032f0858f40f..45c4d4a3b29b1 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -6,6 +6,7 @@
#include <linux/mm.h>
#include <linux/pagemap.h>
#include <linux/page-flags.h>
+#include <linux/rmap.h>
#include <linux/sched/mm.h>
#include <linux/spinlock.h>
#include <linux/blkdev.h>
@@ -299,6 +300,25 @@ static noinline void unlock_delalloc_folio(const struct inode *inode,
PAGE_UNLOCK);
}
+#ifdef CONFIG_BTRFS_DEBUG
+/*
+ * Writeback must write-protect a folio when locking it for IO, before
+ * anything consumes its data (zeroing, inline copy, compression,
+ * checksumming). If this fails, then an mmap writer would be able to
+ * modify the data concurrently while we need it to be stable.
+ */
+void btrfs_check_folio_write_protected(struct folio *folio)
+{
+ if (folio_mkclean(folio)) {
+ const struct btrfs_inode *inode = BTRFS_I(folio->mapping->host);
+
+ DEBUG_WARN("writable mmap PTEs, root %llu ino %llu pos %llu order %u",
+ btrfs_root_id(inode->root), btrfs_ino(inode), folio_pos(folio),
+ folio_order(folio));
+ }
+}
+#endif
+
static noinline int lock_delalloc_folios(struct inode *inode,
struct folio *locked_folio,
u64 start, u64 end)
@@ -332,6 +352,8 @@ static noinline int lock_delalloc_folios(struct inode *inode,
folio_unlock(folio);
goto out;
}
+ /* Locked for writeback; revoke writable mmap PTEs before using the data. */
+ folio_mkclean(folio);
range_start = max_t(u64, folio_pos(folio), start);
range_len = min_t(u64, folio_next_pos(folio), end + 1) - range_start;
btrfs_folio_set_lock(fs_info, folio, range_start, range_len);
@@ -1893,6 +1915,13 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
ASSERT(end <= folio_end, "start=%llu len=%u folio_start=%llu folio_size=%zu",
start, len, folio_start, folio_size(folio));
+ /*
+ * We are about to checksum and write out the data, so it must not be
+ * mmap writeable, or we could corrupt the data and end up with invalid
+ * checksums.
+ */
+ btrfs_check_folio_write_protected(folio);
+
/* Truncate the submit bitmap to the current range. */
if (start > folio_start)
bitmap_clear(bio_ctrl->submit_bitmap, 0,
@@ -2703,6 +2732,8 @@ static int extent_write_cache_pages(struct address_space *mapping,
continue;
}
+ /* Locked for writeback; revoke writable mmap PTEs before using the data. */
+ folio_mkclean(folio);
ret = extent_writepage(folio, bio_ctrl);
if (ret < 0) {
done = true;
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 9896e15ddc406..8699253376993 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -255,6 +255,11 @@ bool try_release_extent_mapping(struct folio *folio, gfp_t mask);
int try_release_extent_buffer(struct folio *folio);
int btrfs_read_folio(struct file *file, struct folio *folio);
+#ifdef CONFIG_BTRFS_DEBUG
+void btrfs_check_folio_write_protected(struct folio *folio);
+#else
+static inline void btrfs_check_folio_write_protected(struct folio *folio) { }
+#endif
void extent_write_locked_range(struct inode *inode, const struct folio *locked_folio,
u64 start, u64 end, struct writeback_control *wbc,
bool pages_dirty);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 2534cd9284d54..39a01f9cf6b51 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -775,19 +775,28 @@ static inline void inode_should_defrag(struct btrfs_inode *inode,
static int extent_range_clear_dirty_for_io(struct btrfs_inode *inode, u64 start, u64 end)
{
+ pgoff_t index = start >> PAGE_SHIFT;
const pgoff_t end_index = end >> PAGE_SHIFT;
struct folio *folio;
int ret = 0;
- for (pgoff_t index = start >> PAGE_SHIFT; index <= end_index; index++) {
+ while (index <= end_index) {
folio = filemap_get_folio(inode->vfs_inode.i_mapping, index);
if (IS_ERR(folio)) {
if (!ret)
ret = PTR_ERR(folio);
+ index++;
continue;
}
+ /*
+ * We are about to compress the folio, so it must not be mmap
+ * writeable or we could corrupt the data as we attempt to
+ * compress it.
+ */
+ btrfs_check_folio_write_protected(folio);
btrfs_folio_clamp_clear_dirty(inode->root->fs_info, folio, start,
end + 1 - start);
+ index = folio_next_index(folio);
folio_put(folio);
}
return ret;
@@ -877,11 +886,6 @@ static void compress_file_range(struct btrfs_work *work)
inode_should_defrag(inode, start, end, end - start + 1, SZ_16K);
- /*
- * We need to call clear_page_dirty_for_io on each page in the range.
- * Otherwise applications with the file mmap'd can wander in and change
- * the page contents while we are compressing them.
- */
ret = extent_range_clear_dirty_for_io(inode, start, end);
/*
@@ -2317,6 +2321,13 @@ static int run_delalloc_inline(struct btrfs_inode *inode, struct folio *locked_f
int ret;
ASSERT(folio_pos(locked_folio) == 0);
+ /*
+ * If an mmap writer could modify the folio while we copy it into an
+ * inline extent we might see only part of their modification then
+ * wrongly mark it clean again after copying, losing that write. So the
+ * folio must be write protected here.
+ */
+ btrfs_check_folio_write_protected(locked_folio);
if (btrfs_inode_can_compress(inode) &&
inode_need_compress(inode, 0, blocksize, true)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 010/713] ring-buffer: Fix subbuf resize race with ring buffer readers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 009/713] btrfs: write-protect folios during data writeback Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 011/713] drm/amd/display: hide Apple Studio Display secondary tile Greg Kroah-Hartman
` (713 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Masami Hiramatsu (Google),
Vincent Donnefort, Steven Rostedt, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
[ Upstream commit 8a5f63637890f03177146efddaba5ec7a1b4d61f ]
trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simultaneously be resized with
ring_buffer_subbuf_order_set().
Instead of trace_buffer::subbuf_size, use bpage::order in
ring_buffer_read_start() and ring_buffer_read_page().
In ring_buffer_read_start(), even with resize_disabled, there is still a
possibility of a race with a buffer modification. Hold the trace_buffer
mutex to synchronise with any pending ring buffer order modification.
trace_buffer::subbuf_size is now actually useless, remove it. Also,
create accessors rb_subbuf_capacity() and rb_page_capacity() which
return the actual size available for storing events, while
rb_subbuf_size() returns the actual subbuf page-size.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260813131152.3589632-5-vdonnefort@google.com
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260805153225.2096152-1-vdonnefort%40google.com # patch 1
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 167 +++++++++++++++++++++++--------------
1 file changed, 106 insertions(+), 61 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 2667992f0aa29..0e92ee401813d 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -391,6 +391,17 @@ static __always_inline unsigned int rb_page_size(struct buffer_page *bpage)
return rb_data_page_size(bpage->page);
}
+/**
+ * rb_page_capacity - Get the capacity of a buffer page
+ * @bpage: The buffer page
+ *
+ * Return: The maximum size available for events in the given buffer page.
+ */
+static __always_inline unsigned int rb_page_capacity(struct buffer_page *bpage)
+{
+ return (PAGE_SIZE << bpage->order) - BUF_PAGE_HDR_SIZE;
+}
+
static void free_buffer_page(struct buffer_page *bpage)
{
/* Range pages are not to be freed */
@@ -586,11 +597,42 @@ struct trace_buffer {
struct ring_buffer_meta *meta;
- unsigned int subbuf_size;
unsigned int subbuf_order;
unsigned int max_data_size;
};
+static __always_inline unsigned int rb_subbuf_size(struct trace_buffer *buffer)
+{
+ return PAGE_SIZE << buffer->subbuf_order;
+}
+
+/**
+ * rb_subbuf_capacity - Get the capacity of a subbuffer
+ * @buffer: A trace buffer
+ *
+ * Unsafe to use without holding trace_buffer::mutex or with resizing enabled.
+ * Consider rb_page_capacity() instead.
+ *
+ * Return: The maximum size available for events in a trace buffer subbuffer.
+ */
+static __always_inline unsigned int rb_subbuf_capacity(struct trace_buffer *buffer)
+{
+ return rb_subbuf_size(buffer) - BUF_PAGE_HDR_SIZE;
+}
+
+/**
+ * rb_subbuf_start - Get the start address of a subbuffer
+ * @buffer: A trace buffer
+ * @addr: An address of an event on a subbuffer
+ *
+ * Return: The start of the subbuffer for where @addr sits
+ */
+static __always_inline
+unsigned long rb_subbuf_start(struct trace_buffer *buffer, unsigned long addr)
+{
+ return addr & ~((unsigned long)(rb_subbuf_size(buffer) - 1));
+}
+
struct ring_buffer_iter {
struct ring_buffer_per_cpu *cpu_buffer;
unsigned long head;
@@ -630,7 +672,7 @@ int ring_buffer_print_page_header(struct trace_buffer *buffer, struct trace_seq
trace_seq_printf(s, "\tfield: char data;\t"
"offset:%u;\tsize:%u;\tsigned:%u;\n",
(unsigned int)offsetof(typeof(field), data),
- (unsigned int)(buffer ? buffer->subbuf_size :
+ (unsigned int)(buffer ? rb_subbuf_capacity(buffer) :
PAGE_SIZE - BUF_PAGE_HDR_SIZE),
(unsigned int)is_signed_type(char));
@@ -1620,7 +1662,7 @@ rb_range_align_subbuf(unsigned long addr, int subbuf_size, int nr_subbufs)
*/
static void *rb_range_meta(struct trace_buffer *buffer, int nr_pages, int cpu)
{
- int subbuf_size = buffer->subbuf_size + BUF_PAGE_HDR_SIZE;
+ int subbuf_size = rb_subbuf_size(buffer);
struct ring_buffer_cpu_meta *meta;
struct ring_buffer_meta *bmeta;
unsigned long ptr;
@@ -2432,8 +2474,8 @@ static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
bpage->id = i + 1;
cpu_buffer->subbuf_ids[i + 1] = bpage;
} else {
- int order = cpu_buffer->buffer->subbuf_order;
- bpage->page = alloc_cpu_data(cpu_buffer->cpu, order);
+ bpage->page = alloc_cpu_data(cpu_buffer->cpu,
+ cpu_buffer->buffer->subbuf_order);
if (!bpage->page)
goto free_pages;
}
@@ -2556,8 +2598,7 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
bpage->range = 1;
cpu_buffer->subbuf_ids[0] = bpage;
} else {
- int order = cpu_buffer->buffer->subbuf_order;
- bpage->page = alloc_cpu_data(cpu, order);
+ bpage->page = alloc_cpu_data(cpu, bpage->order);
if (!bpage->page)
goto fail_free_reader;
}
@@ -2731,10 +2772,9 @@ static struct trace_buffer *alloc_buffer(unsigned long size, unsigned flags,
buffer->subbuf_order = order;
subbuf_size = (PAGE_SIZE << order);
- buffer->subbuf_size = subbuf_size - BUF_PAGE_HDR_SIZE;
/* Max payload is buffer page size - header (8bytes) */
- buffer->max_data_size = buffer->subbuf_size - (sizeof(u32) * 2);
+ buffer->max_data_size = rb_subbuf_capacity(buffer) - (sizeof(u32) * 2);
buffer->flags = flags;
buffer->clock = trace_clock_local;
@@ -2818,9 +2858,8 @@ static struct trace_buffer *alloc_buffer(unsigned long size, unsigned flags,
if (nr_pages < 2)
goto fail_free_buffers;
} else {
-
/* need at least two pages */
- nr_pages = DIV_ROUND_UP(size, buffer->subbuf_size);
+ nr_pages = DIV_ROUND_UP(size, rb_subbuf_capacity(buffer));
if (nr_pages < 2)
nr_pages = 2;
}
@@ -3203,7 +3242,7 @@ static void update_pages_handler(struct work_struct *work)
* @size: the new size.
* @cpu_id: the cpu buffer to resize
*
- * Minimum size is 2 * buffer->subbuf_size.
+ * Minimum size is 2 * rb_subbuf_capacity(buffer).
*
* Returns 0 on success and < 0 on failure.
*/
@@ -3225,12 +3264,6 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
!cpumask_test_cpu(cpu_id, buffer->cpumask))
return 0;
- nr_pages = DIV_ROUND_UP(size, buffer->subbuf_size);
-
- /* we need a minimum of two pages */
- if (nr_pages < 2)
- nr_pages = 2;
-
/*
* Keep CPUs from coming online while resizing to synchronize
* with new per CPU buffers being created.
@@ -3241,6 +3274,12 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
mutex_lock(&buffer->mutex);
atomic_inc(&buffer->resizing);
+ nr_pages = DIV_ROUND_UP(size, rb_subbuf_capacity(buffer));
+
+ /* we need a minimum of two pages */
+ if (nr_pages < 2)
+ nr_pages = 2;
+
if (cpu_id == RING_BUFFER_ALL_CPUS) {
/*
* Don't succeed if resizing is disabled, as a reader might be
@@ -3513,7 +3552,7 @@ rb_event_index(struct ring_buffer_per_cpu *cpu_buffer, struct ring_buffer_event
{
unsigned long addr = (unsigned long)event;
- addr &= (PAGE_SIZE << cpu_buffer->buffer->subbuf_order) - 1;
+ addr &= (unsigned long)rb_subbuf_size(cpu_buffer->buffer) - 1;
return addr - BUF_PAGE_HDR_SIZE;
}
@@ -3755,8 +3794,8 @@ static inline void
rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
unsigned long tail, struct rb_event_info *info)
{
- unsigned long bsize = READ_ONCE(cpu_buffer->buffer->subbuf_size);
struct buffer_page *tail_page = info->tail_page;
+ unsigned long bsize = rb_page_capacity(tail_page);
struct ring_buffer_event *event;
unsigned long length = info->length;
@@ -4101,8 +4140,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
new_index = rb_event_index(cpu_buffer, event);
old_index = new_index + rb_event_ts_length(event);
- addr = (unsigned long)event;
- addr &= ~((PAGE_SIZE << cpu_buffer->buffer->subbuf_order) - 1);
+ addr = rb_subbuf_start(cpu_buffer->buffer, (unsigned long)event);
bpage = READ_ONCE(cpu_buffer->tail_page);
@@ -4767,7 +4805,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
tail = write - info->length;
/* See if we shot pass the end of this buffer page */
- if (unlikely(write > cpu_buffer->buffer->subbuf_size)) {
+ if (unlikely(write > rb_page_capacity(tail_page))) {
check_buffer(cpu_buffer, info, CHECK_FULL_PAGE);
return rb_move_tail(cpu_buffer, tail, info);
}
@@ -5012,7 +5050,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
struct buffer_page *bpage = cpu_buffer->commit_page;
struct buffer_page *start;
- addr &= ~((PAGE_SIZE << cpu_buffer->buffer->subbuf_order) - 1);
+ addr = rb_subbuf_start(cpu_buffer->buffer, addr);
/* Do the likely case first */
if (likely(bpage->page == (void *)addr)) {
@@ -5799,7 +5837,6 @@ static struct buffer_page *
__rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
{
int max_loops = cpu_buffer->ring_meta ? cpu_buffer->nr_pages : 3;
- unsigned long bsize = READ_ONCE(cpu_buffer->buffer->subbuf_size);
struct buffer_page *reader = NULL;
unsigned long overwrite;
unsigned long flags;
@@ -5947,7 +5984,7 @@ __rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
#define USECS_WAIT 1000000
for (nr_loops = 0; nr_loops < USECS_WAIT; nr_loops++) {
/* If the write is past the end of page, a writer is still updating it */
- if (likely(!reader || rb_page_write(reader) <= bsize))
+ if (likely(!reader || rb_page_write(reader) <= rb_page_capacity(reader)))
break;
udelay(1);
@@ -6380,36 +6417,44 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
struct ring_buffer_iter *
ring_buffer_read_start(struct trace_buffer *buffer, int cpu, gfp_t flags)
{
+ struct ring_buffer_iter *iter __free(kfree) = kzalloc_obj(*iter, flags);
struct ring_buffer_per_cpu *cpu_buffer;
- struct ring_buffer_iter *iter;
-
- if (!cpumask_test_cpu(cpu, buffer->cpumask))
- return NULL;
- iter = kzalloc_obj(*iter, flags);
if (!iter)
return NULL;
- /* Holds the entire event: data and meta data */
- iter->event_size = buffer->subbuf_size;
- iter->event = kmalloc(iter->event_size, flags);
- if (!iter->event) {
- kfree(iter);
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
return NULL;
- }
cpu_buffer = buffer->buffers[cpu];
- iter->cpu_buffer = cpu_buffer;
+ /*
+ * Only KDB is using GFP_ATOMIC, for the others, lock the buffer to
+ * prevent concurrent resizing.
+ */
+ if (gfpflags_allow_blocking(flags))
+ mutex_lock(&buffer->mutex);
atomic_inc(&cpu_buffer->resize_disabled);
+ if (gfpflags_allow_blocking(flags))
+ mutex_unlock(&buffer->mutex);
+
+ /* Holds the entire event: data and meta data. */
+ iter->event_size = rb_page_capacity(READ_ONCE(cpu_buffer->reader_page));
+ iter->event = kmalloc(iter->event_size, flags);
+ if (!iter->event) {
+ atomic_dec(&cpu_buffer->resize_disabled);
+ return NULL;
+ }
+ iter->cpu_buffer = cpu_buffer;
+
guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock);
arch_spin_lock(&cpu_buffer->lock);
rb_iter_reset(iter);
arch_spin_unlock(&cpu_buffer->lock);
- return iter;
+ return_ptr(iter);
}
EXPORT_SYMBOL_GPL(ring_buffer_read_start);
@@ -6463,7 +6508,7 @@ unsigned long ring_buffer_size(struct trace_buffer *buffer, int cpu)
if (!cpumask_test_cpu(cpu, buffer->cpumask))
return 0;
- return buffer->subbuf_size * buffer->buffers[cpu]->nr_pages;
+ return rb_subbuf_capacity(buffer) * buffer->buffers[cpu]->nr_pages;
}
EXPORT_SYMBOL_GPL(ring_buffer_size);
@@ -7094,15 +7139,15 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
if (!data_page || !data_page->data)
return -1;
- if (data_page->order != buffer->subbuf_order)
- return -1;
-
dpage = data_page->data;
if (!dpage)
return -1;
guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock);
+ if (data_page->order != cpu_buffer->reader_page->order)
+ return -1;
+
reader = rb_get_reader_page(cpu_buffer);
if (!reader)
return -1;
@@ -7228,7 +7273,7 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
* missed events, then record it there.
*/
if (missed_events > 0 &&
- buffer->subbuf_size - size >= sizeof(missed_events)) {
+ rb_page_capacity(reader) - size >= sizeof(missed_events)) {
memcpy(&dpage->data[size], &missed_events,
sizeof(missed_events));
local_add(RB_MISSED_STORED, &dpage->commit);
@@ -7248,8 +7293,8 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
/*
* This page may be off to user land. Zero it out here.
*/
- if (size < buffer->subbuf_size)
- memset(&dpage->data[size], 0, buffer->subbuf_size - size);
+ if (size < rb_page_capacity(reader))
+ memset(&dpage->data[size], 0, rb_page_capacity(reader) - size);
return read;
}
@@ -7275,7 +7320,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_read_page_data);
*/
int ring_buffer_subbuf_size_get(struct trace_buffer *buffer)
{
- return buffer->subbuf_size + BUF_PAGE_HDR_SIZE;
+ return rb_subbuf_size(buffer);
}
EXPORT_SYMBOL_GPL(ring_buffer_subbuf_size_get);
@@ -7320,7 +7365,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
{
struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_page *bpage, *tmp;
- int old_order, old_size;
+ unsigned int old_capacity;
+ int old_order;
int nr_pages;
int psize;
int err;
@@ -7329,9 +7375,6 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (!buffer || order < 0)
return -EINVAL;
- if (buffer->subbuf_order == order)
- return 0;
-
psize = (1 << order) * PAGE_SIZE;
if (psize <= BUF_PAGE_HDR_SIZE)
return -EINVAL;
@@ -7340,18 +7383,21 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
- old_order = buffer->subbuf_order;
- old_size = buffer->subbuf_size;
-
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);
+
+ old_order = buffer->subbuf_order;
+ if (old_order == order)
+ return 0;
+
+ old_capacity = rb_subbuf_capacity(buffer);
+
atomic_inc(&buffer->record_disabled);
/* Make sure all commits have finished */
synchronize_rcu();
buffer->subbuf_order = order;
- buffer->subbuf_size = psize - BUF_PAGE_HDR_SIZE;
/* Make sure all new buffers are allocated, before deleting the old ones */
for_each_buffer_cpu(buffer, cpu) {
@@ -7367,8 +7413,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
}
/* Update the number of pages to match the new size */
- nr_pages = old_size * buffer->buffers[cpu]->nr_pages;
- nr_pages = DIV_ROUND_UP(nr_pages, buffer->subbuf_size);
+ nr_pages = old_capacity * buffer->buffers[cpu]->nr_pages;
+ nr_pages = DIV_ROUND_UP(nr_pages, rb_subbuf_capacity(buffer));
/* we need a minimum of two pages */
if (nr_pages < 2)
@@ -7454,7 +7500,6 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
error:
buffer->subbuf_order = old_order;
- buffer->subbuf_size = old_size;
atomic_dec(&buffer->record_disabled);
@@ -7532,7 +7577,7 @@ static void rb_setup_ids_meta_page(struct ring_buffer_per_cpu *cpu_buffer,
meta->meta_struct_len = sizeof(*meta);
meta->nr_subbufs = nr_subbufs;
- meta->subbuf_size = cpu_buffer->buffer->subbuf_size + BUF_PAGE_HDR_SIZE;
+ meta->subbuf_size = rb_subbuf_size(cpu_buffer->buffer);
meta->meta_page_size = meta->subbuf_size;
rb_update_meta_page(cpu_buffer);
@@ -7894,7 +7939,7 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
* missed events, then record it there.
*/
commit = rb_page_size(reader);
- if (buffer->subbuf_size - commit >= sizeof(missed_events)) {
+ if (rb_subbuf_capacity(buffer) - commit >= sizeof(missed_events)) {
memcpy(&dpage->data[commit], &missed_events,
sizeof(missed_events));
local_add(RB_MISSED_STORED, &dpage->commit);
@@ -7926,7 +7971,7 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
out:
/* Some archs do not have data cache coherency between kernel and user-space */
flush_kernel_vmap_range(cpu_buffer->reader_page->page,
- buffer->subbuf_size + BUF_PAGE_HDR_SIZE);
+ rb_subbuf_size(buffer));
rb_update_meta_page(cpu_buffer);
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 011/713] drm/amd/display: hide Apple Studio Display secondary tile
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 010/713] ring-buffer: Fix subbuf resize race with ring buffer readers Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 012/713] drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Greg Kroah-Hartman
` (712 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Sun peng Li,
Jerry Zuo, Wayne Lin, Dan Wheeler, Alex Deucher, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Zuo <jerry.zuo@amd.com>
[ Upstream commit 49521be4809d63fe3efb6bc68ee11cb1e1ef3d63 ]
The Apple Studio Display exposes a 2x1 tiled panel over two SST DP
links. The primary tile advertises the full 5120x2880 mode (with DSC on
the bandwidth-sufficient link) while the secondary carries a per-tile
2560x2880 timing on a link without sufficient bandwidth. Report the
non-primary tile connector as disconnected during detect so compositors
only see the primary DP link and configure a single 5K mode instead of
driving both tiled streams independently.
Drive the behaviour from an EDID quirk: add a disable_second_tile panel
patch that apply_edid_quirks() sets for the affected Apple Studio
Display panel IDs (0xAE3A, 0xAE42, 0xAE46), and have detect() hide the
secondary tile when the sink carries that quirk.
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Sun peng Li <sunpeng.li@amd.com>
Signed-off-by: Jerry Zuo <jerry.zuo@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Adjust for lack of movement from amdgpu_dm.c to amdgpu_dm_connector.c
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36 +++++++++++++++++++
.../amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 ++++++
drivers/gpu/drm/amd/display/dc/dc_types.h | 1 +
3 files changed, 48 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 941c1a3128249..6604ce25255d8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7846,6 +7846,39 @@ amdgpu_dm_connector_poll(struct amdgpu_dm_connector *aconnector, bool force)
return status;
}
+/*
+ * Apple Studio Display exposes two SST DP links for a 2x1 tiled panel.
+ * The primary tile advertises the full 5120x2880 mode (with DSC on the
+ * bandwidth-sufficient link) while the secondary carries a per-tile
+ * 2560x2880 timing on a insufficient bandwidth link. Hide the secondary
+ * connector from userspace so compositors configure a single 5K stream
+ * on the primary link only.
+ */
+static bool amdgpu_dm_hide_secondary_tile_from_userspace(struct drm_connector *connector)
+{
+ struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ if (!aconnector->dc_sink)
+ return false;
+
+ if (!aconnector->dc_sink->edid_caps.panel_patch.disable_second_tile)
+ return false;
+
+ drm_edid_connector_update(connector, aconnector->drm_edid);
+
+ if (!connector->has_tile)
+ return false;
+
+ if (!connector->tile_h_loc && !connector->tile_v_loc)
+ return false;
+
+ drm_dbg_kms(connector->dev,
+ "[CONNECTOR:%d:%s] hiding secondary Apple Studio Display tile from userspace\n",
+ connector->base.id, connector->name);
+
+ return true;
+}
+
/**
* amdgpu_dm_connector_detect() - Detect whether a DRM connector is connected to a display
*
@@ -7889,6 +7922,9 @@ amdgpu_dm_connector_detect(struct drm_connector *connector, bool force)
(!aconnector->dc_sink || aconnector->dc_sink->edid_caps.analog))
return amdgpu_dm_connector_poll(aconnector, force);
+ if (amdgpu_dm_hide_secondary_tile_from_userspace(connector))
+ return connector_status_disconnected;
+
return (aconnector->dc_sink ? connector_status_connected :
connector_status_disconnected);
}
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index 6be7f6edd0b29..41aa8f9bb152b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -134,6 +134,17 @@ static void apply_edid_quirks(struct dc_link *link, struct edid *edid,
drm_dbg_driver(dev, "Skip PHY SSC reduction on panel id %X\n", panel_id);
link->wa_flags.skip_phy_ssc_reduction = true;
break;
+ /*
+ * Workaround for Apple Studio Display which exposes a 2x1 tiled panel
+ * over two SST DP links. Hide the secondary tile from userspace so
+ * compositors drive a single 5K stream on the primary link only.
+ */
+ case drm_edid_encode_panel_id('A', 'P', 'P', 0xAE3A):
+ case drm_edid_encode_panel_id('A', 'P', 'P', 0xAE42):
+ case drm_edid_encode_panel_id('A', 'P', 'P', 0xAE46):
+ drm_dbg_driver(dev, "Hiding secondary tile on panel id %X\n", panel_id);
+ edid_caps->panel_patch.disable_second_tile = true;
+ break;
default:
return;
}
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index 4ed1efa172709..6482e275e63bf 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -187,6 +187,7 @@ struct dc_panel_patch {
unsigned int skip_audio_sab_check;
unsigned int mst_start_top_delay;
unsigned int remove_sink_ext_caps;
+ bool disable_second_tile;
unsigned int disable_colorimetry;
uint8_t blankstream_before_otg_off;
bool oled_optimize_display_on;
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 012/713] drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 011/713] drm/amd/display: hide Apple Studio Display secondary tile Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 013/713] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
` (711 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Lin, Fangzhi Zuo, Dan Wheeler,
Alex Deucher, Mario Limonciello, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <jerry.zuo@amd.com>
[ Upstream commit 7a4dd08c3f921576c6a7524f60e4f0e4601835d2 ]
[why]
The Apple Studio Display primary tile advertises both the full 5120x2880
mode and the per-tile 2560x2880 timing. With the secondary tile already
hidden from userspace, the stray 2560x2880 mode on the primary connector
can still be picked by compositors, defeating the single 5K stream goal.
[how]
Prune the per-tile timing from the primary connector during get_modes:
when the sink carries the disable_second_tile quirk and the connector is
the primary tile (tile_h_loc == 0 && tile_v_loc == 0), drop any probed
mode matching the advertised tile size (tile_h_size x tile_v_size) so
userspace only sees the full 5120x2880 mode.
Fixes: 49521be4809d ("drm/amd/display: hide Apple Studio Display secondary tile")
Reviewed-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Adjust for lack of movement from amdgpu_dm.c to amdgpu_dm_connector.c
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 43 +++++++++++++++++++
1 file changed, 43 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 6604ce25255d8..9320e49e44289 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9116,6 +9116,47 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder,
}
}
+/*
+ * The Apple Studio Display primary tile advertises both the full 5120x2880
+ * mode and the per-tile 2560x2880 timing. As the secondary tile is hidden from
+ * userspace (see amdgpu_dm_hide_secondary_tile_from_userspace()), drop the
+ * per-tile timing from the primary connector so compositors only pick the full
+ * 5K mode.
+ */
+static void amdgpu_dm_prune_primary_tile_modes(struct drm_connector *connector)
+{
+ struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+ struct drm_display_mode *mode, *t;
+
+ if (!aconnector->dc_sink)
+ return;
+
+ if (!aconnector->dc_sink->edid_caps.panel_patch.disable_second_tile)
+ return;
+
+ if (!connector->has_tile)
+ return;
+
+ /* Only prune the per-tile timing from the primary tile. */
+ if (connector->tile_h_loc || connector->tile_v_loc)
+ return;
+
+ list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+ if (mode->hdisplay != connector->tile_h_size ||
+ mode->vdisplay != connector->tile_v_size)
+ continue;
+
+ drm_dbg_kms(connector->dev,
+ "[CONNECTOR:%d:%s] pruning per-tile %dx%d timing from primary Apple Studio Display tile\n",
+ connector->base.id, connector->name,
+ mode->hdisplay, mode->vdisplay);
+
+ list_del(&mode->head);
+ drm_mode_destroy(connector->dev, mode);
+ aconnector->num_modes--;
+ }
+}
+
static void amdgpu_set_panel_orientation(struct drm_connector *connector)
{
struct drm_encoder *encoder;
@@ -9158,6 +9199,8 @@ static void amdgpu_dm_connector_ddc_get_modes(struct drm_connector *connector,
amdgpu_dm_connector->num_modes =
drm_edid_connector_add_modes(connector);
+ amdgpu_dm_prune_primary_tile_modes(connector);
+
/* sorting the probed modes before calling function
* amdgpu_dm_get_native_mode() since EDID can have
* more than one preferred mode. The modes that are
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 013/713] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 012/713] drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 014/713] iomap: dont free integrity payload that doesnt exist Greg Kroah-Hartman
` (710 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 49672d026cc4773608e1222b69b29fd70f41336b upstream.
ieee_swcr_to_fpcr() converts the software IEEE trap-enable and status
bits kept in thread_info.ieee_state into the hardware FPCR format. It
contained:
fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
FPCR_DNOD (bit 47) disables denormal operand traps: with it set the
hardware handles a denormal operand itself, treating it as zero, instead
of trapping for software completion. The intent was to set DNOD when the
user has not asked for SIGFPE on denormal operands, but
IEEE_TRAP_ENABLE_DNO is clear by default, so ieee_swcr_to_fpcr(0) always
set DNOD.
Instructions built with the software completion suffix therefore never
trapped on a denormal operand. The hardware silently substituted zero
and produced wrong results, affecting every program compiled with -mieee
and default FPU settings, glibc included.
Set FPCR_DNOD only when IEEE_MAP_DMZ is requested, which is exactly the
case where flushing denormal inputs to zero is what the user asked for.
DNOD then encodes MAP_DMZ, which ieee_fpcr_to_swcr() already recovers
from FPCR_DNZ, so drop its attempt to recover IEEE_TRAP_ENABLE_DNO from
DNOD; the DNO trap enable lives solely in ieee_state.
Both functions are in a uapi header, so the encoding change is visible to
userspace, but nothing outside the kernel is known to depend on DNOD
carrying the DNO trap enable, and the kernel is the only writer of the
FPCR.
This must not be backported on its own. Re-enabling denormal operand
traps exposes a second bug, fixed in the following patch: those traps
usually find an exact result, and for an exact result the emulator did
not write the FPCR back, leaving hardware-fabricated exception bits
visible to user space. Taken alone this change would make spurious
exception flags more common.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-1-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/include/uapi/asm/fpu.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/alpha/include/uapi/asm/fpu.h
+++ b/arch/alpha/include/uapi/asm/fpu.h
@@ -101,7 +101,12 @@ ieee_swcr_to_fpcr(unsigned long sw)
| IEEE_TRAP_ENABLE_OVF)) << 48;
fp |= (~sw & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE)) << 57;
fp |= (sw & IEEE_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
- fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
+ /*
+ * Disable denormal operand traps only when denormal inputs are to be
+ * flushed to zero. Otherwise they must keep trapping, so that /S
+ * instructions reach the kernel emulation handler.
+ */
+ fp |= (sw & IEEE_MAP_DMZ ? FPCR_DNOD : 0);
return fp;
}
@@ -116,7 +121,6 @@ ieee_fpcr_to_swcr(unsigned long fp)
| IEEE_TRAP_ENABLE_OVF);
sw |= (~fp >> 57) & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE);
sw |= (fp >> 47) & IEEE_MAP_UMZ;
- sw |= (~fp >> 41) & IEEE_TRAP_ENABLE_DNO;
return sw;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 014/713] iomap: dont free integrity payload that doesnt exist
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 013/713] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 015/713] rust: time: fix as_micros_ceil() rounding near i64::MAX Greg Kroah-Hartman
` (709 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Anuj Gupta,
Kanchan Joshi, Darrick J. Wong, Christian Brauner (Amutable)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 8a8685b32c0718cc7b2cb4d6202e5a5b8e0a8e2d upstream.
fs_bio_integrity_alloc might not allocate a bio integrity payload if PI
verification is disabled on the block device. Check for that case before
calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to
avoid a NULL pointer dereferences.
Make the branch cover the PI verification as well - while
fs_bio_integrity_verify works without an integrity payload, it requires
one to actually do useful work.
Fixes: 0b10a370529c ("iomap: support T10 protection information")
Cc: stable@vger.kernel.org # v7.1
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20260804124404.737145-2-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/iomap/bio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/iomap/bio.c
+++ b/fs/iomap/bio.c
@@ -179,7 +179,7 @@ int iomap_bio_read_folio_range_sync(cons
if (srcmap->flags & IOMAP_F_INTEGRITY)
fs_bio_integrity_alloc(&bio);
error = submit_bio_wait(&bio);
- if (srcmap->flags & IOMAP_F_INTEGRITY) {
+ if (bio_integrity(&bio)) {
if (!error)
error = fs_bio_integrity_verify(&bio, sector, len);
fs_bio_integrity_free(&bio);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 015/713] rust: time: fix as_micros_ceil() rounding near i64::MAX
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 014/713] iomap: dont free integrity payload that doesnt exist Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 016/713] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
` (708 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, FUJITA Tomonori,
Andreas Hindborg, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit ec90dfcf05f02206c280bb59af660bbb3ae177d0 upstream.
The ceiling adjustment used saturating_add(NSEC_PER_USEC - 1) before
dividing. Once the nanosecond value gets within NSEC_PER_USEC - 1 of
i64::MAX the addition saturates to i64::MAX, which drops the ceiling
bias and can yield a result one microsecond too small.
Fixes: fae0cdc12340 ("rust: time: Introduce Delta type")
Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Closes: https://lore.kernel.org/rust-for-linux/CANiq72mtS0ABA2JnT5tpz6J9c_mnxY+vyPvghV_ukngWvN8F2w@mail.gmail.com/
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260807130531.1056209-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/time.rs | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -441,22 +441,25 @@ impl Delta {
/// to the value in the [`Delta`].
#[inline]
pub fn as_micros_ceil(self) -> i64 {
+ // Only positive values need to be rounded up: truncating division already
+ // rounds towards zero, i.e. up, for negative values.
+ //
+ // The usual `(nanos + d - 1) / d` is not used because the addition overflows
+ // once `nanos` exceeds `i64::MAX - (d - 1)`; saturating the addition instead
+ // would drop the rounding bias and return a result one unit too small.
let n = self.as_nanos();
- let n = if n >= 0 {
- n.saturating_add(NSEC_PER_USEC - 1)
- } else {
- n
- };
+
+ let (n, add) = if n > 0 { (n - 1, 1) } else { (n, 0) };
#[cfg(CONFIG_64BIT)]
{
- n / NSEC_PER_USEC
+ n / NSEC_PER_USEC + add
}
#[cfg(not(CONFIG_64BIT))]
// SAFETY: It is always safe to call `ktime_to_us()` with any value.
unsafe {
- bindings::ktime_to_us(n)
+ bindings::ktime_to_us(n) + add
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 016/713] alpha: dont leak hardware-fabricated FP exception bits to user space
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 015/713] rust: time: fix as_micros_ceil() rounding near i64::MAX Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 017/713] clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Greg Kroah-Hartman
` (707 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit bcfe3187412e342b4619efb92c945f073855ebc0 upstream.
On EV6 and later the hardware records exception status bits in the FPCR
before delivering a software completion trap, and those bits can be wrong
for the instruction that trapped. Converting a double that is exactly
representable as a subnormal float sets FPCR_UNF even though the result
is exact, and an underflow trap additionally sets FPCR_INE even when the
emulated operation turns out to be exact.
alpha_fp_emul() only wrote the FPCR when soft-fp raised an exception, so
whenever it determined that the instruction was exact the fabricated bits
stayed in the FPCR and were reported to user space by fetestexcept().
Pass the exception summary register down from do_entArith() so the
handler can tell which exceptions the hardware attributed to the trapping
instruction, and always write the FPCR. Clear the exceptions that the
trap reported but that soft-fp did not raise. EXC_SUM reports only the
underflow or overflow when the hardware also set INE, so treat INE as a
candidate in that case, and treat a trap with no reported exception as a
denormal operand trap, for which the hardware can fabricate INE and UNF
as well. Bits that software has already confirmed in ieee_state belong
to this or an earlier instruction and are never cleared.
The imprecise path passes no summary. There the trap was taken somewhere
in the trap shadow, so EXC_SUM is not attribution for the instruction
being re-executed -- and only EV6, which traps precisely and so never
takes that path, has fabricated bits to clear. For the same reason the
clearing is guarded by implver(), matching swcr_update_status().
On an UP1500 (EV68) this takes the glibc math testsuite from 831 failures
to 28, the remainder being unrelated to exception status.
This belongs with the preceding fix to ieee_swcr_to_fpcr(), and should
not be backported without it -- nor it without this. That fix stops
FPCR_DNOD being set unconditionally, so denormal operand traps start
firing again. Those traps very often find an exact result, which is
precisely the case where the old code left the FPCR unwritten and the
fabricated bits visible. Applied alone it would make spurious exception
flags more common, not less.
One case cannot be resolved here: an inexact instruction without the
software completion suffix never traps, so its INE reaches the FPCR
without being recorded anywhere else. Such a bit is indistinguishable
from an INE the hardware fabricated for a trapping instruction, and is
lost if an underflow or overflow trap with an exact result follows it.
The FPCR is the only record of those instructions and it carries no
attribution.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-2-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/traps.c | 6 +--
arch/alpha/math-emu/math.c | 88 +++++++++++++++++++++++++++++++++++++++------
2 files changed, 80 insertions(+), 14 deletions(-)
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -166,12 +166,12 @@ static long dummy_emul(void) { return 0;
long (*alpha_fp_emul_imprecise)(struct pt_regs *regs, unsigned long writemask)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul_imprecise);
-long (*alpha_fp_emul) (unsigned long pc)
+long (*alpha_fp_emul) (unsigned long pc, unsigned long summary)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul);
#else
long alpha_fp_emul_imprecise(struct pt_regs *regs, unsigned long writemask);
-long alpha_fp_emul (unsigned long pc);
+long alpha_fp_emul (unsigned long pc, unsigned long summary);
#endif
asmlinkage void
@@ -185,7 +185,7 @@ do_entArith(unsigned long summary, unsig
emulate the instruction. If the processor supports
precise exceptions, we don't have to search. */
if (!amask(AMASK_PRECISE_TRAP))
- si_code = alpha_fp_emul(regs->pc - 4);
+ si_code = alpha_fp_emul(regs->pc - 4, summary);
else
si_code = alpha_fp_emul_imprecise(regs, write_mask);
if (si_code == 0)
--- a/arch/alpha/math-emu/math.c
+++ b/arch/alpha/math-emu/math.c
@@ -52,13 +52,13 @@ MODULE_DESCRIPTION("FP Software completi
MODULE_LICENSE("GPL v2");
extern long (*alpha_fp_emul_imprecise)(struct pt_regs *, unsigned long);
-extern long (*alpha_fp_emul) (unsigned long pc);
+extern long (*alpha_fp_emul) (unsigned long pc, unsigned long summary);
static long (*save_emul_imprecise)(struct pt_regs *, unsigned long);
-static long (*save_emul) (unsigned long pc);
+static long (*save_emul) (unsigned long pc, unsigned long summary);
long do_alpha_fp_emul_imprecise(struct pt_regs *, unsigned long);
-long do_alpha_fp_emul(unsigned long);
+long do_alpha_fp_emul(unsigned long, unsigned long);
static int alpha_fp_emul_init_module(void)
{
@@ -86,7 +86,22 @@ module_exit(alpha_fp_emul_cleanup_module
/*
- * Emulate the floating point instruction at address PC. Returns -1 if the
+ * Exception bits of the exception summary register (EXC_SUM). Bit 0 is the
+ * software completion bit; bits 1 through 5 report the exceptions the
+ * hardware attributed to the trapping instruction, and lie at the same
+ * positions as the corresponding IEEE_TRAP_ENABLE_* bits.
+ */
+#define EXC_SUM_INV (1UL << 1)
+#define EXC_SUM_DZE (1UL << 2)
+#define EXC_SUM_OVF (1UL << 3)
+#define EXC_SUM_UNF (1UL << 4)
+#define EXC_SUM_INE (1UL << 5)
+#define EXC_SUM_MASK (EXC_SUM_INV | EXC_SUM_DZE | EXC_SUM_OVF \
+ | EXC_SUM_UNF | EXC_SUM_INE)
+
+/*
+ * Emulate the floating point instruction at address PC. SUMMARY is the
+ * exception summary register the trap was delivered with. Returns -1 if the
* instruction to be emulated is illegal (such as with the opDEC trap), else
* the SI_CODE for a SIGFPE signal, else 0 if everything's ok.
*
@@ -95,7 +110,7 @@ module_exit(alpha_fp_emul_cleanup_module
* stick the result of the operation into the appropriate register.
*/
long
-alpha_fp_emul (unsigned long pc)
+alpha_fp_emul (unsigned long pc, unsigned long summary)
{
FP_DECL_EX;
FP_DECL_S(SA); FP_DECL_S(SB); FP_DECL_S(SR);
@@ -300,12 +315,56 @@ done:
swcr |= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
current_thread_info()->ieee_state
|= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
- /* Update hardware control register. */
- fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
- fpcr |= ieee_swcr_to_fpcr(swcr);
- wrfpcr(fpcr);
+ /*
+ * EV6 records exception status bits in the FPCR before delivering the
+ * software completion trap, and swcr_update_status() above merged them
+ * into SWCR. Some can be wrong for the instruction we just emulated:
+ * a CVTTS of a value exactly representable as a subnormal sets FPCR_UNF
+ * even though the result is exact. Clear the exceptions the trap
+ * reported but that soft-fp did not raise.
+ */
+ if (implver() == IMPLVER_EV6) {
+ unsigned long spurious = summary & EXC_SUM_MASK;
+
+ if (spurious & (EXC_SUM_UNF | EXC_SUM_OVF)) {
+ /*
+ * EXC_SUM reports only the underflow or overflow,
+ * but the hardware sets INE alongside it in the FPCR.
+ */
+ spurious |= EXC_SUM_INE;
+ } else if (!spurious) {
+ /*
+ * No exception reported, so this was a denormal
+ * operand trap, for which INE and UNF can be
+ * fabricated as well.
+ */
+ spurious = EXC_SUM_INE | EXC_SUM_UNF;
+ }
+ /*
+ * Never clear an exception software has confirmed. Every
+ * instruction that genuinely raises one traps for software
+ * completion and is recorded in ieee_state above, so a bit
+ * found there -- including one just set from _fex -- belongs
+ * to this or an earlier instruction and must survive.
+ */
+ spurious &= ~(current_thread_info()->ieee_state
+ >> IEEE_STATUS_TO_EXCSUM_SHIFT);
+
+ swcr &= ~(spurious << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
+
+ /*
+ * Update hardware control register. This has to happen even when
+ * soft-fp raised nothing, to clear any fabricated bits.
+ */
+ fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
+ fpcr |= ieee_swcr_to_fpcr(swcr);
+ wrfpcr(fpcr);
+
+ if (_fex) {
/* Do we generate a signal? */
_fex = _fex & swcr & IEEE_TRAP_ENABLE_MASK;
si_code = 0;
@@ -387,9 +446,16 @@ alpha_fp_emul_imprecise (struct pt_regs
break;
}
if (!write_mask) {
- /* Re-execute insns in the trap-shadow. */
+ /*
+ * Re-execute insns in the trap-shadow. Pass no
+ * exception summary: it describes the trap, which
+ * was taken anywhere in the shadow, and so is not
+ * attribution for this instruction. Nothing is
+ * lost, since only EV6 -- which traps precisely and
+ * never comes this way -- needs it.
+ */
regs->pc = trigger_pc + 4;
- si_code = alpha_fp_emul(trigger_pc);
+ si_code = alpha_fp_emul(trigger_pc, 0);
goto egress;
}
trigger_pc -= 4;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 017/713] clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 016/713] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 018/713] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
` (706 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Daniel Lezcano
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 05520e035f8332c8e33f3011b5ca016fde61793d upstream.
When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has
successfully called request_irq, the error handling jumps directly to
out_pit_clocksource_unregister without freeing the registered IRQ.
This leaks the IRQ line and, since kfree(pit) follows, leaves a
dangling pointer registered as the interrupt handler's dev_id,
potentially leading to a use-after-free if the IRQ fires afterwards.
Fix it by calling pit_clockevent_per_cpu_exit to properly release the
IRQ before falling through to the existing cleanup chain.
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260628130700.45680-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/timer-nxp-pit.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/clocksource/timer-nxp-pit.c
+++ b/drivers/clocksource/timer-nxp-pit.c
@@ -328,8 +328,10 @@ static int pit_timer_init(struct device_
if (pit_instances == max_pit_instances) {
ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "PIT timer:starting",
pit_clockevent_starting_cpu, NULL);
- if (ret < 0)
+ if (ret < 0) {
+ pit_clockevent_per_cpu_exit(pit, pit_instances);
goto out_pit_clocksource_unregister;
+ }
}
return 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 018/713] clocksource/drivers/timer-sun4i: Advertise a real minimum delta
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 017/713] clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 019/713] fs: fix user path of nested backing files Greg Kroah-Hartman
` (705 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Indrek Kruusa, Felix Yan,
Daniel Lezcano, Jernej Skrabec
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Yan <felixonmars@archlinux.org>
commit d21808328225ab8cee46885bf9a0dffcefbe630e upstream.
sun4i_clkevt_next_event() compensates for the timer stop/start
synchronization delay by programming evt - TIMER_SYNC_TICKS into the
hardware interval register. The clockevent device currently advertises
TIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed
to call set_next_event() with evt == TIMER_SYNC_TICKS.
That programs a zero-tick interval. With oneshot/highres/nohz timer
operation this can leave the next event stuck, which was observed as a
boot hang on Allwinner D1 after the clockevents core started reusing
forced minimum-delta events.
Advertise one extra tick instead, so the smallest event accepted by the
core still programs at least one hardware tick after the synchronization
compensation.
Fixes: 12e1480bcb49 ("clocksource: sun4i: Report the minimum tick that we can program")
Reported-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Closes: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Assisted-by: Codex:gpt-5.5
Signed-off-by: Felix Yan <felixonmars@archlinux.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Tested-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Link: https://patch.msgid.link/20260624220434.4183732-1-felixonmars@archlinux.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/timer-sun4i.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clocksource/timer-sun4i.c
+++ b/drivers/clocksource/timer-sun4i.c
@@ -208,7 +208,7 @@ static int __init sun4i_timer_init(struc
sun4i_timer_clear_interrupt(timer_of_base(&to));
clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
- TIMER_SYNC_TICKS, 0xffffffff);
+ TIMER_SYNC_TICKS + 1, 0xffffffff);
/* Enable timer0 interrupt */
val = readl(timer_of_base(&to) + TIMER_IRQ_EN_REG);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 019/713] fs: fix user path of nested backing files
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 018/713] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 020/713] ovl: fix double end_creating() on the casefold-mismatch path Greg Kroah-Hartman
` (704 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baokun Li, Paul Moore,
Christian Brauner (Amutable)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
commit f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d upstream.
backing_file_open() derives the path to be stored in the new backing
file from user_file->f_path. This is incorrect when user_file itself
is a backing file, which is the case for nested stacking filesystems,
e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged
directory of another. Since commit def3ae83da02 ("fs: store real path
instead of fake path in backing file f_path") the f_path of a backing
file holds the real path of the intermediate layer, not the path that
the user opened.
Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this
for such configurations by passing file_user_path() from
ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add
backing_file LSM hooks") changed the first argument of
backing_file_open() from the user path back to the user file and
derived the path from user_file->f_path again, silently re-introducing
the problem.
As a result, files mapped through a nested overlayfs show the wrong
path in /proc/<pid>/maps and in perf/ftrace mmap records. For example,
with two nested overlayfs mounts:
mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested
echo hello > /ovl/lower/foo
mount -t overlay overlay \
-o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \
/ovl/merged
# at least two lowerdirs are needed when upperdir is nonexistent
mount -t overlay overlay \
-o lowerdir=/ovl/merged:/ovl/lower /ovl/nested
mapping /ovl/nested/foo shows a disconnected path instead of the user
path:
# readlink /proc/self/fd/3
/ovl/nested/foo
# grep foo /proc/self/maps
7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo
The bogus path is derived from the f_path of the intermediate backing
file, whose mount is a private clone that d_path() cannot resolve.
Fix this by using file_user_path(), which returns the outermost
user-visible path for backing files and falls back to
&user_file->f_path for regular files. This restores the behavior of
commit 924577e4f6ca ("ovl: Fix nested backing file paths") for
overlayfs and also fixes the same problem for the other
backing_file_open() callers, fuse passthrough and erofs ishare, when
their user file is itself a backing file.
backing_tmpfile_open() has the same pattern but is not affected: it is
only called by ovl_create_tmpfile() for the upper layer, and another
overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in
ovl_mount_dir_check(), so its user_file can never be a backing file.
Fixes: 6af36aeb147a ("lsm: add backing_file LSM hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260804034204.3487077-1-libaokun@linux.alibaba.com
Tested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/backing-file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -35,7 +35,7 @@ struct file *backing_file_open(const str
const struct path *real_path,
const struct cred *cred)
{
- const struct path *user_path = &user_file->f_path;
+ const struct path *user_path = file_user_path(user_file);
struct file *f;
int error;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 020/713] ovl: fix double end_creating() on the casefold-mismatch path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 019/713] fs: fix user path of nested backing files Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 021/713] pidfd: hold exec_update_lock around namespace ioctl Greg Kroah-Hartman
` (703 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vivek Parikh, Amir Goldstein,
Christian Brauner (Amutable)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivek Parikh <vivek.parikh@breachx.ai>
commit 077ab8985ee278c3d8618182d335b0f0cd919e16 upstream.
ovl_create_real() releases the new dentry twice when the casefold
consistency check fails. The S_IFDIR branch calls end_creating() and
sets err, then falls through to the common out: label which calls
end_creating() on the same dentry again:
case S_IFDIR:
newdentry = ovl_do_mkdir(ofs, dir, newdentry, attr->mode);
err = PTR_ERR_OR_ZERO(newdentry);
if (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) {
pr_warn_ratelimited(...);
end_creating(newdentry); /* first */
err = -EINVAL;
}
break;
...
if (err)
goto out;
...
out:
if (err) {
end_creating(newdentry); /* second, same dentry */
return ERR_PTR(err);
}
end_creating() is end_dirop(), which does inode_unlock() on the parent
and dput() on the dentry, so the parent directory's i_rwsem is unlocked
twice and the dentry is put twice. The second unlock releases a lock
that is not held, which is what wedges every later creation under that
parent, and the second dput() drops a reference that was never taken.
The branch was added by commit dfc7da402ccc ("ovl: Check for casefold
consistency when creating new dentries") as a bare dput(), which already
released the reference twice; commit fe497f0759e0 ("VFS: change
vfs_mkdir() to unlock on failure.") converted both sites to
end_creating(), adding the double unlock.
This is reachable by an unprivileged user. The casefold consistency of
the layers is validated at mount time in ovl_parse_layer(), and again on
every lookup in ovl_lookup_single(), but ofs->workdir is the internal
"work" subdirectory created inside the user-supplied workdir, and that
subdirectory is not re-checked. Marking it casefolded after the mount
therefore makes every ovl_create_temp() inherit the wrong state - and
that path reaches ovl_create_real() through ovl_start_creating_temp(),
which uses start_creating() with a generated name and so never runs the
lookup-time check.
unshare -Urm
mount -t tmpfs -o casefold=utf8-12.1.0 tmpfs mnt
mkdir -p mnt/lower/d mnt/upper mnt/work mnt/merged
mount -t overlay ovl -o lowerdir=mnt/lower,\
upperdir=mnt/upper,workdir=mnt/work mnt/merged
chattr +F mnt/work/work
mkdir mnt/merged/d/sub # directory copy-up
overlayfs: wrong inherited casefold (work/#5)
and the next copy-up blocks forever on the parent's i_rwsem:
mkdir D start_creating+0x65/0xb0
ovl_start_creating_temp+0xb0/0xe0 [overlay]
ovl_create_temp+0xa3/0x1d0 [overlay]
ovl_copy_up_one+0x1f1c/0x21c0 [overlay]
ovl_copy_up_flags+0xf5/0x140 [overlay]
ovl_create_object+0xb7/0x220 [overlay]
ovl_mkdir+0x23/0x40 [overlay]
Drop the end_creating() from the branch and let out: own the cleanup,
which is what every other error path in this function already does.
Fixes: dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries")
Cc: stable@vger.kernel.org
Signed-off-by: Vivek Parikh <vivek.parikh@breachx.ai>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 1 -
1 file changed, 1 deletion(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -188,7 +188,6 @@ struct dentry *ovl_create_real(struct ov
if (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) {
pr_warn_ratelimited("wrong inherited casefold (%pd2)\n",
newdentry);
- end_creating(newdentry);
err = -EINVAL;
}
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 021/713] pidfd: hold exec_update_lock around namespace ioctl
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 020/713] ovl: fix double end_creating() on the casefold-mismatch path Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 022/713] powerpc/pseries/iommu: switch to Default DMA window during kdump Greg Kroah-Hartman
` (702 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Linxuan,
Christian Brauner (Amutable)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Linxuan <me@black-desk.cn>
commit 9688a46802939da28f00cb40e8129615d5d4af39 upstream.
The PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem
credentials ptrace access check before handing out a namespace file
descriptor. The accompanying comment states that the code "mirrors nsfs
behavior", but, unlike the corresponding procfs paths, it does so without
holding the target task's exec_update_lock.
proc_ns_get_link() and proc_ns_readlink() both take exec_update_lock for
reading around the ptrace check and the namespace lookup, so that the
credentials used for the access decision match those of the task when its
namespace is read. Without it, a caller can pass the check against the
target's old credentials and then read the namespace after the target has
execve()'d a setuid binary and committed new credentials -- accessing
namespace information it should have been denied.
Hold exec_update_lock for reading around the ptrace check and the
namespace lookup so that pidfd truly mirrors nsfs behavior, as the comment
already claims. open_namespace() itself runs outside the lock: once a
namespace reference is obtained it carries its own refcount and is opened
with the caller's own credentials, so a concurrent execve() on the target
can no longer affect the outcome.
Fixes: 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors")
Cc: stable@vger.kernel.org
Signed-off-by: Chen Linxuan <me@black-desk.cn>
Link: https://patch.msgid.link/20260731-pidfd-exec-update-lock-v1-1-b388f2f3a8b0@black-desk.cn
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pidfs.c | 43 +++++++++++++++++++++++++++++++------------
1 file changed, 31 insertions(+), 12 deletions(-)
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -532,6 +532,7 @@ static long pidfd_ioctl(struct file *fil
struct task_struct *task __free(put_task) = NULL;
struct nsproxy *nsp __free(put_nsproxy) = NULL;
struct ns_common *ns_common = NULL;
+ int error;
if (!pidfs_ioctl_valid(cmd))
return -ENOIOCTLCMD;
@@ -555,20 +556,33 @@ static long pidfd_ioctl(struct file *fil
if (arg)
return -EINVAL;
+ /*
+ * We're trying to open a file descriptor to the namespace so perform a
+ * filesystem cred ptrace check. Hold @task's exec_update_lock for the
+ * duration of the ptrace check and the namespace lookup so that the
+ * credentials used for the access decision match those of @task at the
+ * time its namespace is read, preventing a concurrent execve() from
+ * swapping the task's credentials in between the check and the use. We
+ * mirror nsfs behavior.
+ */
+ error = down_read_killable(&task->signal->exec_update_lock);
+ if (error)
+ return error;
+
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
+ error = -EACCES;
+ goto out_unlock;
+ }
+
scoped_guard(task_lock, task) {
nsp = task->nsproxy;
if (nsp)
get_nsproxy(nsp);
}
- if (!nsp)
- return -ESRCH; /* just pretend it didn't exist */
-
- /*
- * We're trying to open a file descriptor to the namespace so perform a
- * filesystem cred ptrace check. Also, we mirror nsfs behavior.
- */
- if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
- return -EACCES;
+ if (!nsp) {
+ error = -ESRCH; /* just pretend it didn't exist */
+ goto out_unlock;
+ }
switch (cmd) {
/* Namespaces that hang of nsproxy. */
@@ -650,11 +664,16 @@ static long pidfd_ioctl(struct file *fil
#endif
break;
default:
- return -ENOIOCTLCMD;
+ error = -ENOIOCTLCMD;
}
- if (!ns_common)
- return -EOPNOTSUPP;
+ if (!error && !ns_common)
+ error = -EOPNOTSUPP;
+
+out_unlock:
+ up_read(&task->signal->exec_update_lock);
+ if (error)
+ return error;
/* open_namespace() unconditionally consumes the reference */
return open_namespace(ns_common);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 022/713] powerpc/pseries/iommu: switch to Default DMA window during kdump
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 021/713] pidfd: hold exec_update_lock around namespace ioctl Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 023/713] rust: fmt: fix {:p} printing stack addresses Greg Kroah-Hartman
` (701 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gaurav Batra, Ritesh Harjani (IBM),
Madhavan Srinivasan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Batra <gbatra@linux.ibm.com>
commit 1304643a1c20badbb91b86a5084dd76cb7620c05 upstream.
In PowerPC (pseries) a non-virtualized adapter will have 2 DMA windows -
2GB default and a larger Dynamic DMA Window (DDW). DDW is large enough to
map total RAM to a device.
During normal functioning of OS, since RAM is pre-mapped, 2GB default
window is not used. The only scenario it might get used is when buffers in
pmemory are mapped to the device for DMA.
As of today, during kdump, during early device discovery, pci_dma_find()
finds that the device has 2 DMA windows. It selects to use DDW. This is a
kdump path and DMA window is needed for IO to the device.
Although commit 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not
initialized for kdump over SR-IOV") fixed an issue during kdump with SR-IOV
case, but this also made the kdump prefer DDW over the default DMA window
when both are present (dedicated adapter case). Since the DDW is fully
mapped by the previous kernel, iommu_table_clear() can free only
KDUMP_MIN_TCE_ENTRIES (2048) TCEs for use by kdump kernel.
This is not enough when the dump device is NVMe over Fibre Channel.
Because nvme-fc driver DMA-maps the cmds and resp IUs of every
pre-allocated request and each such mapping consumes roughly:
32 (IO queues, one per cpus = nr_cpus) *
64 (queue_depth, blk-mq kdump limit) *
2 (cmd+resp) = 4096
This is already double of what we have without counting admin queues and
lpfc driver's own allocations / mapping requirement. Hence this results
into iommu_alloc failures like -
lpfc 0153:70:00.0: iommu_alloc failed,
tbl 0000000034ebcf5e vaddr 00000000d814df0b npages 1
lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed.
lpfc 0153:70:00.0: iommu_alloc failed,
tbl 0000000034ebcf5e vaddr 000000009779e4d2 npages 1
lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed.
iommu_map_phys+0x1c4/0x1f0 (unreliable)
dma_iommu_map_phys+0x54/0xa0
dma_map_phys+0x3f8/0x590
__nvme_fc_init_request+0x110/0x300 [nvme_fc]
nvme_fc_init_request+0x60/0xb8 [nvme_fc]
blk_mq_alloc_map_and_rqs+0x388/0x510
blk_mq_alloc_tag_set+0x2a4/0x5f0
nvme_alloc_io_tag_set+0xe0/0x1e0 [nvme_core]
nvme_fc_connect_ctrl_work+0x85c/0xdac [nvme_fc]
process_one_work+0x1e4/0x5a0
worker_thread+0x1ec/0x3e0
Increasing the number of free TCE entries in iommu_table_clear() will
increase the probability of hitting EEH since there could still be some
active IOs from the previous life of the kernel.
Hence this patch partially reverts the previous fixes commit and
switches the kdump's default back to 2GB default DMA window instead of
DDW window. This window will mostly be empty. Or, could be slightly used
if buffers in pmemory were mapped for IO.
Fixes: 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV")
Cc: stable@vger.kernel.org
Signed-off-by: Gaurav Batra <gbatra@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803224029.60538-1-gbatra@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -812,18 +812,11 @@ static struct device_node *pci_dma_find(
/* parse DMA window property. During normal system boot, only default
* DMA window is passed in OF. But, for kdump, a dedicated adapter might
- * have both default and DDW in FDT. In this scenario, DDW takes precedence
- * over default window.
+ * have both default and DDW in FDT. In this scenario, default window
+ * takes precedence over DDW. For a dedicated adapter, default window will
+ * potentially have more unused TCEs.
*/
- if (ddw_win) {
- struct dynamic_dma_window_prop *p;
-
- p = (struct dynamic_dma_window_prop *)ddw_prop;
- prop->liobn = p->liobn;
- prop->dma_base = p->dma_base;
- prop->tce_shift = p->tce_shift;
- prop->window_shift = p->window_shift;
- } else if (default_win) {
+ if (default_win) {
unsigned long offset, size, liobn;
of_parse_dma_window(rdn, default_prop, &liobn, &offset, &size);
@@ -832,6 +825,14 @@ static struct device_node *pci_dma_find(
prop->dma_base = cpu_to_be64(offset);
prop->tce_shift = cpu_to_be32(IOMMU_PAGE_SHIFT_4K);
prop->window_shift = cpu_to_be32(order_base_2(size));
+ } else {
+ struct dynamic_dma_window_prop *p;
+
+ p = (struct dynamic_dma_window_prop *)ddw_prop;
+ prop->liobn = p->liobn;
+ prop->dma_base = p->dma_base;
+ prop->tce_shift = p->tce_shift;
+ prop->window_shift = p->window_shift;
}
return rdn;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 023/713] rust: fmt: fix {:p} printing stack addresses
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 022/713] powerpc/pseries/iommu: switch to Default DMA window during kdump Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 024/713] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
` (700 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ke Sun, Alice Ryhl, Gary Guo,
Link Mauve, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ke Sun <sunke@kylinos.cn>
commit fb7d645176189d2b068d69861e230fa5aceb4922 upstream.
The `impl_fmt_adapter_forward!` macro forwards `Pointer` for
`Adapter<T>` by destructuring `self` into a local `t`, causing `{:p}`
to print the address of that temporary stack variable rather than the
actual pointer.
Remove `Pointer` from the macro and provide a manual impl for
`Adapter<&T>` that passes `self.0` directly.
Signed-off-by: Ke Sun <sunke@kylinos.cn>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Tested-by: Link Mauve <linkmauve@linkmauve.fr>
Cc: stable@vger.kernel.org
Fixes: c5cf01ba8dfe ("rust: support formatting of foreign types")
Link: https://patch.msgid.link/20260810-hashedptr-v15-1-eafd27d36476@kylinos.cn
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/fmt.rs | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/rust/kernel/fmt.rs
+++ b/rust/kernel/fmt.rs
@@ -43,7 +43,14 @@ use core::fmt::{
UpperExp,
UpperHex, //
};
-impl_fmt_adapter_forward!(Debug, LowerHex, UpperHex, Octal, Binary, Pointer, LowerExp, UpperExp);
+impl_fmt_adapter_forward!(Debug, LowerHex, UpperHex, Octal, Binary, LowerExp, UpperExp);
+
+impl<T: ?Sized + Pointer> Pointer for Adapter<&T> {
+ #[inline]
+ fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+ Pointer::fmt(self.0, f)
+ }
+}
/// A copy of [`core::fmt::Display`] that allows us to implement it for foreign types.
///
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 024/713] timers/itimer: Zero-init old itimerval before copy to userspace
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 023/713] rust: fmt: fix {:p} printing stack addresses Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 025/713] objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Greg Kroah-Hartman
` (699 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Thomas Gleixner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 upstream.
On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Codex:gpt-5
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260809190428.1523014-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/itimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/itimer.c
+++ b/kernel/time/itimer.c
@@ -100,7 +100,7 @@ static int do_getitimer(int which, struc
static int put_itimerval(struct __kernel_old_itimerval __user *o,
const struct itimerspec64 *i)
{
- struct __kernel_old_itimerval v;
+ struct __kernel_old_itimerval v = {};
v.it_interval.tv_sec = i->it_interval.tv_sec;
v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 025/713] objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 024/713] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 026/713] rust: kbuild: disambiguate `zerocopy` for `rusttest` Greg Kroah-Hartman
` (698 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf, Peter Zijlstra,
Alice Ryhl, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 16861ca3508e0deac70d3bcacb6dcf435b49d9ef upstream.
Starting with Rust 1.99.0 (expected 2026-10-01), `objtool` may report:
rust/kernel.o: warning: objtool: _R..._6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix()
falls through to next function _R..._6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated()
due to calls to the `noreturn` symbol:
core::num::from_ascii_bytes_radix_panic
The function was renamed from `from_ascii_radix_panic` [1], which is
already in the list.
Thus add the new one to the list so that `objtool` knows it is actually
`noreturn`.
See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
for more details.
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://github.com/rust-lang/rust/pull/159554 [1]
Tested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260728191448.349241-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -194,6 +194,7 @@ static bool is_rust_noreturn(const struc
*/
return str_ends_with(func->name, "_4core3num20from_str_radix_panic") ||
str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
+ str_ends_with(func->name, "_4core3num28from_ascii_bytes_radix_panic") ||
str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
str_ends_with(func->name, "_4core6option13expect_failed") ||
str_ends_with(func->name, "_4core6option13unwrap_failed") ||
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 026/713] rust: kbuild: disambiguate `zerocopy` for `rusttest`
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 025/713] objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 027/713] rust: bug: skip arch-specific asm in `testlib` builds Greg Kroah-Hartman
` (697 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Antoni Boucher, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoni Boucher <bouanto@zoho.com>
commit fe39a233ea52601d416a1d02e7f70049aae47016 upstream.
Starting with Rust 1.76.0, `zerocopy` was added as an (indirect)
compiler dependency [1]. In turn, this meant that the `rustc-dev`
component started including a precompiled `zerocopy` crate in the sysroot.
This makes `rusttest` fail because the compiler finds several candidates:
error[E0464]: multiple candidates for `rmeta` dependency `zerocopy` found
--> rust/kernel/prelude.rs:64:9
|
64 | pub use zerocopy::{
| ^^^^^^^^
|
= note: candidate #1: .../lib/rustlib/x86_64-unknown-linux-gnu/lib/libzerocopy-dfef4cb07ca752aa.rmeta
= note: candidate #2: ./rust/test/libzerocopy.rlib
We cannot use `--sysroot=/dev/null` for these, thus point to the dependency
explicitly.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Antoni Boucher <bouanto@zoho.com>
Cc: stable@vger.kernel.org
Fixes: 567621523ab7 ("rust: zerocopy: enable support in kbuild")
Link: https://github.com/rust-lang/rust/pull/118546 [1]
Link: https://patch.msgid.link/20260729173803.13459-1-ojeda@kernel.org
[ Investigated when it started happening, reworded to add that and to
follow our usual style and sent on behalf of Antoni, who found this
during his work to support Rust for Linux with the GCC backend, i.e.
with `rustc_codegen_gcc`. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rust/Makefile b/rust/Makefile
index 627ed79dc6f5..fbe0accc51a3 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -350,7 +350,7 @@ rusttestlib-pin_init: $(src)/pin-init/src/lib.rs rusttestlib-macros \
rusttestlib-kernel: private rustc_target_flags = --extern ffi \
--extern build_error --extern macros --extern pin_init \
--extern bindings --extern uapi \
- --extern zerocopy --extern zerocopy_derive
+ --extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib --extern zerocopy_derive
rusttestlib-kernel: $(src)/kernel/lib.rs rusttestlib-bindings rusttestlib-uapi \
rusttestlib-build_error rusttestlib-pin_init $(obj)/$(libmacros_name) \
$(obj)/bindings.o rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 027/713] rust: bug: skip arch-specific asm in `testlib` builds
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 026/713] rust: kbuild: disambiguate `zerocopy` for `rusttest` Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 028/713] rust: bug: fix warn_on macro build error on UML Greg Kroah-Hartman
` (696 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, FUJITA Tomonori
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit 5d9668f3930609ead91f39b059ef4fe53db04942 upstream.
Running `make rusttest` with `ARCH=` set to an architecture other than
the host's fails, e.g. `ARCH=arm64` on an x86_64 host:
error: invalid instruction mnemonic 'brk'
--> rust/kernel/bug.rs:63:17
|
63 | / concat!(
64 | | "/* {size} */",
65 | | include!(concat!(env!("OBJTREE"), "/rust/kernel/generated_arch_warn_asm.rs")),
66 | | include!(concat!(env!("OBJTREE"), "/rust/kernel/generated_arch_reachable_asm.rs")));
| |_______________________________________________________________________________________________________^
|
note: instantiated into assembly here
--> <inline asm>:1:115
|
1 | /* 8 */.pushsection __bug_table,"aw"; .align 2; 14470: .long 14471f - .;.short 2305;.align 2; .popsection; 14471:brk 0x800
| ^^^
The reason is that `rusttest` builds the `kernel` crate as a host
library: it passes the `CONFIG_*` cfgs of the configured architecture,
but not `--target`, so code generation happens for the
host. `warn_flags!` then selects the arch-specific inline asm arm
based on `CONFIG_*`, and the host assembler rejects it.
This does not happen with the current `master` because `warn_on!` has
no user inside the `kernel` crate itself yet, but it will as soon as
one is added.
Reported-by: Miguel Ojeda <ojeda@kernel.org>
Closes: https://lore.kernel.org/all/CANiq72n4=fz=JNKY0Jdm8BnLa=RmHB2B7s0bO47YTJ7hygqBZg@mail.gmail.com/
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Cc: stable@vger.kernel.org
Fixes: dff64b072708 ("rust: Add warn_on macro")
Link: https://patch.msgid.link/20260808022608.1125174-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bug.rs | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/rust/kernel/bug.rs
+++ b/rust/kernel/bug.rs
@@ -8,6 +8,7 @@
#[macro_export]
#[doc(hidden)]
+#[cfg(not(testlib))]
#[cfg(all(CONFIG_BUG, not(CONFIG_UML), not(CONFIG_LOONGARCH), not(CONFIG_ARM)))]
#[cfg(CONFIG_DEBUG_BUGVERBOSE)]
macro_rules! warn_flags {
@@ -47,6 +48,7 @@ macro_rules! warn_flags {
#[macro_export]
#[doc(hidden)]
+#[cfg(not(testlib))]
#[cfg(all(CONFIG_BUG, not(CONFIG_UML), not(CONFIG_LOONGARCH), not(CONFIG_ARM)))]
#[cfg(not(CONFIG_DEBUG_BUGVERBOSE))]
macro_rules! warn_flags {
@@ -73,6 +75,7 @@ macro_rules! warn_flags {
#[macro_export]
#[doc(hidden)]
+#[cfg(not(testlib))]
#[cfg(all(CONFIG_BUG, CONFIG_UML))]
macro_rules! warn_flags {
($file:expr, $flags:expr) => {
@@ -91,6 +94,7 @@ macro_rules! warn_flags {
#[macro_export]
#[doc(hidden)]
+#[cfg(not(testlib))]
#[cfg(all(CONFIG_BUG, any(CONFIG_LOONGARCH, CONFIG_ARM)))]
macro_rules! warn_flags {
($file:expr, $flags:expr) => {
@@ -101,7 +105,7 @@ macro_rules! warn_flags {
#[macro_export]
#[doc(hidden)]
-#[cfg(not(CONFIG_BUG))]
+#[cfg(any(testlib, not(CONFIG_BUG)))]
macro_rules! warn_flags {
($file:expr, $flags:expr) => {};
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 028/713] rust: bug: fix warn_on macro build error on UML
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 027/713] rust: bug: skip arch-specific asm in `testlib` builds Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 029/713] rust: bug: prevent dead_code warning from warn_on!s flags constant Greg Kroah-Hartman
` (695 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, FUJITA Tomonori, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit 30a449e04a32033d8e4844fdb4938a0ebccfa37b upstream.
Callers that go through `kernel::prelude` have `CStrExt` in scope, but
code inside the `kernel` crate imports explicitly and may not. Using
`warn_on!` from such a module fails to build on UML, which is the only
configuration where `warn_flags!` needs a C string pointer rather than an
inline asm bug entry:
error[E0599]: no method named `as_char_ptr` found for reference `&ffi::CStr` in the current scope
--> linux/rust/kernel/bug.rs:83:49
|
83 | $crate::c_str!(::core::file!()).as_char_ptr(),
| ^^^^^^^^^^^
|
::: linux/rust/kernel/time.rs:427:9
|
427 | warn_on!(self.nanos < 0);
| ------------------------ in this macro invocation
|
= help: items from traits can only be used if the trait is in scope
= note: this error originates in the macro `$crate::warn_flags` which comes from the expansion of the macro `warn_on` (in Nightly builds, run with -Z mac)
help: trait `CStrExt` which provides `as_char_ptr` is implemented but not in scope; perhaps you want to import it
--> linux/rust/kernel/time.rs:27:1
|
27 + use crate::str::CStrExt;
Call the method through its fully qualified path, which resolves
without any import at the expansion site.
Cc: stable@vger.kernel.org
Fixes: dff64b072708 ("rust: Add warn_on macro")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20260807112427.1039056-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bug.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/kernel/bug.rs
+++ b/rust/kernel/bug.rs
@@ -83,7 +83,7 @@ macro_rules! warn_flags {
// with a valid null-terminated string.
unsafe {
$crate::bindings::warn_slowpath_fmt(
- $crate::c_str!(::core::file!()).as_char_ptr(),
+ $crate::str::CStrExt::as_char_ptr($crate::c_str!(::core::file!())),
line!() as $crate::ffi::c_int,
$flags as $crate::ffi::c_uint,
::core::ptr::null(),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 029/713] rust: bug: prevent dead_code warning from warn_on!s flags constant
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 028/713] rust: bug: fix warn_on macro build error on UML Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 030/713] rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Greg Kroah-Hartman
` (694 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, FUJITA Tomonori, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
commit e66cfc29e0d06fec34c06bb40d4d281f595677b1 upstream.
Fix the following dead_code warning on some configurations in an
atomic development branch:
warning: constant `WARN_ON_FLAGS` is never used
--> linux/rust/kernel/bug.rs:126:19
|
126 | const WARN_ON_FLAGS: u32 = $crate::bug::bugflag_taint($crate::bindings::TAINT_WARN);
| ^^^^^^^^^^^^^
|
::: linux/rust/kernel/sync/srcu.rs:106:12
|
106 | if crate::warn_on!(
| ____________-
107 | | // SAFETY: By the type invariants, `self` contains a valid and pinned `struct srcu_struct`
108 | | // and `srcu_readers_active()` only checks the active reader count.
109 | | unsafe { bindings::srcu_readers_active(ptr) }
110 | | ) {
| |_________- in this macro invocation
|
= note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default
= note: this warning originates in the macro `crate::warn_on` (in Nightly builds, run with -Z macro-backtrace for more info)
The warn_on! macro always defines a WARN_ON_FLAGS constant and hands it
to warn_flags!. On configurations where warn_flags! does not reference
its flags argument (the LOONGARCH/ARM variant, which only calls
WARN_ON(), and the !CONFIG_BUG no-op variant), the constant is left
unused and triggers a dead_code warning.
warn_flags! is the macro that accepts (and here discards) the flags
argument, so make it responsible for the argument it drops.
Also rename `_COND_STR` to `COND_STR` and consume `$file` for consistency.
Fixes: dff64b072708 ("rust: Add warn_on macro")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260801024841.786664-1-tomo@flapping.org
[ Added newlines. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/bug.rs | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
--- a/rust/kernel/bug.rs
+++ b/rust/kernel/bug.rs
@@ -55,6 +55,10 @@ macro_rules! warn_flags {
($file:expr, $flags:expr) => {
const FLAGS: u32 = $crate::bindings::BUGFLAG_WARNING | $flags;
+ if false {
+ _ = $file;
+ }
+
// SAFETY:
// - `flags` and `size` are all compile-time constants, preventing
// any invalid memory access.
@@ -79,6 +83,10 @@ macro_rules! warn_flags {
#[cfg(all(CONFIG_BUG, CONFIG_UML))]
macro_rules! warn_flags {
($file:expr, $flags:expr) => {
+ if false {
+ _ = $file;
+ }
+
// SAFETY: It is always safe to call `warn_slowpath_fmt()`
// with a valid null-terminated string.
unsafe {
@@ -98,6 +106,11 @@ macro_rules! warn_flags {
#[cfg(all(CONFIG_BUG, any(CONFIG_LOONGARCH, CONFIG_ARM)))]
macro_rules! warn_flags {
($file:expr, $flags:expr) => {
+ if false {
+ _ = $file;
+ _ = $flags;
+ }
+
// SAFETY: It is always safe to call `WARN_ON()`.
unsafe { $crate::bindings::WARN_ON(true) }
};
@@ -107,7 +120,12 @@ macro_rules! warn_flags {
#[doc(hidden)]
#[cfg(any(testlib, not(CONFIG_BUG)))]
macro_rules! warn_flags {
- ($file:expr, $flags:expr) => {};
+ ($file:expr, $flags:expr) => {
+ if false {
+ _ = $file;
+ _ = $flags;
+ }
+ };
}
#[doc(hidden)]
@@ -122,14 +140,14 @@ macro_rules! warn_on {
let cond = $cond;
#[cfg(CONFIG_DEBUG_BUGVERBOSE_DETAILED)]
- const _COND_STR: &str = concat!("[", stringify!($cond), "] ", file!());
+ const COND_STR: &str = concat!("[", stringify!($cond), "] ", file!());
#[cfg(not(CONFIG_DEBUG_BUGVERBOSE_DETAILED))]
- const _COND_STR: &str = file!();
+ const COND_STR: &str = file!();
if cond {
const WARN_ON_FLAGS: u32 = $crate::bug::bugflag_taint($crate::bindings::TAINT_WARN);
- $crate::warn_flags!(_COND_STR, WARN_ON_FLAGS);
+ $crate::warn_flags!(COND_STR, WARN_ON_FLAGS);
}
cond
}};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 030/713] rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 029/713] rust: bug: prevent dead_code warning from warn_on!s flags constant Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 031/713] rust: dma: return zero for Coherent reads past EOF Greg Kroah-Hartman
` (693 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Burak Emir, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit dc01dfb37b34beeefcfe1c3055364d41a4070c7e upstream.
Starting with LLVM 22, `clang_getTypeDeclaration()` may return a forward
declaration instead of the type definition. This made `bindgen` generate
opaque types [1][2], which in turn made us fail with e.g.
error[E0609]: no field `__bindgen_anon_1` on type `bindings::kernel_param`
--> rust/kernel/module_param.rs:78:46
|
78 | let container = unsafe { &*((*param).__bindgen_anon_1.arg.cast::<SetOnce<T>>()) };
| ^^^^^^^^^^^^^^^^ unknown field
|
= note: available field is: `_address`
This was fixed in `bindgen` 0.72.1 [3].
In order to clarify what is going on and avoid confusion [4][5], add
a warning to `rust_is_available.sh` about it when the versions match,
similar to past warnings like the one removed in:
commit ae64324ad5c1 ("rust: rust_is_available: remove warning for `bindgen` < 0.69.5 && libclang >= 19.1")
In addition, even if the versions match, check if the issue appears to
not reproduce with the given binaries, to avoid a warning in such a case.
Finally, include tests.
[ Nathan, in parallel, updated the instructions of the LLVM+Rust
kernel.org toolchains [6] so that `--version` is not passed to
`cargo` for `bindgen`, and thus the latest `bindgen` is installed
by default, which should help to avoid some of these situations.
Thanks!
- Miguel ]
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Link: https://github.com/rust-lang/rust-bindgen/issues/3264 [1]
Link: https://github.com/Rust-for-Linux/linux/issues/353 [2] # "Missing fields in nested class with LLVM 22."
Link: https://github.com/rust-lang/rust-bindgen/pull/3278 [3]
Reported-by: Burak Emir <burak.emir@gmail.com>
Link: https://github.com/Rust-for-Linux/linux/issues/1247 [4]
Link: https://lore.kernel.org/rust-for-linux/CABwQupNfMAJOGqRM9ke6tj4f53dCCsBDKU7Vp+zf8mwk7bqt8Q@mail.gmail.com/ [5]
Link: https://mirrors.edge.kernel.org/pub/tools/llvm/rust/ [6]
Tested-by: Burak Emir <burak.emir@gmail.com>
Link: https://patch.msgid.link/20260719120514.159914-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/rust_is_available.sh | 14 +++++++++++
scripts/rust_is_available_bindgen_libclang_22.h | 5 ++++
scripts/rust_is_available_test.py | 30 +++++++++++++++++++++++-
3 files changed, 48 insertions(+), 1 deletion(-)
create mode 100644 scripts/rust_is_available_bindgen_libclang_22.h
--- a/scripts/rust_is_available.sh
+++ b/scripts/rust_is_available.sh
@@ -208,6 +208,20 @@ if [ "$bindgen_libclang_cversion" -lt "$
exit 1
fi
+if [ "$bindgen_libclang_cversion" -ge 2200000 ] &&
+ [ "$rust_bindings_generator_cversion" -lt 7201 ]; then
+ # Distributions may have patched the issue.
+ if ! "$BINDGEN" $(dirname $0)/rust_is_available_bindgen_libclang_22.h | grep -q 'pub foo'; then
+ echo >&2 "***"
+ echo >&2 "*** Rust bindings generator '$BINDGEN' < 0.72.1 together with libclang >= 22"
+ echo >&2 "*** may not work due to a bug (https://github.com/rust-lang/rust-bindgen/pull/3278)."
+ echo >&2 "*** Your bindgen version: $rust_bindings_generator_version"
+ echo >&2 "*** Your libclang version: $bindgen_libclang_version"
+ echo >&2 "***"
+ warning=1
+ fi
+fi
+
# If the C compiler is Clang, then we can also check whether its version
# matches the `libclang` version used by the Rust bindings generator.
#
--- /dev/null
+++ b/scripts/rust_is_available_bindgen_libclang_22.h
@@ -0,0 +1,5 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+struct S;
+struct S {
+ int foo;
+};
--- a/scripts/rust_is_available_test.py
+++ b/scripts/rust_is_available_test.py
@@ -54,16 +54,23 @@ else:
""")
@classmethod
- def generate_bindgen(cls, version_stdout, libclang_stderr):
+ def generate_bindgen(cls, version_stdout, libclang_stderr, libclang_22_patched=False):
if libclang_stderr is None:
libclang_case = f"raise SystemExit({cls.bindgen_default_bindgen_libclang_failure_exit_code})"
else:
libclang_case = f"print({repr(libclang_stderr)}, file=sys.stderr)"
+ if libclang_22_patched:
+ libclang_22_case = "print('pub foo: ::std::os::raw::c_int,')"
+ else:
+ libclang_22_case = "pass"
+
return cls.generate_executable(f"""#!/usr/bin/env python3
import sys
if "rust_is_available_bindgen_libclang.h" in " ".join(sys.argv):
{libclang_case}
+elif "rust_is_available_bindgen_libclang_22.h" in " ".join(sys.argv):
+ {libclang_22_case}
else:
print({repr(version_stdout)})
""")
@@ -248,6 +255,27 @@ else:
result = self.run_script(self.Expected.FAILURE, { "BINDGEN": bindgen })
self.assertIn(f"libclang (used by the Rust bindings generator '{bindgen}') is too old.", result.stderr)
+ def test_bindgen_bad_libclang_22(self):
+ for (bindgen_version, libclang_version, expected_not_patched) in (
+ ("0.71.1", "21.1.0", self.Expected.SUCCESS),
+ ("0.71.1", "22.0.0", self.Expected.SUCCESS_WITH_WARNINGS),
+ ("0.71.1", "22.1.0", self.Expected.SUCCESS_WITH_WARNINGS),
+
+ ("0.72.0", "22.0.0", self.Expected.SUCCESS_WITH_WARNINGS),
+
+ ("0.72.1", "22.0.0", self.Expected.SUCCESS),
+ ):
+ with self.subTest(bindgen_version=bindgen_version, libclang_version=libclang_version):
+ cc = self.generate_clang(f"clang version {libclang_version}")
+ libclang_stderr = f"scripts/rust_is_available_bindgen_libclang.h:2:9: warning: clang version {libclang_version} [-W#pragma-messages], err: false"
+ bindgen = self.generate_bindgen(f"bindgen {bindgen_version}", libclang_stderr)
+ result = self.run_script(expected_not_patched, { "BINDGEN": bindgen, "CC": cc })
+ if expected_not_patched == self.Expected.SUCCESS_WITH_WARNINGS:
+ self.assertIn(f"Rust bindings generator '{bindgen}' < 0.72.1 together with libclang >= 22", result.stderr)
+
+ bindgen = self.generate_bindgen(f"bindgen {bindgen_version}", libclang_stderr, libclang_22_patched=True)
+ result = self.run_script(self.Expected.SUCCESS, { "BINDGEN": bindgen, "CC": cc })
+
def test_clang_matches_bindgen_libclang_different_bindgen(self):
bindgen = self.generate_bindgen_libclang("scripts/rust_is_available_bindgen_libclang.h:2:9: warning: clang version 999.0.0 [-W#pragma-messages], err: false")
result = self.run_script(self.Expected.SUCCESS_WITH_WARNINGS, { "BINDGEN": bindgen })
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 031/713] rust: dma: return zero for Coherent reads past EOF
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 030/713] rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Greg Kroah-Hartman
@ 2026-09-04 4:49 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 032/713] rust: devres: fix race between concurrent revokers Greg Kroah-Hartman
` (692 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Younes Akhouayri, Alexandre Courbot,
Onur Özkan, Danilo Krummrich
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Younes Akhouayri <git@younes.io>
commit 5391b147d9fd8d4736e28c629cda00fd37c2304a upstream.
Coherent<T>::write_to_slice() calculates a zero-byte copy when the file
offset is beyond the allocation, but still calls
UserSliceWriter::write_dma(). The latter rejects offsets beyond the
allocation even when the copy length is zero, so a debugfs read past EOF
returns -ERANGE.
Return before calling write_dma() when the offset is at or beyond the
allocation, matching simple_read_from_buffer() EOF semantics.
Fixes: 016818513936 ("rust: dma: implement BinaryWriter for Coherent<[u8]>")
Cc: stable@vger.kernel.org
Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291566-Library/topic/.E2.9C.94.20Possible.20past-EOF.20bug.20in.20Coherent.3CT.3E.3A.3Awrite_to_slice/near/611677095
Signed-off-by: Younes Akhouayri <git@younes.io>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Onur Özkan <work@onurozkan.dev>
Link: https://patch.msgid.link/20260730-fix-dma-coherent-eof-v2-1-8aff21054afa@younes.io
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/dma.rs | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -1005,7 +1005,11 @@ impl<T: KnownSize + AsBytes + ?Sized> de
return Ok(0);
};
- let count = self.size().saturating_sub(offset_val).min(writer.len());
+ if offset_val >= self.size() {
+ return Ok(0);
+ }
+
+ let count = (self.size() - offset_val).min(writer.len());
writer.write_dma(self, offset_val, count)?;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 032/713] rust: devres: fix race between concurrent revokers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-09-04 4:49 ` [PATCH 7.2 031/713] rust: dma: return zero for Coherent reads past EOF Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 033/713] rust: devres: ensure revocation is complete before device finishes unbinding Greg Kroah-Hartman
` (691 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Gary Guo, Alice Ryhl,
Danilo Krummrich
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
commit acc516dfa1972d31836b50abc0115216cd0fccc5 upstream.
There is a potential race condition when two paths try to revoke a
Devres concurrently.
The driver core's devres_release_all() calls Revocable::revoke() via the
release callback, while Devres::drop() calls revoke_nosync() on another
CPU.
The revoker that does not claim the is_available swap returns
immediately, but the revoker that did may still be executing
drop_in_place() on the inner data. This can cause a use-after-free when
the other revoker's caller proceeds to drop adjacent resources that
drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with
SGTable freeing the backing sg_table and pages).
Fix this by adding a Completion. The release callback signals the
Completion after revoke() finishes, and Devres::drop() waits for it when
it loses the is_available swap. This ensures the wrapped object is fully
torn down before Devres::drop() returns.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260612202841.2577C1F000E9@smtp.kernel.org/
Fixes: 05aa6fb1c21d ("rust: scatterlist: Add abstraction for sg_table")
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260628174451.2275679-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/devres.rs | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/rust/kernel/devres.rs
+++ b/rust/kernel/devres.rs
@@ -21,7 +21,8 @@ use crate::{
sync::{
aref::ARef,
rcu,
- Arc, //
+ Arc,
+ Completion, //
},
types::{
ForeignOwnable,
@@ -37,6 +38,8 @@ struct Inner<T> {
node: Opaque<bindings::devres_node>,
#[pin]
data: Revocable<T>,
+ #[pin]
+ revocation: Completion,
}
/// This abstraction is meant to be used by subsystems to containerize [`Device`] bound resources to
@@ -53,6 +56,10 @@ struct Inner<T> {
/// After the [`Devres`] has been unbound it is not possible to access the encapsulated resource
/// anymore.
///
+/// When a [`Devres`] is dropped, it is guaranteed that `T` has been fully dropped by the time
+/// [`Devres::drop`] returns, even if a concurrent revocation through the release callback is in
+/// progress.
+///
/// [`Devres`] users should make sure to simply free the corresponding backing resource in `T`'s
/// [`Drop`] implementation.
///
@@ -218,6 +225,7 @@ impl<T: Send + 'static> Devres<T> {
};
}),
data <- Revocable::new(data),
+ revocation <- Completion::new(),
}),
GFP_KERNEL,
)?;
@@ -255,7 +263,9 @@ impl<T: Send + 'static> Devres<T> {
// SAFETY: `inner` is a valid `Inner<T>` pointer.
let inner = unsafe { &*inner };
- inner.data.revoke();
+ if inner.data.revoke() {
+ inner.revocation.complete_all();
+ }
}
#[allow(clippy::missing_safety_doc)]
@@ -362,6 +372,10 @@ impl<T: Send + 'static> Drop for Devres<
// this additional reference count.
drop(unsafe { Arc::from_raw(Arc::as_ptr(&self.inner)) });
}
+ } else {
+ // The release callback is concurrently revoking; wait for it to finish
+ // `drop_in_place()` of the wrapped object before returning.
+ self.inner.revocation.wait_for_completion();
}
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 033/713] rust: devres: ensure revocation is complete before device finishes unbinding
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 032/713] rust: devres: fix race between concurrent revokers Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 034/713] rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` Greg Kroah-Hartman
` (690 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gary Guo, Alice Ryhl,
Danilo Krummrich
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
commit a10639966fd72fff8f7fbf3c8e733307daabd38f upstream.
Now that the revocation Completion is in place, also address the
symmetric case. When Devres::drop() wins the is_available swap and the
devres callback loses, the callback returns to devres_release_all()
without waiting. This means device unbinding can complete while
Devres::drop() is still executing drop_in_place() on another CPU, which
is a problem if T's destructor accesses device state.
Make the synchronization bidirectional. Whichever side performs
drop_in_place() signals the Completion, and the other side waits.
This does not reintroduce the nested Devres deadlock fixed by commit
ba268514ea14 ("rust: devres: fix race condition due to nesting"),
because that deadlock was caused by drop waiting for the release
callback to return (the old 'devm' Completion). Here, both sides only
wait for drop_in_place() to finish, which completes within the current
call chain. The Arc<Inner<T>> keeps the Inner allocation alive
independently.
Cc: stable@vger.kernel.org
Fixes: ba268514ea14 ("rust: devres: fix race condition due to nesting")
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260628200304.2365598-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/devres.rs | 7 +++++++
1 file changed, 7 insertions(+)
--- a/rust/kernel/devres.rs
+++ b/rust/kernel/devres.rs
@@ -265,6 +265,11 @@ impl<T: Send + 'static> Devres<T> {
if inner.data.revoke() {
inner.revocation.complete_all();
+ } else {
+ // Devres::drop() is concurrently revoking; wait for it to finish `drop_in_place()`
+ // before returning to `devres_release_all()`, ensuring `T` is fully torn down before
+ // the device finishes unbinding.
+ inner.revocation.wait_for_completion();
}
}
@@ -365,6 +370,8 @@ impl<T: Send + 'static> Drop for Devres<
// SAFETY: When `drop` runs, it is guaranteed that nobody is accessing the revocable data
// anymore, hence it is safe not to wait for the grace period to finish.
if unsafe { self.data().revoke_nosync() } {
+ self.inner.revocation.complete_all();
+
// We revoked `self.data` before devres did, hence try to remove it.
if self.remove_node() {
// SAFETY: In `Self::new` we have taken an additional reference count of `self.data`
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 034/713] rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 033/713] rust: devres: ensure revocation is complete before device finishes unbinding Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 035/713] rust: kernel: list: fix incorrect pop_back example comment Greg Kroah-Hartman
` (689 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Antoni Boucher, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 1b0bab4a873f1034c27573cfc613394cff7e0a5b upstream.
The `rustc-dev` components for Rust 1.82.0 through 1.87.0 include a
precompiled `zerocopy_derive` procedural macro in the sysroot. This
range includes Rust 1.85.0, our minimum supported version.
This makes `rusttest` fail because the compiler finds both the sysroot
copy and the copy built in `rust/test`:
error[E0464]: multiple candidates for `dylib` dependency `zerocopy_derive` found
--> rust/kernel/prelude.rs:70:9
|
70 | pub use zerocopy_derive::{
| ^^^^^^^^^^^^^^^
|
= note: candidate #1: .../lib/rustlib/x86_64-unknown-linux-gnu/lib/libzerocopy_derive-54d2b38896fa6bc5.so
= note: candidate #2: .../rust/test/libzerocopy_derive.so
Commit fe39a233ea52 ("rust: kbuild: disambiguate `zerocopy` for
`rusttest`") fixed the equivalent ambiguity for `zerocopy`.
Thus point to the dependency explicitly in this case too.
Cc: Antoni Boucher <bouanto@zoho.com>
Cc: stable@vger.kernel.org
Fixes: 506054980429 ("rust: zerocopy-derive: enable support in kbuild")
Link: https://patch.msgid.link/20260823193529.156066-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/Makefile | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/rust/Makefile b/rust/Makefile
index 3afaad4a4a3a..9211d82ac96d 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -350,7 +350,8 @@ rusttestlib-pin_init: $(src)/pin-init/src/lib.rs rusttestlib-macros \
rusttestlib-kernel: private rustc_target_flags = --extern ffi \
--extern build_error --extern macros --extern pin_init \
--extern bindings --extern uapi \
- --extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib --extern zerocopy_derive
+ --extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib \
+ --extern zerocopy_derive=$(objtree)/$(obj)/test/$(libzerocopy_derive_name)
rusttestlib-kernel: $(src)/kernel/lib.rs rusttestlib-bindings rusttestlib-uapi \
rusttestlib-build_error rusttestlib-pin_init $(obj)/$(libmacros_name) \
$(obj)/bindings.o rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 035/713] rust: kernel: list: fix incorrect pop_back example comment
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 034/713] rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 036/713] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
` (688 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nikolai Grlica, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolai Grlica <nikolai@nikolaigrlica.dev>
commit a5c7d35e2fd3e24c411816c91f8f6cc78e652e0c upstream.
The example uses pop_back(), but the accompanying comment says
pop_front(). Update the comment to match the example.
Signed-off-by: Nikolai Grlica <nikolai@nikolaigrlica.dev>
Cc: stable@vger.kernel.org
Fixes: bf87a41b85d6 ("rust: list: Add an example for `ListLinksSelfPtr` usage")
Link: https://patch.msgid.link/20260810150322.61809-1-nikolai@nikolaigrlica.dev
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/list.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/kernel/list.rs
+++ b/rust/kernel/list.rs
@@ -249,7 +249,7 @@ pub use self::arc_field::{
/// assert_eq!(list.iter().count(), 3);
/// }
///
-/// // Pop the items from the list using `pop_front()` and verify the content.
+/// // Pop the items from the list using `pop_back()` and verify the content.
/// {
/// assert_eq!(list.pop_back().ok_or(EINVAL)?.value.foo(), ("a", 15));
/// assert_eq!(list.pop_back().ok_or(EINVAL)?.value.foo(), ("a", 32));
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 036/713] objtool/rust: add one more `noreturn` Rust function
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 035/713] rust: kernel: list: fix incorrect pop_back example comment Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 037/713] rust: num: restrict bool conversion to unsigned Bounded Greg Kroah-Hartman
` (687 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf, Peter Zijlstra,
Alice Ryhl, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 993f235c4af49d0e912cc28abe6d733531600237 upstream.
When the pointer formatting series [1] is applied and KUnit tests
are enabled, `objtool` would report an error with any of our
supported Rust versions. For instance, with Rust 1.97.1:
rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_()
falls through to next function _R..._4core7convert5AsRefNtB5_4BStrE6as_ref()
Or, with Rust 1.85.0:
rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_()
falls through to next function _R..._4core3ffi5c_str4CStrENtNtBS_3fmt7Display3fmtB7_()
This happens due to calls to the `noreturn` symbol:
core::str::slice_error_fail
Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.
See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
for more details.
[ While the series [1] mentioned above was not applied in a way
that triggered this, Gary found another case [2]:
I am seeing this function causing issue on my 1.85.1 -Os build, although the
error message is different this time:
rust/kernel.o: warning: objtool: _R..._5range9RangeFromjEE5indexCsldbe0TGTmNx_6kernel+0x1d:
stack state mismatch: cfa1=4+8 cfa2=4+16
Disassembly shows that the function call before the warning location
is a call to _4core3str16slice_error_fail, and objtool thought it can
return (which will end up with a unbalanced stack if it does return).
Thus apply it. - Miguel ]
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Reported-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/rust-for-linux/anLxXvCKBcAVf91_@google.com/
Link: https://lore.kernel.org/rust-for-linux/20260706-hashedptr-v13-0-377a07f2f78d@kylinos.cn/ [1]
Link: https://lore.kernel.org/rust-for-linux/DKS7U9UHY6XR.2JC0EBIPCI06Z@garyguo.net/ [2]
Link: https://patch.msgid.link/20260805144524.233362-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -195,6 +195,7 @@ static bool is_rust_noreturn(const struc
return str_ends_with(func->name, "_4core3num20from_str_radix_panic") ||
str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
str_ends_with(func->name, "_4core3num28from_ascii_bytes_radix_panic") ||
+ str_ends_with(func->name, "_4core3str16slice_error_fail") ||
str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
str_ends_with(func->name, "_4core6option13expect_failed") ||
str_ends_with(func->name, "_4core6option13unwrap_failed") ||
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 037/713] rust: num: restrict bool conversion to unsigned Bounded
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 036/713] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 038/713] rust: cfi: disable function merging if CFI is enabled Greg Kroah-Hartman
` (686 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Courbot, Younes Akhouayri,
Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Younes Akhouayri <git@younes.io>
commit 7dd6343fc127935425a81a8f1989907996c2868d upstream.
From<bool> turns true into 1. A signed Bounded with N = 1 can hold
only -1 and 0. The current implementation can therefore create a value
that breaks Bounded's invariant. Deref relies on that invariant and
calls unreachable_unchecked() when it is broken, so safe Rust can reach
undefined behavior.
The other primitive conversions require the source and destination to
have the same signedness. Treat bool as an unsigned one-bit value and
allow conversions between bool and Bounded only when the backing integer
type is unsigned.
Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
Closes: https://lore.kernel.org/rust-for-linux/OzuVxu0--J-9@younes.io/
Cc: stable@vger.kernel.org
Suggested-by: Alexandre Courbot <acourbot@nvidia.com>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Younes Akhouayri <git@younes.io>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260822-fix-rust-bounded-from-bool-submit-v4-1-aa780bfe7f30@younes.io
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/num/bounded.rs | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
--- a/rust/kernel/num/bounded.rs
+++ b/rust/kernel/num/bounded.rs
@@ -13,7 +13,10 @@ use core::{
};
use kernel::{
- num::Integer,
+ num::{
+ Integer,
+ Unsigned, //
+ },
prelude::*, //
};
@@ -174,13 +177,16 @@ fn fits_within<T: Integer>(value: T, num
/// // `u8` (regardless of the passed value).
/// // let _ = Bounded::<u32, 6>::from(10u8);
///
-/// // Booleans can be converted into single-bit `Bounded`s.
+/// // Booleans can be converted into unsigned `Bounded`s.
///
/// let v = Bounded::<u64, 1>::from(false);
/// assert_eq!(v.get(), 0);
///
/// let v = Bounded::<u64, 1>::from(true);
/// assert_eq!(v.get(), 1);
+///
+/// // This does not build because `i8` is signed.
+/// // let _ = Bounded::<i8, 2>::from(true);
/// ```
///
/// Infallible conversions from a [`Bounded`] to a primitive integer are also supported, and
@@ -203,12 +209,16 @@ fn fits_within<T: Integer>(value: T, num
/// let _v = Bounded::<u32, 10>::new::<10>();
/// // assert_eq!(u8::from(_v), 10);
///
-/// // Single-bit `Bounded`s can be converted into a boolean.
+/// // Unsigned single-bit `Bounded`s can be converted into a boolean.
/// let v = Bounded::<u8, 1>::new::<1>();
/// assert_eq!(bool::from(v), true);
///
/// let v = Bounded::<u8, 1>::new::<0>();
/// assert_eq!(bool::from(v), false);
+///
+/// // This does not build because `i8` is signed.
+/// // let v = Bounded::<i8, 1>::new::<-1>();
+/// // let _ = bool::from(v);
/// ```
///
/// Fallible conversions from any primitive integer to any [`Bounded`] are also supported using the
@@ -1077,31 +1087,33 @@ impl_into_primitive!(
i8 i16 i32 i64 isize
);
-// Single-bit `Bounded`s can be converted from/to a boolean.
+// Unsigned single-bit `Bounded`s can be converted to a boolean.
impl<T> From<Bounded<T, 1>> for bool
where
- T: Integer + Zeroable,
+ T: Integer<Signedness = Unsigned> + Zeroable,
{
fn from(value: Bounded<T, 1>) -> Self {
value.get() != Zeroable::zeroed()
}
}
+// Booleans can be converted to unsigned `Bounded`s.
+
impl<T, const N: u32> From<bool> for Bounded<T, N>
where
- T: Integer + From<bool>,
+ T: Integer<Signedness = Unsigned> + From<bool>,
{
fn from(value: bool) -> Self {
- // SAFETY: A boolean can be represented using a single bit, and thus fits within any
- // integer type for any `N` > 0.
+ // SAFETY: A boolean is represented by `0` or `1`, so it fits within any valid unsigned
+ // `Bounded` width.
unsafe { Self::__new(T::from(value)) }
}
}
impl<T> Bounded<T, 1>
where
- T: Integer + Zeroable,
+ T: Integer<Signedness = Unsigned> + Zeroable,
{
/// Converts this [`Bounded`] into a [`bool`].
///
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 038/713] rust: cfi: disable function merging if CFI is enabled
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 037/713] rust: num: restrict bool conversion to unsigned Bounded Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 039/713] kbuild: rust: preserve unreachable traps with inline helpers Greg Kroah-Hartman
` (685 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Gary Guo,
Sami Tolvanen, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Guo <gary@garyguo.net>
commit 29b03d1de967a177176d12811d970cac7882afcf upstream.
In Rust doc tests, there is a dummy `__module_firmware_test_init` function
generated by the example in `module_firmware!`'s documentation, which
just returns zero. Many other documentation examples generate functions
that produce zero. LKP test robot reports [1] a `Flags::zeroed` instance;
my local reproduction has a `Bounded::new::<0>`.
LLVM's MergeFunctionsPass incorrectly merges functions with different
KCFI types, causing `__module_firmware_test_init` to be merged into
one of the zero-returning functions. As module init is invoked via an
indirect function call, KCFI is checked and this produces a KCFI failure.
I've reported this bug to upstream LLVM [2]; in the meantime, disable
function merging if CFI is enabled. No separate treatment is needed for
CONFIG_RUST_INLINE_HELPERS, as Clang does not enable function merging
by default.
[ LLVM already has a pending PR:
https://github.com/llvm/llvm-project/pull/217665
which solves the issue. In addition, I asked upstream Rust if the
unstable `-Zmerge-functions=disabled` flag will remain around:
https://rust-lang.zulipchat.com/#narrow/channel/425075-rust-for-linux/topic/.60-Zmerge-functions.3Ddisabled.60/
and it does indeed look like that will be the case. - Miguel ]
Reported-by: kernel test robot <yi1.lai@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202608201017.100a4511-lkp@intel.com [1]
Link: https://github.com/llvm/llvm-project/issues/217629 [2]
Signed-off-by: Gary Guo <gary@garyguo.net>
Cc: stable@vger.kernel.org
Fixes: ca627e636551 ("rust: cfi: add support for CFI_CLANG with Rust")
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://patch.msgid.link/20260820135733.37121-1-gary@kernel.org
[ Fixed typos as discussed. Reworded slightly for other typos. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Makefile | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/Makefile
+++ b/Makefile
@@ -1118,7 +1118,8 @@ endif
ifdef CONFIG_RUST
# Always pass -Zsanitizer-cfi-normalize-integers as CONFIG_RUST selects
# CONFIG_CFI_ICALL_NORMALIZE_INTEGERS.
- RUSTC_FLAGS_CFI := -Zsanitizer=kcfi -Zsanitizer-cfi-normalize-integers
+ # Disable function merging as LLVM incorrectly merges functions with different KCFI types.
+ RUSTC_FLAGS_CFI := -Zsanitizer=kcfi -Zsanitizer-cfi-normalize-integers -Zmerge-functions=disabled
KBUILD_RUSTFLAGS += $(RUSTC_FLAGS_CFI)
export RUSTC_FLAGS_CFI
endif
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 039/713] kbuild: rust: preserve unreachable traps with inline helpers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 038/713] rust: cfi: disable function merging if CFI is enabled Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 040/713] kbuild: rust: keep Rust objects out of Clang LTO " Greg Kroah-Hartman
` (684 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gary Guo, Boqun Feng, Alice Ryhl,
Matthew Maurer, Josh Poimboeuf, Peter Zijlstra, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 0bff7711c19ba05ff3b686554c5a2d503c3e9797 upstream.
When `CONFIG_RUST_INLINE_HELPERS` is enabled, it is possible to hit
`objtool` warnings like:
vmlinux.o: warning: objtool: _R..._4cmdq12CommandToGsp4init()
falls through to next function _R..._4core5array4iter8IntoIterRShKj3_EEEBa_()
`rustc` normally emits traps for unreachable paths. However, under
`CONFIG_RUST_INLINE_HELPERS=y`, `rustc` emits LLVM bitcode and Clang
performs final code generation after the helper bitcode is linked,
but Clang does not trap unreachable IR by default.
In turn, this means `objtool` follows compiler-generated impossible Rust
`enum` paths through alignment padding into the next function, resulting
in fallthrough warnings.
Thus pass the LLVM `trap-unreachable` option to the final Clang invocation
and suppress traps immediately after `noreturn` calls, which `objtool`
already recognizes as dead ends. The combination of both flags makes it
match `rustc`'s behavior.
Rust 1.85.0 (the minimum supported one) supports LLVM >= 18, and both
flags are available in LLVM 18.
Assisted-by: LLM
Cc: Gary Guo <gary@garyguo.net>
Cc: Boqun Feng <boqun@kernel.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Matthew Maurer <mmaurer@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Fixes: 3a2486cc1da5 ("kbuild: rust: provide an option to inline C helpers into Rust")
Acked-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260816133233.197500-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Makefile | 10 ++++++++++
rust/Makefile | 3 ++-
scripts/Makefile.build | 3 ++-
3 files changed, 14 insertions(+), 2 deletions(-)
--- a/Makefile
+++ b/Makefile
@@ -1083,6 +1083,16 @@ endif
export CC_FLAGS_SCS
endif
+ifdef CONFIG_RUST_INLINE_HELPERS
+# `rustc` normally emits traps for unreachable paths during code generation.
+# With inline helpers, Clang performs code generation from the linked bitcode
+# instead, so request the same behavior explicitly. Otherwise `objtool` may
+# follow an impossible Rust path into the next function.
+CC_FLAGS_RUST_INLINE_HELPERS := -mllvm -trap-unreachable \
+ -mllvm -no-trap-after-noreturn
+export CC_FLAGS_RUST_INLINE_HELPERS
+endif
+
ifdef CONFIG_LTO_CLANG
ifdef CONFIG_LTO_CLANG_FULL
CC_FLAGS_LTO := -flto
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -645,7 +645,8 @@ quiet_cmd_rustc_library = $(if $(skip_cl
-Zunstable-options \
$(if $(link_helper),;$(LLVM_LINK) --internalize --suppress-warnings $(patsubst %.o,%.bc,$@) \
$(obj)/helpers/helpers$(if $(part-of-module),_module).bc -o $(patsubst %.o,%.m.bc,$@); \
- $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
+ $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) \
+ $(CC_FLAGS_RUST_INLINE_HELPERS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
$(cmd_ld_single)) \
$(if $(rustc_objcopy),;$(OBJCOPY) $(rustc_objcopy) $@) \
$(cmd_objtool)
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -346,7 +346,8 @@ quiet_cmd_rustc_o_rs = $(RUSTC_OR_CLIPPY
cmd_rustc_o_rs = $(rust_common_cmd) --emit=$(if $(CONFIG_RUST_INLINE_HELPERS),llvm-bc=$(patsubst %.o,%.bc,$@),obj=$@) $< \
$(if $(CONFIG_RUST_INLINE_HELPERS),;$(LLVM_LINK) --internalize --suppress-warnings $(patsubst %.o,%.bc,$@) \
$(objtree)/rust/helpers/helpers$(if $(part-of-module),_module).bc -o $(patsubst %.o,%.m.bc,$@); \
- $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
+ $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) \
+ $(CC_FLAGS_RUST_INLINE_HELPERS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
$(cmd_ld_single)) \
$(cmd_objtool)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 040/713] kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 039/713] kbuild: rust: preserve unreachable traps with inline helpers Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 041/713] KEYS: trusted: Fix TPM teardown ordering Greg Kroah-Hartman
` (683 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gary Guo, Boqun Feng, Alice Ryhl,
Matthew Maurer, Josh Poimboeuf, Peter Zijlstra, Miguel Ojeda
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit 5febf432df1cfa5b25d99b54c32103fafbdd0eb9 upstream.
Under `CONFIG_LTO_CLANG` + `CONFIG_RUST_INLINE_HELPERS`, one may hit
`objtool` errors such as:
vmlinux.o: error: objtool: _R..._3Gsp4boot+0xd6a:
can't find jump dest instruction at .text._R..._3Gsp4boot+0x1dfd
The reason is that in such builds, the Clang invocation that compiles
the combined Rust plus helpers bitcode emits LLVM bitcode (again) --
the final code generation happens in the linker's LTO step, which the
`-mllvm` trap options passed to Clang do not reach.
This, in turn, means that unreachable traps are missing, and the
impossible paths do not merely fallthrough to the next symbol, but past
the end of their own section, since LTO builds place each function in
its own section.
Thus filter `CC_FLAGS_LTO` out of the Clang invocation, so that it always
emits machine code directly, with the traps in place.
Assisted-by: LLM
Cc: Gary Guo <gary@garyguo.net>
Cc: Boqun Feng <boqun@kernel.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Matthew Maurer <mmaurer@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Fixes: 3a2486cc1da5 ("kbuild: rust: provide an option to inline C helpers into Rust")
Acked-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260816133233.197500-2-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/Makefile | 2 +-
scripts/Makefile.build | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -645,7 +645,7 @@ quiet_cmd_rustc_library = $(if $(skip_cl
-Zunstable-options \
$(if $(link_helper),;$(LLVM_LINK) --internalize --suppress-warnings $(patsubst %.o,%.bc,$@) \
$(obj)/helpers/helpers$(if $(part-of-module),_module).bc -o $(patsubst %.o,%.m.bc,$@); \
- $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) \
+ $(CC) $(CLANG_FLAGS) $(filter-out $(CC_FLAGS_LTO),$(KBUILD_CFLAGS)) \
$(CC_FLAGS_RUST_INLINE_HELPERS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
$(cmd_ld_single)) \
$(if $(rustc_objcopy),;$(OBJCOPY) $(rustc_objcopy) $@) \
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -346,7 +346,7 @@ quiet_cmd_rustc_o_rs = $(RUSTC_OR_CLIPPY
cmd_rustc_o_rs = $(rust_common_cmd) --emit=$(if $(CONFIG_RUST_INLINE_HELPERS),llvm-bc=$(patsubst %.o,%.bc,$@),obj=$@) $< \
$(if $(CONFIG_RUST_INLINE_HELPERS),;$(LLVM_LINK) --internalize --suppress-warnings $(patsubst %.o,%.bc,$@) \
$(objtree)/rust/helpers/helpers$(if $(part-of-module),_module).bc -o $(patsubst %.o,%.m.bc,$@); \
- $(CC) $(CLANG_FLAGS) $(KBUILD_CFLAGS) \
+ $(CC) $(CLANG_FLAGS) $(filter-out $(CC_FLAGS_LTO),$(KBUILD_CFLAGS)) \
$(CC_FLAGS_RUST_INLINE_HELPERS) -Wno-override-module -c $(patsubst %.o,%.m.bc,$@) -o $@ \
$(cmd_ld_single)) \
$(cmd_objtool)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 041/713] KEYS: trusted: Fix TPM teardown ordering
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 040/713] kbuild: rust: keep Rust objects out of Clang LTO " Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 042/713] apparmor: fix cred UAF caused by begin_current_label_crit_section() Greg Kroah-Hartman
` (682 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Jarkko Sakkinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit 5e2d672280d97d83de43031d93761b12dadd7b8a upstream.
trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
holds key_types_sem for reading until the key operation finishes, while
unregister_key_type() takes it for writing. It therefore provides the
synchronization point that must precede backend teardown.
The current order permits this interleaving:
CPU 0 CPU 1
trusted_tpm_exit() key_type_lookup("trusted")
put_device(&chip->dev) trusted_tpm_seal()
kfree(digests) pcrlock()
unregister_key_type() tpm_pcr_extend(..., digests)
CPU 1 can consequently dereference the freed digest array. The chip can
also be released before callbacks stop using it.
KASAN reported:
BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200
Read of size 2 at addr ffff88810872d000 by task poc/89
Call Trace:
tpm_pcr_extend+0x1f0/0x200
pcrlock+0x42/0x70 [trusted]
trusted_tpm_seal+0x1b6/0x570 [trusted]
trusted_instantiate+0x293/0x340 [trusted]
__key_instantiate_and_link+0xb2/0x2b0
__key_create_or_update+0x61e/0xb50
__do_sys_add_key+0x1b8/0x310
Allocated by task 88:
__kmalloc_noprof+0x1a7/0x490
do_one_initcall+0xa1/0x390
do_init_module+0x2df/0x840
Freed by task 90:
kfree+0x131/0x3c0
trusted_tpm_exit+0x59/0xa0 [trusted]
__do_sys_delete_module+0x346/0x510
Move unregister_key_type() before releasing either resource. This stops
new lookups and waits for in-flight key operations to finish before the
backend state is destroyed.
Fixes: 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://lore.kernel.org/r/20260731140925.2973492-1-nicoyip.dev@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/keys/trusted-keys/trusted_tpm1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -987,9 +987,9 @@ err_put:
static void trusted_tpm_exit(void)
{
if (chip) {
+ unregister_key_type(&key_type_trusted);
put_device(&chip->dev);
kfree(digests);
- unregister_key_type(&key_type_trusted);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 042/713] apparmor: fix cred UAF caused by begin_current_label_crit_section()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 041/713] KEYS: trusted: Fix TPM teardown ordering Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 043/713] apparmor: fix out-of-bounds write when null terminating a label vec Greg Kroah-Hartman
` (681 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jann Horn, John Johansen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit 3f4ae5fab613dca01d6a2a8210dd832e009fcf47 upstream.
AppArmor's begin_current_label_crit_section() is a scary function called
from lots of LSM hooks (in particular VFS/socket-related ones) that checks
if the label referenced by the current creds is marked FLAG_STALE, and if
so, attempts to use aa_replace_current_label() to replace the creds with an
updated version that uses a new label.
The first problem with this is that it would directly lead to UAF of
`struct cred` if anything in the kernel takes a pointer to the current
creds and accesses these past a security hook invocation that replaces
creds, like so:
```
const struct cred *cred = current_cred();
alloc_file_pseudo(...);
uid_t uid = cred->euid;
```
I don't know if anything in the kernel actually does this, but I think it
is very surprising that this pattern could lead to UAF.
The second problem is that things go wrong when aa_replace_current_label()
runs with overridden credentials. aa_replace_current_label() bails out if
`current_cred() != current_real_cred()` (mirroring the check in
proc_pid_attr_write()), but this check can't actually reliably detect
overridden credentials because the overridden creds can be the same as the
objective creds.
So in approximately the following scenario, things go wrong:
1. task begins with <creds A> (as both objective and subjective creds),
with refcount=2
2. task grabs an extra reference on <creds A> for overriding
3. task calls override_creds(<creds A>), which returns a pointer to the old
subjective creds (<creds A>)
4. task enters AppArmor LSM hook
5. AppArmor checks that objective/subjective creds are equal
6. AppArmor replaces both cred pointers with <creds B> and drops 2 refs on
<creds A>
7. task leaves AppArmor LSM hook
8. task calls revert_creds(<creds A>)
9. now task->cred is <creds A> while task->real_cred is <creds B>, but the
task_struct logically holds two references to <creds B>
10. another task drops the extra reference on <creds A> that was used for
overriding, refcount drops to 0
11. now task->real_cred points to freed creds
At this point, any access to current_cred() will be UAF.
I have a test case where I run aa-disable on a profile while a process
using that profile is blocked on splice() from a FUSE passthrough file into
a full pipe; after the profile update, the pipe becomes empty, splice()
resumes, the credentials go out of sync, and a subsequent getuid() syscall
results in a KASAN UAF splat.
To fix this, instead of directly replacing creds, do it via task_work that
will run at the end of the current syscall. (The point in time at which the
cred replacement happens should have no correctness impact; it is just a
performance optimization to avoid unnecessarily touching the refcount of
the new label.)
Note that AppArmor still performs direct cred replacements in the
sb_pivotroot LSM hook after this change, and that direct cred replacements
can still happen in VFS ->write() callbacks via proc_pid_attr_write().
There are two options for what to do with aa_dup_task_ctx(): Either
explicitly reset new->label_replacement_pending after the entire
aa_task_ctx has been copied, or switch to manually copying members over.
I am switching to manually copying members over because that should make
bugs more obvious.
Cc: stable@vger.kernel.org
Fixes: c75afcd153f6 ("AppArmor: contexts used in attaching policy to system objects")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/cred.h | 6 +-----
security/apparmor/include/task.h | 15 +++++++++++----
security/apparmor/task.c | 27 +++++++++++++++++++++++++++
3 files changed, 39 insertions(+), 9 deletions(-)
--- a/security/apparmor/include/cred.h
+++ b/security/apparmor/include/cred.h
@@ -222,13 +222,9 @@ static inline struct aa_label *begin_cur
{
struct aa_label *label = aa_current_raw_label();
- might_sleep();
-
if (label_is_stale(label)) {
label = aa_get_newest_label(label);
- if (aa_replace_current_label(label) == 0)
- /* task cred will keep the reference */
- aa_put_label(label);
+ aa_schedule_stale_label_replacement();
}
return label;
--- a/security/apparmor/include/task.h
+++ b/security/apparmor/include/task.h
@@ -21,15 +21,22 @@ static inline struct aa_task_ctx *task_c
* @onexec: profile to transition to on next exec (MAY BE NULL)
* @previous: profile the task may return to (MAY BE NULL)
* @token: magic value the task must know for returning to @previous_profile
+ * @label_replacement_tw: for aa_schedule_stale_label_replacement()
+ * @label_replacement_pending: is @label_replacement_tw pending?
+ *
+ * When changing this, check if aa_dup_task_ctx() needs to be updated.
*/
struct aa_task_ctx {
struct aa_label *nnp;
struct aa_label *onexec;
struct aa_label *previous;
u64 token;
+ struct callback_head label_replacement_tw;
+ bool label_replacement_pending;
};
int aa_replace_current_label(struct aa_label *label);
+void aa_schedule_stale_label_replacement(void);
void aa_set_current_onexec(struct aa_label *label, bool stack);
int aa_set_current_hat(struct aa_label *label, u64 token);
int aa_restore_previous_label(u64 cookie);
@@ -56,10 +63,10 @@ static inline void aa_free_task_ctx(stru
static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
const struct aa_task_ctx *old)
{
- *new = *old;
- aa_get_label(new->nnp);
- aa_get_label(new->previous);
- aa_get_label(new->onexec);
+ new->nnp = aa_get_label(old->nnp);
+ new->onexec = aa_get_label(old->onexec);
+ new->previous = aa_get_label(old->previous);
+ new->token = old->token;
}
/**
--- a/security/apparmor/task.c
+++ b/security/apparmor/task.c
@@ -14,6 +14,7 @@
#include <linux/gfp.h>
#include <linux/ptrace.h>
+#include <linux/task_work.h>
#include "include/path.h"
#include "include/audit.h"
@@ -89,6 +90,32 @@ int aa_replace_current_label(struct aa_l
return 0;
}
+static void aa_replace_stale_label_tw_func(struct callback_head *tw)
+{
+ struct aa_task_ctx *ctx = task_ctx(current);
+ struct aa_label *label;
+
+ ctx->label_replacement_pending = false;
+ label = aa_current_raw_label();
+ if (!label_is_stale(label))
+ return;
+ label = aa_get_newest_label(label);
+ aa_replace_current_label(label);
+ aa_put_label(label);
+}
+
+/* replace the current task's stale label on syscall return */
+void aa_schedule_stale_label_replacement(void)
+{
+ struct aa_task_ctx *ctx = task_ctx(current);
+
+ if (ctx->label_replacement_pending)
+ return;
+ init_task_work(&ctx->label_replacement_tw, aa_replace_stale_label_tw_func);
+ if (task_work_add(current, &ctx->label_replacement_tw, TWA_RESUME) == 0)
+ ctx->label_replacement_pending = true;
+}
+
/**
* aa_set_current_onexec - set the tasks change_profile to happen onexec
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 043/713] apparmor: fix out-of-bounds write when null terminating a label vec
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 042/713] apparmor: fix cred UAF caused by begin_current_label_crit_section() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 044/713] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
` (680 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, John Johansen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 9f1e40193eef7f047e6b77cfb4b4cafdecd7a123 upstream.
aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE
is passed. If the components are all distinct no duplicates are dropped,
dups is 0 and the terminator goes to vec[n], so the caller has to provide
room for n + 1 entries.
aa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len,
gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but
vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES
it uses the local array of LOCAL_VEC_ENTRIES pointers, above that it
allocates exactly len pointers. The terminator therefore lands one entry
past the end of the local array when len is LOCAL_VEC_ENTRIES, and one
entry past the end of the allocation when len is larger.
len comes from the number of "//&" separated components in the label name
and label_count_strn_entries() does not bound it. An unprivileged task
reaches the parse by writing to /proc/self/attr/apparmor/current or through
lsm_set_self_attr(2), both of which go through do_setattr(), and the name
is parsed before the change_profile permission is checked.
The query_label() path behind the securityfs .access file, which is
mode 0666, performs no permission check at all. Every component has to
resolve to a loaded profile, so a system with policy loaded is required.
The other two VEC_FLAG_TERMINATE users work on a label vec that
aa_label_alloc() has already sized with "+ 1 for null terminator entry on
vec". Reserve the same entry in vec_setup() and DEFINE_VEC(). Passing
len + 1 from the caller instead would move len == LOCAL_VEC_ENTRIES out of
the local array and into kzalloc().
Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/label.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -23,7 +23,7 @@ struct aa_ruleset;
#define LOCAL_VEC_ENTRIES 8
#define DEFINE_VEC(T, V) \
- struct aa_ ## T *(_ ## V ## _localtmp)[LOCAL_VEC_ENTRIES]; \
+ struct aa_ ## T *(_ ## V ## _localtmp)[LOCAL_VEC_ENTRIES + 1]; \
struct aa_ ## T **(V)
#define vec_setup(T, V, N, GFP) \
@@ -31,10 +31,10 @@ struct aa_ruleset;
if ((N) <= LOCAL_VEC_ENTRIES) { \
typeof(N) i; \
(V) = (_ ## V ## _localtmp); \
- for (i = 0; i < (N); i++) \
+ for (i = 0; i <= (N); i++) \
(V)[i] = NULL; \
} else \
- (V) = kzalloc(sizeof(struct aa_ ## T *) * (N), (GFP)); \
+ (V) = kzalloc_objs(struct aa_ ## T *, (N) + 1, (GFP)); \
(V) ? 0 : -ENOMEM; \
})
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 044/713] include/linux/list.h: mark list_add and __list_add as __always_inline
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 043/713] apparmor: fix out-of-bounds write when null terminating a label vec Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 045/713] mm, swap: dont free a hibernation slot that is in the swap cache Greg Kroah-Hartman
` (679 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan R Abrahams-Whitehead,
Nathan Chancellor, Eric Dumazet, Nick Desaulniers,
Giuliano Procida, Yabin Cui, Bill Wendling, Justin Stitt,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan R Abrahams-Whitehead <ajordanr@google.com>
commit 2780860eddecba9ffe210bb9436eee3cf22bfcdd upstream.
This commit resolves an issue where modpost section verification fails due
to section mismatches between list_add and its callers.
At present, list_add (and its internal __list_add) are called from both
.text and .init code sections. Since inlining can vary per call site,
list_add can be 4 different states:
list_add in text with arguments to non-.init.data values
list_add in init with arguments to static .init.data values
list_add in init with arguments to non-.init.data values
list_add in text with arguments to static .init.data values
It is last instance that ends up causing the section mismatch caused by
constant propagation of the address of static libs inside the `dir_add` as
seen below (with the dir_list being defined statically in initramfs.c,
resting in .init.data).
WARNING: modpost: vmlinux.o: section mismatch in reference: __list_add
(section: .text.unlikely.) -> dir_list (section: .init.data)
Because of these section matching requirements, semantically, __list_add
and list_add MUST be inlined. This will then ensure callers inside .init
will receive a list_add that exists and refers to only .init data, and
list_add code in .text sections will only refer to non-init data.
This issue manifests predominently in AutoFDO with clang, which is very
hesitant to inline cold functions such as list_add even when marked
`inline`. Marking them as `__always_inline` therefore matches the
existing semantic constraints imposed by modpost's section mismatch
checks.
Link: https://lore.kernel.org/20260731-always-inline-list-add-v1-1-d29f54ce5477@google.com
Link: https://lore.kernel.org/all/CANn89iJVQe=wedLheJmjZjOTJsWHijT0jZs=iRxKssJZbjAxHw@mail.gmail.com/
Signed-off-by: Jordan R Abrahams-Whitehead <ajordanr@google.com>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reported-by: Giuliano Procida <gprocida@google.com>
Reported-by: Yabin Cui <yabinc@google.com>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2173
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/list.h | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -150,10 +150,13 @@ static inline bool __list_del_entry_vali
*
* This is only for internal list manipulation where we know
* the prev/next entries already!
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void __list_add(struct list_head *new,
- struct list_head *prev,
- struct list_head *next)
+static __always_inline void __list_add(struct list_head *new,
+ struct list_head *prev,
+ struct list_head *next)
{
if (!__list_add_valid(new, prev, next))
return;
@@ -171,8 +174,12 @@ static inline void __list_add(struct lis
*
* Insert a new entry after the specified head.
* This is good for implementing stacks.
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void list_add(struct list_head *new, struct list_head *head)
+static __always_inline void list_add(struct list_head *new,
+ struct list_head *head)
{
__list_add(new, head, head->next);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 045/713] mm, swap: dont free a hibernation slot that is in the swap cache
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 044/713] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 046/713] mm, swap: ratelimit bad swap entry reports Greg Kroah-Hartman
` (678 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Youngjun Park, Kairui Song,
Baoquan He, Barry Song, Chris Li, Kemeng Shi, Nhat Pham,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youngjun Park <youngjun.park@lge.com>
commit 10d9012e83efedde8718ceaa5053f836e0c8596c upstream.
A slot with a folio in the swap cache is freed when the folio leaves the
cache, not when its count drops. swap_put_entries_cluster() follows that
rule. swap_free_hibernation_slot() does not, it calls
__swap_cluster_free_entries() whether or not a folio sits on the slot.
Cluster readahead can put one there. It walks a raw page_cluster sized
window of offsets around the faulting entry, and a hibernation slot passes
__swap_cache_add_check() because it is not a folio and its count is not
zero. Freeing the slot then clears the entry under that folio.
The folio is now unreachable from the swap table, and the offset goes back
to the allocator. The folio is still on the LRU though, so reclaim can
pick it up later. It then takes the old offset out of folio->swap and
overwrites the table entry there, which by then may belong to someone
else.
This bug can trigger silent memory corruption, process crashes, or data
instability across completely unrelated userspace applications - typically
occurring when uswsusp is preparing the hibernation image.
I found this while working on giving hibernation slots their own marker in
the swap table, which I had discussed with Kairui.
(https://lore.kernel.org/linux-mm/abp7aDgYLrxF3Me8@KASONG-MC4/) As far as
I know there are no reports, so there is no Reported-by/Closes to add.
Check for a cached folio before freeing. The slot is then left in the
ordinary state where only the swap cache holds it, and it is freed when
the folio leaves the cache, either through the reclaim below or through
normal reclaim later.
Link: https://lore.kernel.org/20260811132209.2862708-2-youngjun.park@lge.com
Fixes: 0d6af9bcf383 ("mm, swap: use the swap table to track the swap count")
Signed-off-by: Youngjun Park <youngjun.park@lge.com>
Acked-by: Kairui Song <kasong@tencent.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/swapfile.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2196,7 +2196,14 @@ void swap_free_hibernation_slot(swp_entr
ci = swap_cluster_lock(si, offset);
__swap_cluster_put_entry(ci, offset % SWAPFILE_CLUSTER);
- __swap_cluster_free_entries(si, ci, offset % SWAPFILE_CLUSTER, 1);
+ /*
+ * A slot with a folio in the swap cache is freed when the folio
+ * leaves the cache, the same rule swap_put_entries_cluster() follows.
+ * Readahead can put a folio here, and freeing the slot now would
+ * leave that folio with no entry behind it.
+ */
+ if (!swp_tb_is_folio(__swap_table_get(ci, offset % SWAPFILE_CLUSTER)))
+ __swap_cluster_free_entries(si, ci, offset % SWAPFILE_CLUSTER, 1);
swap_cluster_unlock(ci);
/* In theory readahead might add it to the swap cache by accident */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 046/713] mm, swap: ratelimit bad swap entry reports
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 045/713] mm, swap: dont free a hibernation slot that is in the swap cache Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 047/713] mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Greg Kroah-Hartman
` (677 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Barry Song, Nhat Pham,
Kairui Song, David Hildenbrand (Arm), Baoquan He, Chris Li,
Kemeng Shi, Miaohe Lin, Oscar Salvador, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit f9dc428249ed962a70acf301f01eae8578449161 upstream.
A corrupt page table hands the same bogus entry to get_swap_device() on
every access to the mapping, and every rejection is logged. One machine
logged 6185620 copies of the same line in a few hours.
swap_dup_entry_direct() prints the same message from the fork path, once
per call: the WARN_ON_ONCE() guarding it warns once, the pr_err() inside
does not.
Rate limit all three prints.
Link: https://lore.kernel.org/20260818-swap_part_one-v1-1-a4fc58119fc0@debian.org
Fixes: 23b230ba8ac3 ("mm/swap: print bad swap offset entry in get_swap_device")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Nhat Pham <nphamcs@gmail.com>
Acked-by: Kairui Song <kasong@tencent.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/swapfile.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1893,11 +1893,11 @@ struct swap_info_struct *get_swap_device
return si;
bad_nofile:
- pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
+ pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
out:
return NULL;
put_out:
- pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
+ pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
percpu_ref_put(&si->users);
return NULL;
}
@@ -3871,7 +3871,7 @@ int swap_dup_entry_direct(swp_entry_t en
si = swap_entry_to_info(entry);
if (WARN_ON_ONCE(!si)) {
- pr_err("%s%08lx\n", Bad_file, entry.val);
+ pr_err_ratelimited("%s%08lx\n", Bad_file, entry.val);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 047/713] mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 046/713] mm, swap: ratelimit bad swap entry reports Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 048/713] mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd Greg Kroah-Hartman
` (676 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Hugh Dickins, Ackerley Tng, Jason Gunthorpe, John Hubbard,
Kiryl Shutsemau, Peter Xu, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Arm) <david@kernel.org>
commit 078e1a0fc41a42baaf113383b52dab8874c0b967 upstream.
folio_may_be_lru_cached() is currently only true for small folios, and
for small folios FOLL_PIN adds GUP_PIN_COUNTING_BIAS references instead
of 1 in try_grab_folio()/try_grab_folio_fast().
Consequently, our
folio_ref_count(folio) != folio_expected_ref_count(folio) + 1
check in collect_longterm_unpinnable_folios() will currently always
identify "reference mismatch" and first drain the local LRU cache to then
drain the LRU cache on all CPUs, as collect_longterm_unpinnable_folios()
is really called after pinning the folios with FOLL_PIN.
Add a comment because the current code is not quite intuitive: we used to
drain only to make sure the folio_isolate_lru() would succeed. But then we
also started draining to make later migration more reliable.
We'll refactor that code soon a bit, to also make it usable in other
context where we really want to remove any references from LRU caches.
Let's add CC stable, because having an easy way for excessive LRU cache
draining on all CPUs does not sound right. In common scenarios we
don't expect to ever have to drain.
Link: https://lore.kernel.org/20260731-check_and_migrate_movable_folios-v1-1-e0002d7b791e@kernel.org
Fixes: 98c6d259319e ("mm/gup: check ref_count instead of lru before migration")
Fixes: a09a8a1fbb37 ("mm/gup: local lru_add_drain() to avoid lru_add_drain_all()")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Ackerley Tng <ackerleytng@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/gup.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2273,6 +2273,7 @@ static unsigned long collect_longterm_un
for (folio = pofs_get_folio(pofs, i); folio;
folio = pofs_next_folio(folio, pofs, &i)) {
+ const int pin_refs = folio_has_pincount(folio) ? 1 : GUP_PIN_COUNTING_BIAS;
if (folio_is_longterm_pinnable(folio))
continue;
@@ -2287,15 +2288,20 @@ static unsigned long collect_longterm_un
continue;
}
+ /*
+ * We drain not only to make the folio_isolate_lru() succeed,
+ * but also to remove any other folio references from LRU
+ * caches.
+ */
if (drained == 0 && folio_may_be_lru_cached(folio) &&
folio_ref_count(folio) !=
- folio_expected_ref_count(folio) + 1) {
+ folio_expected_ref_count(folio) + pin_refs) {
lru_add_drain();
drained = 1;
}
if (drained == 1 && folio_may_be_lru_cached(folio) &&
folio_ref_count(folio) !=
- folio_expected_ref_count(folio) + 1) {
+ folio_expected_ref_count(folio) + pin_refs) {
lru_add_drain_all();
drained = 2;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 048/713] mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 047/713] mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 049/713] mm/huge_memory: use folios memcg inside __folio_split() Greg Kroah-Hartman
` (675 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Usama Arif, Joshua Hahn, Zi Yan,
Balbir Singh, David Hildenbrand (Arm), Gregory Price,
Alistair Popple, Baolin Wang, Barry Song, Byungchul Park,
Dev Jain, Huang, Ying, Jann Horn, Johannes Weiner, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Nico Pache,
Rakie Kim, Ryan Roberts, sashiko-bot, Shakeel Butt,
Vlastimil Babka, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <usama.arif@linux.dev>
commit ce579dcf730ce5ed8043a5eeea18a3e6706a97e5 upstream.
madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then
madvise_free_huge_pmd() takes pmd_trans_huge_lock(). pmd_is_huge()
returns true for a device-private PMD, so orig_pmd can be device-private
and enter the !pmd_present() branch.
Skip device-private PMDs in that non-present branch and continue to out
before calling pmd_folio(). Downgrade the check to VM_WARN_ON_ONCE() so
an unexpected PMD softleaf logs a warning rather than panicking. Drop the
thp_migration_supported() guard: it expands to
IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both
pmd_is_migration_entry() and pmd_is_device_private_entry() already return
false when that config is not selected, so the guard suppresses only the
case where the warning would already be silent.
Potential trigger: an HMM-based GPU driver races with madvise(MADV_FREE):
migrate_vma_pages() flips the PMD to a device-private entry between the
caller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock().
Link: https://lore.kernel.org/20260710105557.1987433-4-usama.arif@linux.dev
Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations")
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Gregory Price <gourry@gourry.net>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: sashiko-bot <sashiko-bot@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2340,8 +2340,8 @@ bool madvise_free_huge_pmd(struct mmu_ga
goto out;
if (unlikely(!pmd_present(orig_pmd))) {
- VM_BUG_ON(thp_migration_supported() &&
- !pmd_is_migration_entry(orig_pmd));
+ VM_WARN_ON_ONCE(!pmd_is_migration_entry(orig_pmd) &&
+ !pmd_is_device_private_entry(orig_pmd));
goto out;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 049/713] mm/huge_memory: use folios memcg inside __folio_split()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 048/713] mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 050/713] mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Greg Kroah-Hartman
` (674 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zi Yan, Johannes Weiner, Baolin Wang,
Lorenzo Stoakes (ARM), Barry Song, David Hildenbrand, Dev Jain,
Lance Yang, Liam R. Howlett, Matthew Wilcox (Oracle),
Ryan Roberts, William Kucharski, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <ziy@nvidia.com>
commit c299a2285d9d8bda4da024455de65e3d00de6f17 upstream.
Patch series "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to
folio's memcg", v3.
__GFP_ACCOUNT is needed for xarray node allocation accounting when
XA_FLAGS_ACCOUNT is set. Commit 7b785645e8f13 ("mm: fix page cache
convergence regression") fixed a workingset regression with it.
xas_split_alloc() does not have it and needs to be fixed.
In addition, based on Sashiko's review[1] and Johannes' confirmation[2], to
charge the right memcg, folio's memcg needs to be active during folio
split. Add that before adding __GFP_ACCOUNT.
There is no workingset convergence regression related to missing
__GFP_ACCOUNT in xas_split_alloc() and the impact to userspace should be
minor.
This patch (of 2):
During a pagecache folio split, an xarray node allocation can happen and
needs to charge at folio's memcg instead of folio split invoker's memcg,
because for example folio split can happen during reclaim and reclaim's
active memcg might not be folio's memcg. Switch to folio's memcg at the
beginning and switch back afterwards.
Link: https://lore.kernel.org/20260804-add-gfp_account-to-xas_split_alloc-v3-0-38cb3ff325c5@nvidia.com
Link: https://lore.kernel.org/20260804-add-gfp_account-to-xas_split_alloc-v3-1-38cb3ff325c5@nvidia.com
Link: https://sashiko.dev/#/patchset/20260727-add-gfp_account-to-xas_split_alloc-v1-1-9fae6bf64838%40nvidia.com?part=1 [1]
Link: https://lore.kernel.org/all/amtcBZ-_QVRgCd6b@cmpxchg.org/ [2]
Fixes: 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Suggested-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -4027,34 +4027,42 @@ static int __folio_split(struct folio *f
XA_STATE(xas, &folio->mapping->i_pages, folio->index);
struct folio *end_folio = folio_next(folio);
bool is_anon = folio_test_anon(folio);
+ struct mem_cgroup *memcg, *old_memcg;
struct address_space *mapping = NULL;
struct anon_vma *anon_vma = NULL;
int old_order = folio_order(folio);
struct folio *new_folio, *next;
int nr_shmem_dropped = 0;
enum ttu_flags ttu_flags = 0;
- int ret;
pgoff_t end = 0;
+ int ret;
VM_WARN_ON_ONCE_FOLIO(!folio_test_locked(folio), folio);
VM_WARN_ON_ONCE_FOLIO(!folio_test_large(folio), folio);
if (folio != page_folio(split_at) || folio != page_folio(lock_at)) {
ret = -EINVAL;
- goto out;
+ goto out_no_memcg;
}
if (new_order >= old_order) {
ret = -EINVAL;
- goto out;
+ goto out_no_memcg;
}
ret = folio_check_splittable(folio, new_order, split_type);
if (ret) {
VM_WARN_ONCE(ret == -EINVAL, "Tried to split an unsplittable folio");
- goto out;
+ goto out_no_memcg;
}
+ /*
+ * switch to folio's memcg as xarray node allocation can happen and
+ * needs to charge to it.
+ */
+ memcg = get_mem_cgroup_from_folio(folio);
+ old_memcg = set_active_memcg(memcg);
+
if (is_anon) {
/*
* The caller does not necessarily hold an mmap_lock that would
@@ -4197,6 +4205,10 @@ out_unlock:
if (mapping)
i_mmap_unlock_read(mapping);
out:
+ /* restore to caller's old_memcg */
+ set_active_memcg(old_memcg);
+ mem_cgroup_put(memcg);
+out_no_memcg:
xas_destroy(&xas);
if (is_pmd_order(old_order))
count_vm_event(!ret ? THP_SPLIT_PAGE : THP_SPLIT_PAGE_FAILED);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 050/713] mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 049/713] mm/huge_memory: use folios memcg inside __folio_split() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 051/713] mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Greg Kroah-Hartman
` (673 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, Oscar Salvador,
Michal Clapinski, Aneesh Kumar K.V, David Hildenbrand,
Liam R. Howlett, Lorenzo Stoakes, Madhavan Srinivasan,
Michael Ellerman, Mike Rapoport, Nicholas Piggin,
Ritesh Harjani (IBM), Vlastimil Babka, Frank van der Linden,
Oscar Salvador (SUSE), Usama Arif, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <songmuchun@bytedance.com>
commit c0caeceb0c3899dc42844d3979093b27d1434108 upstream.
Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4.
This series is split out from the earlier larger series "mm: Generalize
HVO for HugeTLB and device DAX" [1]. It collects the first 19 patches of
that series as a standalone set of fixes and preparatory cleanups around
bootmem HugeTLB handling, sparse initialization ordering, and related
vmemmap setup.
The first patches fix a few bugs found while reviewing the existing code,
including incorrect bootmem HVO handling, wrong vmemmap registration
arguments, a powerpc compound-vmemmap tracking bug, and too-late
initialization of gigantic bootmem HugeTLB struct pages.
The rest of the series reorders early memory initialization so the
relevant zone state is available before sparse and HugeTLB boot-time setup
runs, then simplifies the remaining bootmem gigantic hugepage allocation
path and removes code made obsolete by that rework.
At a high level:
- patches [1-4] fix boot-time and arch-specific bugs
- patches [5-12] reorder and simplify sparse/mm/hugetlb early init
- patches [13-19] refactor bootmem gigantic hugepage allocation and
remove obsolete helpers and state
This patch (of 19):
Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched
HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].
Those shared tail pages were initialized in hugetlb_vmemmap_init(), but
bootmem HugeTLB folios are prepared earlier from
gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on,
prep_and_add_bootmem_folios() can access pageblock flags on bootmem
HugeTLB pages whose mirrored tail struct pages already point to the shared
tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then
dereferences the still-uninitialized shared tail page and can panic during
boot.
Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before
bootmem HugeTLB folios are processed, and drop the later initialization
from hugetlb_vmemmap_init().
This bug only affects CONFIG_DEBUG_VM kernels, where the relevant
assertion is evaluated.
Link: https://lore.kernel.org/20260612035903.2468601-1-songmuchun@bytedance.com
Link: https://lore.kernel.org/20260612035903.2468601-2-songmuchun@bytedance.com
Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Tested-by: Michal Clapinski <mclapinski@google.com>
Reviewed-by: Michal Clapinski <mclapinski@google.com>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 25 +++++++++++++++++++++++++
mm/hugetlb_vmemmap.c | 17 -----------------
mm/sparse-vmemmap.c | 2 +-
3 files changed, 26 insertions(+), 18 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b75774455d65..4c234611e7a0 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3365,6 +3365,31 @@ static void __init gather_bootmem_prealloc(void)
.max_threads = num_node_state(N_MEMORY),
.numa_aware = true,
};
+#ifdef CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP
+ struct zone *zone;
+
+ for_each_zone(zone) {
+ for (int i = 0; i < NR_VMEMMAP_TAILS; i++) {
+ struct page *tail, *p;
+ unsigned int order;
+
+ tail = zone->vmemmap_tails[i];
+ if (!tail)
+ continue;
+
+ order = i + VMEMMAP_TAIL_MIN_ORDER;
+ p = page_to_virt(tail);
+ /*
+ * prep_and_add_bootmem_folios() can access pageblock
+ * flags on bootmem HugeTLB pages, so initialize the
+ * shared tail struct pages here before bootmem folios
+ * start using them.
+ */
+ for (int j = 0; j < PAGE_SIZE / sizeof(struct page); j++)
+ init_compound_tail(p + j, NULL, order, zone);
+ }
+ }
+#endif
padata_do_multithreaded(&job);
}
diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 133b46dfb09f..c713c0d2593a 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -870,27 +870,10 @@ static const struct ctl_table hugetlb_vmemmap_sysctls[] = {
static int __init hugetlb_vmemmap_init(void)
{
const struct hstate *h;
- struct zone *zone;
/* HUGETLB_VMEMMAP_RESERVE_SIZE should cover all used struct pages */
BUILD_BUG_ON(__NR_USED_SUBPAGE > HUGETLB_VMEMMAP_RESERVE_PAGES);
- for_each_zone(zone) {
- for (int i = 0; i < NR_VMEMMAP_TAILS; i++) {
- struct page *tail, *p;
- unsigned int order;
-
- tail = zone->vmemmap_tails[i];
- if (!tail)
- continue;
-
- order = i + VMEMMAP_TAIL_MIN_ORDER;
- p = page_to_virt(tail);
- for (int j = 0; j < PAGE_SIZE / sizeof(struct page); j++)
- init_compound_tail(p + j, NULL, order, zone);
- }
- }
-
for_each_hstate(h) {
if (hugetlb_vmemmap_optimizable(h)) {
register_sysctl_init("vm", hugetlb_vmemmap_sysctls);
diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index ebd3ac997f64..dff8da23eabb 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -342,7 +342,7 @@ static __meminit struct page *vmemmap_get_tail(unsigned int order, struct zone *
*
* Any initialization done here will be overwritten by memmap_init().
*
- * hugetlb_vmemmap_init() will take care of initialization after
+ * gather_bootmem_prealloc() will take care of initialization after
* memmap_init().
*/
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 051/713] mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 050/713] mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 052/713] mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Greg Kroah-Hartman
` (672 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song,
Mike Rapoport (Microsoft), Oscar Salvador, Aneesh Kumar K.V,
David Hildenbrand, Frank van der Linden, Liam R. Howlett,
Lorenzo Stoakes, Madhavan Srinivasan, Michael Ellerman,
Nicholas Piggin, Oscar Salvador (SUSE), Ritesh Harjani (IBM),
Usama Arif, Vlastimil Babka, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <songmuchun@bytedance.com>
commit b1b7c045e808c761b1cc8c19b3040fadedda3fef upstream.
Gigantic bootmem HugeTLB pages are currently initialized from
hugetlb_init(), but page_alloc_init_late() runs earlier and walks
pageblocks to determine zone contiguity.
If a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can
observe still-uninitialized struct pages through
__pageblock_pfn_to_page(). This may not trigger an immediate failure, but
it can make set_zone_contiguous() compute the wrong zone contiguity state.
If extra poisoned-page checks are added in this path, such as
PF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot
panic.
Initialize gigantic bootmem HugeTLB struct pages from
page_alloc_init_late(), before zone contiguity is evaluated, so later page
allocator setup only sees valid struct page state. This also makes the
initialization order more natural, as struct pages should be initialized
before later code inspects them.
Link: https://lore.kernel.org/20260612035903.2468601-5-songmuchun@bytedance.com
Fixes: fde1c4ecf916 ("mm: hugetlb: skip initialization of gigantic tail struct pages if freed by HVO")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/hugetlb.h | 5 +++++
mm/hugetlb.c | 5 ++---
mm/mm_init.c | 1 +
mm/sparse-vmemmap.c | 4 ++--
4 files changed, 10 insertions(+), 5 deletions(-)
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -171,6 +171,7 @@ extern int movable_gigantic_pages __read
extern int sysctl_hugetlb_shm_group __read_mostly;
extern struct list_head huge_boot_pages[MAX_NUMNODES];
+void hugetlb_bootmem_struct_page_init(void);
void hugetlb_bootmem_alloc(void);
extern nodemask_t hugetlb_bootmem_nodes;
void hugetlb_bootmem_set_nodes(void);
@@ -1293,6 +1294,10 @@ static inline bool hugetlbfs_pagecache_p
static inline void hugetlb_bootmem_alloc(void)
{
}
+
+static inline void hugetlb_bootmem_struct_page_init(void)
+{
+}
#endif /* CONFIG_HUGETLB_PAGE */
static inline spinlock_t *huge_pte_lock(struct hstate *h,
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3353,7 +3353,7 @@ static void __init gather_bootmem_preall
gather_bootmem_prealloc_node(nid);
}
-static void __init gather_bootmem_prealloc(void)
+void __init hugetlb_bootmem_struct_page_init(void)
{
struct padata_mt_job job = {
.thread_fn = gather_bootmem_prealloc_parallel,
@@ -3582,7 +3582,7 @@ static unsigned long __init hugetlb_page
* - For gigantic pages, this is called early in the boot process and
* pages are allocated from memblock allocated or something similar.
* Gigantic pages are actually added to pools later with the routine
- * gather_bootmem_prealloc.
+ * hugetlb_bootmem_struct_page_init.
* - For non-gigantic pages, this is called later in the boot process after
* all of mm is up and functional. Pages are allocated from buddy and
* then added to hugetlb pools.
@@ -4152,7 +4152,6 @@ static int __init hugetlb_init(void)
}
hugetlb_init_hstates();
- gather_bootmem_prealloc();
report_hugepages();
hugetlb_sysfs_init();
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -2330,6 +2330,7 @@ void __init page_alloc_init_late(void)
/* Reinit limits that are based on free pages after the kernel is up */
files_maxfiles_init();
#endif
+ hugetlb_bootmem_struct_page_init();
/* Accounting of total+free memory is stable at this point. */
mem_init_print_info();
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -342,8 +342,8 @@ static __meminit struct page *vmemmap_ge
*
* Any initialization done here will be overwritten by memmap_init().
*
- * gather_bootmem_prealloc() will take care of initialization after
- * memmap_init().
+ * hugetlb_bootmem_struct_page_init() will take care of initialization
+ * after memmap_init().
*/
p = vmemmap_alloc_block_zero(PAGE_SIZE, node);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 052/713] mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 051/713] mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 053/713] mm/kmemleak: avoid soft lockup when scanning task stacks Greg Kroah-Hartman
` (671 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, Oscar Salvador,
Frank van der Linden, Aneesh Kumar K.V, David Hildenbrand,
Liam R. Howlett, Lorenzo Stoakes, Madhavan Srinivasan,
Michael Ellerman, Mike Rapoport (Microsoft), Nicholas Piggin,
Oscar Salvador (SUSE), Ritesh Harjani (IBM), Usama Arif,
Vlastimil Babka, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <songmuchun@bytedance.com>
commit 6e25c6a9c7eff141ecfc966ecdb7801db2a8810e upstream.
__hugetlb_vmemmap_optimize_folios() uses incorrect arguments when handling
bootmem HugeTLB folios.
The section number passed to register_page_bootmem_memmap() is derived
from the vmemmap virtual address of folio->page instead of the folio PFN,
so the bootmem memmap metadata can be registered against the wrong
section. The helper is also given HUGETLB_VMEMMAP_RESERVE_SIZE even
though it expects a page count, not a size in bytes. In addition, the
write-protect range is based on pages_per_huge_page(h), which does not
cover the full HugeTLB vmemmap area and can leave part of the shared tail
vmemmap mapping writable.
Fix the section lookup to use folio_pfn(folio), use
HUGETLB_VMEMMAP_RESERVE_PAGES when registering the reserved memmap pages,
and use hugetlb_vmemmap_size(h) for the write-protect range.
Link: https://lore.kernel.org/20260612035903.2468601-3-songmuchun@bytedance.com
Fixes: 752fe17af693 ("mm/hugetlb: add pre-HVO framework")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: Frank van der Linden <fvdl@google.com>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb_vmemmap.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -635,12 +635,12 @@ static void __hugetlb_vmemmap_optimize_f
* mirrored tail page structs RO.
*/
spfn = (unsigned long)&folio->page;
- epfn = spfn + pages_per_huge_page(h);
+ epfn = spfn + hugetlb_vmemmap_size(h);
vmemmap_wrprotect_hvo(spfn, epfn, folio_nid(folio),
HUGETLB_VMEMMAP_RESERVE_SIZE);
- register_page_bootmem_memmap(pfn_to_section_nr(spfn),
+ register_page_bootmem_memmap(pfn_to_section_nr(folio_pfn(folio)),
&folio->page,
- HUGETLB_VMEMMAP_RESERVE_SIZE);
+ HUGETLB_VMEMMAP_RESERVE_PAGES);
continue;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 053/713] mm/kmemleak: avoid soft lockup when scanning task stacks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 052/713] mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 054/713] mm/madvise: skip device-private PMDs in cold and pageout walks Greg Kroah-Hartman
` (670 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Catalin Marinas,
Davidlohr Bueso, Lance Yang, Oleg Nesterov, Qian Cai,
SeongJae Park, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 5d10d4e19e6daa487f0cd0ea6cba472325de92f9 upstream.
Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3.
kmemleak_scan() scans every task stack under one rcu_read_lock() with no
reschedule point, which can trip the soft lockup watchdog on hosts with
very many threads.
That prints the following message, depending on the workload+host
configuration:
watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
scan_block
kmemleak_scan
kmemleak_scan_thread
kthread
Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between
tasks
Patches 2-3 let the scan loops stop early once a scan is interrupted.
This patch (of 3):
kmemleak_scan() walks every thread and scans its kernel stack under a
single rcu_read_lock() with no reschedule point. On a host with very many
threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog
a CPU long enough to trip the soft lockup watchdog:
watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
scan_block
kmemleak_scan
kmemleak_scan_thread
kthread
A cond_resched() cannot be added directly: the loop runs inside an RCU
read-side critical section.
Walk the tasks one PID at a time with find_ge_pid(), taking the RCU read
lock only to look up and pin each task. The stack is then scanned with no
lock held, so cond_resched() runs between tasks and the scan stops early
on scan_should_stop(). This follows the next_tgid()/task_seq_get_next()
iteration pattern and keeps each RCU critical section short.
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-0-acecd7d7fd92@debian.org
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-1-acecd7d7fd92@debian.org
Fixes: c4b28963fd79 ("mm/kmemleak: rely on rcu for task stack scanning")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: Qian Cai <cai@lca.pw>
Cc: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmemleak.c | 51 ++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 38 insertions(+), 13 deletions(-)
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1697,6 +1697,42 @@ unlock_put:
}
/*
+ * Scan all task kernel stacks, rescheduling between tasks. Each task is looked
+ * up and pinned within its own RCU read-side section, so no lock is held across
+ * the scan and the walk cannot trip the soft lockup watchdog.
+ */
+static void kmemleak_scan_task_stacks(void)
+{
+ struct pid *pid;
+ int nr = 1;
+
+ do {
+ struct task_struct *p = NULL;
+
+ rcu_read_lock();
+ pid = find_ge_pid(nr, &init_pid_ns);
+ if (pid) {
+ nr = pid_nr(pid) + 1;
+ p = pid_task(pid, PIDTYPE_PID);
+ if (p)
+ get_task_struct(p);
+ }
+ rcu_read_unlock();
+
+ if (p) {
+ void *stack = try_get_task_stack(p);
+
+ if (stack) {
+ scan_block(stack, stack + THREAD_SIZE, NULL);
+ put_task_stack(p);
+ }
+ put_task_struct(p);
+ }
+ cond_resched();
+ } while (pid && !scan_should_stop());
+}
+
+/*
* Print one leak inline. The hex dump is gated on OBJECT_ALLOCATED so it
* does not touch user memory that was freed concurrently; the rest of the
* report (backtrace, comm, pid) is always emitted since the kmemleak_object
@@ -1885,19 +1921,8 @@ static void kmemleak_scan(void)
/*
* Scanning the task stacks (may introduce false negatives).
*/
- if (kmemleak_stack_scan) {
- struct task_struct *p, *g;
-
- rcu_read_lock();
- for_each_process_thread(g, p) {
- void *stack = try_get_task_stack(p);
- if (stack) {
- scan_block(stack, stack + THREAD_SIZE, NULL);
- put_task_stack(p);
- }
- }
- rcu_read_unlock();
- }
+ if (kmemleak_stack_scan)
+ kmemleak_scan_task_stacks();
/*
* Scan the objects already referenced from the sections scanned
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 054/713] mm/madvise: skip device-private PMDs in cold and pageout walks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 053/713] mm/kmemleak: avoid soft lockup when scanning task stacks Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 055/713] mm/mempolicy: skip non-present PMDs when queueing folios Greg Kroah-Hartman
` (669 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Usama Arif, sashiko-bot, Joshua Hahn,
Zi Yan, Balbir Singh, Gregory Price, Alistair Popple, Baolin Wang,
Barry Song, Byungchul Park, David Hildenbrand (Arm), Dev Jain,
Huang, Ying, Jann Horn, Johannes Weiner, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Nico Pache,
Rakie Kim, Ryan Roberts, Shakeel Butt, Vlastimil Babka,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <usama.arif@linux.dev>
commit d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2 upstream.
madvise_cold_or_pageout_pte_range() takes pmd_trans_huge_lock(), whose
pmd_is_huge() check returns true for a device-private PMD. The subsequent
!pmd_present() branch has a VM_BUG_ON() asserting migration is the only
allowed non-present case; a device-private PMD trips it.
Skip device-private PMDs in that non-present branch and continue to
huge_unlock before calling pmd_folio(). Downgrade the check to
VM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than
panicking. Drop the thp_migration_supported() guard: it expands to
IS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both
pmd_is_migration_entry() and pmd_is_device_private_entry() already return
false when that config is not selected, so the guard suppresses only the
case where the warning would already be silent.
Potential trigger: an HMM-based GPU driver races with
madvise(MADV_COLD)/MADV_PAGEOUT: pmd_trans_huge(*pmd) reads true, then
migrate_vma_pages() flips the PMD to a device-private entry before the PMD
lock is acquired.
Link: https://lore.kernel.org/20260710105557.1987433-3-usama.arif@linux.dev
Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations")
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=6
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Reviewed-by: Gregory Price <gourry@gourry.net>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/madvise.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index 917f764fef80..bf9ce199935a 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -388,8 +388,8 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
goto huge_unlock;
if (unlikely(!pmd_present(orig_pmd))) {
- VM_BUG_ON(thp_migration_supported() &&
- !pmd_is_migration_entry(orig_pmd));
+ VM_WARN_ON_ONCE(!pmd_is_migration_entry(orig_pmd) &&
+ !pmd_is_device_private_entry(orig_pmd));
goto huge_unlock;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 055/713] mm/mempolicy: skip non-present PMDs when queueing folios
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 054/713] mm/madvise: skip device-private PMDs in cold and pageout walks Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 056/713] mm/mglru: fix and remove redundant unevictable folio handling Greg Kroah-Hartman
` (668 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Usama Arif, sashiko-bot, Joshua Hahn,
Zi Yan, David Hildenbrand (Arm), Balbir Singh, Gregory Price,
Alistair Popple, Baolin Wang, Barry Song, Byungchul Park,
Dev Jain, Huang, Ying, Jann Horn, Johannes Weiner, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Nico Pache,
Rakie Kim, Ryan Roberts, Shakeel Butt, Vlastimil Babka,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <usama.arif@linux.dev>
commit 2858b4027f491e6fdb8ee2d8923798b619bf2791 upstream.
Patch series "mm: handle device-private PMDs in walk callbacks", v3.
Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support
to PMD operations") a PMD may hold a device-private swap entry whenever an
HMM-based GPU driver migrates an anonymous THP folio to device memory via
migrate_vma_pages().
pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true
for any non-present, non-none huge PMD), so several MM walk callbacks that
used to assume present THP or migration entry are now reachable with a
device-private PMD. The results range from a VM_BUG_ON() firing on debug
kernels, to an oops on a bogus vmemmap dereference, to silently isolating
an unrelated live folio from LRU in the aliasing case.
This patch (of 3):
queue_folios_pmd() is called under pmd_trans_huge_lock(), whose
pmd_is_huge() check returns true for any non-present, non-none PMD
softleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding
as a hardware PFN and can return a bogus folio pointer.
Mirror queue_folios_pte_range(): handle non-present entries before looking
up a folio. Keep migration entries counted as failures, but skip other
non-present PMDs such as device-private entries.
Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio
to device memory via migrate_vma_pages(), leaving a device-private PMD.
Userspace then calls mbind(), migrate_pages() or set_mempolicy_home_node()
on that range.
Link: https://lore.kernel.org/20260710105557.1987433-1-usama.arif@linux.dev
Link: https://lore.kernel.org/20260710105557.1987433-2-usama.arif@linux.dev
Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations")
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=6
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Reviewed-by: Gregory Price <gourry@gourry.net>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempolicy.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -653,12 +653,14 @@ static void queue_folios_pmd(pmd_t *pmd,
{
struct folio *folio;
struct queue_pages *qp = walk->private;
+ pmd_t pmdval = pmdp_get(pmd);
- if (unlikely(pmd_is_migration_entry(*pmd))) {
- qp->nr_failed++;
+ if (unlikely(!pmd_present(pmdval))) {
+ if (pmd_is_migration_entry(pmdval))
+ qp->nr_failed++;
return;
}
- folio = pmd_folio(*pmd);
+ folio = pmd_folio(pmdval);
if (is_huge_zero_folio(folio)) {
walk->action = ACTION_CONTINUE;
return;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 056/713] mm/mglru: fix and remove redundant unevictable folio handling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 055/713] mm/mempolicy: skip non-present PMDs when queueing folios Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 057/713] mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Greg Kroah-Hartman
` (667 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kairui Song, Barry Song, Baolin Wang,
Axel Rasmussen, Brian Geffon, David Hildenbrand,
Jan Alexander Steffens (heftig), Johannes Weiner, Lorenzo Stoakes,
Michal Hocko, Oleksandr Natalenko, Shakeel Butt, Steven Barrett,
Suleiman Souhlal, Wei Xu, Yuanchu Xie, Yu Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <kasong@tencent.com>
commit f7e698e326b239a91ea15844817551921209e826 upstream.
sort_folio() has a shortcut for moving folios that are no longer evictable
but are still sitting on a generation list. However, this shortcut is
buggy. It does not follow the PG_lru usage convention, and it has a more
serious issue.
Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that
folio->lru can be reused to hold folio->mlock_count (see the comment in
lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them,
and every other place that turns a folio unevictable initialises
mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and
__mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio()
sets nothing, and the lru_gen_del_folio() right above it may have already
poisoned folio->lru via list_del(), so mlock_count ends up aliasing
LIST_POISON2, which reads as 0x122, i.e. 290. The result is user
visible. On munlock, __munlock_folio() decrements that bogus count, finds
it still non-zero and bails out before clearing PG_mlocked, so the folio
remains unevictable and the Mlocked accounting stays inflated until the
folio is freed.
The shortcut also touches the LRU flags in the wrong order. It calls
lru_gen_del_folio() while PG_lru is still set, so a concurrent
folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed
on a folio that has already been taken off the generation list, which may
lead to unexpected behavior.
So fix it by isolating them as common folios and letting the generic
shrink path cull them. This matches the classical LRU behavior, and there
should be no visible effect on the generic eviction or isolation behavior.
There is no performance concern either, such a folio goes through this
once, and then it is off the generation lists for good.
Link: https://lore.kernel.org/20260812-mglru-mlock-fix-v2-1-a3fec5853c08@tencent.com
Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation")
Signed-off-by: Kairui Song <kasong@tencent.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Barrett <steven@liquorix.net>
Cc: Suleiman Souhlal <suleiman@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 19 +++++--------------
1 file changed, 5 insertions(+), 14 deletions(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -4573,7 +4573,6 @@ void lru_gen_reparent_memcg(struct mem_c
static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_control *sc,
int tier_idx)
{
- bool success;
int gen = folio_lru_gen(folio);
int type = folio_is_file_lru(folio);
int zone = folio_zonenum(folio);
@@ -4585,15 +4584,9 @@ static bool sort_folio(struct lruvec *lr
VM_WARN_ON_ONCE_FOLIO(gen >= MAX_NR_GENS, folio);
- /* unevictable */
- if (!folio_evictable(folio)) {
- success = lru_gen_del_folio(lruvec, folio, true);
- VM_WARN_ON_ONCE_FOLIO(!success, folio);
- folio_set_unevictable(folio);
- lruvec_add_folio(lruvec, folio);
- __count_vm_events(UNEVICTABLE_PGCULLED, delta);
- return true;
- }
+ /* unevictable: let it through and the generic path will cull it */
+ if (!folio_evictable(folio))
+ return false;
/* promoted */
if (gen != lru_gen_from_seq(lrugen->min_seq[type])) {
@@ -4843,11 +4836,9 @@ retry:
list_for_each_entry_safe_reverse(folio, next, &list, lru) {
DEFINE_MIN_SEQ(lruvec);
- if (!folio_evictable(folio)) {
- list_del(&folio->lru);
- folio_putback_lru(folio);
+ /* move_folios_to_lru() culls unevictable folios via folio_putback_lru() */
+ if (!folio_evictable(folio))
continue;
- }
/* retry folios that may have missed folio_rotate_reclaimable() */
if (!skip_retry && !folio_test_active(folio) && !folio_mapped(folio) &&
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 057/713] mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 056/713] mm/mglru: fix and remove redundant unevictable folio handling Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 058/713] mm/migrate: use huge_ptep_get() in remove_migration_pte() Greg Kroah-Hartman
` (666 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Zi Yan, Gregory Price,
Paul E. McKenney, David Hildenbrand (Arm), Alistair Popple,
Byungchul Park, Huang, Ying, Joshua Hahn, Matthew Brost,
Rakie Kim, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit efe8f86c0916f0f74eea74ae21a3b37f728c6bad upstream.
migrate_pages_batch() unmaps each folio before moving it, and every
unmap runs the mmu_notifier invalidate callbacks. On KVM hosts
try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() ->
tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps
the CPU busy for a long time.
The loop already calls cond_resched(), but on PREEMPTION kernels that is
a no-op, and involuntary preemption is not a Tasks-RCU quiescent state.
A long batch therefore never reports a quiescent state, and the
migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the
Tasks-RCU grace period for minutes, which is common at Meta fleet:
INFO: rcu_tasks detected stalls on tasks:
0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task
Call Trace:
tdp_mmu_zap_leafs
tdp_mmu_next_root
gfn_to_pfn_cache_invalidate_start
kvm_mmu_notifier_invalidate_range_start
__mmu_notifier_invalidate_range_start
try_to_migrate_one
try_to_migrate
migrate_pages_batch
migrate_pages
compact_zone
compact_node
kcompactd
kthread
Use cond_resched_tasks_rcu_qs() so a quiescent state is reported even
when cond_resched() does nothing.
This has also been discussed at [1]
Link: https://lore.kernel.org/20260727-kcompact-v1-1-bdfefddd6874@debian.org
Link: https://lore.kernel.org/all/amdWVTs0WKOxguxP@gmail.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Gregory Price <gourry@gourry.net>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/migrate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1830,7 +1830,7 @@ static int migrate_pages_batch(struct li
is_thp = folio_test_pmd_mappable(folio);
nr_pages = folio_nr_pages(folio);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
/*
* The rare folio on the deferred split list should
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 058/713] mm/migrate: use huge_ptep_get() in remove_migration_pte()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 057/713] mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 059/713] mm/migrate_device: clear stale mapping after freeing swapcache Greg Kroah-Hartman
` (665 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, Muchun Song,
David Hildenbrand (Arm), Alistair Popple, Andi Kleen,
Anshuman Khandual, Byungchul Park, Catalin Marinas, Dave Hansen,
Gregory Price, Harry Yoo, Huang, Ying, Jann Horn, Josh Poimboeuf,
Joshua Hahn, Junichi Nick Nomura, Kiryl Shutsemau, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Mel Gorman,
Naoya Horiguchi, Oscar Salvador, Pedro Falcato, Rakie Kim,
Ralph Campbell, Rik van Riel, Ryan Roberts, Vlastimil Babka,
Will Deacon, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
commit ac1ec50d71b953524100ddc09057ee61a3dfaff3 upstream.
remove_migration_pte() converts migration entries back to present PTEs
after folio migration completes. For hugetlb folios,
page_vma_mapped_walk() returns the pte pointer to the hugetlb folio in
pvmw.pte, but the code reads it with ptep_get().
On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(),
pte_present() etc to misbehave.
It is not clear whether this has a trivially visible effect to userspace.
Use huge_ptep_get() to dereference a huge pte pointer.
Link: https://lore.kernel.org/20260703114202.365553-5-dev.jain@arm.com
Fixes: 290408d4a250 ("hugetlb: hugepage migration core")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/migrate.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -371,7 +371,11 @@ static bool remove_migration_pte(struct
continue;
}
#endif
- old_pte = ptep_get(pvmw.pte);
+ if (folio_test_hugetlb(folio))
+ old_pte = huge_ptep_get(vma->vm_mm, pvmw.address,
+ pvmw.pte);
+ else
+ old_pte = ptep_get(pvmw.pte);
if (rmap_walk_arg->map_unused_to_zeropage &&
try_to_map_unused_to_zeropage(&pvmw, folio, old_pte, idx))
continue;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 059/713] mm/migrate_device: clear stale mapping after freeing swapcache
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 058/713] mm/migrate: use huge_ptep_get() in remove_migration_pte() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 060/713] mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Greg Kroah-Hartman
` (664 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arvind Yadav, Zi Yan, Balbir Singh,
David Hildenbrand, Matthew Brost, Joshua Hahn, Rakie Kim,
Byungchul Park, Gregory Price, Ying Huang, Alistair Popple,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvind Yadav <arvind.yadav@intel.com>
commit 34a00895d032a414830d41106a09329ae6c251b6 upstream.
__migrate_device_pages() reads the folio mapping before calling
folio_free_swap(). When folio_free_swap() succeeds, the folio is removed
from the swap cache, but the saved mapping still points to swap_space.
Passing the stale mapping to folio_migrate_mapping() makes it use the
mapped-folio path for a folio that is no longer in swapcache. It can then
operate on swap_space.i_pages with invalid reference accounting,
eventually triggering a folio reference count BUG.
After a successful split, nr still contains the number of pages in the
original large folio, although each resulting page is now a separate
order-0 folio. Reset nr to 1 so each split folio is processed separately,
including its own swapcache removal and mapping lookup.
Refresh the saved mapping after folio_free_swap() so the current folio
state is used during migration.
Link: https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com
Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages")
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/migrate_device.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -1183,6 +1183,13 @@ static void __migrate_device_pages(unsig
MIGRATE_PFN_COMPOUND);
goto next;
}
+
+ /*
+ * reset nr so that only first after-split folio
+ * is processed below
+ */
+ VM_WARN_ON_ONCE(folio_test_large(folio));
+ nr = 1;
} else if ((src_pfns[i] & MIGRATE_PFN_MIGRATE) &&
(dst_pfns[i] & MIGRATE_PFN_COMPOUND) &&
!(src_pfns[i] & MIGRATE_PFN_COMPOUND)) {
@@ -1222,6 +1229,12 @@ static void __migrate_device_pages(unsig
folio = page_folio(migrate_pfn_to_page(src_pfns[i+j]));
newfolio = page_folio(migrate_pfn_to_page(dst_pfns[i+j]));
+ /*
+ * folio_free_swap() removed the folio from the swap
+ * cache. Refresh the saved mapping before migration.
+ */
+ mapping = folio_mapping(folio);
+
r = folio_migrate_mapping(mapping, newfolio, folio, extra_cnt);
if (r)
src_pfns[i+j] &= ~MIGRATE_PFN_MIGRATE;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 060/713] mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 059/713] mm/migrate_device: clear stale mapping after freeing swapcache Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 061/713] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Greg Kroah-Hartman
` (663 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Graf,
Mike Rapoport (Microsoft)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Graf <graf@amazon.com>
commit 97090500d776c3f6d08e857e3a0a7cf092999094 upstream.
With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone()
initializes struct pages early in boot to satisfy an allocation.
With a large CMA reservation in place, the ranges deferred_init_memmap()
finds may not add up to the allocation it was asked for, and the function
ends up initializing the memory map of the entire zone and still falls
short.
That is fine in itself: the function accounts for it and leaves the
caller to decide whether it now has enough memory.
However, the update of pgdat->first_deferred_pfn that tracks where
uninitialized memory map starts could overflow.
If the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and
some deferred struct pages were initialized, pgdat->first_deferred_pfn
would point past the end of the node's memory.
deferred_init_memmap() later picks up from pgdat->first_deferred_pfn and
hits a BUG_ON(), because it expects a pfn within its node.
For example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
and CONFIG_CMA=y using the following qemu command line
qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \
-append "nokaslr cma=4768M@0x100000000"
the kernel panics:
kernel BUG at mm/mm_init.c:2131!
CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1
RIP: 0010:deferred_init_memmap+0x1b8/0x1c0
RAX: 0000000000236000 R13: 0000000000238000
Call Trace:
kthread+0xdf/0x120
ret_from_fork+0x187/0x250
Make sure that the update of pgdta->first_deferred_pfn does not overflow
when the entire zone's (and therefore node's) memory map is initialized.
Fixes: 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()")
Cc: stable@vger.kernel.org
Assisted-by: Kiro:claude-opus-5
Signed-off-by: Alexander Graf <graf@amazon.com>
Link: https://patch.msgid.link/20260807031243.87904-1-graf@amazon.com
[rppt: massaged the changelog]
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mm_init.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -2214,10 +2214,13 @@ bool __init deferred_grow_zone(struct zo
}
/*
- * There were no pages to initialize and free which means the zone's
- * memory map is completely initialized.
+ * The loop only tests spfn before entering an iteration, so on exit it
+ * may point up to a section past the end of the zone. When it does,
+ * the rest of the zone has already been handed to
+ * deferred_init_memmap_chunk() and nothing is left to initialize.
*/
- pgdat->first_deferred_pfn = nr_pages ? spfn : ULONG_MAX;
+ pgdat->first_deferred_pfn =
+ spfn < zone_end_pfn(zone) ? spfn : ULONG_MAX;
pgdat_resize_unlock(pgdat, &flags);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 061/713] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 060/713] mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 062/713] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
` (662 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ye Liu, Sashiko, Zi Yan,
Vlastimil Babka (SUSE), Brendan Jackman, Johannes Weiner,
Lorenzo Stoakes, Michal Hocko, Suren Baghdasaryan,
David Hildenbrand (Arm), Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Liu <ye.liu@linux.dev>
commit 90f095b816e25c6a9e4446d299bac5007fdcb3df upstream.
print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the
start to guard against tail pages and NULL data. However, it later
re-reads page->memcg_data locklessly in two places:
1: page_memcg_check(page)
2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes
VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)
If the page is concurrently freed and reallocated as a THP tail page or
slab page between these calls, the VM_BUG_ON assertions can trigger on
CONFIG_DEBUG_VM=y builds, crashing the kernel.
Fix both TOCTOU issues by using the memcg_data snapshot throughout.
Link: https://lore.kernel.org/20260714015117.78351-10-ye.liu@linux.dev
Fixes: fcf8935832b8 ("mm/page_owner: print memcg information")
Signed-off-by: Ye Liu <ye.liu@linux.dev>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_owner.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -513,6 +513,7 @@ static inline int print_page_owner_memcg
{
#ifdef CONFIG_MEMCG
unsigned long memcg_data;
+ struct obj_cgroup *objcg;
struct mem_cgroup *memcg;
bool online;
char name[80];
@@ -522,11 +523,14 @@ static inline int print_page_owner_memcg
if (!memcg_data || PageTail(page))
goto out_unlock;
- if (memcg_data & MEMCG_DATA_OBJEXTS)
+ if (memcg_data & MEMCG_DATA_OBJEXTS) {
ret += scnprintf(kbuf + ret, count - ret,
"Slab cache page\n");
+ goto out_unlock;
+ }
- memcg = page_memcg_check(page);
+ objcg = (void *)(memcg_data & ~OBJEXTS_FLAGS_MASK);
+ memcg = objcg ? obj_cgroup_memcg(objcg) : NULL;
if (!memcg)
goto out_unlock;
@@ -534,7 +538,7 @@ static inline int print_page_owner_memcg
cgroup_name(memcg->css.cgroup, name, sizeof(name));
ret += scnprintf(kbuf + ret, count - ret,
"Charged %sto %smemcg %s\n",
- PageMemcgKmem(page) ? "(via objcg) " : "",
+ (memcg_data & MEMCG_DATA_KMEM) ? "(via objcg) " : "",
online ? "" : "offline ",
name);
out_unlock:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 062/713] mm/page_vma_mapped: use huge_ptep_get() for hugetlb
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 061/713] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 063/713] mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Greg Kroah-Hartman
` (661 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, David Hildenbrand (Arm),
Muchun Song, Alistair Popple, Andi Kleen, Anshuman Khandual,
Byungchul Park, Catalin Marinas, Dave Hansen, Gregory Price,
Harry Yoo, Huang, Ying, Jann Horn, Josh Poimboeuf, Joshua Hahn,
Junichi Nick Nomura, Kiryl Shutsemau, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Mel Gorman,
Naoya Horiguchi, Oscar Salvador, Pedro Falcato, Rakie Kim,
Ralph Campbell, Rik van Riel, Ryan Roberts, Vlastimil Babka,
Will Deacon, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
commit e87df0d5d6962bde50f55f6d02b779daa394f894 upstream.
check_pte() is the final validation step in page_vma_mapped_walk(). It
reads pvmw->pte with ptep_get() to decide whether the entry maps the PFN
range being walked. For hugetlb VMAs, that pointer refers to a hugetlb
entry.
On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present()
etc to misbehave.
It is not clear whether this has a trivially visible effect to userspace.
Use huge_ptep_get() to dereference a huge pte pointer.
Link: https://lore.kernel.org/20260703114202.365553-6-dev.jain@arm.com
Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_vma_mapped.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -107,7 +107,13 @@ again:
static bool check_pte(struct page_vma_mapped_walk *pvmw, unsigned long pte_nr)
{
unsigned long pfn;
- pte_t ptent = ptep_get(pvmw->pte);
+ pte_t ptent;
+
+ if (is_vm_hugetlb_page(pvmw->vma))
+ ptent = huge_ptep_get(pvmw->vma->vm_mm, pvmw->address,
+ pvmw->pte);
+ else
+ ptent = ptep_get(pvmw->pte);
if (pvmw->flags & PVMW_MIGRATION) {
const softleaf_t entry = softleaf_from_pte(ptent);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 063/713] mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 062/713] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 064/713] mm/rmap: use huge_ptep_get() in try_to_unmap_one() Greg Kroah-Hartman
` (660 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Lorenzo Stoakes (ARM),
David Hildenbrand (Arm), Max Boone, Liam R. Howlett, Michal Hocko,
Mike Rapoport, Suren Baghdasaryan, Vlastimil Babka, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit aedf2efd18977e0cef7eb963166e2b1fcc0aa321 upstream.
If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is
retried. The PMD entry may be cleared at the point of retry.
In this case, if walk->ops->install_pte is not specified, the code
continues to the next PMD entry in the range without resetting
walk->action to ACTION_SUBTREE.
This leaves walk->action erroneously set to ACTION_AGAIN, which is
incorrect.
This was incorrect but not problematic up until commit 3b89863c3fa4
("mm/pagewalk: fix race between concurrent split and refault") which
updated walk_pud_range() to check for walk->action == ACTION_AGAIN upon
walk_pmd_range()'s return, causing the PUD walk to be retried.
In this case this results in duplicate walk callbacks being invoked,
which is erroneous and will break any caller that is not idempotent
with respect to this (and waste time for those which are). The result
is an out-of-bounds write, triggered by a local fuzzer:
[ 2.272695] ==================================================================
[ 2.273471] BUG: KASAN: slab-out-of-bounds in __mincore_unmapped_range+0x14f/0x190
[ 2.274302] Write of size 1 at addr ffff888008d9b000 by task poc/106
[ 2.274966]
[ 2.275154] CPU: 0 UID: 1000 PID: 106 Comm: poc Not tainted 7.2.0-rc6-00429-ga7c7074b58d2 #55 PREEMPT(lazy)
[ 2.275159] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 2.275164] Call Trace:
[ 2.275170] <TASK>
[ 2.275172] dump_stack_lvl+0x53/0x70
[ 2.275200] print_report+0xd0/0x630
[ 2.275210] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 2.275219] ? irqentry_exit+0xd2/0x670
[ 2.275224] ? irqentry_exit+0xd2/0x670
[ 2.275226] ? __virt_addr_valid+0xef/0x1a0
[ 2.275239] ? __mincore_unmapped_range+0x14f/0x190
[ 2.275242] kasan_report+0xce/0x100
[ 2.275245] ? __mincore_unmapped_range+0x14f/0x190
[ 2.275248] __mincore_unmapped_range+0x14f/0x190
[ 2.275252] mincore_unmapped_range+0x45/0x70
[ 2.275254] walk_pgd_range+0xafc/0xfc0
[ 2.275261] ? __pfx_walk_pgd_range+0x10/0x10
[ 2.275264] ? __update_load_avg_se+0x3d1/0x670
[ 2.275275] __walk_page_range+0xc0/0x310
[ 2.275278] ? __pfx_find_vma+0x10/0x10
[ 2.275281] ? finish_task_switch.isra.0+0x16d/0x4f0
[ 2.275290] walk_page_range_mm_unsafe+0x26f/0x3a0
[ 2.275293] ? __pfx_mtree_load+0x10/0x10
[ 2.275298] ? __pfx_walk_page_range_mm_unsafe+0x10/0x10
[ 2.275302] ? __free_frozen_pages+0x54d/0x7e0
[ 2.275308] __do_sys_mincore+0x132/0x380
[ 2.275311] do_syscall_64+0xf9/0x540
[ 2.275316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2.275322] RIP: 0033:0x422ccd
[ 2.275326] Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 2.275329] RSP: 002b:00007fffffffec18 EFLAGS: 00000287 ORIG_RAX: 000000000000001b
[ 2.275337] RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000422ccd
[ 2.275339] RDX: 00000000004d0940 RSI: 0000000001000000 RDI: 00007ffff4000000
[ 2.275340] RBP: 00000000004d0940 R08: 0000000000000100 R09: 0000000000000100
[ 2.275342] R10: 0000000000000100 R11: 0000000000000287 R12: 20c49ba5e353f7cf
[ 2.275343] R13: 00000000004990d3 R14: 0000000000000000 R15: 0000000000000001
[ 2.275346] </TASK>
[ 2.275347]
[ 2.296904] The buggy address belongs to the object at ffff888008d9b000
[ 2.296904] which belongs to the cache sigqueue of size 80
[ 2.298151] The buggy address is located 0 bytes inside of
[ 2.298151] allocated 80-byte region [ffff888008d9b000, ffff888008d9b050)
[ 2.299408]
[ 2.299601] The buggy address belongs to the physical page:
[ 2.300191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8d9b
[ 2.301001] flags: 0x100000000000000(node=0|zone=1)
[ 2.301535] page_type: f5(slab)
[ 2.301884] raw: 0100000000000000 ffff888107e46780 dead000000000122 0000000000000000
[ 2.302687] raw: 0000000000000000 0000000800240024 00000000f5000000 0000000000000000
[ 2.303489] page dumped because: kasan: bad access detected
[ 2.304092]
[ 2.304276] Memory state around the buggy address:
[ 2.304801] ffff888008d9af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 2.305567] ffff888008d9af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 2.306340] >ffff888008d9b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2.307115] ^
[ 2.307474] ffff888008d9b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2.308237] ffff888008d9b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2.308997] ==================================================================
A specific example of this breaking things is mincore which walks an
internal cursor data structure a byte at a time on assumption that page
table entry callbacks are called only once for each entry.
Fix the problem by resetting walk->action to ACTION_SUBTREE prior to the
none check.
The pattern also exists in walk_pud_range() so fix it there too.
This issue was found through AI-based fuzzing.
Link: https://lore.kernel.org/20260811161949.3879321-2-imv4bel@gmail.com
Fixes: 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Max Boone <mboone@akamai.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/pagewalk.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -126,6 +126,7 @@ static int walk_pmd_range(pud_t *pud, un
pmd = pmd_offset(pud, addr);
do {
again:
+ walk->action = ACTION_SUBTREE;
next = pmd_addr_end(addr, end);
if (pmd_none(*pmd)) {
if (has_install)
@@ -138,8 +139,6 @@ again:
continue;
}
- walk->action = ACTION_SUBTREE;
-
/*
* This implies that each ->pmd_entry() handler
* needs to know about pmd_trans_huge() pmds
@@ -196,6 +195,7 @@ static int walk_pud_range(p4d_t *p4d, un
pud = pud_offset(p4d, addr);
do {
again:
+ walk->action = ACTION_SUBTREE;
next = pud_addr_end(addr, end);
if (pud_none(*pud)) {
if (has_install)
@@ -208,8 +208,6 @@ static int walk_pud_range(p4d_t *p4d, un
continue;
}
- walk->action = ACTION_SUBTREE;
-
if (ops->pud_entry)
err = ops->pud_entry(pud, addr, next, walk);
if (err)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 064/713] mm/rmap: use huge_ptep_get() in try_to_unmap_one()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 063/713] mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 065/713] mm/rmap: use huge_ptep_get() in try_to_migrate_one() Greg Kroah-Hartman
` (659 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, David Hildenbrand,
Muchun Song, Alistair Popple, Andi Kleen, Anshuman Khandual,
Byungchul Park, Catalin Marinas, Dave Hansen, Gregory Price,
Harry Yoo, Huang, Ying, Jann Horn, Josh Poimboeuf, Joshua Hahn,
Junichi Nick Nomura, Kiryl Shutsemau, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Mel Gorman,
Naoya Horiguchi, Oscar Salvador, Pedro Falcato, Rakie Kim,
Ralph Campbell, Rik van Riel, Ryan Roberts, Vlastimil Babka,
Will Deacon, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
commit f5407e9b697c940e78b27ff63c6e14d8d171adc3 upstream.
Patch series "Fix incorrect access of hugetlb pte entries", v3.
There are various places which use ptep_get() to get the pte entry
corresponding to a hugetlb folio. Some arches (like s390) have special
handling to compute the pteval, so they provide huge_ptep_get(). Use this
helper consistently.
Additionally, some code paths may provide huge_ptep_get with an unaligned
address. This is a problem on arm64 (I checked other arches and it looks
fine for them), which is fixed in patch 1. The fix is made to be
backport-friendly: the cleaner fix would be to perhaps pass the hstate to
huge_ptep_get() - that is wider churn and we can do that later.
This patch (of 5):
try_to_unmap_one() handles hugetlb folios when memory failure needs to
replace a poisoned hugetlb mapping with a hwpoison entry. In that case
page_vma_mapped_walk() returns the pte pointer to the hugetlb folio in
pvmw.pte, but the code reads it with ptep_get().
On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present()
etc to misbehave.
It is not clear whether this has a trivially visible effect to userspace.
Just use huge_ptep_get() for dereferencing a huge pte pointer.
Link: https://lore.kernel.org/20260703114202.365553-1-dev.jain@arm.com
Link: https://lore.kernel.org/20260703114202.365553-3-dev.jain@arm.com
Fixes: c7ab0d2fdc84 ("mm: convert try_to_unmap_one() to use page_vma_mapped_walk()")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Reported-by: David Hildenbrand <david@kernel.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/hugetlb.h | 2 ++
mm/rmap.c | 16 ++++++++++------
2 files changed, 12 insertions(+), 6 deletions(-)
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -1262,6 +1262,8 @@ static inline void hugetlb_count_sub(lon
{
}
+pte_t huge_ptep_get(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+
static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
unsigned long addr, pte_t *ptep)
{
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2095,14 +2095,19 @@ static bool try_to_unmap_one(struct foli
/* Unexpected PMD-mapped THP? */
VM_BUG_ON_FOLIO(!pvmw.pte, folio);
- /*
- * Handle PFN swap PTEs, such as device-exclusive ones, that
- * actually map pages.
- */
- pteval = ptep_get(pvmw.pte);
+ address = pvmw.address;
+ if (folio_test_hugetlb(folio)) {
+ pteval = huge_ptep_get(mm, address, pvmw.pte);
+ } else {
+ pteval = ptep_get(pvmw.pte);
+ }
if (likely(pte_present(pteval))) {
pfn = pte_pfn(pteval);
} else {
+ /*
+ * Handle PFN swap PTEs, such as device-exclusive ones,
+ * that actually map pages.
+ */
const softleaf_t entry = softleaf_from_pte(pteval);
pfn = softleaf_to_pfn(entry);
@@ -2110,7 +2115,6 @@ static bool try_to_unmap_one(struct foli
}
subpage = folio_page(folio, pfn - folio_pfn(folio));
- address = pvmw.address;
anon_exclusive = folio_test_anon(folio) &&
PageAnonExclusive(subpage);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 065/713] mm/rmap: use huge_ptep_get() in try_to_migrate_one()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 064/713] mm/rmap: use huge_ptep_get() in try_to_unmap_one() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 066/713] mm/slub: fix missing debugfs entries for caches created before sysfs init Greg Kroah-Hartman
` (658 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, Muchun Song,
David Hildenbrand (Arm), Alistair Popple, Andi Kleen,
Anshuman Khandual, Byungchul Park, Catalin Marinas, Dave Hansen,
Gregory Price, Harry Yoo, Huang, Ying, Jann Horn, Josh Poimboeuf,
Joshua Hahn, Junichi Nick Nomura, Kiryl Shutsemau, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Mel Gorman,
Naoya Horiguchi, Oscar Salvador, Pedro Falcato, Rakie Kim,
Ralph Campbell, Rik van Riel, Ryan Roberts, Vlastimil Babka,
Will Deacon, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
commit 9be12ffa78cd087d41086f937a156435d4e588e9 upstream.
try_to_migrate_one() is used by folio migration to replace a present
mapping with a migration entry. For hugetlb folios, page_vma_mapped_walk()
returns the pte pointer to the hugetlb folio in pvmw.pte, but the code
reads the huge pte entry with ptep_get().
On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present()
etc to misbehave.
It is not clear whether this has a trivially visible effect to userspace.
Use huge_ptep_get() to dereference a huge pte pointer.
Commit a98a2f0c8ce1 copied the bug from try_to_unmap_one into
try_to_migrate_one.
[akpm@linux-foundation.org: coding-style cleanups]
Link: https://lore.kernel.org/20260703114202.365553-4-dev.jain@arm.com
Fixes: a98a2f0c8ce1 ("mm/rmap: split migration into its own function")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/rmap.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2505,14 +2505,18 @@ static bool try_to_migrate_one(struct fo
/* Unexpected PMD-mapped THP? */
VM_BUG_ON_FOLIO(!pvmw.pte, folio);
- /*
- * Handle PFN swap PTEs, such as device-exclusive ones, that
- * actually map pages.
- */
- pteval = ptep_get(pvmw.pte);
+ address = pvmw.address;
+ if (folio_test_hugetlb(folio))
+ pteval = huge_ptep_get(mm, address, pvmw.pte);
+ else
+ pteval = ptep_get(pvmw.pte);
if (likely(pte_present(pteval))) {
pfn = pte_pfn(pteval);
} else {
+ /*
+ * Handle PFN swap PTEs, such as device-exclusive ones,
+ * that actually map pages.
+ */
const softleaf_t entry = softleaf_from_pte(pteval);
pfn = softleaf_to_pfn(entry);
@@ -2520,7 +2524,6 @@ static bool try_to_migrate_one(struct fo
}
subpage = folio_page(folio, pfn - folio_pfn(folio));
- address = pvmw.address;
anon_exclusive = folio_test_anon(folio) &&
PageAnonExclusive(subpage);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 066/713] mm/slub: fix missing debugfs entries for caches created before sysfs init
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 065/713] mm/rmap: use huge_ptep_get() in try_to_migrate_one() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 067/713] mm/slub: prevent pfmemalloc objects from entering the barn Greg Kroah-Hartman
` (657 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlastimil Babka, Li Xiasong,
Harry Yoo (Oracle)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <lixiasong1@huawei.com>
commit 7e98f856395618011c517f767fb80ac3fe90de2b upstream.
slab_debugfs_init() creates the slab debugfs root at device initcall
time, while slab_sysfs_init() moves slab_state to FULL at late initcall
time. SLAB_STORE_USER caches created in this window miss their debugfs
entries because do_kmem_cache_create() skips debugfs_slab_add() when
slab_state <= UP. This was observed with MPTCP's request_sock_subflow_v6
cache, whose slab debugfs directory was missing.
The affected window is:
slab_debugfs_init()
slab_debugfs_root = debugfs_create_dir(...)
list_for_each_entry(s, &slab_caches, list)
debugfs_slab_add(s)
kmem_cache_create(..., SLAB_STORE_USER, ...)
do_kmem_cache_create()
if (slab_state <= UP)
return without debugfs entries
slab_sysfs_init()
slab_state = FULL
Initialize the debugfs root and add debugfs entries while holding
slab_mutex, walking slab_caches exactly once and handling both sysfs
and debugfs entries in the same pass. This gives the sysfs and debugfs
initialization an explicit order and prevents caches from being
created between the debugfs scan and slab_state reaching FULL.
Gate the new slab_late_init() on either sysfs or debugfs being enabled,
with the slab_kset creation and alias_list processing factored into
helpers that have empty no-sysfs variants, as suggested by Vlastimil
Babka. On slab_kset_init() failure, slab_state stays below FULL so
kmem_cache_create() keeps taking the early-boot path, matching prior
behavior.
Guard debugfs_slab_release() against an uninitialized debugfs root,
since the root is now created later and a cache may be released before
it exists.
Fixes: 1a5ad30b89b4 ("mm: slub: make slab_sysfs_init() a late_initcall")
Cc: stable@vger.kernel.org
Suggested-by: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
Link: https://patch.msgid.link/20260729101849.3734287-1-lixiasong1@huawei.com
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slub.c | 76 +++++++++++++++++++++++++++++++++++++++-----------------------
1 file changed, 48 insertions(+), 28 deletions(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -333,14 +333,20 @@ enum track_item { TRACK_ALLOC, TRACK_FRE
#ifdef SLAB_SUPPORTS_SYSFS
static int sysfs_slab_add(struct kmem_cache *);
+static int __init slab_kset_init(void);
+static void __init slab_sysfs_process_aliases(void);
#else
static inline int sysfs_slab_add(struct kmem_cache *s) { return 0; }
+static inline int slab_kset_init(void) { return 0; }
+static inline void slab_sysfs_process_aliases(void) { }
#endif
#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_SLUB_DEBUG)
static void debugfs_slab_add(struct kmem_cache *);
+static void __init slab_debugfs_root_init(void);
#else
static inline void debugfs_slab_add(struct kmem_cache *s) { }
+static inline void slab_debugfs_root_init(void) { }
#endif
enum add_mode {
@@ -9734,28 +9740,20 @@ int sysfs_slab_alias(struct kmem_cache *
return 0;
}
-static int __init slab_sysfs_init(void)
+static int __init slab_kset_init(void)
{
- struct kmem_cache *s;
- int err;
-
- mutex_lock(&slab_mutex);
-
slab_kset = kset_create_and_add("slab", NULL, kernel_kobj);
if (!slab_kset) {
- mutex_unlock(&slab_mutex);
pr_err("Cannot register slab subsystem.\n");
return -ENOMEM;
}
- slab_state = FULL;
+ return 0;
+}
- list_for_each_entry(s, &slab_caches, list) {
- err = sysfs_slab_add(s);
- if (err)
- pr_err("SLUB: Unable to add boot slab %s to sysfs\n",
- s->name);
- }
+static void __init slab_sysfs_process_aliases(void)
+{
+ int err;
while (alias_list) {
struct saved_alias *al = alias_list;
@@ -9767,12 +9765,41 @@ static int __init slab_sysfs_init(void)
al->name);
kfree(al);
}
+}
+#endif /* SLAB_SUPPORTS_SYSFS */
+
+#if defined(SLAB_SUPPORTS_SYSFS) || \
+ (defined(CONFIG_SLUB_DEBUG) && defined(CONFIG_DEBUG_FS))
+static int __init slab_late_init(void)
+{
+ struct kmem_cache *s;
+ int err;
+ mutex_lock(&slab_mutex);
+
+ err = slab_kset_init();
+ if (err)
+ goto out;
+
+ slab_debugfs_root_init();
+ slab_state = FULL;
+
+ list_for_each_entry(s, &slab_caches, list) {
+ if (sysfs_slab_add(s))
+ pr_err("SLUB: Unable to add boot slab %s to sysfs\n",
+ s->name);
+
+ if (s->flags & SLAB_STORE_USER)
+ debugfs_slab_add(s);
+ }
+
+ slab_sysfs_process_aliases();
+out:
mutex_unlock(&slab_mutex);
- return 0;
+ return err;
}
-late_initcall(slab_sysfs_init);
-#endif /* SLAB_SUPPORTS_SYSFS */
+late_initcall(slab_late_init);
+#endif
#if defined(CONFIG_SLUB_DEBUG) && defined(CONFIG_DEBUG_FS)
static int slab_debugfs_show(struct seq_file *seq, void *v)
@@ -9964,23 +9991,16 @@ static void debugfs_slab_add(struct kmem
void debugfs_slab_release(struct kmem_cache *s)
{
+ if (unlikely(!slab_debugfs_root))
+ return;
+
debugfs_lookup_and_remove(s->name, slab_debugfs_root);
}
-static int __init slab_debugfs_init(void)
+static void __init slab_debugfs_root_init(void)
{
- struct kmem_cache *s;
-
slab_debugfs_root = debugfs_create_dir("slab", NULL);
-
- list_for_each_entry(s, &slab_caches, list)
- if (s->flags & SLAB_STORE_USER)
- debugfs_slab_add(s);
-
- return 0;
-
}
-__initcall(slab_debugfs_init);
#endif
/*
* The /proc/slabinfo ABI
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 067/713] mm/slub: prevent pfmemalloc objects from entering the barn
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 066/713] mm/slub: fix missing debugfs entries for caches created before sysfs init Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 068/713] mm/vmalloc: make vm_struct.nr_pages an unsigned long Greg Kroah-Hartman
` (656 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengming Hu, Harry Yoo (Oracle),
Hao Li, Vlastimil Babka (SUSE)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengming Hu <hu.shengming@zte.com.cn>
commit 9338b189be6895e45cf6fcf819c55cd3c47e4a18 upstream.
kmem_cache_return_sheaf() may refill a partially consumed sheaf before
placing it in the barn. Without an explicit restriction, this refill may
draw objects from pfmemalloc slabs and consume emergency reserves.
Add __GFP_NOMEMALLOC so that returned sheaves are refilled only from
non-pfmemalloc slabs. Also add __GFP_NOWARN, as suggested by Hao Li,
because this refill is a best-effort attempt and failure is acceptable.
If the refill fails, flush and free the sheaf instead.
Fixes: 1ce20c28eafd ("slab: handle pfmemalloc slabs properly with sheaves")
Cc: stable@vger.kernel.org
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Hao Li <hao.li@linux.dev>
Link: https://patch.msgid.link/20260721084522552ZPa16p1SRj3PYat3sqxuN@zte.com.cn
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5153,7 +5153,7 @@ void kmem_cache_return_sheaf(struct kmem
* simply flush and free it.
*/
if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
- refill_sheaf(s, sheaf, gfp)) {
+ refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC | __GFP_NOWARN)) {
sheaf_flush_unused(s, sheaf);
free_empty_sheaf(s, sheaf);
return;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 068/713] mm/vmalloc: make vm_struct.nr_pages an unsigned long
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 067/713] mm/slub: prevent pfmemalloc objects from entering the barn Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 069/713] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
` (655 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artem Lytkin, Andrew Morton,
Uladzislau Rezki (Sony), Matthew Wilcox (Oracle), shivamkalra98
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Lytkin <iprintercanon@gmail.com>
commit 272b0d84b17f72f6396254dbaa6264f2f74a7997 upstream.
vm_struct::nr_pages is an unsigned int, and the file keeps deriving byte
counts from it as nr_pages << PAGE_SHIFT. A shift is evaluated in the
type of its promoted left operand, so those are 32-bit arithmetic and wrap
at 4 GiB of bytes, which is 2^20 pages. Every site depends on a cast
being remembered; vmap() has one, two recent commits did not.
vread_iter() then computes a size of zero for a 4 GiB VM_ALLOC area and
/proc/kcore returns it as zeros while reporting a successful read, which
drgn, crash or gdb cannot tell from real memory, and the vrealloc()
grow-in-place check declines a request that would have fit.
Widen the field so the class of bug goes away instead of one site at a
time. Everything feeding or consuming it widens too:
vm_area_alloc_pages() and its accumulators, nr_small_pages, new_nr_pages
and old_nr_pages, the index range of vm_area_free_pages(), and three page
indexes that were plain int. Five casts go. Two prints needed fixing as
well, %u in vmalloc_dump_obj() and %d for the unsigned field in
vmalloc_info_show().
No bug report behind this, I found it reading the code. The 4 GiB wrap
needs only a machine with over 4 GiB of memory. Neither larger threshold
is a practical concern: 2^32 pages, where the field itself truncates, is
16 TiB and beyond what hardware can populate, and 2^31, where the plain
int indexes break, is 8 TiB and larger than anything in the tree asks for.
The int *nr cursor in the mapping path is unchanged and is separate work.
Users outside mm/vmalloc.c need no change either. Those handing the
count to a narrower parameter cannot drive it near 2^31, and
kho_preserve_vmalloc() stores it into a 32-bit ABI field that still
receives the same low bits; above 2^32 pages the truncation just moves out
of vm_struct into that store.
sizeof(struct vm_struct) on x86-64 stays 72 bytes with
CONFIG_HAVE_ARCH_HUGE_VMALLOC=n and goes from 72 to 80 with it enabled,
both inside the kmalloc-96 bucket it already comes from.
Link: https://lore.kernel.org/20260801114915.115224-1-iprintercanon@gmail.com
Fixes: 0bca23804632 ("mm/vmalloc: use physical page count in vread_iter() for VM_ALLOC areas")
Fixes: d57ac904ffdc ("mm/vmalloc: use physical page count for vrealloc() grow-in-place check")
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Assisted-by: Claude:claude-fable-5
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <shivamkalra98@zohomail.in>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/vmalloc.h | 2 -
mm/vmalloc.c | 60 +++++++++++++++++++++++-------------------------
2 files changed, 30 insertions(+), 32 deletions(-)
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -62,7 +62,7 @@ struct vm_struct {
#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC
unsigned int page_order;
#endif
- unsigned int nr_pages;
+ unsigned long nr_pages;
phys_addr_t phys_addr;
const void *caller;
unsigned long requested_size;
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3360,7 +3360,7 @@ struct vm_struct *remove_vm_area(const v
static inline void set_area_direct_map(const struct vm_struct *area,
int (*set_direct_map)(struct page *page))
{
- int i;
+ unsigned long i;
/* HUGE_VMALLOC passes small pages to set_direct_map */
for (i = 0; i < area->nr_pages; i++)
@@ -3376,7 +3376,7 @@ static void vm_reset_perms(struct vm_str
unsigned long start = ULONG_MAX, end = 0;
unsigned int page_order = vm_area_page_order(area);
int flush_dmap = 0;
- int i;
+ unsigned long i;
/*
* Find the start and end range of the direct mappings to make sure that
@@ -3449,10 +3449,10 @@ void vfree_atomic(const void *addr)
* Caller is responsible for unmapping (vunmap_range) and KASAN
* poisoning before calling this.
*/
-static void vm_area_free_pages(struct vm_struct *vm, unsigned int start_idx,
- unsigned int end_idx)
+static void vm_area_free_pages(struct vm_struct *vm, unsigned long start_idx,
+ unsigned long end_idx)
{
- unsigned int i;
+ unsigned long i;
if (!(vm->flags & VM_MAP_PUT_PAGES)) {
for (i = start_idx; i < end_idx; i++)
@@ -3664,12 +3664,12 @@ static inline gfp_t vmalloc_gfp_adjust(g
return flags;
}
-static inline unsigned int
+static inline unsigned long
vm_area_alloc_pages(gfp_t gfp, int nid,
- unsigned int order, unsigned int nr_pages, struct page **pages)
+ unsigned int order, unsigned long nr_pages, struct page **pages)
{
- unsigned int nr_allocated = 0;
- unsigned int nr_remaining = nr_pages;
+ unsigned long nr_allocated = 0;
+ unsigned long nr_remaining = nr_pages;
unsigned int max_attempt_order = MAX_PAGE_ORDER;
struct page *page;
int i;
@@ -3717,7 +3717,7 @@ vm_area_alloc_pages(gfp_t gfp, int nid,
if (!order) {
while (nr_allocated < nr_pages) {
unsigned int nr, nr_pages_request;
- int i;
+ unsigned long i;
/*
* A maximum allowed request is hard-coded and is 100
@@ -3725,7 +3725,7 @@ vm_area_alloc_pages(gfp_t gfp, int nid,
* long preemption off scenario in the bulk-allocator
* so the range is [1:100].
*/
- nr_pages_request = min(100U, nr_pages - nr_allocated);
+ nr_pages_request = min(100UL, nr_pages - nr_allocated);
/* memory allocation should consider mempolicy, we can't
* wrongly use nearest node when nid == NUMA_NO_NODE,
@@ -3871,12 +3871,12 @@ static void *__vmalloc_area_node(struct
unsigned long addr = (unsigned long)area->addr;
unsigned long size = get_vm_area_size(area);
unsigned long array_size;
- unsigned int nr_small_pages = size >> PAGE_SHIFT;
+ unsigned long nr_small_pages = size >> PAGE_SHIFT;
unsigned int page_order;
unsigned int flags;
int ret;
- array_size = (unsigned long)nr_small_pages * sizeof(struct page *);
+ array_size = nr_small_pages * sizeof(struct page *);
/* __GFP_NOFAIL and "noblock" flags are mutually exclusive. */
if (!gfpflags_allow_blocking(gfp_mask))
@@ -4374,7 +4374,7 @@ void *vrealloc_node_align_noprof(const v
}
if (size <= old_size) {
- unsigned int new_nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+ unsigned long new_nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
/* Zero out "freed" memory, potentially for future realloc. */
if (want_init_on_free() || want_init_on_alloc(flags))
@@ -4403,7 +4403,7 @@ void *vrealloc_node_align_noprof(const v
!(vm->flags & (VM_FLUSH_RESET_PERMS | VM_USERMAP)) &&
gfp_has_io_fs(flags)) {
unsigned long addr = (unsigned long)kasan_reset_tag(p);
- unsigned int old_nr_pages = vm->nr_pages;
+ unsigned long old_nr_pages = vm->nr_pages;
/*
* Use the node lock to synchronize with concurrent
@@ -4416,16 +4416,13 @@ void *vrealloc_node_align_noprof(const v
spin_unlock(&vn->busy.lock);
/* Notify kmemleak of the reduced allocation size before unmapping. */
- kmemleak_free_part(
- (void *)addr + ((unsigned long)new_nr_pages
- << PAGE_SHIFT),
- (unsigned long)(old_nr_pages - new_nr_pages)
- << PAGE_SHIFT);
-
- vunmap_range(addr + ((unsigned long)new_nr_pages
- << PAGE_SHIFT),
- addr + ((unsigned long)old_nr_pages
- << PAGE_SHIFT));
+ kmemleak_free_part((void *)addr +
+ (new_nr_pages << PAGE_SHIFT),
+ (old_nr_pages - new_nr_pages)
+ << PAGE_SHIFT);
+
+ vunmap_range(addr + (new_nr_pages << PAGE_SHIFT),
+ addr + (old_nr_pages << PAGE_SHIFT));
vm_area_free_pages(vm, new_nr_pages, old_nr_pages);
}
@@ -5250,7 +5247,7 @@ bool vmalloc_dump_obj(void *object)
struct vmap_area *va;
struct vmap_node *vn;
unsigned long addr;
- unsigned int nr_pages;
+ unsigned long nr_pages;
addr = PAGE_ALIGN((unsigned long) object);
vn = addr_to_node(addr);
@@ -5270,7 +5267,7 @@ bool vmalloc_dump_obj(void *object)
nr_pages = vm->nr_pages;
spin_unlock(&vn->busy.lock);
- pr_cont(" %u-page vmalloc region starting at %#lx allocated at %pS\n",
+ pr_cont(" %lu-page vmalloc region starting at %#lx allocated at %pS\n",
nr_pages, addr, caller);
return true;
@@ -5288,16 +5285,17 @@ bool vmalloc_dump_obj(void *object)
static void show_numa_info(struct seq_file *m, struct vm_struct *v,
unsigned int *counters)
{
- unsigned int nr;
unsigned int step = 1U << vm_area_page_order(v);
+ unsigned long i;
+ unsigned int nr;
if (!counters)
return;
memset(counters, 0, nr_node_ids * sizeof(unsigned int));
- for (nr = 0; nr < v->nr_pages; nr += step)
- counters[page_to_nid(v->pages[nr])] += step;
+ for (i = 0; i < v->nr_pages; i += step)
+ counters[page_to_nid(v->pages[i])] += step;
for_each_node_state(nr, N_HIGH_MEMORY)
if (counters[nr])
seq_printf(m, " N%u=%u", nr, counters[nr]);
@@ -5355,7 +5353,7 @@ static int vmalloc_info_show(struct seq_
seq_printf(m, " %pS", v->caller);
if (v->nr_pages)
- seq_printf(m, " pages=%d", v->nr_pages);
+ seq_printf(m, " pages=%lu", v->nr_pages);
if (v->phys_addr)
seq_printf(m, " phys=%pa", &v->phys_addr);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 069/713] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 068/713] mm/vmalloc: make vm_struct.nr_pages an unsigned long Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 070/713] mm/zswap: fix global shrinker when memory cgroup is disabled Greg Kroah-Hartman
` (654 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
Johannes Weiner, Shakeel Butt, Axel Rasmussen, Barry Song,
David Hildenbrand, Kairui Song, Lorenzo Stoakes, Michal Hocko,
Wei Xu, Yuanchu Xie, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 25f52e81216884a7444bf07a606691feb09a94e3 upstream.
I am seeing some rcu_tasks stalls in the Meta fleet during reclaim.
INFO: rcu_tasks detected stalls on tasks:
0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8
task:GlobalCPUThread state:R running task pid:2552016 tgid:2524552
Call Trace:
shrink_lruvec
mem_cgroup_iter
shrink_node
do_try_to_free_pages
try_to_free_pages
__alloc_frozen_pages_noprof
alloc_pages_noprof
pte_alloc_one
__pte_alloc
handle_mm_fault
Nothing promises direct reclaim returns in bounded time, and the scan loop
in shrink_lruvec() only calls cond_resched(), which is a no-op on
PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent
state, so the reclaiming task never reports one and becomes a holdout.
Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent state
even when cond_resched() does nothing.
PS: This has been discussed in [1]
Link: https://lore.kernel.org/20260810-rcu_task_shrink_lruvec-v1-1-4d9f7d5251cb@debian.org
Link: https://lore.kernel.org/all/amdWVTs0WKOxguxP@gmail.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -5918,7 +5918,7 @@ static void shrink_lruvec(struct lruvec
}
}
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (nr_reclaimed < nr_to_reclaim || proportional_reclaim)
continue;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 070/713] mm/zswap: fix global shrinker when memory cgroup is disabled
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 069/713] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 071/713] mm: compaction: support non-movable compaction for pageblock requests Greg Kroah-Hartman
` (653 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Jia, Nhat Pham, Yosry Ahmed,
Chengming Zhou, Johannes Weiner, Michal Hocko, Michal Koutný,
Muchun Song, Roman Gushchin, Shakeel Butt, Tejun Heo,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Jia <jiahao1@lixiang.com>
commit dc8458f43fe964d8ade74c9b0fce54fe71d156de upstream.
Patch series "mm/zswap: Fixes and improves the zswap shrink", v4.
This series fixes and improves the zswap global shrinker
(shrink_worker()): Patch 1: Fix missing global shrinker when memory cgroup
is disabled. Patch 2: Extend shrink_memcg() to support batch writeback
and thereby improving the writeback efficiency in the shrink_worker() and
zswap_store() paths.
This patch (of 2):
Zswap writeback when the global pool limit is hit fails when memory cgroup
is disabled. The pool remains full until it is organically drained by
swapins or memory freeing, leading to zswap store failures and pages
bypassing getting written directly to the backing swap device, causing LRU
inversion (hotter pages with higher fault latency).
This happens because mem_cgroup_iter() always returns NULL when memory
cgroups are disabled. As a result, the global shrinker shrink_worker()
repeatedly takes empty walks. After MAX_RECLAIM_RETRIES failed attempts,
the worker gives up without writing back any pages.
Therefore, when memory cgroup is disabled, fall through with the !memcg
branch and shrink the root memcg directly.
With memcg disabled, shrink_memcg() only returns -ENOENT when the root LRU
is empty, which means the total pages are already below thr. In the
absence of heavy concurrent zswap stores, the loop then safely bails out
via the zswap_total_pages() <= thr check; otherwise, it will resume
shrinking the memcg after processing the reschedule check. For any other
return value from shrink_memcg(), the loop is guaranteed to terminate,
either after MAX_RECLAIM_RETRIES failures or once the threshold is met.
This is a potential performance regression for people using zswap
without memcg that was introduced by the commit in "Fixes".
Link: https://lore.kernel.org/20260806070943.95542-1-jiahao.kernel@gmail.com
Link: https://lore.kernel.org/20260806070943.95542-2-jiahao.kernel@gmail.com
Fixes: a65b0e7607cc ("zswap: make shrinking memcg-aware")
Signed-off-by: Hao Jia <jiahao1@lixiang.com>
Suggested-by: Nhat Pham <nphamcs@gmail.com>
Acked-by: Nhat Pham <nphamcs@gmail.com>
Acked-by: Yosry Ahmed <yosry@kernel.org>
Reported-by: Yosry Ahmed <yosry@kernel.org>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/zswap.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1356,11 +1356,12 @@ static void shrink_worker(struct work_st
} while (memcg && !mem_cgroup_tryget_online(memcg));
spin_unlock(&zswap_shrink_lock);
- if (!memcg) {
- /*
- * Continue shrinking without incrementing failures if
- * we found candidate memcgs in the last tree walk.
- */
+ /*
+ * A NULL memcg ends a full hierarchy pass (except when memcg is
+ * disabled, where it is always NULL: fall through to the root LRU).
+ * Count a failure only if the last pass found no candidates.
+ */
+ if (!memcg && !mem_cgroup_disabled()) {
if (!attempts && ++failures == MAX_RECLAIM_RETRIES)
break;
@@ -1379,7 +1380,7 @@ static void shrink_worker(struct work_st
* and failures.
*/
if (ret == -ENOENT)
- continue;
+ goto resched;
++attempts;
if (ret && ++failures == MAX_RECLAIM_RETRIES)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 071/713] mm: compaction: support non-movable compaction for pageblock requests
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 070/713] mm/zswap: fix global shrinker when memory cgroup is disabled Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 072/713] mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Greg Kroah-Hartman
` (652 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Weiner,
Vlastimil Babka (SUSE), Gregory Price, Brendan Jackman,
Brendan Jackman, David Hildenbrand, Liam R. Howlett,
Lorenzo Stoakes, Michal Hocko, Mike Rapoport, Shakeel Butt,
Suren Baghdasaryan, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit 1b4b697a5743e624cc259d6c31a8d8716b796305 upstream.
While trying to fix a reclaim storm in defrag_mode, I noticed that
non-movable direct compaction is extremely inefficient.
When searching for space to evacuate, compaction only allows blocks of the
same type as the incoming request. This is to prevent migratetype
pollution, where a small non-movable request frees space in a movable
block and provokes the allocator to fall back and pollute it.
This protection is reasonable on one hand, but the downside is that it
makes non-movable direct compaction nearly useless: if we get the type
annotations right, by definition there aren't any movable pages inside the
non-movable blocks it is allowed to scan.
With defrag_mode, the goal is the production of whole blocks, which are
essentially type neutral: __rmqueue_claim() will convert them wholesale on
alloc. This makes type mixing and pollution a non-issue.
Fix the pollution gates to take the requested order into account, and
allow whole-block requests to scan blocks of other types.
The only exception is CMA blocks. That type is sticky and these blocks
cannot be claimed to other types. Continue to be strict with them, and
allow only explicit ALLOC_CMA requests and kcompactd to evacuate them.
Link: https://lore.kernel.org/20260722150006.3848560-3-hannes@cmpxchg.org
Fixes: e3aa7df331bc ("mm: page_alloc: defrag_mode")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Gregory Price <gourry@gourry.net>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 46 +++++++++++++++++++++++++++++++++++++++-------
1 file changed, 39 insertions(+), 7 deletions(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1381,12 +1381,44 @@ static bool suitable_migration_source(st
if (pageblock_skip_persistent(page))
return false;
- if ((cc->mode != MIGRATE_ASYNC) || !cc->direct_compaction)
+ /*
+ * Background compaction produces blocks for the zone at
+ * large, with no particular allocation context. Allow all
+ * block types, including CMA.
+ */
+ if (!cc->direct_compaction)
return true;
block_mt = get_pageblock_migratetype(page);
- if (cc->migratetype == MIGRATE_MOVABLE)
+ /*
+ * CMA pages can only be taken by ALLOC_CMA requests. For anybody
+ * else, vacating a CMA block consumes free pages the caller
+ * could have used, and produces free pages it cannot.
+ */
+ if (is_migrate_cma(block_mt) && !(cc->alloc_flags & ALLOC_CMA))
+ return false;
+
+ /*
+ * Per default, scans are restricted to blocks compatible with
+ * the request, to prevent cross-contamination. Once
+ * compaction priority escalates to synchronous scans, though,
+ * scan all blocks to try to make forward progress. For
+ * movable request, this likely helps little: there shouldn't
+ * be many migratable pages inside non-movable blocks besides
+ * allocator fallbacks. For non-movable requests, this helps a
+ * lot, as they can finally scan movable blocks.
+ */
+ if (cc->mode != MIGRATE_ASYNC)
+ return true;
+
+ /*
+ * Prevent <pageblock_order unmovable/reclaimable requests from
+ * polluting movable blocks through fallbacks. Whole-block production
+ * (directly requested, or defrag_mode) is exempt as the allocator
+ * claims and converts these.
+ */
+ if (cc->migratetype == MIGRATE_MOVABLE || cc->order >= pageblock_order)
return is_migrate_movable(block_mt);
else
return block_mt == cc->migratetype;
@@ -1974,12 +2006,12 @@ static unsigned long fast_find_migratebl
return pfn;
/*
- * Only allow kcompactd and direct requests for movable pages to
- * quickly clear out a MOVABLE pageblock for allocation. This
- * reduces the risk that a large movable pageblock is freed for
- * an unmovable/reclaimable small allocation.
+ * Prevent <pageblock_order unmovable/reclaimable requests from
+ * polluting movable blocks through fallbacks. Whole-block production
+ * is exempt as the allocator claims and converts these.
*/
- if (cc->direct_compaction && cc->migratetype != MIGRATE_MOVABLE)
+ if (cc->direct_compaction && cc->migratetype != MIGRATE_MOVABLE &&
+ cc->order < pageblock_order)
return pfn;
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 072/713] mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 071/713] mm: compaction: support non-movable compaction for pageblock requests Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 073/713] mm: memcg-v1: fix memsw and TCP failcnt accounting Greg Kroah-Hartman
` (651 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Michal Hocko,
Johannes Weiner, Muchun Song, Shakeel Butt, Roman Gushchin,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 45b1ec4887bdcc58af885540d9fefa8b67d17d57 upstream.
The deprecation warnings for memory.oom_control and memory.pressure_level
use linux-mm-@kvack.org instead of the linux-mm mailing list address.
Remove the extra hyphen.
Link: https://lore.kernel.org/20260713085756.2973549-1-guopeng.zhang@linux.dev
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol-v1.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/mm/memcontrol-v1.c
+++ b/mm/memcontrol-v1.c
@@ -1181,13 +1181,13 @@ static ssize_t memcg_write_event_control
event->unregister_event = mem_cgroup_usage_unregister_event;
} else if (!strcmp(name, "memory.oom_control")) {
pr_warn_once("oom_control is deprecated and will be removed. "
- "Please report your usecase to linux-mm-@kvack.org"
+ "Please report your usecase to linux-mm@kvack.org"
" if you depend on this functionality.\n");
event->register_event = mem_cgroup_oom_register_event;
event->unregister_event = mem_cgroup_oom_unregister_event;
} else if (!strcmp(name, "memory.pressure_level")) {
pr_warn_once("pressure_level is deprecated and will be removed. "
- "Please report your usecase to linux-mm-@kvack.org "
+ "Please report your usecase to linux-mm@kvack.org "
"if you depend on this functionality.\n");
event->register_event = vmpressure_register_event;
event->unregister_event = vmpressure_unregister_event;
@@ -2040,7 +2040,7 @@ static int mem_cgroup_oom_control_write(
struct mem_cgroup *memcg = mem_cgroup_from_css(css);
pr_warn_once("oom_control is deprecated and will be removed. "
- "Please report your usecase to linux-mm-@kvack.org if you "
+ "Please report your usecase to linux-mm@kvack.org if you "
"depend on this functionality.\n");
/* cannot set to root cgroup and only 0 and 1 are allowed */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 073/713] mm: memcg-v1: fix memsw and TCP failcnt accounting
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 072/713] mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 074/713] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
` (650 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Johannes Weiner,
Michal Hocko, Tao Cui, Shakeel Butt, Muchun Song, Roman Gushchin,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 92192e9c5ee07efc657d3654bc264081fb0aa01b upstream.
Commit 0e2759afcaf9 ("page_counter: track failcnt only for legacy
cgroups") made failcnt accounting conditional on track_failcnt. It
enabled the flag for memcg->memory, but not for memcg->memsw or
memcg->tcpmem.
Consequently, memory.memsw.failcnt remains zero when the memory+swap limit
is hit. memory.kmem.tcp.limit_in_bytes still sets memcg->tcpmem.max, but
TCP charge failures are not reflected in memory.kmem.tcp.failcnt.
Enable failcnt accounting for both v1 counters.
To reproduce memory.memsw.failcnt:
CG=/sys/fs/cgroup/memory/memsw-test
LIMIT=33554432
mkdir "$CG"
echo "$LIMIT" > "$CG/memory.limit_in_bytes"
echo "$LIMIT" > "$CG/memory.memsw.limit_in_bytes"
Start a child process in the cgroup and make it allocate and touch 96 MiB
of memory, causing a memcg OOM.
cat "$CG/memory.memsw.failcnt"
Without the patch, memory.memsw.failcnt is 0. With the patch,
memory.memsw.failcnt is greater than 0.
To reproduce memory.kmem.tcp.failcnt:
CG=/sys/fs/cgroup/memory/tcpmem-test
LIMIT=65536
mkdir "$CG"
echo "$LIMIT" > "$CG/memory.kmem.tcp.limit_in_bytes"
Start a child process in the cgroup, create a TCP socket, and reserve
1 MiB of socket memory with SO_RESERVE_MEM. The reservation fails with
ENOMEM.
cat "$CG/memory.kmem.tcp.failcnt"
Without the patch, memory.kmem.tcp.failcnt is 0. With the patch,
memory.kmem.tcp.failcnt is greater than 0.
Link: https://lore.kernel.org/20260811030843.109104-1-guopeng.zhang@linux.dev
Closes: https://sashiko.dev/#/patchset/20260810074247.52747-1-guopeng.zhang@linux.dev?part=1
Fixes: 0e2759afcaf9 ("page_counter: track failcnt only for legacy cgroups")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4180,9 +4180,11 @@ mem_cgroup_css_alloc(struct cgroup_subsy
page_counter_init(&memcg->swap, &parent->swap, false);
#ifdef CONFIG_MEMCG_V1
memcg->memory.track_failcnt = !memcg_on_dfl;
+ memcg->memsw.track_failcnt = !memcg_on_dfl;
WRITE_ONCE(memcg->oom_kill_disable, READ_ONCE(parent->oom_kill_disable));
page_counter_init(&memcg->kmem, &parent->kmem, false);
page_counter_init(&memcg->tcpmem, &parent->tcpmem, false);
+ memcg->tcpmem.track_failcnt = !memcg_on_dfl;
#endif
} else {
init_memcg_stats();
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 074/713] mm: memcg: stop reclaim when a limit update is superseded
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 073/713] mm: memcg-v1: fix memsw and TCP failcnt accounting Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 075/713] mm: memcontrol: update state_local when flushing NMI stats Greg Kroah-Hartman
` (649 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Tao Cui,
Johannes Weiner, Michal Hocko, Muchun Song, Roman Gushchin,
Shakeel Butt, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 9477820c63cbf4d97114238f3d1ff10dfd6bee3f upstream.
kernfs serializes file operations only per open file, so separate open
files can update the same memory.high or memory.max file concurrently.
Both handlers store the new limit before synchronous reclaim, but continue
to use the writer's local target in the reclaim loop. If another writer
raises or removes the limit, the first writer can continue reclaiming
toward a stale target.
For memory.max, this can leave the writer looping indefinitely once
reclaim retries are exhausted. The OOM path sees sufficient margin under
the current limit and returns true without killing, while the writer still
compares usage against its stale target and records another OOM event.
Check the current limit at the start of each reclaim iteration and stop if
it no longer matches the writer's target.
Reproducer:
Populate a cgroup with anonymous memory and disable swapping. Lower
memory.max from one open file, then restore it to "max" through another
open file after the new limit becomes visible.
Without the patch, the first writer remains blocked and repeatedly
increments the OOM event counter. With the patch, it returns normally.
This was not motivated by a reported production workload. We found it
through automated randomized testing for our cgroup observability work
and reduced it to the reproducer above.
Link: https://lore.kernel.org/20260724021805.1234583-1-guopeng.zhang@linux.dev
Fixes: 8c8c383c04f6 ("mm: memcontrol: try harder to set a new memory.high")
Fixes: b6e6edcfa405 ("mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4790,6 +4790,9 @@ static ssize_t memory_high_write(struct
unsigned long nr_pages = page_counter_read(&memcg->memory);
unsigned long reclaimed;
+ if (high != READ_ONCE(memcg->memory.high))
+ break;
+
if (nr_pages <= high)
break;
@@ -4841,6 +4844,9 @@ static ssize_t memory_max_write(struct k
for (;;) {
unsigned long nr_pages = page_counter_read(&memcg->memory);
+ if (max != READ_ONCE(memcg->memory.max))
+ break;
+
if (nr_pages <= max)
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 075/713] mm: memcontrol: update state_local when flushing NMI stats
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 074/713] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 076/713] mm: mempolicy: fix automatic numa balancing for shmem Greg Kroah-Hartman
` (648 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Tao Cui,
Johannes Weiner, Shakeel Butt, Alexandre Ghiti, Michal Hocko,
Muchun Song, Roman Gushchin, Vlastimil Babka, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 72f522bbf473f03a77e83547b677dc1505c5d41a upstream.
flush_nmi_stats() updates state[] for kmem and slab counters but leaves
the corresponding state_local[] counters unchanged. Local kmem and slab
statistics therefore miss updates collected through the NMI-safe atomic
path.
Update state_local[] together with state[].
Link: https://lore.kernel.org/20260713085053.2916813-1-guopeng.zhang@linux.dev
Fixes: 940b01fc8dc1 ("memcg: nmi safe memcg stats for specific archs")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4440,6 +4440,7 @@ static void flush_nmi_stats(struct mem_c
int index = memcg_stats_index(MEMCG_KMEM);
memcg->vmstats->state[index] += kmem;
+ memcg->vmstats->state_local[index] += kmem;
if (parent)
parent->vmstats->state_pending[index] += kmem;
}
@@ -4457,9 +4458,11 @@ static void flush_nmi_stats(struct mem_c
int index = memcg_stats_index(NR_SLAB_RECLAIMABLE_B);
lstats->state[index] += slab;
+ lstats->state_local[index] += slab;
if (plstats)
plstats->state_pending[index] += slab;
memcg->vmstats->state[index] += slab;
+ memcg->vmstats->state_local[index] += slab;
if (parent)
parent->vmstats->state_pending[index] += slab;
}
@@ -4468,9 +4471,11 @@ static void flush_nmi_stats(struct mem_c
int index = memcg_stats_index(NR_SLAB_UNRECLAIMABLE_B);
lstats->state[index] += slab;
+ lstats->state_local[index] += slab;
if (plstats)
plstats->state_pending[index] += slab;
memcg->vmstats->state[index] += slab;
+ memcg->vmstats->state_local[index] += slab;
if (parent)
parent->vmstats->state_pending[index] += slab;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 076/713] mm: mempolicy: fix automatic numa balancing for shmem
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 075/713] mm: memcontrol: update state_local when flushing NMI stats Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 077/713] mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Greg Kroah-Hartman
` (647 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Weiner, Neha Gholkar,
Gregory Price, David Hildenbrand (Arm), Balbir Singh,
Alistair Popple, Byungchul Park, Huang, Ying, Joshua Hahn,
Matthew Brost, Rakie Kim, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit d230991493b521eeff39f32434fddcbcdb109eb0 upstream.
Neha reports that mapped shmem aren't considered for NUMA balancing,
noting convergence problems and bandwidth bottlenecking for cachelib based
workloads on tiered memory systems.
Looking at the code and going through the git history, this doesn't
actually seem intentional:
Commit fc3147245d19 ("mm: numa: Limit NUMA scanning to migrate-on-fault
VMAs") added a vma_policy_mof() gate to task_numa_work() so VMAs whose
policy lacks MPOL_F_MOF are skipped from NUMA balancing scans. The
motivation was a real usecase: Oracle was pinning shared segments with
mbind(MPOL_BIND) so trapping faults was both expensive and pointless.
The handling of NULL from vm_ops->get_policy, however, treated "user
explicitly opted out" the same as "user never specified anything." For
VMAs whose shared policy is absent - the common case for shmem - the scan
was disabled too.
This issue is old. It probably hurts less in conventional NUMA. But it's
very noticeable on tiered systems, where entire tmpfs workingsets can get
stuck on lower-bandwidth memory.
Fix this by having vma_policy_mof() use __get_vma_policy() directly, and
thereby handle the fallback to task policy (-> preferred_node_policy() has
MPOL_F_MOF per default). Every other consumer of vm_ops->get_policy
already handles it this way, the scan-eligibility check was the outlier.
This preserves Mel's intended fix: don't scan stuff the user explicitly
pinned. But allow default policy vmas to participate in balancing.
Link: https://lore.kernel.org/20260629163337.1264881-1-hannes@cmpxchg.org
Fixes: fc3147245d19 ("mm: numa: Limit NUMA scanning to migrate-on-fault VMAs")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: Neha Gholkar <nehagholkar@gmail.com>
Tested-by: Neha Gholkar <nehagholkar@gmail.com>
Reviewed-by: Gregory Price <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Balbir Singh <balbirs@nvidia.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempolicy.c | 21 ++++++---------------
1 file changed, 6 insertions(+), 15 deletions(-)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2059,24 +2059,15 @@ struct mempolicy *get_vma_policy(struct
bool vma_policy_mof(struct vm_area_struct *vma)
{
struct mempolicy *pol;
+ pgoff_t ilx;
+ bool mof;
- if (vma->vm_ops && vma->vm_ops->get_policy) {
- bool ret = false;
- pgoff_t ilx; /* ignored here */
-
- pol = vma->vm_ops->get_policy(vma, vma->vm_start, &ilx);
- if (pol && (pol->flags & MPOL_F_MOF))
- ret = true;
- mpol_cond_put(pol);
-
- return ret;
- }
-
- pol = vma->vm_policy;
+ pol = __get_vma_policy(vma, vma->vm_start, &ilx);
if (!pol)
pol = get_task_policy(current);
-
- return pol->flags & MPOL_F_MOF;
+ mof = pol->flags & MPOL_F_MOF;
+ mpol_cond_put(pol);
+ return mof;
}
bool apply_policy_zone(struct mempolicy *policy, enum zone_type zone)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 077/713] mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 076/713] mm: mempolicy: fix automatic numa balancing for shmem Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 078/713] mm: page_alloc: move capture_control to the page allocator Greg Kroah-Hartman
` (646 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Weiner,
Vlastimil Babka (SUSE), Shakeel Butt, Brendan Jackman,
Brendan Jackman, David Hildenbrand, Liam R. Howlett,
Lorenzo Stoakes, Michal Hocko, Mike Rapoport, Suren Baghdasaryan,
Zi Yan, Gregory Price, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit 37864d0bf5a4d60da6109b9078cc78ef3fc81216 upstream.
Patch series "mm: fix reclaim storms in defrag_mode", v2.
As we deployed vm.defrag_mode=1 in Meta production, some workloads
regressed with recurring pressure spikes and swap storms (which in turn
triggered userspace OOM rules on pressure and swap utilization levels).
Tracing pinned this to non-movable requests spinning and reclaiming
unproductively when kswapd/kcompactd are overwhelmed. Direct reclaim
predominantly frees up pages in movable blocks, but those requests cannot
use that space under defrag_mode rules; and it is unlikely to free up
whole blocks incidentally for __rmqueue_claim() to work.
This series fixes it by making non-movable requests participate in
pageblock production in the allocator slowpath - meaning, they will invoke
direct reclaim and direct compaction with pageblock_order.
That requires some small-ish adjustments up front in the allocator and the
compaction code: three prep patches and the fix last.
The series has been in production against one of the affected workloads
for several weeks and restores the OOM kill rate to !defrag_mode baseline.
This patch (of 4):
A subsequent patch will have some order-0 allocations participate in
compaction under defrag_mode, to stave off extfrag events.
Since this is a sprawling expansion of entry points, and compaction can
enter filesystem paths, add lockdep annotations that catches __GFP_FS
passing errors.
Direct reclaim has had this annotation for a while, and since reclaim and
compaction are usually used in conjunction, this is unlikely to unearth
old bugs. It's more about future proofing and peace of mind.
Link: https://lore.kernel.org/20260722150006.3848560-1-hannes@cmpxchg.org
Link: https://lore.kernel.org/20260722150006.3848560-2-hannes@cmpxchg.org
Fixes: e3aa7df331bc ("mm: page_alloc: defrag_mode")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Gregory Price <gourry@gourry.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4152,12 +4152,14 @@ __alloc_pages_direct_compact(gfp_t gfp_m
psi_memstall_enter(&pflags);
delayacct_compact_start();
+ fs_reclaim_acquire(gfp_mask);
noreclaim_flag = memalloc_noreclaim_save();
*compact_result = try_to_compact_pages(gfp_mask, order, alloc_flags, ac,
prio, &page);
memalloc_noreclaim_restore(noreclaim_flag);
+ fs_reclaim_release(gfp_mask);
psi_memstall_leave(&pflags);
delayacct_compact_end();
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 078/713] mm: page_alloc: move capture_control to the page allocator
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 077/713] mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 079/713] mm: page_alloc: fix non-movable reclaim storm in defrag_mode Greg Kroah-Hartman
` (645 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlastimil Babka (SUSE),
Johannes Weiner, Gregory Price, Brendan Jackman, Brendan Jackman,
David Hildenbrand, Liam R. Howlett, Lorenzo Stoakes, Michal Hocko,
Mike Rapoport, Shakeel Butt, Suren Baghdasaryan, Zi Yan,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka (SUSE) <vbabka@kernel.org>
commit aee220f565cce38f0efcff940ae2b44bdc495408 upstream.
The compaction capturing code assumes the allocation request order and
compaction target order are the same. That won't be true once defrag_mode
promotes sub-block allocations to pageblock-order compaction: compaction
targets the larger order, while capture should remain at the original
allocation order.
Move the capture_control to the page allocator and give it its own copies
of what the page freeing path matches against - zone, migratetype and the
allocation order - rather than reaching into compaction's live
compact_control. __alloc_pages_direct_compact() fills in migratetype and
order, and installs and hides current->capture_control around the whole
compaction call; try_to_compact_pages() aims capc->zone at each zone while
it is being compacted. compact_zone_order() no longer deals with capture
at all.
Pass the capture_control through try_to_compact_pages() /
compact_zone_order() in place of the bare struct page **.
No functional change.
Link: https://lore.kernel.org/20260722150006.3848560-4-hannes@cmpxchg.org
Fixes: e3aa7df331bc ("mm: page_alloc: defrag_mode")
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Co-developed-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Gregory Price <gourry@gourry.net>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/compaction.h | 3 +-
mm/compaction.c | 50 ++++++++++++---------------------------------
mm/internal.h | 4 ++-
mm/page_alloc.c | 45 ++++++++++++++++++++++++++++++++++------
4 files changed, 57 insertions(+), 45 deletions(-)
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -58,6 +58,7 @@ enum compact_result {
};
struct alloc_context; /* in mm/internal.h */
+struct capture_control; /* in mm/internal.h */
/*
* Number of free order-0 pages that should be available above given watermark
@@ -92,7 +93,7 @@ extern int fragmentation_index(struct zo
extern enum compact_result try_to_compact_pages(gfp_t gfp_mask,
unsigned int order, unsigned int alloc_flags,
const struct alloc_context *ac, enum compact_priority prio,
- struct page **page);
+ struct capture_control *capc);
extern void reset_isolation_suitable(pg_data_t *pgdat);
extern bool compaction_suitable(struct zone *zone, int order,
unsigned long watermark, int highest_zoneidx);
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -2802,9 +2802,8 @@ out:
static enum compact_result compact_zone_order(struct zone *zone, int order,
gfp_t gfp_mask, enum compact_priority prio,
unsigned int alloc_flags, int highest_zoneidx,
- struct page **capture)
+ struct capture_control *capc)
{
- enum compact_result ret;
struct compact_control cc = {
.order = order,
.search_order = order,
@@ -2819,38 +2818,8 @@ static enum compact_result compact_zone_
.ignore_skip_hint = (prio == MIN_COMPACT_PRIORITY),
.ignore_block_suitable = (prio == MIN_COMPACT_PRIORITY)
};
- struct capture_control capc = {
- .cc = &cc,
- .page = NULL,
- };
-
- /*
- * Make sure the structs are really initialized before we expose the
- * capture control, in case we are interrupted and the interrupt handler
- * frees a page.
- */
- barrier();
- WRITE_ONCE(current->capture_control, &capc);
-
- ret = compact_zone(&cc, &capc);
-
- /*
- * Make sure we hide capture control first before we read the captured
- * page pointer, otherwise an interrupt could free and capture a page
- * and we would leak it.
- */
- WRITE_ONCE(current->capture_control, NULL);
- *capture = READ_ONCE(capc.page);
- /*
- * Technically, it is also possible that compaction is skipped but
- * the page is still captured out of luck(IRQ came and freed the page).
- * Returning COMPACT_SUCCESS in such cases helps in properly accounting
- * the COMPACT[STALL|FAIL] when compaction is skipped.
- */
- if (*capture)
- ret = COMPACT_SUCCESS;
- return ret;
+ return compact_zone(&cc, capc);
}
/**
@@ -2860,13 +2829,13 @@ static enum compact_result compact_zone_
* @alloc_flags: The allocation flags of the current allocation
* @ac: The context of current allocation
* @prio: Determines how hard direct compaction should try to succeed
- * @capture: Pointer to free page created by compaction will be stored here
+ * @capc: Free page capture bypassing the freelist
*
* This is the main entry point for direct page compaction.
*/
enum compact_result try_to_compact_pages(gfp_t gfp_mask, unsigned int order,
unsigned int alloc_flags, const struct alloc_context *ac,
- enum compact_priority prio, struct page **capture)
+ enum compact_priority prio, struct capture_control *capc)
{
struct zoneref *z;
struct zone *zone;
@@ -2893,8 +2862,17 @@ enum compact_result try_to_compact_pages
continue;
}
+ WRITE_ONCE(capc->zone, zone);
+
status = compact_zone_order(zone, order, gfp_mask, prio,
- alloc_flags, ac->highest_zoneidx, capture);
+ alloc_flags, ac->highest_zoneidx, capc);
+
+ WRITE_ONCE(capc->zone, NULL);
+
+ /* Stop if a page has been captured */
+ if (READ_ONCE(capc->page))
+ status = COMPACT_SUCCESS;
+
rc = max(status, rc);
/* The allocation should succeed, stop compacting */
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -1059,7 +1059,9 @@ struct compact_control {
* immediately when one is created during the free path.
*/
struct capture_control {
- struct compact_control *cc;
+ struct zone *zone;
+ int migratetype;
+ int order;
struct page *page;
};
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -721,14 +721,14 @@ static inline struct capture_control *ta
return unlikely(capc) &&
!(current->flags & PF_KTHREAD) &&
!capc->page &&
- capc->cc->zone == zone ? capc : NULL;
+ capc->zone == zone ? capc : NULL;
}
static inline bool
compaction_capture(struct capture_control *capc, struct page *page,
int order, int migratetype)
{
- if (!capc || order != capc->cc->order)
+ if (!capc || order != capc->order)
return false;
/* Do not accidentally pollute CMA or isolated regions*/
@@ -744,12 +744,12 @@ compaction_capture(struct capture_contro
* have trouble finding a high-order free page.
*/
if (order < pageblock_order && migratetype == MIGRATE_MOVABLE &&
- capc->cc->migratetype != MIGRATE_MOVABLE)
+ capc->migratetype != MIGRATE_MOVABLE)
return false;
- if (migratetype != capc->cc->migratetype)
- trace_mm_page_alloc_extfrag(page, capc->cc->order, order,
- capc->cc->migratetype, migratetype);
+ if (migratetype != capc->migratetype)
+ trace_mm_page_alloc_extfrag(page, capc->order, order,
+ capc->migratetype, migratetype);
capc->page = page;
return true;
@@ -4146,6 +4146,12 @@ __alloc_pages_direct_compact(gfp_t gfp_m
struct page *page = NULL;
unsigned long pflags;
unsigned int noreclaim_flag;
+ struct capture_control capc = {
+ .zone = NULL,
+ .migratetype = ac->migratetype,
+ .order = order,
+ .page = NULL,
+ };
if (!order)
return NULL;
@@ -4155,8 +4161,33 @@ __alloc_pages_direct_compact(gfp_t gfp_m
fs_reclaim_acquire(gfp_mask);
noreclaim_flag = memalloc_noreclaim_save();
+ /*
+ * Make sure the structs are really initialized before we expose the
+ * capture control, in case we are interrupted and the interrupt handler
+ * frees a page.
+ */
+ barrier();
+ WRITE_ONCE(current->capture_control, &capc);
+
*compact_result = try_to_compact_pages(gfp_mask, order, alloc_flags, ac,
- prio, &page);
+ prio, &capc);
+
+ /*
+ * Make sure we hide capture control first before we read the captured
+ * page pointer, otherwise an interrupt could free and capture a page
+ * and we would leak it.
+ */
+ WRITE_ONCE(current->capture_control, NULL);
+ page = READ_ONCE(capc.page);
+
+ /*
+ * Technically, it is also possible that compaction is skipped but
+ * the page is still captured out of luck(IRQ came and freed the page).
+ * Returning COMPACT_SUCCESS in such cases helps in properly accounting
+ * the COMPACT[STALL|FAIL] when compaction is skipped.
+ */
+ if (page)
+ *compact_result = COMPACT_SUCCESS;
memalloc_noreclaim_restore(noreclaim_flag);
fs_reclaim_release(gfp_mask);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 079/713] mm: page_alloc: fix non-movable reclaim storm in defrag_mode
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 078/713] mm: page_alloc: move capture_control to the page allocator Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 080/713] mm: vmscan: fix node reclaim ignoring swappiness parameter Greg Kroah-Hartman
` (644 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Weiner, Brendan Jackman,
Vlastimil Babka (SUSE), David Hildenbrand, Gregory Price,
Liam R. Howlett, Lorenzo Stoakes, Michal Hocko, Mike Rapoport,
Shakeel Butt, Suren Baghdasaryan, Zi Yan, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit 7e8756d7ad22655b935c384f123071aa9de07a27 upstream.
As we deployed defrag_mode into Meta production, pressure spikes and
excessive swapping were observed on some workloads. Tracing confirmed
that this is unmovable/reclaimable requests spinning in the allocator and
direct reclaim, causing excessive amounts of swap.
The initial plan for defrag_mode was to rely on kswapd/kcompactd to
produce blocks, and if those are overwhelmed under high pressure, let the
allocator fall back (__rmqueue_steal()) after its retry loops. However,
that retrying results in more reclaim on some of these workloads than we'd
hoped, sometimes excessively so, spurred on by the !costly order
conditions in should_reclaim_retry().
The storms are dependent on the request type. Reclaim will inevitably
make room in existing movable blocks, since that's where the LRU pages
live. So if movable requests retry on reclaim, they make progress.
When non-movable requests spin in reclaim that isn't productive. They
cannot use the individually freed pages, and the process is unlikely to
accidentally free whole blocks to meet the ALLOC_NOFRAGMENT bar. They
spin and overreclaim excessively, which tanks performance and triggers
userspace guards like swap exhaustion or pressure based OOM.
To fix this, send non-movable requests, regardless of order, into
pageblock reclaim/compaction. This way, they help move things along to
meet the ALLOC_NOFRAGMENT bar. After this patch, the reclaim storms and
excess OOM rates are no longer observed in production.
The longer-term plan is still to have all requests, including the movable
ones, help make blocks to spread the cost of defragmenting more evenly and
fairly; combined with proper watermarking to reduce allocation latencies
in the common case. However, doing this naively unearths scaling and
concurrency limitations in compaction that need to be addressed first.
Promoting just non-movables for now is the minimally viable bug fix for
the above issue.
[brendan.jackman@linux.dev: fix try_to_compact_pages() kerneldoc]
Link: https://lore.kernel.org/DK7NM9RPUJOD.11PNJJ5N2OBED@linux.dev
Link: https://lore.kernel.org/20260722150006.3848560-5-hannes@cmpxchg.org
Fixes: e3aa7df331bc ("mm: page_alloc: defrag_mode")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: "Brendan Jackman" <brendan.jackman@linux.dev>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Gregory Price <gourry@gourry.net>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 2 +-
mm/internal.h | 6 ++++++
mm/page_alloc.c | 31 ++++++++++++++++++++++++++-----
3 files changed, 33 insertions(+), 6 deletions(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -2825,7 +2825,7 @@ static enum compact_result compact_zone_
/**
* try_to_compact_pages - Direct compact to satisfy a high-order allocation
* @gfp_mask: The GFP mask of the current allocation
- * @order: The order of the current allocation
+ * @order: The order to try to make available
* @alloc_flags: The allocation flags of the current allocation
* @ac: The context of current allocation
* @prio: Determines how hard direct compaction should try to succeed
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -1061,6 +1061,12 @@ struct compact_control {
struct capture_control {
struct zone *zone;
int migratetype;
+ /*
+ * Allocation request order. May differ from the compaction
+ * order: defrag_mode promotes sub-block allocations to
+ * pageblock-order compaction; capture still matches at the
+ * original allocation order so prep_new_page() is consistent.
+ */
int order;
struct page *page;
};
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4152,8 +4152,24 @@ __alloc_pages_direct_compact(gfp_t gfp_m
.order = order,
.page = NULL,
};
+ int compact_order = order;
- if (!order)
+ /*
+ * If fallbacks are not permitted (defrag_mode), we either
+ * need to reclaim space in a block of matching type, or clear
+ * out an entire block to allow __rmqueue_claim() to convert.
+ *
+ * Reclaim by itself is primarily freeing space in movable
+ * blocks, since that's where the LRU pages live. So this
+ * works for movable requests, but not for others.
+ *
+ * For those, promote the order to help make blocks, instead
+ * of spinning in reclaim alone unproductively.
+ */
+ if ((alloc_flags & ALLOC_NOFRAGMENT) && ac->migratetype != MIGRATE_MOVABLE)
+ compact_order = max(order, pageblock_order);
+
+ if (!compact_order)
return NULL;
psi_memstall_enter(&pflags);
@@ -4169,8 +4185,8 @@ __alloc_pages_direct_compact(gfp_t gfp_m
barrier();
WRITE_ONCE(current->capture_control, &capc);
- *compact_result = try_to_compact_pages(gfp_mask, order, alloc_flags, ac,
- prio, &capc);
+ *compact_result = try_to_compact_pages(gfp_mask, compact_order,
+ alloc_flags, ac, prio, &capc);
/*
* Make sure we hide capture control first before we read the captured
@@ -4215,7 +4231,7 @@ __alloc_pages_direct_compact(gfp_t gfp_m
struct zone *zone = page_zone(page);
zone->compact_blockskip_flush = false;
- compaction_defer_reset(zone, order, true);
+ compaction_defer_reset(zone, compact_order, true);
count_vm_event(COMPACTSUCCESS);
return page;
}
@@ -4455,9 +4471,14 @@ __alloc_pages_direct_reclaim(gfp_t gfp_m
struct page *page = NULL;
unsigned long pflags;
bool drained = false;
+ int reclaim_order = order;
+
+ /* Match the slowpath compaction promotion in __alloc_pages_direct_compact */
+ if ((alloc_flags & ALLOC_NOFRAGMENT) && ac->migratetype != MIGRATE_MOVABLE)
+ reclaim_order = max(order, pageblock_order);
psi_memstall_enter(&pflags);
- *did_some_progress = __perform_reclaim(gfp_mask, order, ac);
+ *did_some_progress = __perform_reclaim(gfp_mask, reclaim_order, ac);
if (unlikely(!(*did_some_progress)))
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 080/713] mm: vmscan: fix node reclaim ignoring swappiness parameter
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 079/713] mm: page_alloc: fix non-movable reclaim storm in defrag_mode Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 081/713] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
` (643 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridong Chen, Johannes Weiner,
Barry Song, Qi Zheng, Song Hu, Shakeel Butt, Axel Rasmussen,
Baoquan He, Chris Li, David Hildenbrand, Davidlohr Bueso,
Kairui Song, Kemeng Shi, Lorenzo Stoakes, Michal Hocko,
Muchun Song, Nhat Pham, Roman Gushchin, Wei Xu, Yuanchu Xie,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridong Chen <chenridong@xiaomi.com>
commit 8a905195850d383c0465ab5bdd3c91d94269b242 upstream.
sc_swappiness() had two separate definitions depending on CONFIG_MEMCG.
The !CONFIG_MEMCG variant simply returned vm_swappiness, ignoring the
proactive_swappiness value passed through scan_control. This caused the
swappiness parameter written to /sys/devices/system/node/nodeX/reclaim to
have no effect when CONFIG_MEMCG is disabled.
Fix this by consolidating sc_swappiness() into a single definition that
checks sc->proactive_swappiness first, then falls back to
mem_cgroup_swappiness() which already handles both CONFIG_MEMCG and
!CONFIG_MEMCG.
Before fix (swappiness=max ignored, mostly file pages reclaimed):
# cat /proc/sys/vm/swappiness
60
# cat /proc/vmstat | grep pgsteal
pgsteal_kswapd 0
pgsteal_direct 0
pgsteal_khugepaged 0
pgsteal_proactive 1840
pgsteal_anon 25
pgsteal_file 1815
# echo "64M swappiness=max" > /sys/devices/system/node/node0/reclaim
# cat /proc/vmstat | grep pgsteal
pgsteal_kswapd 0
pgsteal_direct 0
pgsteal_khugepaged 0
pgsteal_proactive 18013
pgsteal_anon 337
pgsteal_file 17676
After fix (swappiness=max honored, anon pages reclaimed as expected):
# cat /proc/vmstat | grep pgsteal
pgsteal_kswapd 0
pgsteal_direct 0
pgsteal_khugepaged 0
pgsteal_proactive 0
pgsteal_anon 0
pgsteal_file 0
# echo "64M swappiness=max" > /sys/devices/system/node/node0/reclaim
# cat /proc/vmstat | grep pgsteal
pgsteal_kswapd 0
pgsteal_direct 0
pgsteal_khugepaged 0
pgsteal_proactive 16283
pgsteal_anon 16283
pgsteal_file 0
Link: https://lore.kernel.org/20260723032434.2016749-3-ridong.chen@linux.dev
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Ridong Chen <chenridong@xiaomi.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Acked-by: Qi Zheng <qi.zheng@linux.dev>
Tested-by: Song Hu <husong@kylinos.cn>
Reviewed-by: Song Hu <husong@kylinos.cn>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org> [6.17+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 19 +++++++------------
1 file changed, 7 insertions(+), 12 deletions(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -198,6 +198,13 @@ struct scan_control {
*/
int vm_swappiness = 60;
+static int sc_swappiness(struct scan_control *sc, struct mem_cgroup *memcg)
+{
+ if (sc->proactive && sc->proactive_swappiness)
+ return *sc->proactive_swappiness;
+ return mem_cgroup_swappiness(memcg);
+}
+
#ifdef CONFIG_MEMCG
/* Returns true for reclaim through cgroup limits or cgroup interfaces. */
@@ -238,13 +245,6 @@ static bool writeback_throttling_sane(st
#endif
return false;
}
-
-static int sc_swappiness(struct scan_control *sc, struct mem_cgroup *memcg)
-{
- if (sc->proactive && sc->proactive_swappiness)
- return *sc->proactive_swappiness;
- return mem_cgroup_swappiness(memcg);
-}
#else
static bool cgroup_reclaim(struct scan_control *sc)
{
@@ -260,11 +260,6 @@ static bool writeback_throttling_sane(st
{
return true;
}
-
-static int sc_swappiness(struct scan_control *sc, struct mem_cgroup *memcg)
-{
- return READ_ONCE(vm_swappiness);
-}
#endif
static void set_task_reclaim_state(struct task_struct *task,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 081/713] tools/compiler: match glibc 2.42 definition of __attribute_const__
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 080/713] mm: vmscan: fix node reclaim ignoring swappiness parameter Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 082/713] x86/locking: Use sfence for wmb() if SSE is available Greg Kroah-Hartman
` (642 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy H.J. Lee, Nathan Chancellor,
David Laight, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy H.J. Lee <rkr0k0r@gmail.com>
commit 8700a4761beb219873956666cf91776a2c61e698 upstream.
glibc 2.42 added __attribute_const__ to sys/cdefs.h:
# define __attribute_const__ __attribute__ ((__const__))
GCC 15 warns when a macro is redefined to a different replacement list
(-Wbuiltin-macro-redefined). Since host tool Makefiles (resolve_btfids,
objtool) pass -Werror, this conflict becomes fatal.
The warning is suppressed on standard native builds because GCC treats
/usr/include as a system header path (-isystem), and macro-redefinition
warnings from system headers are silently suppressed by GCC. It fires
when glibc headers are on a regular include path (-I) instead, which
is the case in cross-compilation setups such as NixOS, where the
sysroot's glibc is passed explicitly via -I rather than -isystem.
Per (C11 6.10.3), identical replacement lists are accepted silently.
Match the glibc definition exactly, including the space before "((", so
the redefinition is accepted without warning regardless of whether
glibc headers are treated as system or non-system includes.
Link: https://lore.kernel.org/20260701200635.3992767-1-rkr0k0r@gmail.com
Signed-off-by: Joy H.J. Lee <rkr0k0r@gmail.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: David Laight <david.laight.linux@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/linux/compiler.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -119,7 +119,7 @@
#define __read_mostly
#ifndef __attribute_const__
-# define __attribute_const__
+# define __attribute_const__ __attribute__ ((__const__))
#endif
#ifndef __maybe_unused
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 082/713] x86/locking: Use sfence for wmb() if SSE is available
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 081/713] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 083/713] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
` (641 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yao Zi, Peter Zijlstra (Intel)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Zi <me@ziyao.cc>
commit d824ed1307680dd482f607b0e707c575f70668c4 upstream.
When adding cc clobber to wmb()'s definition, the alternative()
condition to use sfence was incorrectly raised from X86_FEATURE_XMM to
X86_FEATURE_XMM2.
Restore the correct constraint for potential better performance on
machines without SSE2.
Fixes: bd922477d935 ("locking/x86: Add cc clobber for ADDL")
Signed-off-by: Yao Zi <me@ziyao.cc>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260801182953.15069-1-me@ziyao.cc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/barrier.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -17,7 +17,7 @@
#define rmb() asm volatile(ALTERNATIVE("lock addl $0,-4(%%esp)", "lfence", \
X86_FEATURE_XMM2) ::: "memory", "cc")
#define wmb() asm volatile(ALTERNATIVE("lock addl $0,-4(%%esp)", "sfence", \
- X86_FEATURE_XMM2) ::: "memory", "cc")
+ X86_FEATURE_XMM) ::: "memory", "cc")
#else
#define __mb() asm volatile("mfence":::"memory")
#define __rmb() asm volatile("lfence":::"memory")
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 083/713] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 082/713] x86/locking: Use sfence for wmb() if SSE is available Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 084/713] x86/tdx: Fix off-by-one in port I/O handling Greg Kroah-Hartman
` (640 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau (Meta), Dave Hansen,
Sean Christopherson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
commit 1fe104b048d77d6cb25bd938e6a67450fb50e61d upstream.
KVM's instruction emulator has a small helper, assign_register(), that
writes a value into a register following the x86 rules for writes to
general-purpose registers: an 8- or 16-bit write leaves the rest of the
register untouched, a 32-bit write zero-extends the result to 64 bits,
and a 64-bit write replaces the whole register.
The TDX guest #VE handler needs the same logic for port I/O emulation
to get 32-bit zero-extension right. Rather than add a third copy of
the same switch, move the helper verbatim to <asm/insn-eval.h>, rename
it to insn_assign_reg(), and route KVM's callers through it.
Add <asm/insn.h> to the header's includes so it builds standalone in
callers that have not pulled it in transitively.
No functional change.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-3-kirill@shutemov.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/insn-eval.h | 36 ++++++++++++++++++++++++++++++++++++
arch/x86/kvm/emulate.c | 26 ++++----------------------
2 files changed, 40 insertions(+), 22 deletions(-)
--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/bug.h>
#include <linux/err.h>
+#include <asm/insn.h>
#include <asm/ptrace.h>
#define INSN_CODE_SEG_ADDR_SZ(params) ((params >> 4) & 0xf)
@@ -46,4 +47,39 @@ enum insn_mmio_type insn_decode_mmio(str
bool insn_is_nop(struct insn *insn);
+/*
+ * Write @val into *@reg following the x86 rules for writes to
+ * general-purpose registers (Intel SDM Vol. 1, "General-Purpose
+ * Registers in 64-Bit Mode"): an 8- or 16-bit write leaves the rest of
+ * the register untouched, a 32-bit write zero-extends the result into
+ * the upper 32 bits, and a 64-bit write replaces the whole register.
+ *
+ * @bytes is the width of the write, not a property of the instruction:
+ * an instruction that, say, sign-extends a 32-bit immediate into a
+ * 64-bit register does a 64-bit write here.
+ *
+ * @reg need not be 8-byte aligned: KVM's instruction emulator offsets
+ * the pointer by one byte to address the high-byte registers (AH, CH,
+ * DH, BH). Use narrow stores for the sub-word cases so the access
+ * width matches @bytes and the adjacent bytes are left alone.
+ */
+static inline void insn_assign_reg(unsigned long *reg, u64 val, int bytes)
+{
+ switch (bytes) {
+ case 1:
+ *(u8 *)reg = (u8)val;
+ break;
+ case 2:
+ *(u16 *)reg = (u16)val;
+ break;
+ case 4:
+ /* A 32-bit write zero-extends into the upper 32 bits. */
+ *reg = (u32)val;
+ break;
+ case 8:
+ *reg = val;
+ break;
+ }
+}
+
#endif /* _ASM_X86_INSN_EVAL_H */
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -24,6 +24,7 @@
#include "kvm_emulate.h"
#include <linux/stringify.h>
#include <asm/debugreg.h>
+#include <asm/insn-eval.h>
#include <asm/nospec-branch.h>
#include <asm/ibt.h>
#include <asm/text-patching.h>
@@ -439,25 +440,6 @@ static void assign_masked(ulong *dest, u
*dest = (*dest & ~mask) | (src & mask);
}
-static void assign_register(unsigned long *reg, u64 val, int bytes)
-{
- /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
- switch (bytes) {
- case 1:
- *(u8 *)reg = (u8)val;
- break;
- case 2:
- *(u16 *)reg = (u16)val;
- break;
- case 4:
- *reg = (u32)val;
- break; /* 64b: zero-extend */
- case 8:
- *reg = val;
- break;
- }
-}
-
static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
{
return (1UL << (ctxt->ad_bytes << 3)) - 1;
@@ -505,7 +487,7 @@ register_address_increment(struct x86_em
{
ulong *preg = reg_rmw(ctxt, reg);
- assign_register(preg, *preg + inc, ctxt->ad_bytes);
+ insn_assign_reg(preg, *preg + inc, ctxt->ad_bytes);
}
static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
@@ -1767,7 +1749,7 @@ static int load_segment_descriptor(struc
static void write_register_operand(struct operand *op)
{
- return assign_register(op->addr.reg, op->val, op->bytes);
+ return insn_assign_reg(op->addr.reg, op->val, op->bytes);
}
static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)
@@ -2008,7 +1990,7 @@ static int em_popa(struct x86_emulate_ct
rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
if (rc != X86EMUL_CONTINUE)
break;
- assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
+ insn_assign_reg(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
--reg;
}
return rc;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 084/713] x86/tdx: Fix off-by-one in port I/O handling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 083/713] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 085/713] x86/tdx: Fix zero-extension for 32-bit port I/O Greg Kroah-Hartman
` (639 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Borys Tsyrulnikov,
Kiryl Shutsemau (Meta), Dave Hansen, Kai Huang,
Kuppuswamy Sathyanarayanan, Binbin Wu, Rick Edgecombe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
commit 0f63e656b1c679d32ac595de29d10c03efca6a25 upstream.
handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use:
u64 mask = GENMASK(BITS_PER_BYTE * size, 0);
GENMASK(h, l) includes bit h. For size=1 (INB), this produces
GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8
bits). The mask is one bit too wide for all I/O sizes.
Fix the mask calculation.
Fixes: 03149948832a ("x86/tdx: Port I/O: Add runtime hypercalls")
Reported-by: Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Link: https://lore.kernel.org/all/CAKw_Dz96rfSQc6Rn+9QBcUFHhmkK+9zu+P=bxowfZwxrATCBRg@mail.gmail.com/
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-2-kirill@shutemov.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/coco/tdx/tdx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -694,7 +694,7 @@ static bool handle_in(struct pt_regs *re
.r13 = PORT_READ,
.r14 = port,
};
- u64 mask = GENMASK(BITS_PER_BYTE * size, 0);
+ u64 mask = GENMASK(BITS_PER_BYTE * size - 1, 0);
bool success;
/*
@@ -714,7 +714,7 @@ static bool handle_in(struct pt_regs *re
static bool handle_out(struct pt_regs *regs, int size, int port)
{
- u64 mask = GENMASK(BITS_PER_BYTE * size, 0);
+ u64 mask = GENMASK(BITS_PER_BYTE * size - 1, 0);
/*
* Emulate the I/O write via hypercall. More info about ABI can be found
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 085/713] x86/tdx: Fix zero-extension for 32-bit port I/O
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 084/713] x86/tdx: Fix off-by-one in port I/O handling Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 086/713] x86/xen: fix init of balloon stats again Greg Kroah-Hartman
` (638 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Borys Tsyrulnikov,
Kiryl Shutsemau (Meta), Dave Hansen, Binbin Wu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
commit 941370fc93cc3474e26811f4d3b062903eefe2cf upstream.
According to x86 architecture rules, 32-bit operations zero-extend the
result to 64 bits. The current implementation of handle_in() only masks
the lower 32 bits, which preserves the upper 32 bits of RAX when a
32-bit port IN instruction is emulated.
Use insn_assign_reg() to write the result back into RAX with proper
partial-register-write semantics: 1- and 2-byte forms leave the upper
bits untouched, the 4-byte form zero-extends to the full register.
Fixes: 03149948832a ("x86/tdx: Port I/O: Add runtime hypercalls")
Reported-by: Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://lore.kernel.org/all/CAKw_Dz96rfSQc6Rn+9QBcUFHhmkK+9zu+P=bxowfZwxrATCBRg@mail.gmail.com/
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-4-kirill@shutemov.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/coco/tdx/tdx.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -694,8 +694,8 @@ static bool handle_in(struct pt_regs *re
.r13 = PORT_READ,
.r14 = port,
};
- u64 mask = GENMASK(BITS_PER_BYTE * size - 1, 0);
bool success;
+ u64 val;
/*
* Emulate the I/O read via hypercall. More info about ABI can be found
@@ -703,11 +703,9 @@ static bool handle_in(struct pt_regs *re
* "TDG.VP.VMCALL<Instruction.IO>".
*/
success = !__tdx_hypercall(&args);
+ val = success ? args.r11 : 0;
- /* Update part of the register affected by the emulated instruction */
- regs->ax &= ~mask;
- if (success)
- regs->ax |= args.r11 & mask;
+ insn_assign_reg(®s->ax, val, size);
return success;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 086/713] x86/xen: fix init of balloon stats again
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 085/713] x86/tdx: Fix zero-extension for 32-bit port I/O Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 087/713] hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Greg Kroah-Hartman
` (637 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roger Pau Monné, Juergen Gross,
Matthias Goergens
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Pau Monne <roger@xenproject.org>
commit 5d00a11d484e7b31a358cd81afebccb4602dbe8c upstream.
The handling of extra memory regions done in balloon_add_regions() is not
correct for PV guests, since the initial target is set to reflect the real
memory the system has, not what's described on the memory map, which can be
higher if memory != maxmem.
Introduce separate logic for addition vs subtraction in
balloon_add_regions() and handle extra regions correctly by adding them to
the total amount of pages, instead of subtracting from the current and
target pages amounts.
In the common case PV domU/dom0 and PVH dom0 will use the addition path,
since the initial target reflects the real assigned memory. HVM and PVH
domUs use the subtraction path, since the target is set based on the amount
of memory reported in the memory map, without accounting for released
regions.
Fixes: 87af633689ce ("x86/xen: fix balloon target initialization for PVH dom0")
Fixes: 0949c646d646 ("Partial revert "x86/xen: fix balloon target initialization for PVH dom0"")
Signed-off-by: Roger Pau Monné <roger@xenproject.org>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Tested-by: Matthias Goergens <matthias.goergens@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260805094008.95778-1-roger@xenproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/balloon.c | 29 +++++++++++++++++++----------
1 file changed, 19 insertions(+), 10 deletions(-)
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -679,7 +679,7 @@ void xen_free_ballooned_pages(unsigned i
}
EXPORT_SYMBOL(xen_free_ballooned_pages);
-static int __init balloon_add_regions(void)
+static int __init balloon_add_regions(bool append)
{
unsigned long start_pfn, pages;
unsigned long pfn, extra_pfn_end;
@@ -703,19 +703,26 @@ static int __init balloon_add_regions(vo
balloon_append(pfn_to_page(pfn));
/*
- * Extra regions are accounted for in the physmap, but need
- * decreasing from current_pages and target_pages to balloon
- * down the initial allocation, because they are already
- * accounted for in total_pages.
+ * There are two different use-cases depending on how the
+ * initial memory target is fetched. For PVH dom0 and PV the
+ * target is usually set to reflect the domain assigned memory,
+ * and hence extra regions need adding.
+ *
+ * OTOH for HVM and PVH domU the target is set to the amount of
+ * RAM reported in the memory map, and hence extra regions need
+ * subtracting to reflect the real memory usage.
*/
pages = extra_pfn_end - start_pfn;
- if (pages >= balloon_stats.current_pages ||
- pages >= balloon_stats.target_pages) {
+ if (append) {
+ balloon_stats.total_pages += pages;
+ } else if (pages >= balloon_stats.current_pages ||
+ pages >= balloon_stats.target_pages) {
WARN(1, "Extra pages underflow current target");
return -ERANGE;
+ } else {
+ balloon_stats.current_pages -= pages;
+ balloon_stats.target_pages -= pages;
}
- balloon_stats.current_pages -= pages;
- balloon_stats.target_pages -= pages;
}
return 0;
@@ -726,6 +733,7 @@ static int __init balloon_init(void)
struct task_struct *task;
long current_pages = 0;
domid_t domid = DOMID_SELF;
+ bool append = true;
int rc;
if (!xen_domain())
@@ -745,6 +753,7 @@ static int __init balloon_init(void)
} else {
if (xen_unpopulated_pages >= get_num_physpages())
goto underflow;
+ append = false;
current_pages = get_num_physpages() -
xen_unpopulated_pages;
}
@@ -767,7 +776,7 @@ static int __init balloon_init(void)
register_sysctl_init("xen/balloon", balloon_table);
#endif
- rc = balloon_add_regions();
+ rc = balloon_add_regions(append);
if (rc)
return rc;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 087/713] hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 086/713] x86/xen: fix init of balloon stats again Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 088/713] tracing/user_events: Clear copied tracing state before fork duplication Greg Kroah-Hartman
` (636 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Sizhe Liu,
Yicong Yang, Suzuki K Poulose
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
commit 75d42d990335322852ed5f7ce324b701c0949d79 upstream.
hisi_ptt_wait_dma_reset_done() discards the return value of
readl_poll_timeout_atomic(). If the DMA engine does not complete its
reset within the timeout, hisi_ptt_trace_start() proceeds to start
tracing regardless.
Return a bool from hisi_ptt_wait_dma_reset_done(), consistent with the
other wait helpers in this driver. On timeout, log an error, de-assert
the reset bit, and return -ETIMEDOUT. Move ctrl->started to the
successful path so a failed start does not leave the trace marked as
active.
Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Reviewed-by: Sizhe Liu <liusizhe5@huawei.com>
Reviewed-by: Yicong Yang <yangyccccc@gmail.com>
Tested-by: Sizhe Liu <liusizhe5@huawei.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260414172451.14331-2-sanman.pradhan@hpe.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/ptt/hisi_ptt.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/drivers/hwtracing/ptt/hisi_ptt.c
+++ b/drivers/hwtracing/ptt/hisi_ptt.c
@@ -171,13 +171,13 @@ static bool hisi_ptt_wait_trace_hw_idle(
HISI_PTT_WAIT_TRACE_TIMEOUT_US);
}
-static void hisi_ptt_wait_dma_reset_done(struct hisi_ptt *hisi_ptt)
+static bool hisi_ptt_wait_dma_reset_done(struct hisi_ptt *hisi_ptt)
{
u32 val;
- readl_poll_timeout_atomic(hisi_ptt->iobase + HISI_PTT_TRACE_WR_STS,
- val, !val, HISI_PTT_RESET_POLL_INTERVAL_US,
- HISI_PTT_RESET_TIMEOUT_US);
+ return !readl_poll_timeout_atomic(hisi_ptt->iobase + HISI_PTT_TRACE_WR_STS,
+ val, !val, HISI_PTT_RESET_POLL_INTERVAL_US,
+ HISI_PTT_RESET_TIMEOUT_US);
}
static void hisi_ptt_trace_end(struct hisi_ptt *hisi_ptt)
@@ -202,14 +202,18 @@ static int hisi_ptt_trace_start(struct h
return -EBUSY;
}
- ctrl->started = true;
-
/* Reset the DMA before start tracing */
val = readl(hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
val |= HISI_PTT_TRACE_CTRL_RST;
writel(val, hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
- hisi_ptt_wait_dma_reset_done(hisi_ptt);
+ if (!hisi_ptt_wait_dma_reset_done(hisi_ptt)) {
+ pci_err(hisi_ptt->pdev, "timed out waiting for DMA reset\n");
+ val = readl(hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
+ val &= ~HISI_PTT_TRACE_CTRL_RST;
+ writel(val, hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
+ return -ETIMEDOUT;
+ }
val = readl(hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
val &= ~HISI_PTT_TRACE_CTRL_RST;
@@ -234,6 +238,8 @@ static int hisi_ptt_trace_start(struct h
if (!hisi_ptt->trace_ctrl.is_port)
val |= HISI_PTT_TRACE_CTRL_FILTER_MODE;
+ ctrl->started = true;
+
/* Start the Trace */
val |= HISI_PTT_TRACE_CTRL_EN;
writel(val, hisi_ptt->iobase + HISI_PTT_TRACE_CTRL);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 088/713] tracing/user_events: Clear copied tracing state before fork duplication
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 087/713] hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 089/713] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
` (635 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Bradley Morgan, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 390f6bd8583d177029d9df4bea6667509e55a765 upstream.
dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it. user_event_mm_dup() should
replace it, but it leaves that copied pointer unmodified if
user_event_mm_alloc() fails.
When the child exits, user_event_mm_remove() decrements a reference
the child never owned, which ultimately frees user_event_mm, while
the parent still as a stale pointer to it. This creates a UAF, which
KASAN reports as:
BUG: KASAN: slab-use-after-free in
current_user_event_mm+0x51/0x1d0 Write of size 4 at addr
ffff888005010d30 by task init/44
Call Trace:
<TASK>
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
current_user_event_mm+0x51/0x1d0
user_events_ioctl+0x82e/0x15c0
__x64_sys_ioctl+0x139/0x1c0
do_syscall_64+0xce/0x450
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 44:
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x180/0x3a0
user_event_mm_alloc+0x3c/0x1f0
current_user_event_mm+0x88/0x1d0
Freed by task 42:
__kasan_slab_free+0x43/0x70
kfree+0x13a/0x390
process_one_work+0x696/0xf90
worker_thread+0x420/0xba0
The fix simply clears the copied pointer before any possible failure.
In case of failure, the child then has nothing to free.
Cc: stable@vger.kernel.org
Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event enablement")
Link: https://patch.msgid.link/20260827184321.2964601-2-Jeremy.Jean@oss.cyber.gouv.fr
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_user.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -868,6 +868,9 @@ void user_event_mm_dup(struct task_struc
struct user_event_mm *mm = user_event_mm_alloc(t);
struct user_event_enabler *enabler;
+ /* On failure, do not free parent's copy */
+ t->user_event_mm = NULL;
+
if (!mm)
return;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 089/713] tracing: Fix crash passing ERR_PTR to kthread_stop()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 088/713] tracing/user_events: Clear copied tracing state before fork duplication Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 090/713] tracing: Fix logged instance name on creation failure Greg Kroah-Hartman
` (634 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 649bc7df3e5d7be6f7996a95084037dbf3cad1e5 upstream.
event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the kernel.
Check the result of kthread_run() before passing it to kthread_stop(). Use
WARN_ON() so that a failure to create the self-test thread does not go
unnoticed, matching the ring-buffer self-test fix in commit
91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").
Cc: stable@vger.kernel.org
Fixes: e6187007d6c3 ("tracing/events: add startup tests for events")
Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4901,6 +4901,8 @@ static __init void event_test_stuff(void
struct task_struct *test_thread;
test_thread = kthread_run(event_test_thread, NULL, "test-events");
+ if (WARN_ON(IS_ERR(test_thread)))
+ return;
msleep(1);
kthread_stop(test_thread);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 090/713] tracing: Fix logged instance name on creation failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 089/713] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 091/713] tracing: Fix retry exhaustion in simple ring buffer reader swap Greg Kroah-Hartman
` (633 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Vincent Donnefort, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
commit a9a01be2834a529cbd490ccbab02643f0c1735f2 upstream.
When boot instance creation fails, the kernel incorrectly logs "(null)"
as the instance name because strsep() consumes curr_str entirely during
parsing.
Print the properly parsed name variable instead. And while at it log
the error code.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260807085423.4175161-1-vdonnefort@google.com
Fixes: cb1f98c5e574 ("tracing: Add creation of instances at boot command line")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9726,7 +9726,8 @@ __init static void enable_instances(void
tr = trace_array_create_systems(name, NULL, addr, size);
if (IS_ERR(tr)) {
- pr_warn("Tracing: Failed to create instance buffer %s\n", curr_str);
+ pr_warn("Tracing: Failed to create instance buffer '%s' (%ld)\n", name,
+ PTR_ERR(tr));
continue;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 091/713] tracing: Fix retry exhaustion in simple ring buffer reader swap
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 090/713] tracing: Fix logged instance name on creation failure Greg Kroah-Hartman
@ 2026-09-04 4:50 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 092/713] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Greg Kroah-Hartman
` (632 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Donnefort,
Ivan Immanuel Shaji, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
commit e0d3aed7b12cf37b74c7cc5265073d0263b49cde upstream.
simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a failed
replacement leaves it at -1.
The current !retry test reverses both outcomes. It returns an error after
a successful final replacement, leaving the link update complete but the
reader bookkeeping unfinished. After a failed final replacement, it
falls through and updates the head and reader pointers as though the
replacement succeeded, which can corrupt the ring.
Treat only a negative counter as exhaustion and return the documented
-EBUSY error.
Cc: stable@vger.kernel.org
Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer")
Link: https://patch.msgid.link/20260825-kernel-patch-1-v2-1-bb3461807a32@gmail.com
Assisted-by: LLM sparse
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/simple_ring_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/trace/simple_ring_buffer.c
+++ b/kernel/trace/simple_ring_buffer.c
@@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(
overrun = cpu_buffer->meta->overrun;
} while (!simple_bpage_unset_head_link(last, reader, SIMPLE_RB_LINK_NORMAL) && retry--);
- if (!retry)
- return -EINVAL;
+ if (retry < 0)
+ return -EBUSY;
cpu_buffer->head_page = simple_bpage_from_link(reader->link.next);
cpu_buffer->head_page->link.prev = &reader->link;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 092/713] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-09-04 4:50 ` [PATCH 7.2 091/713] tracing: Fix retry exhaustion in simple ring buffer reader swap Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 093/713] tracing: Fix use-after-free with same-name named triggers Greg Kroah-Hartman
` (631 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+685955db58555575fdd2,
Bradley Morgan, Deepanshu Kartikey, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 372f8534244d632ad5118e8a87a11291b01712d3 upstream.
Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of the ring buffer, including the reader
page, and replaces them with newly allocated ones.
Readers of trace_pipe hold pointers into those pages. ring_buffer_peek()
looks up an event under cpu_buffer->reader_lock but returns the event
pointer after dropping the lock, and peek_next_entry() then calls
ring_buffer_event_length() and ring_buffer_event_data() on it. If the
sub-buffer order is changed in that window, the reader dereferences
freed memory:
BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430
Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
Freed by:
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change.
This is the lock trace_pipe readers already hold across their entire
peek-and-print loop, so the swap can no longer race with a reader that
is dereferencing a peeked event.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260817140655.5694-1-kartikey406@gmail.com
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2
Tested-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
Reviewed-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8214,6 +8214,8 @@ buffer_subbuf_size_write(struct file *fi
/* Do not allow tracing while changing the order of the ring buffer */
tracing_stop_tr(tr);
+ trace_access_lock(RING_BUFFER_ALL_CPUS);
+
old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
if (old_order == order)
goto out;
@@ -8253,6 +8255,7 @@ buffer_subbuf_size_write(struct file *fi
#endif
(*ppos)++;
out:
+ trace_access_unlock(RING_BUFFER_ALL_CPUS);
if (ret)
cnt = ret;
tracing_start_tr(tr);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 093/713] tracing: Fix use-after-free with same-name named triggers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 092/713] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 094/713] cdx: Fix double free when sysfs file creation fails Greg Kroah-Hartman
` (630 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit a7318172aa332a161fb9618286e64454c827f8fd upstream.
When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named_data. Both are added to
tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),
because save_hist_vars() is called before event_trigger_register() while
the named reuse is only detected later, in hist_register_trigger().
In the named-data branch hist_register_trigger() then frees the second
histogram's hist_data via destroy_hist_data(), but never removes its
tr->hist_vars list entry, leaving a dangling pointer and leaking the
trace_array reference it holds.
A later hist trigger that references a variable makes find_var_file()
walk tr->hist_vars and dereference the freed hist_data. The bug is
reproducible from userspace by writing three hist triggers to tracefs:
cd /sys/kernel/tracing
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger
echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger
The third write panics the kernel:
BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290
Read of size 8 at addr ffff888001f8a0e0 by task sh/1
CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N
Call Trace:
find_var_file.part.0
find_event_var
parse_atom
parse_expr
__create_val_field
event_hist_trigger_parse
trigger_process_regex
event_trigger_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
Allocated by task 1:
event_hist_trigger_parse
Freed by task 1:
hist_register_trigger+0x618/0xa30
event_hist_trigger_parse
The buggy address belongs to freed 2048-byte region
Oops: general protection fault ... RIP: find_var_file.part.0
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Fix by removing the hist_data from tr->hist_vars and releasing the
trace_array reference in the named-data branch of hist_register_trigger()
before freeing the hist_data.
Cc: stable@vger.kernel.org
Fixes: 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list")
Link: https://patch.msgid.link/20260816100427.33642-3-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_hist.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6641,8 +6641,10 @@ static int hist_register_trigger(char *g
tracing_set_filter_buffering(file->tr, true);
}
- if (named_data)
+ if (named_data) {
+ remove_hist_vars(hist_data);
destroy_hist_data(hist_data);
+ }
out:
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 094/713] cdx: Fix double free when sysfs file creation fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 093/713] tracing: Fix use-after-free with same-name named triggers Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 095/713] debugfs: Fix lockdown check for mmap_prepare Greg Kroah-Hartman
` (629 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prasanna Kumar T S M, Nikhil Agarwal,
Nipun Gupta
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
commit 6f4acc3a3c300e174e3f586b97b04ed8f5948c36 upstream.
In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code
frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This
leaves a dangling pointer in the array. Then cdx_destroy_res_attr()
frees the already-freed memory. Fix the double free by initializing
cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.
Fixes: aeda33ab8160 ("cdx: create sysfs bin files for cdx resources")
Cc: stable@vger.kernel.org
Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
Acked-by: Nikhil Agarwal <Nikhil.agarwal@amd.com>
Acked-by: Nipun Gupta <nipun.gupta@amd.com>
Link: https://patch.msgid.link/20260724092712.2119149-1-ptsm@linux.microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cdx/cdx.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/cdx/cdx.c
+++ b/drivers/cdx/cdx.c
@@ -738,7 +738,6 @@ static int cdx_create_res_attr(struct cd
sysfs_bin_attr_init(res_attr);
- cdx_dev->res_attr[num] = res_attr;
sprintf(res_attr_name, "resource%d", num);
res_attr->mmap = cdx_mmap_resource;
@@ -747,8 +746,12 @@ static int cdx_create_res_attr(struct cd
res_attr->size = cdx_resource_len(cdx_dev, num);
res_attr->private = (void *)(unsigned long)num;
ret = sysfs_create_bin_file(&cdx_dev->dev.kobj, res_attr);
- if (ret)
+ if (ret) {
kfree(res_attr);
+ return ret;
+ }
+
+ cdx_dev->res_attr[num] = res_attr;
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 095/713] debugfs: Fix lockdown check for mmap_prepare
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 094/713] cdx: Fix double free when sysfs file creation fails Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 096/713] device property: fix infinite loop in fwnode_for_each_child_node() Greg Kroah-Hartman
` (628 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chun-Yi Lee, David Howells,
Lorenzo Stoakes, Andy Shevchenko, Thomas Gleixner,
Rafael J. Wysocki, Matthew Garrett, Danilo Krummrich, driver-core,
linux-kernel, Disha Goel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chun-Yi Lee <jlee@suse.com>
commit f81808de37338aac8e167f99bfae647b1b835c70 upstream.
Commit 651fdda8406d ("relay: update relay to use mmap_prepare")
changed the `mmap` file operation to `mmap_prepare` for relayfs, but
the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in
integrity mode if a file uses `mmap_prepare` but not `mmap`.
Since the conversion to `mmap_prepare` across the kernel is not yet
complete, update the lockdown check to look for both `mmap` and
`mmap_prepare` to ensure comprehensive coverage.
Fixes: 651fdda8406d ("relay: update relay to use mmap_prepare")
Signed-off-by: Chun-Yi Lee <jlee@suse.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: driver-core@lists.linux.dev
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Disha Goel <disgoel@linux.ibm.com>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Link: https://patch.msgid.link/20260615104750.1000-1-jlee@suse.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/debugfs/file.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -273,7 +273,8 @@ static int debugfs_locked_down(struct in
(!real_fops ||
(!real_fops->unlocked_ioctl &&
!real_fops->compat_ioctl &&
- !real_fops->mmap)))
+ !real_fops->mmap &&
+ !real_fops->mmap_prepare)))
return 0;
if (security_locked_down(LOCKDOWN_DEBUGFS))
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 096/713] device property: fix infinite loop in fwnode_for_each_child_node()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 095/713] debugfs: Fix lockdown check for mmap_prepare Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 097/713] misc: nsm: bound the device-reported response length Greg Kroah-Hartman
` (627 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Andy Shevchenko
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit 1900692555826753adab8799a1a8d50bb1ee200c upstream.
When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an infinite loop if the secondary
fwnode has more than one child.
Parent Child
(Primary fwnode) FWa: {FWa1, FWa2, FWa3}
(Secondary fwnode) FWb: {FWb1, FWb2}
In this case:
┌─> fwnode_get_next_child_node(FWa, FWa1)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2
│
│ ...
│
│ fwnode_get_next_child_node(FWa, FWa3)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL
│ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1
│
│ fwnode_get_next_child_node(FWa, FWb1)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1
└────┘
This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly
output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.
The root cause is that when the current child (FWb1) belongs to the
secondary fwnode, calling get_next_child_node() on the parimary fwnode
incorrectly returns the first child (FWa1) again instead of NULL.
Fix this by dynamically checking the parent fwnode of the current child
before calling get_next_child_node(). This approach follows the pattern
established in commit b5b41ab6b0c1 ("device property: Check
fwnode->secondary in fwnode_graph_get_next_endpoint()").
Fixes: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260611203537.1786399-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -807,18 +807,31 @@ struct fwnode_handle *
fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
struct fwnode_handle *child)
{
+ const struct fwnode_handle *parent;
+ struct fwnode_handle *child_parent __free(fwnode_handle) = NULL;
struct fwnode_handle *next;
- if (IS_ERR_OR_NULL(fwnode))
+ /*
+ * If this function is in a loop and the previous iteration returned
+ * an child from fwnode->secondary, then we need to use the secondary
+ * as parent rather than @fwnode.
+ */
+ if (child) {
+ child_parent = fwnode_get_parent(child);
+ parent = child_parent;
+ } else {
+ parent = fwnode;
+ }
+ if (IS_ERR_OR_NULL(parent))
return NULL;
/* Try to find a child in primary fwnode */
- next = fwnode_call_ptr_op(fwnode, get_next_child_node, child);
+ next = fwnode_call_ptr_op(parent, get_next_child_node, child);
if (next)
return next;
/* When no more children in primary, continue with secondary */
- return fwnode_call_ptr_op(fwnode->secondary, get_next_child_node, child);
+ return fwnode_get_next_child_node(parent->secondary, NULL);
}
EXPORT_SYMBOL_GPL(fwnode_get_next_child_node);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 097/713] misc: nsm: bound the device-reported response length
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 096/713] device property: fix infinite loop in fwnode_for_each_child_node() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 098/713] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
` (626 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Alexander Graf
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 808e530654a5354e6df78863a5d61e4d44e67235 upstream.
nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported
by the NSM device into msg->resp.len without bounding it to the response
buffer. A malicious or buggy backend can report a length larger than the
response buffer; parse_resp_raw() then copies that many bytes out of the
fixed buffer to user space, disclosing adjacent kernel heap (an
out-of-bounds read). The request path already floors its length in
fill_req_raw(); the response path lacks the symmetric check.
Clamp the stored length to the size of the response buffer. Well-behaved
devices report no more than the posted buffer size, so conforming traffic
is unaffected.
Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Alexander Graf <graf@amazon.com>
Link: https://patch.msgid.link/20260620-b4-disp-a54b7dd6-v1-1-79d1f236a854@proton.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/nsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -243,7 +243,7 @@ static int nsm_sendrecv_msg_locked(struc
goto cleanup;
}
- msg->resp.len = len;
+ msg->resp.len = min_t(unsigned int, len, sizeof(msg->resp.data));
rc = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 098/713] powerpc/powermac: fix OF node refcount
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 097/713] misc: nsm: bound the device-reported response length Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 099/713] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
` (625 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Bartosz Golaszewski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit bd0abfe6b013aeb2a1aebc5fbc7ceeb50355bda3 upstream.
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().
Cc: stable@vger.kernel.org
Fixes: 81e5d8646ff6 ("i2c/powermac: Register i2c devices from device-tree")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706-pdev-fwnode-ref-v3-1-1ff028e33779@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1471,7 +1471,7 @@ static int __init pmac_i2c_create_platfo
if (bus->platform_dev == NULL)
return -ENOMEM;
bus->platform_dev->dev.platform_data = bus;
- bus->platform_dev->dev.of_node = bus->busnode;
+ bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
platform_device_add(bus->platform_dev);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 099/713] rapidio: mport_cdev: fix use-after-free in dma_req_free()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 098/713] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 100/713] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
` (624 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Kim, Dan Carpenter,
Alexandre Bounine, Matt Porter, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
commit 5cbef379a94b161726c5f504598bf4791d45cedc upstream.
dma_req_free() acquires buf_mutex through req->map, drops the mapping
reference with kref_put(), and then dereferences req->map again to unlock
the mutex.
If kref_put() drops the last reference, mport_release_mapping() frees the
mapping, and the subsequent mutex_unlock() dereferences a freed object.
This is a use-after-free.
Fix this by caching map and md before kref_put(), clearing req->map while
holding buf_mutex, and using the cached md for mutex unlocking.
The bug is reachable from userspace via the RapidIO mport character device
interface.
Link: https://lore.kernel.org/20260723235220.588424-1-james010kim@gmail.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: James Kim <james010kim@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/rio_mport_cdev.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -564,9 +564,13 @@ static void dma_req_free(struct kref *re
}
if (req->map) {
- mutex_lock(&req->map->md->buf_mutex);
- kref_put(&req->map->ref, mport_release_mapping);
- mutex_unlock(&req->map->md->buf_mutex);
+ struct rio_mport_mapping *map = req->map;
+ struct mport_dev *md = map->md;
+
+ mutex_lock(&md->buf_mutex);
+ req->map = NULL;
+ kref_put(&map->ref, mport_release_mapping);
+ mutex_unlock(&md->buf_mutex);
}
kref_put(&priv->dma_ref, mport_release_dma);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 100/713] Revert "media: v4l2-dev: fix error handling in __video_register_device()"
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 099/713] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 101/713] serial: imx: serialize imx_uart_ports[] lifetime Greg Kroah-Hartman
` (623 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans Verkuil
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil+cisco@kernel.org>
commit e7600f5cee5de14065f950807931d6e6d40fb2d7 upstream.
This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.
The intentions of that patch were good, but it doesn't work.
The idea is that if device_register fails, you have to do a put_device
to let the ref counter release resources.
However, the V4L2 API says that if video_register_device() fails, then
you have to call video_device_release(), which kfree()s the video_device
struct.
But the put_device() will already have freed the struct, so you end
up in a double-free scenario.
There is not really a good way of fixing this without breaking
video_register_device() into two parts, one that initializes everything,
and one that does the actual device_register, and then converting all
V4L2 drivers to this new model.
That is a massive job, and it is very unlikely that device_register
will fail.
So rather than ending up in a double-free scenario, just revert this
patch, and in that case we'll have a small memory leak. Which is a lot
more robust.
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Fixes: 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-media/20260520090624.1071139-1-lgs201920130244@gmail.com/
Link: https://lore.kernel.org/all/2026042058-charm-storable-4ad8@gregkh/
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -1071,25 +1071,25 @@ int __video_register_device(struct video
vdev->dev.class = &video_class;
vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
vdev->dev.parent = vdev->dev_parent;
- vdev->dev.release = v4l2_device_release;
dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
-
- /* Increase v4l2_device refcount */
- v4l2_device_get(vdev->v4l2_dev);
-
mutex_lock(&videodev_lock);
ret = device_register(&vdev->dev);
if (ret < 0) {
mutex_unlock(&videodev_lock);
pr_err("%s: device_register failed\n", __func__);
- put_device(&vdev->dev);
- return ret;
+ goto cleanup;
}
+ /* Register the release callback that will be called when the last
+ reference to the device goes away. */
+ vdev->dev.release = v4l2_device_release;
if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
pr_warn("%s: requested %s%d, got %s\n", __func__,
name_base, nr, video_device_node_name(vdev));
+ /* Increase v4l2_device refcount */
+ v4l2_device_get(vdev->v4l2_dev);
+
/* Part 5: Register the entity. */
ret = video_register_media_controller(vdev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 101/713] serial: imx: serialize imx_uart_ports[] lifetime
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 100/713] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 102/713] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
` (622 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Karl Mehltretter, Frank Li
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit 8b0b29fdcb47907ae0296b8fe829e918e05e300f upstream.
imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[]
before uart_add_one_port() because console setup uses the table. The entry
is not cleared when adding the port fails or after removal, leaving a
dangling pointer.
A sibling probe can register the shared console through that stale entry.
This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a
sibling UART, unbinding the console UART and rebinding the sibling.
Keep the entry valid through uart_remove_one_port(), then clear it. Protect
port addition and removal together with their table updates so sibling
operations cannot interleave. Reject an occupied slot rather than
clobbering an active port during a duplicate-line probe.
Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables")
Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260719162850.043B41F000E9@smtp.kernel.org
Link: https://lore.kernel.org/all/20260719222501.CB4CB1F000E9@smtp.kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731181844.11330-6-kmehltretter@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/imx.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -22,6 +22,7 @@
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/ktime.h>
+#include <linux/mutex.h>
#include <linux/pinctrl/consumer.h>
#include <linux/rational.h>
#include <linux/slab.h>
@@ -2080,6 +2081,9 @@ static const struct uart_ops imx_uart_po
static struct imx_port *imx_uart_ports[UART_NR];
+/* Held across uart_add/remove_one_port(); console callbacks must not take it. */
+static DEFINE_MUTEX(imx_uart_ports_lock);
+
#if IS_ENABLED(CONFIG_SERIAL_IMX_CONSOLE)
static void imx_uart_console_putchar(struct uart_port *port, unsigned char ch)
{
@@ -2632,11 +2636,19 @@ static int imx_uart_probe(struct platfor
}
}
- imx_uart_ports[sport->port.line] = sport;
-
platform_set_drvdata(pdev, sport);
- ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port);
+ scoped_guard(mutex, &imx_uart_ports_lock) {
+ if (imx_uart_ports[sport->port.line]) {
+ ret = -EBUSY;
+ } else {
+ imx_uart_ports[sport->port.line] = sport;
+ ret = uart_add_one_port(&imx_uart_uart_driver,
+ &sport->port);
+ if (ret)
+ imx_uart_ports[sport->port.line] = NULL;
+ }
+ }
err_clk:
clk_disable_unprepare(sport->clk_ipg);
@@ -2648,7 +2660,9 @@ static void imx_uart_remove(struct platf
{
struct imx_port *sport = platform_get_drvdata(pdev);
+ guard(mutex)(&imx_uart_ports_lock);
uart_remove_one_port(&imx_uart_uart_driver, &sport->port);
+ imx_uart_ports[sport->port.line] = NULL;
}
static void imx_uart_restore_context(struct imx_port *sport)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 102/713] staging: greybus: hid: fix SET_REPORT return value
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 101/713] serial: imx: serialize imx_uart_ports[] lifetime Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 103/713] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
` (621 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 6d45195a9626d8aaaaed212c55638829a9c624a3 upstream.
__gb_hid_output_raw_report() stores the result of gb_hid_set_report()
in ret and even adjusts it to account for the report ID byte, but then
always returns 0.
This hides Greybus transport errors from HID_REQ_SET_REPORT callers,
and makes hidraw report zero bytes written to user space on success,
although hid_hw_raw_request() is expected to return the number of
bytes transferred or a negative errno. The sibling GET_REPORT path,
__gb_hid_get_raw_report(), already follows this convention.
Return ret like the other HID transport drivers do.
Fixes: 96eab779e198 ("greybus: hid: add HID class driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704081613.434445-1-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/greybus/hid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -256,7 +256,7 @@ static int __gb_hid_output_raw_report(st
if (report_id && ret >= 0)
ret++; /* add report_id to the number of transferred bytes */
- return 0;
+ return ret;
}
static int gb_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 103/713] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 102/713] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 104/713] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Greg Kroah-Hartman
` (620 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Lavra
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit bf1e90189a98ca4a824fd64b4f3c6043d13c98ea upstream.
When a USB host suspends a connected device, the DWC2 USB device controller
enters a partial power down state where controller registers are not
accessible. If the USB gadget is then disconnected or deactivated
(e.g. when a gadget function is unbound from the controller), the `pullup`
callback in struct usb_gadget_ops is invoked; if the controller is kept in
partial power down, the register write in dwc2_hsotg_core_disconnect() does
not take effect; as a result, the USB host keeps seeing the device as
connected, even though the device is disabled.
Properly exit partial power down state in the pullup callback, so that the
USB host detects a device disconnection as intended.
Fixes: 97861781daff ("usb: dwc2: Allow entering hibernation from USB_SUSPEND interrupt")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Link: https://patch.msgid.link/20260728154420.2021519-1-flavra@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -4680,6 +4680,7 @@ static int dwc2_hsotg_pullup(struct usb_
{
struct dwc2_hsotg *hsotg = to_hsotg(gadget);
unsigned long flags;
+ int ret = 0;
dev_dbg(hsotg->dev, "%s: is_on: %d op_state: %d\n", __func__, is_on,
hsotg->op_state);
@@ -4691,6 +4692,13 @@ static int dwc2_hsotg_pullup(struct usb_
}
spin_lock_irqsave(&hsotg->lock, flags);
+ if (hsotg->in_ppd) {
+ ret = dwc2_exit_partial_power_down(hsotg, 0, true);
+ if (ret) {
+ dev_err(hsotg->dev, "exit partial_power_down failed\n");
+ goto exit;
+ }
+ }
if (is_on) {
hsotg->enabled = 1;
dwc2_hsotg_core_init_disconnected(hsotg, false);
@@ -4704,9 +4712,10 @@ static int dwc2_hsotg_pullup(struct usb_
}
hsotg->gadget.speed = USB_SPEED_UNKNOWN;
+exit:
spin_unlock_irqrestore(&hsotg->lock, flags);
- return 0;
+ return ret;
}
static int dwc2_hsotg_vbus_session(struct usb_gadget *gadget, int is_active)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 104/713] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 103/713] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 105/713] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Greg Kroah-Hartman
` (619 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thinh Nguyen, Pei Xiao,
Radhey Shyam Pandey
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
commit 9c855832790cd488d87de1885974f4c37cfe7358 upstream.
In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
event is received.
If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
the memory allocated for dep with kzalloc() is released by kfree(dep),
while the delayed work mentioned above may still be pending or
running. The sequence of operations that may lead to a UAF bug is as
follows:
CPU0 CPU1
| dwc3_thread_interrupt
| dwc3_endpoint_interrupt
| dwc3_gadget_endpoint_stream_event
| queue_delayed_work(system_percpu_wq,
| &dep->nostream_work)
dwc3_gadget_free_endpoints |
dwc3_free_trb_pool(dep) |
list_del(&dep->endpoint.ep_list) |
dwc3_debugfs_remove_endpoint_dir(dep) |
kfree(dep) |
// dep is freed |
| dwc3_nostream_work
| // use dep (use-after-free)
Fix it by canceling the delayed work before kfree(dep) in
dwc3_gadget_free_endpoints.
Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
Assisted-by: Codex:deepseek-v4-flash
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Cc: stable@vger.kernel.org
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://patch.msgid.link/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3497,6 +3497,7 @@ static void dwc3_gadget_free_endpoints(s
}
dwc3_debugfs_remove_endpoint_dir(dep);
+ cancel_delayed_work_sync(&dep->nostream_work);
kfree(dep);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 105/713] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 104/713] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 106/713] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
` (618 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit c27d13ce4bab80fbdf6523928071b6c24b37606c upstream.
In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a
self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and
at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via
mod_timer(). Both recover the same udc through container_of and dereference
it on every iteration.
Neither teardown path cancels this cycle. udc is devm-allocated, so it is
freed after at91udc_remove() returns, and is likewise freed when probe
fails and devres runs. A timer callback or work item that is pending or
running at either point dereferences the freed udc.
Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and
from the usb_add_gadget_udc() failure path in probe; the remaining probe
error paths fail before the timer is armed. timer_shutdown_sync() waits
for a running callback and clears timer->function, which makes the work
handler's mod_timer() a permanent no-op; cancel_work_sync() then drains
any pending or running work whose re-arm attempt now does nothing. The
timer must be shut down first, since cancelling the work alone would let
the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and
work_struct are never initialized.
This does not require a fault; a normal driver unbind can interleave with
an already queued work item.
This issue was found by an in-house static analysis tool.
Fixes: 4037242c4f5f ("ARM: 6209/3: at91_udc: Add vbus polarity and polling mode")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719042839.3167094-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/at91_udc.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/at91_udc.c
+++ b/drivers/usb/gadget/udc/at91_udc.c
@@ -1794,6 +1794,19 @@ static void at91udc_of_init(struct at91_
udc->caps = match->data;
}
+/*
+ * The work handler re-arms this timer, so shut the timer down before
+ * draining the work; otherwise it restarts the polling cycle.
+ */
+static void at91_udc_shutdown_vbus_timer(struct at91_udc *udc)
+{
+ if (!(udc->board.vbus_pin && udc->board.vbus_polled))
+ return;
+
+ timer_shutdown_sync(&udc->vbus_timer);
+ cancel_work_sync(&udc->vbus_timer_work);
+}
+
static int at91udc_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -1907,7 +1920,7 @@ static int at91udc_probe(struct platform
}
retval = usb_add_gadget_udc(dev, &udc->gadget);
if (retval)
- goto err_unprepare_iclk;
+ goto err_shutdown_vbus;
dev_set_drvdata(dev, udc);
device_init_wakeup(dev, 1);
create_debug_file(udc);
@@ -1915,6 +1928,8 @@ static int at91udc_probe(struct platform
INFO("%s version %s\n", driver_name, DRIVER_VERSION);
return 0;
+err_shutdown_vbus:
+ at91_udc_shutdown_vbus_timer(udc);
err_unprepare_iclk:
clk_unprepare(udc->iclk);
err_unprepare_fclk:
@@ -1933,6 +1948,9 @@ static void at91udc_remove(struct platfo
DBG("remove\n");
usb_del_gadget_udc(&udc->gadget);
+
+ at91_udc_shutdown_vbus_timer(udc);
+
if (udc->driver) {
dev_err(&pdev->dev,
"Driver still in use but removing anyhow\n");
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 106/713] USB: phy: fsl-usb: fix missing static keywords
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 105/713] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 107/713] usb: typec: hd3ss3220: fix VBUS regulator error message Greg Kroah-Hartman
` (617 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Johan Hovold
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 80574c40598aedbc1751c528e414d7e224bc6313 upstream.
A recent change enabling compile testing of a Freescale dual-role
controller indirectly enabled a USB PHY driver to be built. That driver
in turn is missing a bunch of static keywords which results in warnings
like:
drivers/usb/phy/phy-fsl-usb.c:105:5: error: no previous prototype for 'write_ulpi' [-Werror=missing-prototypes]
105 | int write_ulpi(u8 addr, u8 data)
| ^~~~~~~~~~
which consequently breaks -Werror builds.
Add the missing static keywords.
Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Cc: stable@vger.kernel.org # 3.0
Reported-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/4f9f5ff9-8eaa-4bd5-9331-37119f78e13f@sirena.org.uk
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260717154957.1853976-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-fsl-usb.c | 52 +++++++++++++++++++++---------------------
drivers/usb/phy/phy-fsl-usb.h | 6 ++--
2 files changed, 29 insertions(+), 29 deletions(-)
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -46,7 +46,7 @@
static const char driver_name[] = "fsl-usb2-otg";
-const pm_message_t otg_suspend_state = {
+static const pm_message_t otg_suspend_state = {
.event = 1,
};
@@ -57,11 +57,11 @@ static struct fsl_otg *fsl_otg_dev;
static int srp_wait_done;
/* FSM timers */
-struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
+static struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
*b_ase0_brst_tmr, *b_se0_srp_tmr;
/* Driver specific timers */
-struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
+static struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
*b_srp_wait_tmr, *a_wait_enum_tmr;
static struct list_head active_timers;
@@ -102,7 +102,7 @@ static void (*_fsl_writel)(u32 v, unsign
#define fsl_writel(val, addr) writel(val, addr)
#endif /* CONFIG_PPC32 */
-int write_ulpi(u8 addr, u8 data)
+static int write_ulpi(u8 addr, u8 data)
{
u32 temp;
@@ -115,7 +115,7 @@ int write_ulpi(u8 addr, u8 data)
/* Operations that will be called from OTG Finite State Machine */
/* Charge vbus for vbus pulsing in SRP */
-void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -133,7 +133,7 @@ void fsl_otg_chrg_vbus(struct otg_fsm *f
}
/* Discharge vbus through a resistor to ground */
-void fsl_otg_dischrg_vbus(int on)
+static void fsl_otg_dischrg_vbus(int on)
{
u32 tmp;
@@ -151,7 +151,7 @@ void fsl_otg_dischrg_vbus(int on)
}
/* A-device driver vbus, controlled through PP bit in PORTSC */
-void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -169,7 +169,7 @@ void fsl_otg_drv_vbus(struct otg_fsm *fs
* Pull-up D+, signalling connect by periperal. Also used in
* data-line pulsing in SRP
*/
-void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -188,7 +188,7 @@ void fsl_otg_loc_conn(struct otg_fsm *fs
* port. In host mode, controller will automatically send SOF.
* Suspend will block the data on the port.
*/
-void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -203,7 +203,7 @@ void fsl_otg_loc_sof(struct otg_fsm *fsm
}
/* Start SRP pulsing by data-line pulsing, followed with v-bus pulsing. */
-void fsl_otg_start_pulse(struct otg_fsm *fsm)
+static void fsl_otg_start_pulse(struct otg_fsm *fsm)
{
u32 tmp;
@@ -219,7 +219,7 @@ void fsl_otg_start_pulse(struct otg_fsm
fsl_otg_add_timer(fsm, b_data_pulse_tmr);
}
-void b_data_pulse_end(unsigned long foo)
+static void b_data_pulse_end(unsigned long foo)
{
#ifdef HA_DATA_PULSE
#else
@@ -230,7 +230,7 @@ void b_data_pulse_end(unsigned long foo)
fsl_otg_pulse_vbus();
}
-void fsl_otg_pulse_vbus(void)
+static void fsl_otg_pulse_vbus(void)
{
srp_wait_done = 0;
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 1);
@@ -238,7 +238,7 @@ void fsl_otg_pulse_vbus(void)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_vbus_pulse_tmr);
}
-void b_vbus_pulse_end(unsigned long foo)
+static void b_vbus_pulse_end(unsigned long foo)
{
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 0);
@@ -251,7 +251,7 @@ void b_vbus_pulse_end(unsigned long foo)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_srp_wait_tmr);
}
-void b_srp_end(unsigned long foo)
+static void b_srp_end(unsigned long foo)
{
fsl_otg_dischrg_vbus(0);
srp_wait_done = 1;
@@ -266,7 +266,7 @@ void b_srp_end(unsigned long foo)
* a_host will start by SRP. It needs to set b_hnp_enable before
* actually suspending to start HNP
*/
-void a_wait_enum(unsigned long foo)
+static void a_wait_enum(unsigned long foo)
{
VDBG("a_wait_enum timeout\n");
if (!fsl_otg_dev->phy.otg->host->b_hnp_enable)
@@ -276,13 +276,13 @@ void a_wait_enum(unsigned long foo)
}
/* The timeout callback function to set time out bit */
-void set_tmout(unsigned long indicator)
+static void set_tmout(unsigned long indicator)
{
*(int *)indicator = 1;
}
/* Initialize timers */
-int fsl_otg_init_timers(struct otg_fsm *fsm)
+static int fsl_otg_init_timers(struct otg_fsm *fsm)
{
/* FSM used timers */
a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,
@@ -339,7 +339,7 @@ int fsl_otg_init_timers(struct otg_fsm *
}
/* Uninitialize timers */
-void fsl_otg_uninit_timers(void)
+static void fsl_otg_uninit_timers(void)
{
/* FSM used timers */
kfree(a_wait_vrise_tmr);
@@ -391,7 +391,7 @@ static struct fsl_otg_timer *fsl_otg_get
}
/* Add timer to timer list */
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer;
@@ -421,7 +421,7 @@ static void fsl_otg_fsm_add_timer(struct
}
/* Remove timer from the timer list; clear timeout status */
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer, *del_tmp;
@@ -443,7 +443,7 @@ static void fsl_otg_fsm_del_timer(struct
}
/* Reset controller, not reset the bus */
-void otg_reset_controller(void)
+static void otg_reset_controller(void)
{
u32 command;
@@ -455,7 +455,7 @@ void otg_reset_controller(void)
}
/* Call suspend/resume routines in host driver */
-int fsl_otg_start_host(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_host(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -522,7 +522,7 @@ end:
* Call suspend and resume function in udc driver
* to stop and start udc driver.
*/
-int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -704,7 +704,7 @@ static int fsl_otg_start_hnp(struct usb_
* intact. It needs to have knowledge of some USB interrupts
* such as port change.
*/
-irqreturn_t fsl_otg_isr(int irq, void *dev_id)
+static irqreturn_t fsl_otg_isr(int irq, void *dev_id)
{
struct otg_fsm *fsm = &((struct fsl_otg *)dev_id)->fsm;
struct usb_otg *otg = ((struct fsl_otg *)dev_id)->phy.otg;
@@ -830,7 +830,7 @@ err:
}
/* OTG Initialization */
-int usb_otg_start(struct platform_device *pdev)
+static int usb_otg_start(struct platform_device *pdev)
{
struct fsl_otg *p_otg;
struct usb_phy *otg_trans = usb_get_phy(USB_PHY_TYPE_USB2);
@@ -1002,7 +1002,7 @@ static void fsl_otg_remove(struct platfo
pdata->exit(pdev);
}
-struct platform_driver fsl_otg_driver = {
+static struct platform_driver fsl_otg_driver = {
.probe = fsl_otg_probe,
.remove = fsl_otg_remove,
.driver = {
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -373,6 +373,6 @@ struct fsl_otg_config {
#define FSL_OTG_NAME "fsl-usb2-otg"
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_pulse_vbus(void);
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_pulse_vbus(void);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 107/713] usb: typec: hd3ss3220: fix VBUS regulator error message
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 106/713] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 108/713] usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Greg Kroah-Hartman
` (616 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Xu Rao
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 10ff55ff552b3bf1dadba03fcc430ea205fa2761 upstream.
hd3ss3220_regulator_control() enables the VBUS regulator when @on is
true and disables it when @on is false. However, its error message uses
the opposite operation name, so an enable failure is reported as a
disable failure and vice versa.
Print the operation that was actually attempted. Reporting the opposite
regulator operation on failures can mislead debugging of VBUS problems.
Fixes: 27fbc19e52b9 ("usb: typec: hd3ss3220: Enable VBUS based on role state")
Cc: stable@vger.kernel.org
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/7A42A287B2B588D0+20260812094632.348581-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/hd3ss3220.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/hd3ss3220.c
+++ b/drivers/usb/typec/hd3ss3220.c
@@ -218,7 +218,7 @@ static void hd3ss3220_regulator_control(
if (ret)
dev_err(hd3ss3220->dev,
- "vbus regulator %s failed: %d\n", on ? "disable" : "enable", ret);
+ "vbus regulator %s failed: %d\n", on ? "enable" : "disable", ret);
}
static void hd3ss3220_set_role(struct hd3ss3220 *hd3ss3220)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 108/713] usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 107/713] usb: typec: hd3ss3220: fix VBUS regulator error message Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 109/713] usb: typec: thunderbolt: Disable work before freeing tbt on remove Greg Kroah-Hartman
` (615 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Yang, Heikki Krogerus,
Badhri Jagan Sridharan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit b691a07c5f644080374ddd24de6a0e05f5d28744 upstream.
Previously, tcpci_irq() always passed TCPC_TX_SOP as the receive type
to tcpm_pd_receive(), ignoring the actual frame type reported by the
TCPC_RX_BUF_FRAME_TYPE register.
Cache the TCPC_RX_DETECT register value in rx_type_mask variable. When
a PD messageis received, read TCPC_RX_BUF_FRAME_TYPE register and handle
the message only if its frame type is enabled in mask.
The TCPC_RX_BUF_FRAME_TYPE register records the received message type,
which has a 1:1 mapping to enum tcpm_transmit_type.
Fixes: fb7ff25ae433 ("usb: typec: tcpm: add discover identity support for SOP'")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://patch.msgid.link/20260723104614.3717623-1-xu.yang_2@oss.nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpci.c | 12 +++++++++++-
include/linux/usb/tcpci.h | 1 +
2 files changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/usb/typec/tcpm/tcpci.c
+++ b/drivers/usb/typec/tcpm/tcpci.c
@@ -38,6 +38,7 @@ struct tcpci {
struct regmap *regmap;
unsigned int alert_mask;
+ unsigned int rx_type_mask;
bool controls_vbus;
@@ -488,6 +489,8 @@ static int tcpci_set_pd_rx(struct tcpc_d
if (tcpci->data->cable_comm_capable)
reg |= TCPC_RX_DETECT_SOP1;
}
+
+ tcpci->rx_type_mask = reg;
ret = regmap_write(tcpci->regmap, TCPC_RX_DETECT, reg);
if (ret < 0)
return ret;
@@ -749,6 +752,7 @@ process_status:
if (status & TCPC_ALERT_RX_STATUS) {
struct pd_message msg;
unsigned int cnt, payload_cnt;
+ enum tcpm_transmit_type rx_type;
u16 header;
regmap_read(tcpci->regmap, TCPC_RX_BYTE_CNT, &cnt);
@@ -773,10 +777,16 @@ process_status:
regmap_raw_read(tcpci->regmap, TCPC_RX_DATA,
&msg.payload, payload_cnt);
+ ret = regmap_read(tcpci->regmap, TCPC_RX_BUF_FRAME_TYPE, &rx_type);
+ if (ret)
+ return ret;
+
/* Read complete, clear RX status alert bit */
tcpci_write16(tcpci, TCPC_ALERT, TCPC_ALERT_RX_STATUS);
- tcpm_pd_receive(tcpci->port, &msg, TCPC_TX_SOP);
+ rx_type &= TCPC_RX_BUF_FRAME_TYPE_MASK;
+ if (tcpci->rx_type_mask & BIT(rx_type))
+ tcpm_pd_receive(tcpci->port, &msg, rx_type);
}
if (tcpci->data->vbus_vsafe0v && (status & TCPC_ALERT_EXTENDED_STATUS)) {
--- a/include/linux/usb/tcpci.h
+++ b/include/linux/usb/tcpci.h
@@ -144,6 +144,7 @@
#define TCPC_RX_BUF_FRAME_TYPE 0x31
#define TCPC_RX_BUF_FRAME_TYPE_SOP 0
#define TCPC_RX_BUF_FRAME_TYPE_SOP1 1
+#define TCPC_RX_BUF_FRAME_TYPE_MASK GENMASK(2, 0)
#define TCPC_RX_HDR 0x32
#define TCPC_RX_DATA 0x34 /* through 0x4f */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 109/713] usb: typec: thunderbolt: Disable work before freeing tbt on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 108/713] usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 110/713] usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Greg Kroah-Hartman
` (614 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Heikki Krogerus
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 92090f6ff2acc81e9dd99881dcfb4f8c1bdaabd3 upstream.
tbt_altmode_remove() drops the plug and cable references without
draining tbt->work. The work function dereferences those references,
and can also requeue itself in its error path. The VDM callbacks can
queue the same work item.
Disable and drain tbt->work before dropping the references. This waits
for an existing invocation and prevents subsequent schedule_work()
calls from queueing it during teardown.
This issue was found by an in-house static analysis tool and confirmed
by manual code review.
Fixes: 100e25738659 ("usb: typec: Add driver for Thunderbolt 3 Alternate Mode")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260802014959.416687-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/altmodes/thunderbolt.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/typec/altmodes/thunderbolt.c
+++ b/drivers/usb/typec/altmodes/thunderbolt.c
@@ -303,6 +303,8 @@ static void tbt_altmode_remove(struct ty
{
struct tbt_altmode *tbt = typec_altmode_get_drvdata(alt);
+ disable_work_sync(&tbt->work);
+
for (int i = TYPEC_PLUG_SOP_PP; i >= 0; --i) {
if (tbt->plug[i])
typec_altmode_put_plug(tbt->plug[i]);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 110/713] usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 109/713] usb: typec: thunderbolt: Disable work before freeing tbt on remove Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 111/713] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
` (613 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huang Wei, Heikki Krogerus,
Fedor Pchelkin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Wei <huangwei@kylinos.cn>
commit eb4573cf2fd860b20adfae050c3f6ec6ddc3abdb upstream.
The synchronous command completion path in ucsi_sync_control_common()
hardcodes a 5 second (5 * HZ) timeout when waiting for the PPM to signal
command completion via ACPI notification. This value matched
UCSI_TIMEOUT_MS when it was still 5000 ms, but it was not updated when
that macro was later raised to 10000 ms to fix PPM reset timeouts.
As a result, the two PPM communication paths are now inconsistent: the
polling path in ucsi_reset_ppm() respects the 10 second timeout, while
the event-driven completion path still uses 5 seconds. On machines where
the firmware is slow to respond during boot (e.g. some Lenovo ThinkPad
models such as the E14 Gen 7), commands sent after the PPM reset, such
as SET_NOTIFICATION_ENABLE and GET_CAPABILITY, can exceed 5 seconds and
cause UCSI initialization to fail with:
ucsi_acpi USBC000:00: error -ETIMEDOUT: PPM init failed
Once UCSI init aborts, USB-C PD negotiation never completes, which in
turn blocks USB-C dock enumeration since the dock depends on a successful
PD contract.
Replace the hardcoded 5 * HZ with msecs_to_jiffies(UCSI_TIMEOUT_MS) so
that both communication paths share a single, consistent timeout value,
and future adjustments to UCSI_TIMEOUT_MS are picked up automatically.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221740
Link: https://bugzilla.kernel.org/show_bug.cgi?id=2183790
Fixes: bf4f9ae1cb08c ("usb: typec: ucsi: increase timeout for PPM reset operations")
Cc: stable@vger.kernel.org
Signed-off-by: Huang Wei <huangwei@kylinos.cn>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Fedor Pchelkin <boddah8794@gmail.com>
Link: https://patch.msgid.link/20260805085725.389761-1-huangwei@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -91,7 +91,8 @@ int ucsi_sync_control_common(struct ucsi
if (ret)
goto out_clear_bit;
- if (!wait_for_completion_timeout(&ucsi->complete, 5 * HZ))
+ if (!wait_for_completion_timeout(&ucsi->complete,
+ msecs_to_jiffies(UCSI_TIMEOUT_MS)))
ret = -ETIMEDOUT;
out_clear_bit:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 111/713] usb: gadget: u_audio: Fix use-after-free on sound card disconnect
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 110/713] usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 112/713] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
` (612 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sonali Pradhan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <sonalipradhan@google.com>
commit 858965947081d10d41d9a1010a540d3d5eea958b upstream.
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the underlying struct snd_uac_chip
context. However, snd_card_free_when_closed() returns asynchronously
while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file
descriptors, kctl callbacks attempt to dereference kctl->private_data
pointing to &uac->c_prm or &uac->p_prm within the freed uac structure,
resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snd_uac_chip until
all references to the ALSA sound card are released. Register a custom
card->private_free callback (u_audio_card_free) during g_audio_setup()
that frees uac and its associated playback/capture request and ring
buffers only when the sound card reference count drops to zero.
Fixes: 6c67ed9ad9b8 ("usb: gadget: u_audio: don't let userspace block driver unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
Link: https://patch.msgid.link/20260810071237.2207680-1-sonalipradhan@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/u_audio.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -1177,6 +1177,20 @@ static struct snd_kcontrol_new u_audio_c
},
};
+static void u_audio_card_free(struct snd_card *card)
+{
+ struct snd_uac_chip *uac = card->private_data;
+
+ if (!uac)
+ return;
+
+ kfree(uac->p_prm.reqs);
+ kfree(uac->c_prm.reqs);
+ kfree(uac->p_prm.rbuf);
+ kfree(uac->c_prm.rbuf);
+ kfree(uac);
+}
+
int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
const char *card_name)
{
@@ -1256,6 +1270,8 @@ int g_audio_setup(struct g_audio *g_audi
goto fail;
uac->card = card;
+ card->private_data = uac;
+ card->private_free = u_audio_card_free;
/*
* Create first PCM device
@@ -1424,6 +1440,8 @@ int g_audio_setup(struct g_audio *g_audi
snd_fail:
snd_card_free(card);
+ return err;
+
fail:
kfree(uac->p_prm.reqs);
kfree(uac->c_prm.reqs);
@@ -1449,12 +1467,6 @@ void g_audio_cleanup(struct g_audio *g_a
card = uac->card;
if (card)
snd_card_free_when_closed(card);
-
- kfree(uac->p_prm.reqs);
- kfree(uac->c_prm.reqs);
- kfree(uac->p_prm.rbuf);
- kfree(uac->c_prm.rbuf);
- kfree(uac);
}
EXPORT_SYMBOL_GPL(g_audio_cleanup);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 112/713] usb: gadget: snps_udc_plat: clean up PHY on probe deferral
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 111/713] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 113/713] usb: gadget: midi2: remove default configfs groups on teardown Greg Kroah-Hartman
` (611 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 886338ea7d40e4ba5123c58204d7f7e53d825825 upstream.
When the referenced extcon device has not registered yet,
extcon_get_edev_by_phandle() returns -EPROBE_DEFER after the driver has
initialized and powered on the PHY. The direct return bypasses the common
cleanup path and leaves both operations unbalanced.
Store the lookup error first and route deferred probing through exit_phy,
while retaining the existing behavior of suppressing the error message for
deferral.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260804140510.37639-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/snps_udc_plat.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/udc/snps_udc_plat.c
+++ b/drivers/usb/gadget/udc/snps_udc_plat.c
@@ -159,10 +159,9 @@ static int udc_plat_probe(struct platfor
if (of_property_present(dev->of_node, "extcon")) {
udc->edev = extcon_get_edev_by_phandle(dev, 0);
if (IS_ERR(udc->edev)) {
- if (PTR_ERR(udc->edev) == -EPROBE_DEFER)
- return -EPROBE_DEFER;
- dev_err(dev, "Invalid or missing extcon\n");
ret = PTR_ERR(udc->edev);
+ if (ret != -EPROBE_DEFER)
+ dev_err(dev, "Invalid or missing extcon\n");
goto exit_phy;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 113/713] usb: gadget: midi2: remove default configfs groups on teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 112/713] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 114/713] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
` (610 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+eaa106d192c9daf37f95,
Joshua Crofts
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
commit 0f6bffb5008f0cba9cad5ded2caccc64466a6e54 upstream.
f_midi2_alloc_inst() creates default configfs child groups for the
default endpoint and default block using configfs_add_default_group(),
setting their internal refcount to 1.
However, during function teardown in f_midi2_free_inst() or EP cleanup
in f_midi2_ep_opts_release(), configfs_remove_default_groups() is
never called, therefore never dropping the refcount and leaking struct
f_midi2_ep_opts and f_midi2_block_opts.
Add the missing configfs_remove_default_groups() in the afformentioned
functions to free the structs properly.
Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Link: https://patch.msgid.link/20260730135811.1498-1-joshua.crofts1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_midi2.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -2473,6 +2473,7 @@ static void f_midi2_ep_opts_release(stru
{
struct f_midi2_ep_opts *opts = to_f_midi2_ep_opts(item);
+ configfs_remove_default_groups(&opts->group);
kfree(opts->info.ep_name);
kfree(opts->info.product_id);
kfree(opts);
@@ -2639,6 +2640,7 @@ static void f_midi2_free_inst(struct usb
opts = container_of(f, struct f_midi2_opts, func_inst);
+ configfs_remove_default_groups(&opts->func_inst.group);
kfree(opts->info.iface_name);
kfree(opts);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 114/713] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 113/713] usb: gadget: midi2: remove default configfs groups on teardown Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 115/713] usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Greg Kroah-Hartman
` (609 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+c9f9d646b08f3b6032fe,
Yun Zhou
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
commit 9dbf74f4022f80f7669d2b3c22c5deb46c1b5674 upstream.
usbg_make_tpg() held dep_lock while calling
configfs_depend_item_unlocked(), which acquires the configfs root
inode lock when operating across subsystems. This creates a circular
lock dependency with configfs_rmdir():
dep_lock -> configfs root inode lock -> su_mutex -> dep_lock
In usbg_make_tpg(), dep_lock only serialized the read of opts->ready,
which is a monotonic flag that transitions from false to true exactly
once (in tcm_set_name()) and never reverts. Remove dep_lock from
usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access
opts->ready locklessly instead.
Reported-by: syzbot+c9f9d646b08f3b6032fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c9f9d646b08f3b6032fe
Fixes: 4bb8548df632 ("usb: gadget: f_tcm: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260731081151.285599-1-yun.zhou@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1675,19 +1675,25 @@ static struct se_portal_group *usbg_make
opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
func_inst);
- mutex_lock(&opts->dep_lock);
- if (!opts->ready)
- goto unlock_dep;
+ if (!READ_ONCE(opts->ready))
+ goto unlock_inst;
if (opts->has_dep) {
if (!try_module_get(opts->dependent))
- goto unlock_dep;
+ goto unlock_inst;
} else {
+ /*
+ * configfs_depend_item_unlocked() may acquire the configfs
+ * root inode lock when the target belongs to a different
+ * subsystem. Calling it under dep_lock would create a
+ * circular dependency:
+ * dep_lock -> configfs inode lock -> su_mutex -> dep_lock
+ */
ret = configfs_depend_item_unlocked(
wwn->wwn_group.cg_subsys,
&opts->func_inst.group.cg_item);
if (ret)
- goto unlock_dep;
+ goto unlock_inst;
}
tpg = kzalloc_obj(struct usbg_tpg);
@@ -1714,7 +1720,6 @@ static struct se_portal_group *usbg_make
tpg_instances[i].tpg = tpg;
tpg->fi = tpg_instances[i].func_inst;
- mutex_unlock(&opts->dep_lock);
mutex_unlock(&tpg_instances_lock);
return &tpg->se_tpg;
@@ -1727,8 +1732,6 @@ unref_dep:
module_put(opts->dependent);
else
configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
-unlock_dep:
- mutex_unlock(&opts->dep_lock);
unlock_inst:
mutex_unlock(&tpg_instances_lock);
@@ -2666,9 +2669,7 @@ static int tcm_set_name(struct usb_funct
pr_debug("tcm: Activating %s\n", name);
- mutex_lock(&opts->dep_lock);
- opts->ready = true;
- mutex_unlock(&opts->dep_lock);
+ WRITE_ONCE(opts->ready, true);
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 115/713] usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 114/713] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 116/713] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
` (608 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+8dcac923582c28505fd7,
Jeffin Philip, Xu Yang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit 5b1da38592efdc1a263d4c0353298cba19e9d6fc upstream.
In uvcg_video_init(), if kthread_run_worker() fails,
the error logged uses uvcg_err(), however, the pointer it uses:
video->uvc is not assigned at this point, triggering a null
pointer dereference. Fix this by directly using uvc->func which
is assigned already.
Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
Fixes: f0bbfbd16b3b ("usb: gadget: uvc: rework to enqueue in pump worker from encoded queue")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260804034338.7976-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/uvc_video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -821,7 +821,7 @@ int uvcg_video_init(struct uvc_video *vi
/* Allocate a kthread for asynchronous hw submit handler. */
video->kworker = kthread_run_worker(0, "UVCG");
if (IS_ERR(video->kworker)) {
- uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");
+ uvcg_err(&uvc->func, "failed to create UVCG kworker\n");
return PTR_ERR(video->kworker);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 116/713] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 115/713] usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 117/713] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
` (607 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+de553c19cb054f174a35,
Jeffin Philip
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc upstream.
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().
Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df9393855 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c45d ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uvc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -889,9 +889,12 @@ error_unlock:
v4l2_error:
v4l2_device_unregister(&uvc->v4l2_dev);
error:
- if (uvc->control_req)
+ if (uvc->control_req) {
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
+ }
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
return ret;
@@ -1075,7 +1078,9 @@ static void uvc_function_unbind(struct u
uvc->vdev_release_done = NULL;
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 117/713] usb: gadget: f_fs: Prevent deadlock during ep0 read loop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 116/713] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 118/713] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Greg Kroah-Hartman
` (606 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neill Kapron
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <nkapron@google.com>
commit 569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082 upstream.
Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to
sleep waiting for an event. When no setup events are pending, it calls
wait_event_interruptible_exclusive_locked_irq() with the mutex still
held. The wait macro deliberately drops the waitqueue spinlock before
sleeping but does not drop the mutex.
If a userspace daemon is polling ep0 via read() and the gadget is
asynchronously torn down via configfs (e.g., echo "" > UDC), a
deadlock can occur:
1. The configfs teardown calls functionfs_unbind(), which queues a
FUNCTIONFS_UNBIND event.
2. The daemon wakes up, consumes the event, and drops the mutex.
3. However, if the daemon loops and immediately issues another read()
before exiting, it reacquires ffs->mutex and again goes into an
interruptible sleep.
4. Meanwhile, functionfs_unbind() continues execution and attempts to
acquire ffs->mutex to tear down ep0req.
5. The kernel deadlocks because the configfs thread is stuck in an
uninterruptible sleep waiting for the mutex, while the userspace
daemon is in an interruptible sleep holding the mutex forever
because no more events will arrive.
To fix this, we drop both the waitqueue spinlock and ffs->mutex before
going to sleep, and use wait_event_interruptible_exclusive() instead.
Upon waking up, we jump back to the `retry` label to safely reacquire
the mutex and re-evaluate the state machine. By not sleeping with
ffs->mutex held, we natively decouple gadget teardowns (which require
the mutex) from userspace polling.
Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260724204117.4036015-1-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -548,6 +548,7 @@ static ssize_t ffs_ep0_read(struct file
if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
return -EIDRM;
+retry:
/* Acquire mutex */
ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
if (ret < 0)
@@ -582,10 +583,15 @@ static ssize_t ffs_ep0_read(struct file
break;
}
- if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
- ffs->ev.count)) {
- ret = -EINTR;
- break;
+ if (!ffs->ev.count) {
+ spin_unlock_irq(&ffs->ev.waitq.lock);
+ mutex_unlock(&ffs->mutex);
+
+ if (wait_event_interruptible_exclusive(ffs->ev.waitq,
+ ffs->ev.count))
+ return -EINTR;
+
+ goto retry;
}
/* unlocks spinlock */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 118/713] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 117/713] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 119/713] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
` (605 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Terry Bowman,
Alison Schofield, Dave Jiang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Bowman <terry.bowman@amd.com>
commit 29458e62d0829cbc99435f3e44fd560f9bbf1da7 upstream.
cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from
the RCRB MMIO block using a readl() loop bounded by sizeof(struct
aer_capability_regs). This struct is a software layout and its embedded
struct pcie_tlp_log is larger than the on-wire AER capability. As a
result the loop reads past the mapped AER register block.
The over-read also populates the software-only tail fields including
header_log.header_len. An out-of-range header_len passed to
pcie_print_tlp_log() can then loop past the header log buffer and cause
a second out-of-bounds read.
The read was correct when introduced, but struct pcie_tlp_log has since
grown (Header Log and TLP Prefix Log sizes, header_len and flit fields),
so sizeof(struct aer_capability_regs) no longer matches the physical AER
capability.
Bound the read to the physical AER registers, header through the 16 byte
Header Log. Zero the destination first so the software-only fields are
deterministic.
Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging")
Reported-by: Sashiko <sashiko@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260803221810.3685703-2-terry.bowman@amd.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/core/ras_rch.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/cxl/core/ras_rch.c
+++ b/drivers/cxl/core/ras_rch.c
@@ -58,13 +58,28 @@ void cxl_disable_rch_root_ints(struct cx
static bool cxl_rch_get_aer_info(void __iomem *aer_base,
struct aer_capability_regs *aer_regs)
{
- int read_cnt = sizeof(struct aer_capability_regs) / sizeof(u32);
+ /*
+ * Bound the copy to the physically-defined AER registers (header
+ * through the 16-byte Header Log). struct aer_capability_regs is a
+ * software layout whose embedded struct pcie_tlp_log is larger than
+ * the on-wire AER capability; copying sizeof(*aer_regs) would
+ * over-read the RCRB-mapped MMIO block.
+ */
+ int read_cnt = (PCI_ERR_HEADER_LOG + 16) / sizeof(u32);
u32 *aer_regs_buf = (u32 *)aer_regs;
int n;
if (!aer_base)
return false;
+ /*
+ * Zero the destination so the software-only tail fields
+ * (e.g. header_log.header_len) are deterministic rather than
+ * left as uninitialized stack, which could drive a bogus loop
+ * length in pcie_print_tlp_log().
+ */
+ memset(aer_regs, 0, sizeof(*aer_regs));
+
/* Use readl() to guarantee 32-bit accesses */
for (n = 0; n < read_cnt; n++)
aer_regs_buf[n] = readl(aer_base + n * sizeof(u32));
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 119/713] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 118/713] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 120/713] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
` (604 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daisuke Matsuda, Xu Yilun, Xu Yilun
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daisuke Matsuda <matsuda@preferred.jp>
commit 9da70a43b5fea60d758137f7f0ccfe19356cb5bb upstream.
The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.
Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/altera-cvp.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -16,6 +16,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/sizes.h>
+#include <linux/string.h>
#define CVP_BAR 0 /* BAR used for data transfer in memory mode */
#define CVP_DUMMY_WR 244 /* dummy writes to clear CvP state machine */
@@ -261,7 +262,7 @@ static int altera_cvp_v2_wait_for_credit
static int altera_cvp_send_block(struct altera_cvp_conf *conf,
const u32 *data, size_t len)
{
- u32 mask, words = len / sizeof(u32);
+ u32 words = len / sizeof(u32);
int i, remainder;
for (i = 0; i < words; i++)
@@ -270,9 +271,10 @@ static int altera_cvp_send_block(struct
/* write up to 3 trailing bytes, if any */
remainder = len % sizeof(u32);
if (remainder) {
- mask = BIT(remainder * 8) - 1;
- if (mask)
- conf->write_data(conf, *data & mask);
+ u32 word = 0;
+
+ memcpy(&word, data, remainder);
+ conf->write_data(conf, word);
}
return 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 120/713] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 119/713] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 121/713] i3c: renesas: Fix out-of-bounds access for newdevs mask Greg Kroah-Hartman
` (603 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Xingrui Li,
Srinivas Pandruvada, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingrui Li <baka9@bakabaka9.tech>
commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream.
sensor_hub_get_feature() clamps its return value to the caller's buffer
size, but the copy loop still copies field->report_size / 8 bytes for
each report value. A malicious HID descriptor can advertise a large
feature field size while an IIO caller supplies a small stack buffer,
such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in __s32 slots and clamps extracted
values to 32 bits. Reject feature fields that require more than one slot
per value, guard the total byte count calculation, and clamp each
per-value copy to the remaining caller buffer.
Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report")
Cc: stable@kernel.org
Assisted-by: OpenAI:GPT-5.5-Cyber
Signed-off-by: Xingrui Li <baka9@bakabaka9.tech>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 44 +++++++++++++++++++++++++------------------
1 file changed, 26 insertions(+), 18 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -239,12 +239,17 @@ int sensor_hub_get_feature(struct hid_se
u32 field_index, int buffer_size, void *buffer)
{
struct hid_report *report;
+ struct hid_field *field;
struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
- int report_size;
+ size_t field_size;
+ size_t report_size;
+ size_t copied = 0;
+ size_t to_copy;
int ret = 0;
- u8 *val_ptr;
- int buffer_index = 0;
- int i;
+ unsigned int i;
+
+ if (!buffer || buffer_size <= 0)
+ return -EINVAL;
memset(buffer, 0, buffer_size);
@@ -258,26 +263,29 @@ int sensor_hub_get_feature(struct hid_se
hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
hid_hw_wait(hsdev->hdev);
+ field = report->field[field_index];
+
/* calculate number of bytes required to read this field */
- report_size = DIV_ROUND_UP(report->field[field_index]->report_size,
- 8) *
- report->field[field_index]->report_count;
- if (!report_size) {
+ field_size = DIV_ROUND_UP(field->report_size, 8);
+ /* HID core stores each parsed report value in a __s32 slot. */
+ if (!field_size || field_size > sizeof(field->value[0])) {
+ ret = -EINVAL;
+ goto done_proc;
+ }
+ if (field->report_count > SIZE_MAX / field_size) {
ret = -EINVAL;
goto done_proc;
}
- ret = min(report_size, buffer_size);
- val_ptr = (u8 *)report->field[field_index]->value;
- for (i = 0; i < report->field[field_index]->report_count; ++i) {
- if (buffer_index >= ret)
- break;
-
- memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
- report->field[field_index]->report_size / 8);
- val_ptr += sizeof(__s32);
- buffer_index += (report->field[field_index]->report_size / 8);
+ report_size = field_size * field->report_count;
+ report_size = min_t(size_t, report_size, buffer_size);
+
+ for (i = 0; i < field->report_count && copied < report_size; ++i) {
+ to_copy = min(field_size, report_size - copied);
+ memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy);
+ copied += to_copy;
}
+ ret = copied;
done_proc:
mutex_unlock(&data->mutex);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 121/713] i3c: renesas: Fix out-of-bounds access for newdevs mask
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 120/713] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 122/713] KVM: arm64: GICv2: Dont WARN on out-of-range GICV_DIR INTID Greg Kroah-Hartman
` (602 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Frank Li,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 50dec95c9d1f1f82819bc898ef2b60fa83fd4ccd upstream.
When software initiates DAA (Dynamic Address Assignment), the controller
reports the result via the NRSPQP (Normal Response Queue Port Register).
The data length field of the response descriptor, which is accessible
through the NRSPQP register, indicates the number of devices remaining
after DAA. Consequently, when the bus is empty, this field contains the
maximum number of devices supported by the controller (8 for the Renesas
I3C controller).
Adjust the condition that computes the newly discovered devices bitmask
to prevent an out-of-bounds when the I3C bus is empty.
Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-9-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -689,7 +689,11 @@ static int renesas_i3c_daa(struct i3c_ma
renesas_i3c_wait_xfer(i3c, xfer);
- newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
+ if (cmd->rx_count >= i3c->maxdevs)
+ newdevs = 0;
+ else
+ newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
+
newdevs &= ~olddevs;
for (pos = 0; pos < i3c->maxdevs; pos++) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 122/713] KVM: arm64: GICv2: Dont WARN on out-of-range GICV_DIR INTID
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 121/713] i3c: renesas: Fix out-of-bounds access for newdevs mask Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 123/713] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
` (601 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Karl Mehltretter,
Oliver Upton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit c6d9c8ac6521d3049ec90ac58bebd23ed03ac496 upstream.
vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight
to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen"
condition with WARN_ON_ONCE().
The guest can make it happen at will, though: for any INTID outside of
the implemented SGI, PPI and SPI ranges the lookup returns NULL, since
GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID
to GICV_DIR triggers the WARN, and panics hosts running with
panic_on_warn.
Drop the WARN and ignore failed lookups.
Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps")
Cc: stable@vger.kernel.org
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260726174803.5880-1-kmehltretter@gmail.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-v2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm64/kvm/vgic/vgic-v2.c
+++ b/arch/arm64/kvm/vgic/vgic-v2.c
@@ -170,8 +170,9 @@ void vgic_v2_deactivate(struct kvm_vcpu
/* Make sure we're in the same context as LR handling */
local_irq_save(flags);
+ /* Guest-supplied INTID: out of range yields no irq, so ignore it */
irq = vgic_get_vcpu_irq(vcpu, val);
- if (WARN_ON_ONCE(!irq))
+ if (!irq)
goto out;
/* See the corresponding v3 code for the rationale */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 123/713] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 122/713] KVM: arm64: GICv2: Dont WARN on out-of-range GICV_DIR INTID Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 124/713] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
` (600 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Kees Cook,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
commit cec0d03fe785380540dc1b4d07c80f67ae2ffc78 upstream.
Patch series "lib/ucs2_string.c: fix out-of-bounds read in
ucs2_strnlen()", v2.
This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().
The first patch is the real fix, the second patch comes as a bonus and
fixes the code indentation.
This patch (of 2):
ucs2_strnlen() checks the current character before checking whether the
caller-provided maximum length has been reached. If the input is not
NUL-terminated within that bound, the loop can read one ucs2_char_t past
the limit.
Test the length before dereferencing to prevent an off-by-one
out-of-bounds read.
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-0-9ea94e32a358@kernel.org
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-1-9ea94e32a358@kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/ucs2_string.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -8,7 +8,7 @@ ucs2_strnlen(const ucs2_char_t *s, size_
{
unsigned long length = 0;
- while (*s++ != 0 && length < maxlength)
+ while (length < maxlength && *s++ != 0)
length++;
return length;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 124/713] media: cec: stm32: prevent out-of-bounds write on RX overflow
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 123/713] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 125/713] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
` (599 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Hans Verkuil
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
commit fb9dda38d4b9e90db07ed9a0ee2d35bf85494035 upstream.
stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using
rx_msg.len as the write index, incrementing it on every RXBR
(receive-byte-ready) interrupt without checking it against the buffer
size:
cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct
cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a
completed message (RXEND). The number of bytes received before RXEND is
decided by the remote CEC device (it sets EOM), not by the driver. A
peer that keeps sending bytes without ending the message drives RXBR
repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes
out of bounds into the surrounding memory. This is reachable in normal
operation once the driver has probed and receiving is enabled, from the
IRQ thread, without any local privilege.
The length check in the CEC core runs on the consumer side, after the
byte has been stored, so it does not prevent the overflow. Bound the
index in the driver before the store, as the other platform CEC drivers
already do (e.g. tegra_cec), dropping the excess bytes of an overlong
frame.
Found by static analysis tool CodeQL.
Fixes: d69ae57453c8 ("[media] cec: add STM32 cec driver")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/platform/stm32/stm32-cec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/cec/platform/stm32/stm32-cec.c
+++ b/drivers/media/cec/platform/stm32/stm32-cec.c
@@ -132,7 +132,8 @@ static void stm32_rx_done(struct stm32_c
u32 val;
regmap_read(cec->regmap, CEC_RXDR, &val);
- cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
+ if (cec->rx_msg.len < CEC_MAX_MSG_SIZE)
+ cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
}
if (cec->irq_status & RXEND) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 125/713] media: vicodec: fix out-of-bounds write in FWHT encoder
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 124/713] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 126/713] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
` (598 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9 upstream.
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
encodes one plane per component, and an incompressible plane takes the
FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.
For a 4-component pixel format all four planes are full resolution
(width_div == height_div == 1), so a frame that forces every plane
through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
the plane by coded_w * coded_h, which can result in corruption
of adjacent kernel heap memory.
Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
components_num among the supported raw formats, so the capture buffer is
always large enough for the unencoded fallback.
Fixes: 16ecf6dff97c ("media: vicodec: Add support for 4 planes formats")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -63,11 +63,11 @@ struct pixfmt_info {
};
static const struct v4l2_fwht_pixfmt_info pixfmt_fwht = {
- V4L2_PIX_FMT_FWHT, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static const struct v4l2_fwht_pixfmt_info pixfmt_stateless_fwht = {
- V4L2_PIX_FMT_FWHT_STATELESS, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT_STATELESS, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static void vicodec_dev_release(struct device *dev)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 126/713] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 125/713] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 127/713] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
` (597 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Ryusuke Konishi,
Viacheslav Dubeyko
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit 45662dedb8f272ef7f16e69f13424c4bd0399240 upstream.
Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
in nilfs_direct_propagate() during testing.
Analysis revealed that after truncating a file, a node block immediately
below the B-tree root was not deleted. Instead, it remained in the B-tree
node cache in a dirty state. The log writer subsequently detected this
block and incorrectly invoked nilfs_direct_propagate() on it, which is
designed to handle only data blocks in direct mapping.
B-tree nodes in the cache are managed by virtual block numbers, and their
logical keys typically exceed the range expected by direct mapping.
Consequently, processing such a node as a direct mapping entry triggers
a slab-out-of-bounds access.
The root cause is that when a B-tree mapping collapses into a direct
mapping during truncation, an intermediate node block pointed to by the
root node is left behind as garbage instead of being explicitly deleted.
This resolves the issue by adding a nilfs_btree_discard() operation
to delete the remaining intermediate node block during the conversion.
A 'deform' flag is added to the bop_delete interface to explicitly signal
that the deletion is part of a mapping transformation. This allows the
B-tree mapping implementation to perform the necessary cleanup and
discarding of the residual node structure that would be otherwise be left
orphaned after the transition.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/r/08A3603A-ADB6-484C-9015-9AC1340E6FB8@gmail.com
Fixes: 36a580eb489f ("nilfs2: direct block mapping")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 ++++++++++++++++++++++++++++++++-------
fs/nilfs2/direct.c | 4 ++--
4 files changed, 36 insertions(+), 11 deletions(-)
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -175,7 +175,7 @@ static int nilfs_bmap_do_delete(struct n
return ret;
}
- return bmap->b_ops->bop_delete(bmap, key);
+ return bmap->b_ops->bop_delete(bmap, key, false);
}
/**
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -63,7 +63,7 @@ struct nilfs_bmap_operations {
int (*bop_lookup_contig)(const struct nilfs_bmap *, __u64, __u64 *,
unsigned int);
int (*bop_insert)(struct nilfs_bmap *, __u64, __u64);
- int (*bop_delete)(struct nilfs_bmap *, __u64);
+ int (*bop_delete)(struct nilfs_bmap *bmap, __u64 key, bool deform);
void (*bop_clear)(struct nilfs_bmap *);
int (*bop_propagate)(struct nilfs_bmap *, struct buffer_head *);
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1425,6 +1425,28 @@ static void nilfs_btree_shrink(struct ni
path[level].bp_bh = NULL;
}
+/**
+ * nilfs_btree_discard - discard the last node for the mapping transformation
+ * @btree: bmap struct of btree
+ * @path: array of nilfs_btree_path struct
+ * @level: level of the B-tree node being operated on
+ * @keyp: argument for passing a key (unused)
+ * @ptrp: argument for passing a pointer (unused)
+ */
+static void nilfs_btree_discard(struct nilfs_bmap *btree,
+ struct nilfs_btree_path *path, int level,
+ __u64 *keyp, __u64 *ptrp)
+{
+ struct nilfs_btree_node *root = nilfs_btree_get_root(btree);
+
+ nilfs_btree_node_delete(root, 0, NULL, NULL,
+ NILFS_BTREE_ROOT_NCHILDREN_MAX);
+ nilfs_btree_node_set_level(root, level);
+
+ nilfs_btnode_delete(path[level].bp_bh);
+ path[level].bp_bh = NULL;
+}
+
static void nilfs_btree_nop(struct nilfs_bmap *btree,
struct nilfs_btree_path *path,
int level, __u64 *keyp, __u64 *ptrp)
@@ -1435,7 +1457,7 @@ static int nilfs_btree_prepare_delete(st
struct nilfs_btree_path *path,
int *levelp,
struct nilfs_bmap_stats *stats,
- struct inode *dat)
+ struct inode *dat, bool deform)
{
struct buffer_head *bh;
struct nilfs_btree_node *node, *parent, *sib;
@@ -1522,15 +1544,17 @@ static int nilfs_btree_prepare_delete(st
if (nilfs_btree_node_get_nchildren(node) - 1 <=
NILFS_BTREE_ROOT_NCHILDREN_MAX) {
path[level].bp_op = nilfs_btree_shrink;
- stats->bs_nblocks += 2;
- level++;
- path[level].bp_op = nilfs_btree_nop;
- goto shrink_root_child;
+ } else if (deform) {
+ path[level].bp_op = nilfs_btree_discard;
} else {
path[level].bp_op = nilfs_btree_do_delete;
stats->bs_nblocks++;
goto out;
}
+ stats->bs_nblocks += 2;
+ level++;
+ path[level].bp_op = nilfs_btree_nop;
+ goto shrink_root_child;
}
}
@@ -1581,7 +1605,7 @@ static void nilfs_btree_commit_delete(st
nilfs_bmap_set_dirty(btree);
}
-static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key)
+static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key, bool deform)
{
struct nilfs_btree_path *path;
@@ -1601,7 +1625,8 @@ static int nilfs_btree_delete(struct nil
dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
- ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat);
+ ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat,
+ deform);
if (ret < 0)
goto out;
nilfs_btree_commit_delete(btree, path, level, dat);
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -144,7 +144,7 @@ static int nilfs_direct_insert(struct ni
return ret;
}
-static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key)
+static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key, bool deform)
{
union nilfs_bmap_ptr_req req;
struct inode *dat;
@@ -234,7 +234,7 @@ int nilfs_direct_delete_and_convert(stru
/* no need to allocate any resource for conversion */
/* delete */
- ret = bmap->b_ops->bop_delete(bmap, key);
+ ret = bmap->b_ops->bop_delete(bmap, key, true);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 127/713] of: fix out-of-bounds read in of_alias_scan() stem parser
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 126/713] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 128/713] PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Greg Kroah-Hartman
` (596 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdurrahman Hussain,
Geert Uytterhoeven, Rob Herring (Arm)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
commit 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f upstream.
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1967,7 +1967,7 @@ void of_alias_scan(void * (*dt_alloc)(u6
/* walk the alias backwards to extract the id and work out
* the 'stem' string */
- while (isdigit(*(end-1)) && end > start)
+ while (end > start && isdigit(*(end - 1)))
end--;
len = end - start;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 128/713] PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 127/713] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 129/713] phy: rockchip-samsung-dcphy: fix out-of-range max_register Greg Kroah-Hartman
` (595 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit dc76258d0132df1d831a5a29758bd448ca9c566e upstream.
pci_write_legacy_io() loads 4 bytes from the kernfs write buffer
regardless of how many bytes userspace wrote:
if (count != 1 && count != 2 && count != 4)
return -EINVAL;
return pci_legacy_write(bus, off, *(u32 *)buf, count);
kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1),
so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and
the unconditional u32 load reads up to 2 bytes past the end of the
allocation, which KASAN reports as a slab-out-of-bounds read.
Similarly, a 2-byte write overreads by 1 byte.
Thus, read only the number of bytes requested using get_unaligned_le16()
and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the
buffer as little-endian to match the byte ordering of PCI I/O port
space.
The PowerPC implementation previously compensated for the generic
code's native-endian 32-bit load by shifting the value into place
for the 1 and 2 byte cases. The shifts were only correct on
big-endian kernels.
On little-endian PowerPC (POWER8 and later), they extracted the wrong
bytes, so a 1-byte write wrote an out-of-bounds byte instead of the
requested value. On big-endian, the native load also caused out_le16()
and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte
writes. The little-endian helpers resolve both issues, so the shifts
are removed.
No changes are needed for the Alpha platform.
The legacy_io file is root-only and exists only on Alpha and PowerPC,
the two architectures that define HAVE_PCI_LEGACY.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616163131.2763281-1-kwilczynski@kernel.org
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/pci-common.c | 9 ++-------
drivers/pci/pci-sysfs.c | 18 +++++++++++++++---
2 files changed, 17 insertions(+), 10 deletions(-)
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -626,19 +626,14 @@ int pci_legacy_write(struct pci_bus *bus
return -ENXIO;
addr = hose->io_base_virt + port;
- /* WARNING: The generic code is idiotic. It gets passed a pointer
- * to what can be a 1, 2 or 4 byte quantity and always reads that
- * as a u32, which means that we have to correct the location of
- * the data read within those 32 bits for size 1 and 2
- */
switch(size) {
case 1:
- out_8(addr, val >> 24);
+ out_8(addr, val);
return 1;
case 2:
if (port & 1)
return -EINVAL;
- out_le16(addr, val >> 16);
+ out_le16(addr, val);
return 2;
case 4:
if (port & 3)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -913,12 +913,24 @@ static ssize_t pci_write_legacy_io(struc
char *buf, loff_t off, size_t count)
{
struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj));
+ u32 val;
- /* Only support 1, 2 or 4 byte accesses */
- if (count != 1 && count != 2 && count != 4)
+ /* Only support 1, 2 or 4 byte accesses. */
+ switch (count) {
+ case 1:
+ val = *(u8 *)buf;
+ break;
+ case 2:
+ val = get_unaligned_le16(buf);
+ break;
+ case 4:
+ val = get_unaligned_le32(buf);
+ break;
+ default:
return -EINVAL;
+ }
- return pci_legacy_write(bus, off, *(u32 *)buf, count);
+ return pci_legacy_write(bus, off, val, count);
}
/**
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 129/713] phy: rockchip-samsung-dcphy: fix out-of-range max_register
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 128/713] PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 130/713] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
` (594 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Yang, Sebastian Reichel,
Vinod Koul
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Yang <jason98166@gmail.com>
commit 4486e75ba647bd8b98fc1f053101b40caceeed4b upstream.
The PHY register block is 64KB, so with a register stride of 4 the
last accessible register sits at offset 0xfffc. max_register names
0x10000, one register past the end of the mapping: dumping the
registers through the regmap debugfs interface reads beyond the
ioremapped region and oopses on the unmapped page. The oops fires
with the regmap lock held, so later PHY operations deadlock.
Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Yang <jason98166@gmail.com>
Assisted-by: Claude:claude-opus-5
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://patch.msgid.link/20260811-dcphy-maxreg-v1-v1-1-aa63f6a63a64@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
@@ -1526,7 +1526,7 @@ static const struct regmap_config samsun
.reg_bits = 32,
.val_bits = 32,
.reg_stride = 4,
- .max_register = 0x10000,
+ .max_register = 0xfffc,
};
static struct phy *samsung_mipi_dcphy_xlate(struct device *dev,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 130/713] ubifs: fix out-of-bounds read in signature length check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 129/713] phy: rockchip-samsung-dcphy: fix out-of-range max_register Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 131/713] zram: fix out-of-bounds access in read_block_state() Greg Kroah-Hartman
` (593 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Richard Weinberger,
Zhihao Cheng
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf upstream.
ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
before handing the signature payload to verify_pkcs7_signature(), but the
check has the wrong sign:
if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))
The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
64 bytes) into the node, so the payload is at most
snod->len - sizeof(struct ubifs_sig_node)
bytes long. Adding the header size instead of subtracting it accepts a
declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).
verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
is then handed that inflated length and reads beyond the allocation while
walking the DER headers. The node length comes straight from the mounted
image, so a crafted signed UBIFS image reaches this via
ubifs_read_superblock() before the signature is cryptographically checked.
snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
subtraction cannot underflow. Legitimately signed images are unaffected: a
correct superblock never declares a signature longer than the node it is
embedded in.
Fixes: 817aa094842d ("ubifs: support offline signed images")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Reviewed-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -217,7 +217,7 @@ int ubifs_sb_verify_signature(struct ubi
signode = snod->node;
- if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) {
+ if (le32_to_cpu(signode->len) > snod->len - sizeof(struct ubifs_sig_node)) {
ubifs_err(c, "invalid signature len %d", le32_to_cpu(signode->len));
err = -EINVAL;
goto out_destroy;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 131/713] zram: fix out-of-bounds access in read_block_state()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 130/713] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 132/713] zram: fix out-of-bounds access in writeback_store() Greg Kroah-Hartman
` (592 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Sergey Senozhatsky,
Jens Axboe, Minchan Kim, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
commit 391f057f44a51cc9418da5cba78b014324174264 upstream.
read_block_state() calculates nr_pages before taking dev_lock. If the
device is reset and reinitialized with a smaller disksize before lock
acquisition, nr_pages still describes the old table. The subsequent loop
can then call slot_lock() past the end of the newly allocated table.
Read disksize after acquiring dev_lock and checking that the device is
initialized. The read lock then keeps the table and its bound stable for
the duration of the scan.
Link: https://lore.kernel.org/20260804065919.3970386-3-xialonglong2025@163.com
Fixes: c0265342bff4 ("zram: introduce zram memory tracking")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1549,7 +1549,7 @@ static ssize_t read_block_state(struct f
char *kbuf;
ssize_t index, written = 0;
struct zram *zram = file->private_data;
- unsigned long nr_pages = zram->disksize >> PAGE_SHIFT;
+ unsigned long nr_pages;
kbuf = kvmalloc(count, GFP_KERNEL);
if (!kbuf)
@@ -1561,6 +1561,8 @@ static ssize_t read_block_state(struct f
return -EINVAL;
}
+ nr_pages = zram->disksize >> PAGE_SHIFT;
+
for (index = *ppos; index < nr_pages; index++) {
int copied;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 132/713] zram: fix out-of-bounds access in writeback_store()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 131/713] zram: fix out-of-bounds access in read_block_state() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 133/713] zram: set default primary compressor in zram_destroy_comps() Greg Kroah-Hartman
` (591 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Sergey Senozhatsky,
Jens Axboe, Minchan Kim, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
commit 894913e2d35c46ff19a77530907771ae57862b96 upstream.
Patch series "zram: fix stale scan bounds after reinitialization".
Both writeback_store() and read_block_state() derive their table scan
bounds from zram->disksize before acquiring dev_lock. If the device is
reset and reinitialized with a smaller disksize between that read and lock
acquisition, the bound can describe the old table while the scan operates
on the new one. This can lead to out-of-bounds slot accesses.
Move both bound calculations under dev_lock so each bound remains
consistent with the table throughout its scan. Keep the fixes separate
because the affected interfaces originate from different commits and can
be backported independently.
This patch (of 2):
writeback_store() calculates the table scan bounds before taking dev_lock.
A reset followed by reconfiguration with a smaller disksize can therefore
replace zram->table while writeback_store() is waiting for the lock. Once
it acquires the lock, it sees an initialized device but scans the new
table using the old upper bound, resulting in an out-of-bounds access.
Calculate the number of pages while holding dev_lock so the scan bound
matches the table protected by the lock.
Link: https://lore.kernel.org/20260804065919.3970386-1-xialonglong2025@163.com
Link: https://lore.kernel.org/20260804065919.3970386-2-xialonglong2025@163.com
Fixes: a939888ec38b ("zram: support idle/huge page writeback")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1244,8 +1244,8 @@ static ssize_t writeback_store(struct de
const char *buf, size_t len)
{
struct zram *zram = dev_to_zram(dev);
- u64 nr_pages = zram->disksize >> PAGE_SHIFT;
- unsigned long lo = 0, hi = nr_pages;
+ u64 nr_pages;
+ unsigned long lo = 0, hi;
struct zram_pp_ctl *pp_ctl = NULL;
struct zram_wb_ctl *wb_ctl = NULL;
char *args, *param, *val;
@@ -1259,6 +1259,9 @@ static ssize_t writeback_store(struct de
if (!zram->backing_dev)
return -ENODEV;
+ nr_pages = zram->disksize >> PAGE_SHIFT;
+ hi = nr_pages;
+
pp_ctl = init_pp_ctl();
if (!pp_ctl)
return -ENOMEM;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 133/713] zram: set default primary compressor in zram_destroy_comps()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 132/713] zram: fix out-of-bounds access in writeback_store() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 134/713] zram: validate deflate params Greg Kroah-Hartman
` (590 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Minchan Kim,
Haoqin Huang, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit dde75313eed0b014c437f48dd75c0308b592cbf9 upstream.
Patch series "zram: fix zram issues reported by sashiko".
Sashiko drove by and reported [1] a couple of zram issues:
a possible BUG_ON() in zlib code due to missing winbits range
validation and one possible NULL-ptr dereference in zcomp.
Both are low risk yet still worth fixing.
This patch (of 2):
zram_destroy_comps() resets all compressors and leaves them set to NULL,
including the primary one, which is invalid device state, as now
comp_algorithm_show()->strcmp() can be called on a NULL compressor. Set
default primary compressor in zram_destroy_comps().
Link: https://lore.kernel.org/20260729045745.775973-2-senozhatsky@chromium.org
Fixes: 486fd58af7ac ("zram: don't free statically defined names")
Link: https://sashiko.dev/#/patchset/20260728092935.31139-1-haoqinhuang7@gmail.com [1]
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Haoqin Huang <haoqinhuang7@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2841,6 +2841,7 @@ static void zram_destroy_comps(struct zr
zram->comp_algs[prio] = NULL;
zram_comp_params_reset(zram);
+ comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
}
static void zram_reset_device(struct zram *zram)
@@ -2858,8 +2859,6 @@ static void zram_reset_device(struct zra
zram_destroy_comps(zram);
memset(&zram->stats, 0, sizeof(zram->stats));
reset_bdev(zram);
-
- comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
}
static ssize_t disksize_store(struct device *dev, struct device_attribute *attr,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 134/713] zram: validate deflate params
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 133/713] zram: set default primary compressor in zram_destroy_comps() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 135/713] zsmalloc: account for handle size in class lookup Greg Kroah-Hartman
` (589 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Minchan Kim,
Haoqin Huang, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit ec7607ac4717ff521c9c1e9d8271c26293345513 upstream.
We must validate user-supplied deflate winbits before we pass it to
zlib_deflate_workspacesize(), which triggers BUG_ON() if winbits value is
outside of valid ranges.
Link: https://lore.kernel.org/20260729045745.775973-3-senozhatsky@chromium.org
Fixes: dc75a0d93bd5 ("zram: support deflate-specific params")
Link: https://sashiko.dev/#/patchset/20260728092935.31139-1-haoqinhuang7@gmail.com
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Haoqin Huang <haoqinhuang7@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/backend_deflate.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/block/zram/backend_deflate.c
+++ b/drivers/block/zram/backend_deflate.c
@@ -24,8 +24,16 @@ static int deflate_setup_params(struct z
{
if (params->level == ZCOMP_PARAM_NOT_SET)
params->level = Z_DEFAULT_COMPRESSION;
- if (params->deflate.winbits == ZCOMP_PARAM_NOT_SET)
+ if (params->deflate.winbits == ZCOMP_PARAM_NOT_SET) {
params->deflate.winbits = DEFLATE_DEF_WINBITS;
+ } else {
+ s32 wb = params->deflate.winbits;
+
+ if ((wb < -15 || wb > -9) && (wb < 9 || wb > 15)) {
+ pr_err("invalid deflate winbits: %d\n", wb);
+ return -EINVAL;
+ }
+ }
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 135/713] zsmalloc: account for handle size in class lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 134/713] zram: validate deflate params Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 136/713] NFS/localio: fix ref leak on nfs_uuid_add_file failure Greg Kroah-Hartman
` (588 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Sergey Senozhatsky,
Minchan Kim, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
commit f7bf5cd5b5f2b13fe2361860880c4e214c08b440 upstream.
zs_lookup_class_index() lets zram recompression decide whether a newly
compressed object would use a smaller size class. It currently classifies
the payload size directly, while zs_malloc() adds ZS_HANDLE_SIZE before
selecting the class.
This makes lookup disagree with allocation near size-class boundaries.
With 4 KiB pages, CONFIG_ZSMALLOC_CHAIN_SIZE=8, and 64-bit handles, a
1025-to-1024-byte recompression appears to move from class 64 to class 62
although both allocations use class 64. Conversely, a 1049-to-1025-byte
recompression appears to stay in class 64 although the allocations move
from class 65 to class 64.
As a result, zram can accept replacements with no allocation benefit or
reject ones that would save memory, potentially marking the object
incompressible.
Factor size-class selection into lookup_size_class(), account for the
handle there, and use the helper for both lookup and allocation.
Link: https://lore.kernel.org/20260809115518.3791787-1-xialonglong2025@163.com
Fixes: 7c2af309abd2 ("zram: add size class equals check into recompression")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/zsmalloc.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -478,6 +478,11 @@ static int get_size_class_index(int size
return min_t(int, ZS_SIZE_CLASSES - 1, idx);
}
+static struct size_class *lookup_size_class(struct zs_pool *pool, size_t size)
+{
+ return pool->size_class[get_size_class_index(size + ZS_HANDLE_SIZE)];
+}
+
static inline void class_stat_add(struct size_class *class, int type,
unsigned long cnt)
{
@@ -1021,7 +1026,7 @@ unsigned int zs_lookup_class_index(struc
{
struct size_class *class;
- class = pool->size_class[get_size_class_index(size)];
+ class = lookup_size_class(pool, size);
return class->index;
}
@@ -1311,9 +1316,7 @@ unsigned long zs_malloc(struct zs_pool *
if (!handle)
return (unsigned long)ERR_PTR(-ENOMEM);
- /* extra space in chunk to keep the handle */
- size += ZS_HANDLE_SIZE;
- class = pool->size_class[get_size_class_index(size)];
+ class = lookup_size_class(pool, size);
/* class->lock effectively protects the zpage migration */
spin_lock(&class->lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 136/713] NFS/localio: fix ref leak on nfs_uuid_add_file failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 135/713] zsmalloc: account for handle size in class lookup Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 137/713] NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Greg Kroah-Hartman
` (587 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit ca018c19e0ba38975e5ddc3ef8117d5b734313aa upstream.
When nfs_uuid_add_file() races with nfs_uuid_put() tearing down
uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via
rcu_assign_pointer(). nfs_open_local_fh() then enters its error
branch and only releases the slot's file ref and its paired net
ref plus its own entry-time net ref, while the close path is a
no-op:
nfs_close_local_fh()
nfs_uuid = rcu_dereference(nfl->nfs_uuid);
if (!nfs_uuid) { rcu_read_unlock(); return; } /* always */
nfsd_open_local_fh() returns localio holding a caller-owned +1
nfsd_file reference (from nfsd_file_get() after
nfsd_file_acquire_local()) and an entry-time nfsd_net reference
(from its first nfsd_net_try_get()) embedded as nf->nf_net. Both
are leaked on the failure path, pinning one nfsd_file (and the
underlying struct file, dentry, inode) and one nfsd_net_ref per
occurrence, which blocks nfsd_net and netns teardown.
Fix by releasing the caller-owned file ref and its net ref through
the existing helper, using a stack-local RCU pointer so the helper
can xchg it out, then returning -ENXIO so callers do not
dereference a localio whose slot has been cleared:
struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);
nfs_to_nfsd_file_put_local(pnf);
nfs_to_nfsd_file_put_local(&tmp);
localio = ERR_PTR(-ENXIO);
The trailing nfs_to_nfsd_net_put(net) continues to release the
outer net ref, so all three nfsd_net_try_get() increments are
balanced on the error branch.
Fixes: fdd015de7679 ("NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh()")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-3-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs_common/nfslocalio.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/fs/nfs_common/nfslocalio.c
+++ b/fs/nfs_common/nfslocalio.c
@@ -292,8 +292,22 @@ struct nfsd_file *nfs_open_local_fh(nfs_
localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt, cred,
nfs_fh, pnf, fmode);
if (!IS_ERR(localio) && nfs_uuid_add_file(uuid, nfl) < 0) {
- /* Delete the cached file when racing with nfs_uuid_put() */
+ /*
+ * Delete the cached file when racing with nfs_uuid_put().
+ * Since nfl->nfs_uuid was never published via
+ * rcu_assign_pointer(), nfs_close_local_fh() will early-return
+ * and cannot clean up after us. Drop the slot's file ref and
+ * its paired net ref, then drop the caller-owned nfsd_file ref
+ * (+1) and the entry-time nfsd_net ref carried via nf->nf_net,
+ * and return -ENXIO so the caller never dereferences the
+ * now-cleared localio.
+ */
+ struct nfsd_file __rcu *tmp =
+ (struct nfsd_file __force __rcu *)localio;
+
nfs_to_nfsd_file_put_local(pnf);
+ nfs_to_nfsd_file_put_local(&tmp);
+ localio = ERR_PTR(-ENXIO);
}
nfs_to_nfsd_net_put(net);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 137/713] NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 136/713] NFS/localio: fix ref leak on nfs_uuid_add_file failure Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 138/713] NFSD: check truncate permission under inode lock Greg Kroah-Hartman
` (586 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nate Prodromou, Christoph Hellwig,
Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Prodromou <nate@prodromou.com>
commit 2092f5b38f88be306140c77aeeeb43fc1adacacc upstream.
nfs4_server_common_setup() allocates server->delegation_hash_table
first, but server->destroy - the only path that frees the table via
nfs4_destroy_server() - is not assigned until the very end of the
function. If any intermediate step fails (the is_ds_only_client()
check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()),
the function returns with server->destroy still NULL, so the caller's
nfs_free_server() skips the destroy callback and the hash table is
leaked (4 KiB per attempt with the default delegation watermark).
This is trivially reachable from userspace: every failed NFSv4 mount
leaks one allocation. A client that persistently retries a mount that
cannot succeed leaks kernel memory without bound. Observed in
production where a Longhorn backup poller retried mount.nfs4 against
an NFSv3-only server roughly 10 times per second, leaking ~3.4 GiB of
unreclaimable slab (kmalloc-rnd-13-4k) per day; the node accumulated
12 GiB of leaked slab before the source was identified via the
kmem:kmalloc tracepoint (call_site=nfs4_delegation_hash_alloc).
Reproducer:
# server exports NFSv3 only (or export path absent for v4)
while :; do mount -t nfs4 <server>:/missing /mnt; done
# watch SUnreclaim in /proc/meminfo grow 4 KiB per iteration
Free the table on the error paths between the allocation and the
assignment of server->destroy.
Fixes: f5b3108e6a14 ("NFS: use a hash table for delegation lookup")
Cc: stable@vger.kernel.org
Signed-off-by: Nate Prodromou <nate@prodromou.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4client.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -915,20 +915,22 @@ static int nfs4_server_common_setup(stru
return error;
/* data servers support only a subset of NFSv4.1 */
- if (is_ds_only_client(server->nfs_client))
- return -EPROTONOSUPPORT;
+ if (is_ds_only_client(server->nfs_client)) {
+ error = -EPROTONOSUPPORT;
+ goto out_free_delegation_hash;
+ }
/* We must ensure the session is initialised first */
error = nfs4_init_session(server->nfs_client);
if (error < 0)
- return error;
+ goto out_free_delegation_hash;
nfs_server_set_init_caps(server);
/* Probe the root fh to retrieve its FSID and filehandle */
error = nfs4_get_rootfh(server, mntfh, auth_probe);
if (error < 0)
- return error;
+ goto out_free_delegation_hash;
dprintk("Server FSID: %llx:%llx\n",
(unsigned long long) server->fsid.major,
@@ -937,7 +939,7 @@ static int nfs4_server_common_setup(stru
error = nfs_probe_server(server, mntfh);
if (error < 0)
- return error;
+ goto out_free_delegation_hash;
nfs4_session_limit_rwsize(server);
nfs4_session_limit_xasize(server);
@@ -949,6 +951,11 @@ static int nfs4_server_common_setup(stru
server->mount_time = jiffies;
server->destroy = nfs4_destroy_server;
return 0;
+
+out_free_delegation_hash:
+ kfree(server->delegation_hash_table);
+ server->delegation_hash_table = NULL;
+ return error;
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 138/713] NFSD: check truncate permission under inode lock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 137/713] NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 139/713] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
` (585 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit b778e0e0a16759f22a70579c3cf8d254a40d4a7f upstream.
nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC
before it takes inode_lock(). The comparison uses the file size sampled
by that unlocked read, but the actual ATTR_SIZE update is applied later
under inode_lock() by notify_change().
This leaves a TOCTOU window for append-only files. If a client sends a
SETATTR that does not shrink the file at the time of the unlocked
sample, a concurrent append can extend the file before nfsd_setattr()
takes inode_lock(). notify_change() then applies a real truncation
without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS
truncate syscall paths perform their own append-only checks before
calling notify_change(), so NFSD must make this decision against the
locked size it is about to change.
Split the write-count acquisition from the truncation permission check.
Keep get_write_access() before the locked setattr work, then recheck
whether the requested size is below i_size_read(inode) after inode_lock()
has been acquired and before notify_change(ATTR_SIZE). This also avoids
the plain unlocked inode->i_size load.
Fixes: 783112f7401f ("nfsd: special case truncates some more")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-6-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 30 ++++++++++++++++++------------
1 file changed, 18 insertions(+), 12 deletions(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -419,21 +419,22 @@ nfsd_sanitize_attrs(struct inode *inode,
}
static __be32
-nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
- struct iattr *iap)
+nfsd_may_truncate(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ struct iattr *iap)
{
struct inode *inode = d_inode(fhp->fh_dentry);
- if (iap->ia_size < inode->i_size) {
- __be32 err;
+ if (iap->ia_size >= i_size_read(inode))
+ return nfs_ok;
- err = nfsd_permission(&rqstp->rq_cred,
- fhp->fh_export, fhp->fh_dentry,
- NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
- if (err)
- return err;
- }
- return nfserrno(get_write_access(inode));
+ return nfsd_permission(&rqstp->rq_cred, fhp->fh_export, fhp->fh_dentry,
+ NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
+}
+
+static __be32
+nfsd_get_write_access(struct svc_fh *fhp)
+{
+ return nfserrno(get_write_access(d_inode(fhp->fh_dentry)));
}
static int __nfsd_setattr(struct dentry *dentry, struct iattr *iap)
@@ -560,12 +561,17 @@ nfsd_setattr(struct svc_rqst *rqstp, str
* setattr call.
*/
if (size_change) {
- err = nfsd_get_write_access(rqstp, fhp, iap);
+ err = nfsd_get_write_access(fhp);
if (err)
return err;
}
inode_lock(inode);
+ if (size_change) {
+ err = nfsd_may_truncate(rqstp, fhp, iap);
+ if (err)
+ goto out_unlock;
+ }
err = fh_fill_pre_attrs(fhp);
if (err)
goto out_unlock;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 139/713] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 138/713] NFSD: check truncate permission under inode lock Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 140/713] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
` (584 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit ed4edddad19babf76b56882ad9600f5646b167a0 upstream.
The NFSv2 ACL GETACL reply is a union that carries file attributes
and ACL data only when the status is NFS_OK. All error cases are
void results. However, currently the NFSv2 ACL GETACL result encoder
decides whether to append the "OK" body by testing only whether the
file handle resolved to a positive dentry, not the actual reply
status.
A GETACL request that resolves its file handle but then fails for
another reason (an unsupported mask value, a getattr failure, or an
ACL retrieval error) therefore appends file attributes and ACL data
after the error status on the wire. Worse, when the mask is
rejected, fh_getattr() hasn't been called at all, so those
attributes are serialized from a zero-filled kstat and are junk.
The logic before the xdr_stream conversion used the reply status.
Revert to that approach (but keep the xdr_stream conversion in
place).
Fixes: f8cba47344f7 ("NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260712150911.48461-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs2acl.c | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -248,22 +248,21 @@ nfsaclsvc_encode_getaclres(struct svc_rq
if (!svcxdr_encode_stat(xdr, resp->status))
return false;
-
- if (dentry == NULL || d_really_is_negative(dentry))
- return true;
- inode = d_inode(dentry);
-
- if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
- return false;
- if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
- return false;
-
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
- resp->mask & NFS_ACL, 0))
- return false;
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
- resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
- return false;
+ switch (resp->status) {
+ case nfs_ok:
+ inode = d_inode(dentry);
+ if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
+ return false;
+ if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
+ resp->mask & NFS_ACL, 0))
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
+ resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
+ return false;
+ break;
+ }
return true;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 140/713] NFSD: Fix off-by-one in DRC bucket pruning limit
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 139/713] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 141/713] NFSD: fix up error returned by write_threads() Greg Kroah-Hartman
` (583 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, NeilBrown, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit d0728723c80dcb3432effd67c7e919b596004b1d upstream.
nfsd_prune_bucket_locked() evicts an entry before checking
the freed count against @max. The check uses "++freed > max",
which does not break until freed exceeds max, resulting in
max + 1 evictions. Use ">=" so the limit stated in the
function comment is honored.
Fixes: a9507f6af145 ("NFSD: Replace nfsd_prune_bucket()")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260717001232.438792-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -275,7 +275,7 @@ nfsd_prune_bucket_locked(struct nfsd_net
nfsd_cacherep_unlink_locked(nn, b, rp);
list_add(&rp->c_lru, dispose);
- if (max && ++freed > max)
+ if (max && ++freed >= max)
break;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 141/713] NFSD: fix up error returned by write_threads()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 140/713] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 142/713] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
` (582 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Scott Mayhew, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <smayhew@redhat.com>
commit 75e620912c815801ea241e133ba34c9e8cf2cbb1 upstream.
Previously, writing 0 to /proc/fs/nfsd/threads would return 0 if the
NFS server wasn't running. After commit 14282cc3cfa2 ("NFSD: don't
start nfsd if sv_permsocks is empty"), -EIO is returned. Existing
scripts don't expect this behavior.
Add a check to bypass the call to nfsd_svc() when newthreads is 0 and
the NFS server is already stopped.
Fixes: 14282cc3cfa2 ("NFSD: don't start nfsd if sv_permsocks is empty")
Cc: stable@vger.kernel.org
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260608131402.95625-1-smayhew@redhat.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -420,6 +420,7 @@ static ssize_t write_threads(struct file
char *mesg = buf;
int rv;
struct net *net = netns(file);
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
if (size > 0) {
int newthreads;
@@ -430,7 +431,10 @@ static ssize_t write_threads(struct file
return -EINVAL;
trace_nfsd_ctl_threads(net, newthreads);
mutex_lock(&nfsd_mutex);
- rv = nfsd_svc(1, &newthreads, net, file->f_cred, NULL);
+ if (newthreads > 0 || nn->nfsd_serv != NULL)
+ rv = nfsd_svc(1, &newthreads, net, file->f_cred, NULL);
+ else
+ rv = 0;
mutex_unlock(&nfsd_mutex);
if (rv < 0)
return rv;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 142/713] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 141/713] NFSD: fix up error returned by write_threads() Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 143/713] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
` (581 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 036c1b182f4da65363e79ec0ac276edc6b7296e5 upstream.
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
list_for_each_entry_safe(ni, tmp, ...). For each expired entry it
sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
source vfsmount, then reacquires the lock to list_del + kfree the
entry and continue iterating via the macro's saved tmp pointer.
The nsui_busy flag protects the current ni from concurrent
nfsd4_ssc_setup_dul() finders during the lock-drop window, but it
does not pin tmp. Another nfsd RPC thread that fails its source-
server mount and reaches nfsd4_ssc_cancel_dul() will, during that
same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
item, and release the lock. If that item is the saved tmp of the
expire walk, the next iteration dereferences a freed
nfsd4_ssc_umount_item.
Restart the walk from the head after the mntput() unlock window so
no saved next pointer survives the lock-drop. The list is bounded
by the number of active inter-server source mounts (typically small)
and the expire delayed-work runs periodically rather than per-IO,
so the restart is cheap.
Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524130654.1924556-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++-------------------
1 file changed, 25 insertions(+), 19 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6859,30 +6859,36 @@ static void nfsd4_ssc_shutdown_umount(st
static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
{
bool do_wakeup = false;
- struct nfsd4_ssc_umount_item *ni = NULL;
- struct nfsd4_ssc_umount_item *tmp;
+ struct nfsd4_ssc_umount_item *ni;
+restart:
spin_lock(&nn->nfsd_ssc_lock);
- list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
- if (time_after(jiffies, ni->nsui_expire)) {
- if (refcount_read(&ni->nsui_refcnt) > 1)
- continue;
+ list_for_each_entry(ni, &nn->nfsd_ssc_mount_list, nsui_list) {
+ if (!time_after(jiffies, ni->nsui_expire))
+ break;
+ if (refcount_read(&ni->nsui_refcnt) > 1)
+ continue;
- /* mark being unmount */
- ni->nsui_busy = true;
- spin_unlock(&nn->nfsd_ssc_lock);
- mntput(ni->nsui_vfsmount);
- spin_lock(&nn->nfsd_ssc_lock);
+ /* Prevent concurrent setup during unmount */
+ ni->nsui_busy = true;
+ spin_unlock(&nn->nfsd_ssc_lock);
+ mntput(ni->nsui_vfsmount);
+ spin_lock(&nn->nfsd_ssc_lock);
- /* waiters need to start from begin of list */
- list_del(&ni->nsui_list);
- kfree(ni);
+ /* Force concurrent scanners to restart */
+ list_del(&ni->nsui_list);
+ kfree(ni);
- /* wakeup ssc_connect waiters */
- do_wakeup = true;
- continue;
- }
- break;
+ /* wakeup ssc_connect waiters */
+ do_wakeup = true;
+ /*
+ * Concurrent nfsd4_ssc_cancel_dul() can free any item
+ * on the list under nfsd_ssc_lock while mntput() runs
+ * above. Restart from the head; the list is short and
+ * the expire worker is periodic, so this is cheap.
+ */
+ spin_unlock(&nn->nfsd_ssc_lock);
+ goto restart;
}
if (do_wakeup)
wake_up_all(&nn->nfsd_ssc_waitq);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 143/713] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 142/713] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 144/713] nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Greg Kroah-Hartman
` (580 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e upstream.
The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in
fh_verify of directories") details the assumption that justified
adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is
invalid (in the case of NFS reexport).
When NFSD exports an NFS filesystem it is very possible for
nfsd_mode_check() to encounter a @dentry that doesn't have
i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and
NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).
So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir
return on that branch must stay. It guards the subsequent
lookup_one_unlocked() -> __lookup_slow() path, which calls
inode->i_op->lookup() with no NULL check, so returning nfserr_notdir
is what keeps a client LOOKUP into such a @dentry from dereferencing
a NULL method pointer.
Fixes: e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20260612191410.50177-1-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsfh.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -70,10 +70,8 @@ nfsd_mode_check(struct dentry *dentry, u
if (requested == 0) /* the caller doesn't care */
return nfs_ok;
if (mode == requested) {
- if (mode == S_IFDIR && !d_can_lookup(dentry)) {
- WARN_ON_ONCE(1);
+ if (mode == S_IFDIR && !d_can_lookup(dentry))
return nfserr_notdir;
- }
return nfs_ok;
}
if (mode == S_IFLNK) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 144/713] nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 143/713] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 145/713] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
` (579 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 9f1ddfc8cb9076592401a611eb3a44d36186d014 upstream.
nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd
service thread loop calls it to drain entries that the filecache
garbage collector and shrinker append via
nfsd_file_dispose_list_delayed(). During per-net teardown,
nn->nfsd_serv is cleared before the filecache laundrette is shut
down, so the service thread can still run a dispose pass that finds
more than eight entries on l->freeme and dereferences a NULL
svc_serv:
nfsd service thread loop
nfsd_file_net_dispose(nn)
if (!list_empty(&l->freeme)) {
...
svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */
}
The sibling helper nfsd_file_dispose_list_delayed() already documents
this ordering and caches nn->nfsd_serv into a local before testing it
for NULL. nfsd_file_net_dispose() was introduced with the same raw
svc_wake_up(nn->nfsd_serv) call and never picked up the guard.
Fix by loading nn->nfsd_serv into a local svc_serv pointer and only
calling svc_wake_up() when it is non-NULL, matching the pattern in
nfsd_file_dispose_list_delayed().
Fixes: ffb402596147 ("nfsd: Don't leave work of closing files to a work queue")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-4-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -471,11 +471,20 @@ void nfsd_file_net_dispose(struct nfsd_n
for (i = 0; i < 8 && !list_empty(&l->freeme); i++)
list_move(l->freeme.next, &dispose);
spin_unlock(&l->lock);
- if (!list_empty(&l->freeme))
- /* Wake up another thread to share the work
+ if (!list_empty(&l->freeme)) {
+ /*
+ * Wake up another thread to share the work
* *before* doing any actual disposing.
+ *
+ * The filecache laundrette is shut down after
+ * the nn->nfsd_serv pointer is cleared, but
+ * before the svc_serv is freed.
*/
- svc_wake_up(nn->nfsd_serv);
+ struct svc_serv *serv = nn->nfsd_serv;
+
+ if (serv)
+ svc_wake_up(serv);
+ }
nfsd_file_dispose_list(&dispose);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 145/713] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 144/713] nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 146/713] pNFS: Fix EBUSY check in pnfs_layout_need_return Greg Kroah-Hartman
` (578 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124 upstream.
When the server returns a new layout stateid while a valid one is still
held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
the on-stack free_me list and jumps to out_forget. Segments whose
reference count drops to zero are unlinked from lo->plh_segs and moved
to free_me by mark_lseg_invalid(); for an idle cached segment the layout
header holds the only reference, so this happens on the first decrement.
out_forget never drains free_me -- only the success path calls
pnfs_free_lseg_list().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in
pnfs_layout_process()") added the drain; commit 08bd8dbe8882
("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")
removed it while switching the destination to lo->plh_return_segs, which
is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout
return in pnfs_layout_process()") switched the destination back to
free_me without restoring the drain.
Restore the pnfs_free_lseg_list() call.
Fixes: fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2643,6 +2643,7 @@ out_forget:
spin_unlock(&ino->i_lock);
lseg->pls_layout = lo;
NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
+ pnfs_free_lseg_list(&free_me);
return ERR_PTR(-EAGAIN);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 146/713] pNFS: Fix EBUSY check in pnfs_layout_need_return
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 145/713] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 147/713] lockd, nfsd: RCU-protect nlmsvc_ops dispatch Greg Kroah-Hartman
` (577 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Menninger, Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Menninger <tmenninger@everpuredata.com>
commit 20358201777496fd0bb7b4336fcb4d3fc13cad28 upstream.
Commit 41d0a8ead9720 ("NFSv4/pnfs: Add support for the
PNFS_LAYOUT_FILE_BULK_RETURN flag") replaced
pnfs_layout_segments_returnable() in pnfs_layout_need_return() with a
direct call to pnfs_mark_layout_stateid_return().
The old helper checked the return value against -EBUSY, but the
replacement compares against EBUSY. Since
pnfs_mark_layout_stateid_return() returns negative errno values, the
-EBUSY case is never detected.
Fix the comparison in pnfs_layout_need_return() to check against -EBUSY.
Fixes: 41d0a8ead9720 ("NFSv4/pnfs: Add support for the PNFS_LAYOUT_FILE_BULK_RETURN flag")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1389,7 +1389,7 @@ pnfs_layout_need_return(struct pnfs_layo
return false;
return pnfs_mark_layout_stateid_return(lo, &lo->plh_return_segs,
lo->plh_return_iomode,
- lo->plh_return_seq) != EBUSY;
+ lo->plh_return_seq) != -EBUSY;
}
static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 147/713] lockd, nfsd: RCU-protect nlmsvc_ops dispatch
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 146/713] pNFS: Fix EBUSY check in pnfs_layout_need_return Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 148/713] nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Greg Kroah-Hartman
` (576 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 641e5e20852359b8c31149be4598884e30652f60 upstream.
nlmsvc_ops is published by nfsd_lockd_init() and cleared by
nfsd_lockd_shutdown() with plain stores, while lockd dereferences
it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer
targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's
.text, so a stale load after rmmod nfsd results in either a NULL
deref or a module-text use-after-free.
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear
via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module
*owner field to nlmsvc_binding and pin the module across indirect
calls with try_module_get/module_put. When the binding is torn down,
fall back to fput() to avoid leaking struct file references.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-16-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc.c | 4 +--
fs/lockd/svc4proc.c | 4 +--
fs/lockd/svcproc.c | 4 +--
fs/lockd/svcsubs.c | 52 ++++++++++++++++++++++++++++++++++++++-------
fs/nfsd/lockd.c | 6 +++--
include/linux/lockd/bind.h | 12 +++++++---
6 files changed, 64 insertions(+), 18 deletions(-)
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -47,7 +47,7 @@
static struct svc_program nlmsvc_program;
-const struct nlmsvc_binding *nlmsvc_ops;
+const struct nlmsvc_binding __rcu *nlmsvc_ops;
EXPORT_SYMBOL_GPL(nlmsvc_ops);
static DEFINE_MUTEX(nlmsvc_mutex);
@@ -142,7 +142,7 @@ lockd(void *vrqstp)
nlmsvc_retry_blocked(rqstp);
svc_recv(rqstp, 0);
}
- if (nlmsvc_ops)
+ if (rcu_access_pointer(nlmsvc_ops))
nlmsvc_invalidate_all();
nlm_shutdown_hosts();
cancel_delayed_work_sync(&ln->grace_period_end);
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -128,7 +128,7 @@ nlm4svc_lookup_host(struct svc_rqst *rqs
{
struct nlm_host *host;
- if (!nlmsvc_ops)
+ if (!rcu_access_pointer(nlmsvc_ops))
return NULL;
host = nlmsvc_lookup_host(rqstp, caller.data, caller.len);
if (!host)
@@ -894,7 +894,7 @@ static __be32 nlm4svc_proc_granted_res(s
{
struct nlm4_res_wrapper *argp = rqstp->rq_argp;
- if (!nlmsvc_ops)
+ if (!rcu_access_pointer(nlmsvc_ops))
return rpc_success;
if (nlm4_netobj_to_cookie(&argp->cookie, &argp->xdrgen.cookie))
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -133,7 +133,7 @@ nlm3svc_lookup_host(struct svc_rqst *rqs
{
struct nlm_host *host;
- if (!nlmsvc_ops)
+ if (!rcu_access_pointer(nlmsvc_ops))
return NULL;
host = nlmsvc_lookup_host(rqstp, caller.data, caller.len);
if (!host)
@@ -924,7 +924,7 @@ static __be32 nlmsvc_proc_granted_res(st
{
struct nlm_res_wrapper *argp = rqstp->rq_argp;
- if (!nlmsvc_ops)
+ if (!rcu_access_pointer(nlmsvc_ops))
return rpc_success;
if (nlm_netobj_to_cookie(&argp->cookie, &argp->xdrgen.cookie))
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -90,22 +90,35 @@ int lock_to_openmode(struct file_lock *l
static __be32 nlm_do_fopen(struct svc_rqst *rqstp,
struct nlm_file *file, int mode)
{
+ const struct nlmsvc_binding *ops;
__be32 nlmerr = nlm__int__failed;
__be32 deferred = 0;
int error;
int m;
+ rcu_read_lock();
+ ops = rcu_dereference(nlmsvc_ops);
+ if (!ops || !try_module_get(ops->owner)) {
+ rcu_read_unlock();
+ return nlm__int__failed;
+ }
+ rcu_read_unlock();
+
for (m = O_RDONLY; m <= O_WRONLY; m++) {
struct file **fp = &file->f_file[m];
if (mode != O_RDWR && mode != m)
continue;
- if (*fp)
+ if (*fp) {
+ module_put(ops->owner);
return nlm_granted;
+ }
- error = nlmsvc_ops->fopen(rqstp, &file->f_handle, fp, m);
- if (!error)
+ error = ops->fopen(rqstp, &file->f_handle, fp, m);
+ if (!error) {
+ module_put(ops->owner);
return nlm_granted;
+ }
dprintk("lockd: open failed (errno %d)\n", error);
switch (error) {
@@ -122,6 +135,7 @@ static __be32 nlm_do_fopen(struct svc_rq
}
}
+ module_put(ops->owner);
return deferred ? deferred : nlmerr;
}
@@ -186,6 +200,33 @@ out_free:
}
/*
+ * Release the struct file references held by a nlm_file.
+ */
+static void nlm_release_files(struct nlm_file *file)
+{
+ const struct nlmsvc_binding *ops;
+ bool have_ops;
+
+ rcu_read_lock();
+ ops = rcu_dereference(nlmsvc_ops);
+ have_ops = ops && try_module_get(ops->owner);
+ rcu_read_unlock();
+
+ if (have_ops) {
+ if (file->f_file[O_RDONLY])
+ ops->fclose(file->f_file[O_RDONLY]);
+ if (file->f_file[O_WRONLY])
+ ops->fclose(file->f_file[O_WRONLY]);
+ module_put(ops->owner);
+ } else {
+ if (file->f_file[O_RDONLY])
+ fput(file->f_file[O_RDONLY]);
+ if (file->f_file[O_WRONLY])
+ fput(file->f_file[O_WRONLY]);
+ }
+}
+
+/*
* Delete a file after having released all locks, blocks and shares
*/
static inline void
@@ -194,10 +235,7 @@ nlm_delete_file(struct nlm_file *file)
nlm_debug_print_file("closing file", file);
if (!hlist_unhashed(&file->f_list)) {
hlist_del(&file->f_list);
- if (file->f_file[O_RDONLY])
- nlmsvc_ops->fclose(file->f_file[O_RDONLY]);
- if (file->f_file[O_WRONLY])
- nlmsvc_ops->fclose(file->f_file[O_WRONLY]);
+ nlm_release_files(file);
kfree(file);
} else {
printk(KERN_WARNING "lockd: attempt to release unknown file!\n");
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -92,6 +92,7 @@ nlm_fclose(struct file *filp)
}
static const struct nlmsvc_binding nfsd_nlm_ops = {
+ .owner = THIS_MODULE,
.fopen = nlm_fopen, /* open file for locking */
.fclose = nlm_fclose, /* close file */
};
@@ -100,11 +101,12 @@ void
nfsd_lockd_init(void)
{
dprintk("nfsd: initializing lockd\n");
- nlmsvc_ops = &nfsd_nlm_ops;
+ rcu_assign_pointer(nlmsvc_ops, &nfsd_nlm_ops);
}
void
nfsd_lockd_shutdown(void)
{
- nlmsvc_ops = NULL;
+ RCU_INIT_POINTER(nlmsvc_ops, NULL);
+ synchronize_rcu();
}
--- a/include/linux/lockd/bind.h
+++ b/include/linux/lockd/bind.h
@@ -16,17 +16,23 @@ struct svc_rqst;
struct rpc_task;
struct rpc_clnt;
struct super_block;
+struct module;
-/*
- * This is the set of functions for lockd->nfsd communication
+/**
+ * struct nlmsvc_binding - lockd -> nfsd callback table
+ * @owner: module that provides this binding.
+ * @fopen: open a file by NFS file handle on behalf of an NLM request.
+ * @fclose: close a file that was previously opened via @fopen.
+ * Implementations MUST be semantically equivalent to fput().
*/
struct nlmsvc_binding {
+ struct module *owner;
int (*fopen)(struct svc_rqst *rqstp, struct nfs_fh *f,
struct file **filp, int flags);
void (*fclose)(struct file *filp);
};
-extern const struct nlmsvc_binding *nlmsvc_ops;
+extern const struct nlmsvc_binding __rcu *nlmsvc_ops;
/*
* Similar to nfs_client_initdata, but without the NFS-specific
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 148/713] nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 147/713] lockd, nfsd: RCU-protect nlmsvc_ops dispatch Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 149/713] nfsd: release path refs on follow_down() error Greg Kroah-Hartman
` (575 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 01c5d5f58a5db9b0ee5afba2e49d3157788687b2 upstream.
After a DESTROY_SESSION the per-session teardown path can free a
session while rpciod still holds an inflight callback rpc_task that
dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes
cl_callback_wq, but once nfsd4_run_cb_work() has called
rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue
does not wait for it. rpc_shutdown_client() does drain rpciod tasks,
but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()
(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.
destroy path rpciod
------------ ------
unhash_session(ses)
nfsd4_probe_callback_sync(clp)
flush_workqueue(cl_callback_wq)
/* returns; rpc_task still live */
nfsd4_put_session_locked(ses)
free_session(ses) -> kfree(ses)
nfsd4_cb_sequence_done()
reads cb_clp->cl_cb_session
/* freed slab */
A second window exists in nfsd4_process_cb_update(). When
__nfsd4_find_backchannel() returns NULL because unhash_session() has
already removed the destroyed session from cl_sessions,
setup_callback_client() takes the v4.1 early return so
clp->cl_cb_session = ses never fires and the field retains a pointer
to the about-to-be-freed session.
Fix both by converting cl_cb_session to an RCU-protected pointer:
- Move the cl_cb_session = ses assignment in setup_callback_client()
to after rpc_create() succeeds, so it is only published when a
working backchannel exists. Clear cl_cb_session on the error
return in nfsd4_process_cb_update(). Both stores use
rcu_assign_pointer().
- Annotate cl_cb_session with __rcu. All rpciod-side readers use
rcu_read_lock()/rcu_dereference() and check for NULL, bailing to
the appropriate error or requeue path:
encode_cb_sequence4args(), decode_cb_sequence4resok(),
nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),
nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().
- Switch __free_session() from kfree() to kfree_rcu() so the
session slab is not reclaimed until after an RCU grace period,
guaranteeing that rpciod readers inside rcu_read_lock() never
dereference freed memory.
- Pass the session pointer to the nfsd_cb_seq_status and
nfsd_cb_free_slot tracepoints instead of having them re-read
cl_cb_session.
- nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,
routing through the done/release path to requeue the callback.
Fixes: dcbeaa68dbbd ("nfsd4: allow backchannel recovery")
Cc: stable@vger.kernel.org
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-2-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4callback.c | 109 ++++++++++++++++++++++++++++++++++++++++---------
fs/nfsd/nfs4state.c | 4 -
fs/nfsd/state.h | 3 -
fs/nfsd/trace.h | 14 ++----
4 files changed, 100 insertions(+), 30 deletions(-)
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -456,13 +456,20 @@ static void encode_cb_sequence4args(stru
const struct nfsd4_callback *cb,
struct nfs4_cb_compound_hdr *hdr)
{
- struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
+ struct nfsd4_session *session;
struct nfsd4_referring_call_list *rcl;
__be32 *p;
if (hdr->minorversion == 0)
return;
+ rcu_read_lock();
+ session = rcu_dereference(cb->cb_clp->cl_cb_session);
+ if (!session) {
+ rcu_read_unlock();
+ return;
+ }
+
encode_nfs_cb_opnum4(xdr, OP_CB_SEQUENCE);
encode_sessionid4(xdr, session);
@@ -478,6 +485,7 @@ static void encode_cb_sequence4args(stru
encode_referring_call_list4(xdr, rcl);
hdr->nops++;
+ rcu_read_unlock();
}
static void update_cb_slot_table(struct nfsd4_session *ses, u32 target)
@@ -529,21 +537,32 @@ static void update_cb_slot_table(struct
static int decode_cb_sequence4resok(struct xdr_stream *xdr,
struct nfsd4_callback *cb)
{
- struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
+ struct nfsd4_session *session;
int status = -ESERVERFAULT;
__be32 *p;
u32 seqid, slotid, target;
+ rcu_read_lock();
+ session = rcu_dereference(cb->cb_clp->cl_cb_session);
+ if (!session) {
+ rcu_read_unlock();
+ cb->cb_seq_status = -NFS4ERR_BADSESSION;
+ return -NFS4ERR_BADSESSION;
+ }
+
/*
* If the server returns different values for sessionID, slotID or
* sequence number, the server is looney tunes.
*/
p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4 + 4 + 4);
- if (unlikely(p == NULL))
+ if (unlikely(p == NULL)) {
+ rcu_read_unlock();
goto out_overflow;
+ }
if (memcmp(p, session->se_sessionid.data, NFS4_MAX_SESSIONID_LEN)) {
dprintk("NFS: %s Invalid session id\n", __func__);
+ rcu_read_unlock();
goto out;
}
p += XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN);
@@ -551,12 +570,14 @@ static int decode_cb_sequence4resok(stru
seqid = be32_to_cpup(p++);
if (seqid != session->se_cb_seq_nr[cb->cb_held_slot]) {
dprintk("NFS: %s Invalid sequence number\n", __func__);
+ rcu_read_unlock();
goto out;
}
slotid = be32_to_cpup(p++);
if (slotid != cb->cb_held_slot) {
dprintk("NFS: %s Invalid slotid\n", __func__);
+ rcu_read_unlock();
goto out;
}
@@ -564,6 +585,7 @@ static int decode_cb_sequence4resok(stru
target = be32_to_cpup(p++);
update_cb_slot_table(session, target);
+ rcu_read_unlock();
status = 0;
out:
cb->cb_seq_status = status;
@@ -1150,9 +1172,8 @@ static int setup_callback_client(struct
} else {
if (!conn->cb_xprt || !ses)
return -EINVAL;
- clp->cl_cb_session = ses;
args.bc_xprt = conn->cb_xprt;
- args.prognumber = clp->cl_cb_session->se_cb_prog;
+ args.prognumber = ses->se_cb_prog;
args.protocol = conn->cb_xprt->xpt_class->xcl_ident |
XPRT_TRANSPORT_BC;
args.authflavor = ses->se_cb_sec.flavor;
@@ -1170,8 +1191,10 @@ static int setup_callback_client(struct
return -ENOMEM;
}
- if (clp->cl_minorversion != 0)
+ if (clp->cl_minorversion != 0) {
clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
+ rcu_assign_pointer(clp->cl_cb_session, ses);
+ }
clp->cl_cb_client = client;
clp->cl_cb_cred = cred;
rcu_read_lock();
@@ -1278,18 +1301,33 @@ static int grab_slot(struct nfsd4_sessio
static bool nfsd41_cb_get_slot(struct nfsd4_callback *cb, struct rpc_task *task)
{
struct nfs4_client *clp = cb->cb_clp;
- struct nfsd4_session *ses = clp->cl_cb_session;
+ struct nfsd4_session *ses;
if (cb->cb_held_slot >= 0)
return true;
+
+ rcu_read_lock();
+ ses = rcu_dereference(clp->cl_cb_session);
+ if (!ses) {
+ rcu_read_unlock();
+ rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
+ return false;
+ }
cb->cb_held_slot = grab_slot(ses);
if (cb->cb_held_slot < 0) {
+ rcu_read_unlock();
rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
/* Race breaker */
- cb->cb_held_slot = grab_slot(ses);
+ rcu_read_lock();
+ ses = rcu_dereference(clp->cl_cb_session);
+ if (ses)
+ cb->cb_held_slot = grab_slot(ses);
+ rcu_read_unlock();
if (cb->cb_held_slot < 0)
return false;
rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
+ } else {
+ rcu_read_unlock();
}
return true;
}
@@ -1297,12 +1335,17 @@ static bool nfsd41_cb_get_slot(struct nf
static void nfsd41_cb_release_slot(struct nfsd4_callback *cb)
{
struct nfs4_client *clp = cb->cb_clp;
- struct nfsd4_session *ses = clp->cl_cb_session;
+ struct nfsd4_session *ses;
if (cb->cb_held_slot >= 0) {
- spin_lock(&ses->se_lock);
- ses->se_cb_slot_avail |= BIT(cb->cb_held_slot);
- spin_unlock(&ses->se_lock);
+ rcu_read_lock();
+ ses = rcu_dereference(clp->cl_cb_session);
+ if (ses) {
+ spin_lock(&ses->se_lock);
+ ses->se_cb_slot_avail |= BIT(cb->cb_held_slot);
+ spin_unlock(&ses->se_lock);
+ }
+ rcu_read_unlock();
cb->cb_held_slot = -1;
rpc_wake_up_next(&clp->cl_cb_waitq);
}
@@ -1434,22 +1477,35 @@ static void nfsd4_cb_prepare(struct rpc_
trace_nfsd_cb_rpc_prepare(clp);
cb->cb_seq_status = 1;
cb->cb_status = 0;
- if (minorversion && !nfsd41_cb_get_slot(cb, task))
- return;
+ if (minorversion) {
+ if (!rcu_access_pointer(clp->cl_cb_session)) {
+ rpc_exit(task, -EIO);
+ return;
+ }
+ if (!nfsd41_cb_get_slot(cb, task))
+ return;
+ }
rpc_call_start(task);
}
/* Returns true if CB_COMPOUND processing should continue */
static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback *cb)
{
- struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
+ struct nfsd4_session *session;
bool ret = false;
if (cb->cb_held_slot < 0)
goto requeue;
+ rcu_read_lock();
+ session = rcu_dereference(cb->cb_clp->cl_cb_session);
+ if (!session) {
+ rcu_read_unlock();
+ goto requeue;
+ }
+
/* This is the operation status code for CB_SEQUENCE */
- trace_nfsd_cb_seq_status(task, cb);
+ trace_nfsd_cb_seq_status(task, cb, session);
switch (cb->cb_seq_status) {
case 0:
/*
@@ -1481,12 +1537,16 @@ static bool nfsd4_cb_sequence_done(struc
fallthrough;
case -NFS4ERR_BADSESSION:
nfsd4_mark_cb_fault(cb->cb_clp);
+ rcu_read_unlock();
goto requeue;
case -NFS4ERR_DELAY:
cb->cb_seq_status = 1;
- if (RPC_SIGNALLED(task) || !rpc_restart_call(task))
+ if (RPC_SIGNALLED(task) || !rpc_restart_call(task)) {
+ rcu_read_unlock();
goto requeue;
+ }
rpc_delay(task, 2 * HZ);
+ rcu_read_unlock();
return false;
case -NFS4ERR_SEQ_MISORDERED:
case -NFS4ERR_BADSLOT:
@@ -1498,11 +1558,13 @@ static bool nfsd4_cb_sequence_done(struc
*/
nfsd4_mark_cb_fault(cb->cb_clp);
cb->cb_held_slot = -1;
+ rcu_read_unlock();
goto retry_nowait;
default:
nfsd4_mark_cb_fault(cb->cb_clp);
}
- trace_nfsd_cb_free_slot(task, cb);
+ trace_nfsd_cb_free_slot(task, cb, session);
+ rcu_read_unlock();
nfsd41_cb_release_slot(cb);
return ret;
retry_nowait:
@@ -1624,7 +1686,15 @@ static struct nfsd4_conn * __nfsd4_find_
* Note there isn't a lot of locking in this code; instead we depend on
* the fact that it is run from clp->cl_callback_wq, which won't run two
* work items at once. So, for example, clp->cl_callback_wq handles all
- * access of cl_cb_client and all calls to rpc_create or rpc_shutdown_client.
+ * access of cl_cb_client, and all calls to rpc_create or
+ * rpc_shutdown_client.
+ *
+ * cl_cb_session is written only from cl_callback_wq (via
+ * rcu_assign_pointer) and read from rpciod under rcu_read_lock (via
+ * rcu_dereference) by encode_cb_sequence4args(), decode_cb_sequence4resok(),
+ * nfsd4_cb_sequence_done(), and the cb-slot helpers. Sessions are freed
+ * with kfree_rcu() so that rpciod readers in an RCU read-side critical
+ * section never dereference a freed session.
*/
static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
{
@@ -1676,6 +1746,7 @@ static void nfsd4_process_cb_update(stru
nfsd4_mark_cb_down(clp);
if (c)
svc_xprt_put(c->cn_xprt);
+ rcu_assign_pointer(clp->cl_cb_session, ses);
return;
}
}
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2295,7 +2295,7 @@ static void __free_session(struct nfsd4_
{
free_session_slots(ses, 0);
xa_destroy(&ses->se_slots);
- kfree(ses);
+ kfree_rcu(ses, rcu_head);
}
static void free_session(struct nfsd4_session *ses)
@@ -3414,7 +3414,7 @@ static struct nfs4_client *create_client
clp->cl_time = ktime_get_boottime_seconds();
copy_verf(clp, verf);
memcpy(&clp->cl_addr, sa, sizeof(struct sockaddr_storage));
- clp->cl_cb_session = NULL;
+ RCU_INIT_POINTER(clp->cl_cb_session, NULL);
clp->net = net;
clp->cl_nfsd_dentry = nfsd_client_mkdir(
nn, &clp->cl_nfsdfs,
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -384,6 +384,7 @@ struct nfsd4_session {
u16 se_slot_gen;
bool se_dead;
u32 se_target_maxslots;
+ struct rcu_head rcu_head;
};
/* formatted contents of nfs4_sessionid */
@@ -496,7 +497,7 @@ struct nfs4_client {
#define NFSD4_CB_FAULT 3
int cl_cb_state;
struct nfsd4_callback cl_cb_null;
- struct nfsd4_session *cl_cb_session;
+ struct nfsd4_session __rcu *cl_cb_session;
/* for all client information that callback code might need: */
spinlock_t cl_lock;
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -1727,9 +1727,10 @@ DEFINE_NFSD_CB_LIFETIME_EVENT(bc_shutdow
TRACE_EVENT(nfsd_cb_seq_status,
TP_PROTO(
const struct rpc_task *task,
- const struct nfsd4_callback *cb
+ const struct nfsd4_callback *cb,
+ const struct nfsd4_session *session
),
- TP_ARGS(task, cb),
+ TP_ARGS(task, cb, session),
TP_STRUCT__entry(
__field(unsigned int, task_id)
__field(unsigned int, client_id)
@@ -1741,8 +1742,6 @@ TRACE_EVENT(nfsd_cb_seq_status,
__field(int, seq_status)
),
TP_fast_assign(
- const struct nfs4_client *clp = cb->cb_clp;
- const struct nfsd4_session *session = clp->cl_cb_session;
const struct nfsd4_sessionid *sid =
(struct nfsd4_sessionid *)&session->se_sessionid;
@@ -1768,9 +1767,10 @@ TRACE_EVENT(nfsd_cb_seq_status,
TRACE_EVENT(nfsd_cb_free_slot,
TP_PROTO(
const struct rpc_task *task,
- const struct nfsd4_callback *cb
+ const struct nfsd4_callback *cb,
+ const struct nfsd4_session *session
),
- TP_ARGS(task, cb),
+ TP_ARGS(task, cb, session),
TP_STRUCT__entry(
__field(unsigned int, task_id)
__field(unsigned int, client_id)
@@ -1781,8 +1781,6 @@ TRACE_EVENT(nfsd_cb_free_slot,
__field(u32, slot_seqno)
),
TP_fast_assign(
- const struct nfs4_client *clp = cb->cb_clp;
- const struct nfsd4_session *session = clp->cl_cb_session;
const struct nfsd4_sessionid *sid =
(struct nfsd4_sessionid *)&session->se_sessionid;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 149/713] nfsd: release path refs on follow_down() error
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 148/713] nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 150/713] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
` (574 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 6cba08dc1922140d260cfeb30bbda4ee1bf869d8 upstream.
nfsd_cross_mnt() initializes a local struct path with mntget() and
dget() before calling follow_down(). On a negative return the error
arm jumps to out without releasing those references:
err = follow_down(&path, follow_flags);
if (err < 0)
goto out;
follow_down() never drops the caller's entry-time refs on any error
sub-case; for example a pre-cross d_manage() failure leaves path
untouched, so the mntget()/dget() taken on entry survive the call.
Every other early-exit arm in nfsd_cross_mnt() (other-namespace
return, IS_ERR(exp2), and the success tail after the swap) already
calls path_put(&path); the err < 0 arm is the lone omission. The
leak inflates mnt_count and d_count on each failed cross-mount,
blocking umount and pinning dentries against the shrinker, and is
reachable by any authenticated NFS client through nfsd_lookup_dentry
or the NFSv4 READDIR encode path.
Fix by calling path_put(&path) before the goto out in the err < 0
arm so the entry-time refs are released on all follow_down() error
returns.
Fixes: cc53ce53c869 ("Add a dentry op to allow processes to be held during pathwalk transit")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260531-nfsd-testing-v1-2-7bfa481b0540@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -137,8 +137,10 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, s
follow_flags = LOOKUP_AUTOMOUNT;
err = follow_down(&path, follow_flags);
- if (err < 0)
+ if (err < 0) {
+ path_put(&path);
goto out;
+ }
if (path.mnt == exp->ex_path.mnt && path.dentry == dentry &&
nfsd_mountpoint(dentry, exp) == 2) {
/* This is only a mountpoint in some other namespace */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 150/713] nfsd: Reset write verifier when async COPY writeback fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 149/713] nfsd: release path refs on follow_down() error Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 151/713] nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths Greg Kroah-Hartman
` (573 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9 upstream.
Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread completes. When
the post-copy vfs_fsync_range() or filemap_check_wb_err() in
_nfsd_copy_file_range() reports an error, the worker correctly
leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes
wr_stable_how as NFS_UNSTABLE, but the server's write verifier is
not rotated.
A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with
COMMIT to make the copied data durable. With the verifier
unchanged, COMMIT returns the same value the client just received
via CB_OFFLOAD, and the client concludes the copy is durable --
silently dropping the data whose writeback in fact failed. This
violates the UNSTABLE+COMMIT durability contract (RFC 7862 section
15.1, RFC 8881 section 18.32) and matches the bug just fixed in
nfsd_vfs_write() and nfsd_commit().
Rotate nn->writeverf at the writeback-failure site. The async COPY
worker has no svc_rqst, so commit_reset_write_verifier() is not
available here; calling nfsd_reset_write_verifier() directly
mirrors the trace-less reset already used by
nfsd_file_check_write_error() for the same purpose. Filter out
-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since
neither indicates a durable-storage failure.
Fixes: eac0b17a77fb ("NFSD add vfs_fsync after async copy is done")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522203723.446841-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1972,6 +1972,8 @@ static ssize_t _nfsd_copy_file_range(str
status = filemap_check_wb_err(dst->f_mapping, since);
if (!status)
set_bit(NFSD4_COPY_F_COMMITTED, ©->cp_flags);
+ else if (status != -EAGAIN && status != -ESTALE)
+ nfsd_reset_write_verifier(copy->cp_nn);
}
return bytes_copied;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 151/713] nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 150/713] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
@ 2026-09-04 4:51 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 152/713] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
` (572 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f6045886fe3f14f269f683d64021b004a50d0efa upstream.
nfsd_dispatch() sets rq_status_counter to an odd value once a request has
been decoded, and back to an even value once it has been fully processed,
forming a seq-lock like protocol with the lockless reader in
nfsd_nl_rpc_status_get_dumpit().
Only the fully successful path restored the counter to even. The cache-hit
(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return
after the odd-valued store without ever bringing the counter back to even.
Once one of those paths is taken, rq_status_counter is left odd: the next
request's decode ORs in 1 (still odd) and only a subsequent successful
encode restores even. While stuck odd, the dumpit reader treats the rqstp
fields as stable and its retry check compares against the same unchanging
odd value, so it never detects concurrent mutation. This exposes actively
mutating fields (e.g. args->ops / args->opcnt during compound decode and
release) to the lockless reader, which can read past the end of the
8-element inline ops array.
Add a helper that advances the counter to the next even value and call it
on every return path that follows the odd-valued store. The decode-error
path is left untouched as it is reached before the counter is set odd.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-19-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfssvc.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -960,6 +960,20 @@ nfsd(void *vrqstp)
return 0;
}
+/*
+ * Set rq_status_counter back to an even value, indicating that the rqstp
+ * fields are no longer meaningful to a lockless reader. This pairs with the
+ * odd-valued store made once the request has been decoded, and must run on
+ * every return path that follows it so that the seq-lock like protocol used
+ * by nfsd_nl_rpc_status_get_dumpit() is not left permanently odd. The store
+ * also advances the counter so a concurrent reader detects the transition.
+ */
+static void nfsd_status_counter_set_idle(struct svc_rqst *rqstp)
+{
+ smp_store_release(&rqstp->rq_status_counter,
+ (rqstp->rq_status_counter | 1) + 1);
+}
+
/**
* nfsd_dispatch - Process an NFS or NFSACL or LOCALIO Request
* @rqstp: incoming request
@@ -1022,14 +1036,9 @@ int nfsd_dispatch(struct svc_rqst *rqstp
if (!proc->pc_encode(rqstp, &rqstp->rq_res_stream))
goto out_encode_err;
- /*
- * Release rq_status_counter setting it to an even value after the rpc
- * request has been properly processed.
- */
- smp_store_release(&rqstp->rq_status_counter, rqstp->rq_status_counter + 1);
-
nfsd_cache_update(rqstp, rp, ntli->ntli_cachetype, nfs_reply);
out_cached_reply:
+ nfsd_status_counter_set_idle(rqstp);
return 1;
out_decode_err:
@@ -1040,12 +1049,14 @@ out_decode_err:
out_update_drop:
nfsd_cache_update(rqstp, rp, RC_NOCACHE, NULL);
out_dropit:
+ nfsd_status_counter_set_idle(rqstp);
return 0;
out_encode_err:
trace_nfsd_cant_encode_err(rqstp);
nfsd_cache_update(rqstp, rp, RC_NOCACHE, NULL);
*statp = rpc_system_err;
+ nfsd_status_counter_set_idle(rqstp);
return 1;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 152/713] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-09-04 4:51 ` [PATCH 7.2 151/713] nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 153/713] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
` (571 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 45b06a75086f331f52cbb81223a59421d43f8809 upstream.
nfsd4_decode_nl4_server() handled only NL4_NETADDR and returned
nfserr_bad_xdr for NL4_NAME and NL4_URL. Those forms are well-formed XDR,
so BADXDR is misleading -- the request is unsupported, not malformed.
Decode and discard the utf8str_cis for NL4_NAME and NL4_URL to keep the
stream consistent, and return nfserr_notsupp. nfsd4_proc_compound() honors
a decode-time op->status, so the op fails without executing.
Fixes: 84e1b21d5ec4 ("NFSD add ca_source_server<> to COPY")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-7-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2106,6 +2106,7 @@ static __be32 nfsd4_decode_nl4_server(st
{
struct nfs42_netaddr *naddr;
__be32 *p;
+ u32 str_len;
if (xdr_stream_decode_u32(argp->xdr, &ns->nl4_type) < 0)
return nfserr_bad_xdr;
@@ -2135,6 +2136,18 @@ static __be32 nfsd4_decode_nl4_server(st
return nfserr_bad_xdr;
memcpy(naddr->addr, p, naddr->addr_len);
break;
+ case NL4_NAME:
+ case NL4_URL:
+ /*
+ * Well-formed XDR, but only NL4_NETADDR is supported. Consume
+ * the utf8str_cis to keep the stream aligned, then return
+ * NFS4ERR_NOTSUPP rather than the misleading NFS4ERR_BADXDR.
+ */
+ if (xdr_stream_decode_u32(argp->xdr, &str_len) < 0)
+ return nfserr_bad_xdr;
+ if (!xdr_inline_decode(argp->xdr, str_len))
+ return nfserr_bad_xdr;
+ return nfserr_notsupp;
default:
return nfserr_bad_xdr;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 153/713] nfsd: sample writeback error cursor before async COPY loop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 152/713] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 154/713] nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Greg Kroah-Hartman
` (570 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 20a67a7d18221af736f124770c2c5e859b479046 upstream.
_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback errors
via filemap_check_wb_err() once vfs_fsync_range() returns.
Because the nfsd_file cache reuses a single struct file
across requests targeting the same inode, a concurrent
COMMIT or stable WRITE on dst advances dst->f_wb_err to the
current mapping->wb_err via file_check_and_advance_wb_err()
during its own vfs_fsync_range(). If that advancement lands
between the writeback error appearing in mapping->wb_err
and the COPY worker sampling "since", the worker captures
the already-advanced cursor, errseq_check() sees cur ==
since and returns zero, and NFSD4_COPY_F_COMMITTED is set
even though writeback failed. CB_OFFLOAD then encodes
wr_stable_how = FILE_SYNC4, the client treats the copied
data as durable, and the failure becomes silent data loss.
Sample since once at the start of the function. The cursor
then reflects state in effect before this COPY issues any
writes, and filemap_check_wb_err() detects any error that
occurs during the copy regardless of which thread first
observes it. This matches the pattern used by
nfsd_vfs_write() and nfsd4_clone_file_range().
Closes: https://sashiko.dev/#/patchset/20260522194441.436065-1-cel@kernel.org?part=1
Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522214558.460859-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1950,6 +1950,7 @@ static ssize_t _nfsd_copy_file_range(str
/* See RFC 7862 p.67: */
if (bytes_total == 0)
bytes_total = ULLONG_MAX;
+ since = READ_ONCE(dst->f_wb_err);
do {
/* Only async copies can be stopped here */
if (kthread_should_stop())
@@ -1965,7 +1966,6 @@ static ssize_t _nfsd_copy_file_range(str
} while (bytes_total > 0 && nfsd4_copy_is_async(copy));
/* for a non-zero asynchronous copy do a commit of data */
if (nfsd4_copy_is_async(copy) && copy->cp_res.wr_bytes_written > 0) {
- since = READ_ONCE(dst->f_wb_err);
end = copy->cp_dst_pos + copy->cp_res.wr_bytes_written - 1;
status = vfs_fsync_range(dst, copy->cp_dst_pos, end, 0);
if (!status)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 154/713] nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 153/713] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 155/713] nfsd: size fh_verify server sockaddr slot by xpt_locallen Greg Kroah-Hartman
` (569 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhenghang Xiao, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenghang Xiao <kipreyyy@gmail.com>
commit 650d370cfbc66a96dd14d517bd704689b5bda4e5 upstream.
nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().
The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Fixes: 8dd91e8d31fe ("nfsd: fix race between laundromat and free_stateid")
Cc: stable@vger.kernel.org
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526104554.46262-1-kipreyyy@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5172,6 +5172,7 @@ static void nfsd4_drop_revoked_stid(stru
case SC_TYPE_DELEG:
dp = delegstateid(s);
list_del_init(&dp->dl_recall_lru);
+ s->sc_status |= SC_STATUS_FREED;
spin_unlock(&cl->cl_lock);
nfs4_put_stid(s);
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 155/713] nfsd: size fh_verify server sockaddr slot by xpt_locallen
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 154/713] nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 156/713] nfsd: validate nseconds in TIME_DELEG decode paths Greg Kroah-Hartman
` (568 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 71d068490098b1d23c63b2345e40675d3a1ca763 upstream.
The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the
server sockaddr slot sized by xpt_remotelen but fill it from
xpt_local using xpt_locallen:
TP_STRUCT__entry(
...
__sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
...
)
TP_fast_assign(
...
__assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,
rqstp->rq_xprt->xpt_locallen);
...
)
When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy
writes past the reserved ring-buffer slot. In the reverse direction
(xpt_locallen < xpt_remotelen) the slot is oversized and the
unwritten tail leaks prior ring-buffer contents to trace consumers.
The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()
is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from
the RDMA connect path; svc_create_socket() for UDP calls only
svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's
lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request
then copies 16 or 28 bytes from xpt_local into a zero-byte slot.
The other NFSD tracepoints that record the server address
(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,
SVC_RQST_ENDPOINT_FIELDS) already size the server slot by
xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only
exceptions.
Fix by sizing the server slot with xpt_locallen so the declared slot
matches the copy length. The client slot and its assignment already
agree on xpt_remotelen and are left untouched.
Fixes: 051382885552 ("NFSD: Instrument fh_verify()")
Fixes: 948755efc951 ("NFSD: Replace dprintk() call site in fh_verify()")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260531-nfsd-testing-v1-1-7bfa481b0540@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/trace.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -271,7 +271,7 @@ TRACE_EVENT_CONDITION(nfsd_fh_verify,
TP_CONDITION(rqstp != NULL),
TP_STRUCT__entry(
__field(unsigned int, netns_ino)
- __sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
+ __sockaddr(server, rqstp->rq_xprt->xpt_locallen)
__sockaddr(client, rqstp->rq_xprt->xpt_remotelen)
__field(u32, xid)
__field(u32, fh_hash)
@@ -310,7 +310,7 @@ TRACE_EVENT_CONDITION(nfsd_fh_verify_err
TP_CONDITION(rqstp != NULL && error),
TP_STRUCT__entry(
__field(unsigned int, netns_ino)
- __sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
+ __sockaddr(server, rqstp->rq_xprt->xpt_locallen)
__sockaddr(client, rqstp->rq_xprt->xpt_remotelen)
__field(u32, xid)
__field(u32, fh_hash)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 156/713] nfsd: validate nseconds in TIME_DELEG decode paths
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 155/713] nfsd: size fh_verify server sockaddr slot by xpt_locallen Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 157/713] nfsd: validate sockaddr length per family in listener_set Greg Kroah-Hartman
` (567 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 0f4a767340fad392bd656115b8752005518c9065 upstream.
The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms
store a raw uint32_t nseconds directly into tv_nsec without enforcing
nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this
check but the TIME_DELEG paths do not. A malformed timespec can
propagate through notify_change() to disk.
Add range checks in both nfs4xdr.c (SETATTR path) and
nfs4callback.c (CB_GETATTR path).
Fixes: 6ae30d6eb26b ("nfsd: add support for delegated timestamps")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-7-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4callback.c | 4 ++++
fs/nfsd/nfs4xdr.c | 4 ++++
2 files changed, 8 insertions(+)
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -108,6 +108,8 @@ static int decode_cb_fattr4(struct xdr_s
if (!xdrgen_decode_fattr4_time_deleg_access(xdr, &access))
return -EIO;
+ if (access.nseconds >= NSEC_PER_SEC)
+ return -EIO;
fattr->ncf_cb_atime.tv_sec = access.seconds;
fattr->ncf_cb_atime.tv_nsec = access.nseconds;
@@ -117,6 +119,8 @@ static int decode_cb_fattr4(struct xdr_s
if (!xdrgen_decode_fattr4_time_deleg_modify(xdr, &modify))
return -EIO;
+ if (modify.nseconds >= NSEC_PER_SEC)
+ return -EIO;
fattr->ncf_cb_mtime.tv_sec = modify.seconds;
fattr->ncf_cb_mtime.tv_nsec = modify.nseconds;
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -628,6 +628,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoun
if (!xdrgen_decode_fattr4_time_deleg_access(argp->xdr, &access))
return nfserr_bad_xdr;
+ if (access.nseconds >= NSEC_PER_SEC)
+ return nfserr_inval;
iattr->ia_atime.tv_sec = access.seconds;
iattr->ia_atime.tv_nsec = access.nseconds;
iattr->ia_valid |= ATTR_ATIME | ATTR_ATIME_SET | ATTR_DELEG;
@@ -637,6 +639,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoun
if (!xdrgen_decode_fattr4_time_deleg_modify(argp->xdr, &modify))
return nfserr_bad_xdr;
+ if (modify.nseconds >= NSEC_PER_SEC)
+ return nfserr_inval;
iattr->ia_mtime.tv_sec = modify.seconds;
iattr->ia_mtime.tv_nsec = modify.nseconds;
iattr->ia_ctime.tv_sec = modify.seconds;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 157/713] nfsd: validate sockaddr length per family in listener_set
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 156/713] nfsd: validate nseconds in TIME_DELEG decode paths Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 158/713] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
` (566 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464 upstream.
nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY
attribute with no minimum length. A CAP_NET_ADMIN caller can send a
16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte
OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener,
kernel_bind).
nfsd_nl_listener_set_doit() also parsed and validated each listener
entry inline in two separate loops, interleaved with mutating the
running listener configuration. The validation was duplicated, used an
open-coded "nla_len < sizeof(struct sockaddr)" check that was too short
for AF_INET6, and handled a malformed entry inconsistently depending on
which loop noticed it.
Add an nfsd_nl_validate_listeners() helper that walks the entire list
once and confirms each entry parses, carries both an address and a
transport name, and is long enough for its address family
(sizeof(struct sockaddr_in) for AF_INET, sizeof(struct sockaddr_in6)
for AF_INET6, -EAFNOSUPPORT otherwise). Call it before taking
nfsd_mutex or creating the serv, so a malformed request fails cleanly
with no side effects.
Since every entry is known valid by the time the two existing loops
run, drop the redundant presence and per-family length checks from
both, leaving only the nla_parse_nested() call needed to extract the
data.
Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260615-nfsd-testing-v5-1-188d75aedda0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 65 insertions(+), 12 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1948,6 +1948,60 @@ err_free_msg:
}
/**
+ * nfsd_nl_validate_listeners - sanity-check the listener list from userland
+ * @info: netlink metadata and command arguments
+ *
+ * Walk every NFSD_A_SERVER_SOCK_ADDR attribute and confirm that each entry
+ * is well-formed: it parses against the policy, carries both an address and
+ * a transport name, and the address is long enough for its family. Doing
+ * this up front lets the callers below assume every entry is valid and
+ * guarantees we make no changes when the request is malformed.
+ *
+ * Return: 0 if every entry is valid, or a negative errno otherwise.
+ */
+static int nfsd_nl_validate_listeners(struct genl_info *info)
+{
+ const struct nlattr *attr;
+ int rem;
+
+ nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
+ GENL_HDRLEN, rem) {
+ struct nlattr *tb[NFSD_A_SOCK_MAX + 1];
+ struct sockaddr *sa;
+ int err;
+
+ err = nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
+ nfsd_sock_nl_policy, info->extack);
+ if (err < 0)
+ return err;
+
+ if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
+ return -EINVAL;
+
+ sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
+ if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(sa->sa_family))
+ return -EINVAL;
+
+ switch (sa->sa_family) {
+ case AF_INET:
+ if (nla_len(tb[NFSD_A_SOCK_ADDR]) <
+ sizeof(struct sockaddr_in))
+ return -EINVAL;
+ break;
+ case AF_INET6:
+ if (nla_len(tb[NFSD_A_SOCK_ADDR]) <
+ sizeof(struct sockaddr_in6))
+ return -EINVAL;
+ break;
+ default:
+ return -EAFNOSUPPORT;
+ }
+ }
+
+ return 0;
+}
+
+/**
* nfsd_nl_listener_set_doit - set the nfs running sockets
* @skb: reply buffer
* @info: netlink metadata and command arguments
@@ -1965,6 +2019,15 @@ int nfsd_nl_listener_set_doit(struct sk_
bool delete = false;
int err, rem;
+ /*
+ * Validate the entire listener list before making any changes, so a
+ * malformed request fails cleanly without creating a serv or touching
+ * the existing listeners.
+ */
+ err = nfsd_nl_validate_listeners(info);
+ if (err)
+ return err;
+
mutex_lock(&nfsd_mutex);
err = nfsd_create_serv(net);
@@ -1991,16 +2054,11 @@ int nfsd_nl_listener_set_doit(struct sk_
const char *xcl_name;
struct sockaddr *sa;
+ /* validated up front in nfsd_nl_validate_listeners() */
if (nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
nfsd_sock_nl_policy, info->extack) < 0)
continue;
- if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
- continue;
-
- if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(*sa))
- continue;
-
xcl_name = nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]);
sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
@@ -2052,16 +2110,11 @@ int nfsd_nl_listener_set_doit(struct sk_
struct sockaddr *sa;
int ret;
+ /* validated up front in nfsd_nl_validate_listeners() */
if (nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
nfsd_sock_nl_policy, info->extack) < 0)
continue;
- if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
- continue;
-
- if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(*sa))
- continue;
-
xcl_name = nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]);
sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 158/713] nfsd: validate symlink target length in NFSv4 CREATE
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 157/713] nfsd: validate sockaddr length per family in listener_set Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 159/713] nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Greg Kroah-Hartman
` (565 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 041f57056e5fb9c80adc088269322d2c61074406 upstream.
nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for
NF4LNK symlink targets, allowing a client to force a kmalloc of up to
the maximum RPC payload size (several MiB) per COMPOUND op that persists
until compound teardown. The VFS rejects oversized targets with
ENAMETOOLONG, but the allocation has already occurred.
Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater
than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the
allocation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-9-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -959,6 +959,10 @@ nfsd4_decode_create(struct nfsd4_compoun
case NF4LNK:
if (xdr_stream_decode_u32(argp->xdr, &create->cr_datalen) < 0)
return nfserr_bad_xdr;
+ if (create->cr_datalen == 0)
+ return nfserr_inval;
+ if (create->cr_datalen > NFS4_MAXPATHLEN)
+ return nfserr_nametoolong;
p = xdr_inline_decode(argp->xdr, create->cr_datalen);
if (!p)
return nfserr_bad_xdr;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 159/713] nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 158/713] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 160/713] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
` (564 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit a99d720ed2a5258564e5e9d5f39f3184a030d354 upstream.
struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
"struct sockaddr" (16 bytes). When an IPv6 NFS client is connected,
nfsd_genl_rpc_status_compose_msg() casts these fields to
"struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24,
which extends 8 bytes past the end of the 16-byte sockaddr field into
the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8
bytes of truncated IPv6 address followed by 8 bytes of rq_flags to
userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes.
This is reachable by any unprivileged process in the network namespace
because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without
GENL_ADMIN_PERM.
Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the
IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage)
bytes in the memcpy calls so the full address is captured, and
zero-initializing the genl_rqstp stack variable to prevent leaking
uninitialized tail bytes through netlink.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-5-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1418,8 +1418,8 @@ static int create_proc_exports_entry(voi
unsigned int nfsd_net_id;
struct nfsd_genl_rqstp {
- struct sockaddr rq_daddr;
- struct sockaddr rq_saddr;
+ struct sockaddr_storage rq_daddr;
+ struct sockaddr_storage rq_saddr;
unsigned long rq_flags;
ktime_t rq_stime;
__be32 rq_xid;
@@ -1454,7 +1454,7 @@ static int nfsd_genl_rpc_status_compose_
NFSD_A_RPC_STATUS_PAD))
return -ENOBUFS;
- switch (genl_rqstp->rq_saddr.sa_family) {
+ switch (genl_rqstp->rq_saddr.ss_family) {
case AF_INET: {
const struct sockaddr_in *s_in, *d_in;
@@ -1531,7 +1531,7 @@ int nfsd_nl_rpc_status_get_dumpit(struct
list_for_each_entry_rcu(rqstp,
&nn->nfsd_serv->sv_pools[i].sp_all_threads,
rq_all) {
- struct nfsd_genl_rqstp genl_rqstp;
+ struct nfsd_genl_rqstp genl_rqstp = {};
unsigned int status_counter;
if (rqstp_index++ < cb->args[1]) /* already consumed */
@@ -1555,9 +1555,9 @@ int nfsd_nl_rpc_status_get_dumpit(struct
genl_rqstp.rq_stime = rqstp->rq_stime;
genl_rqstp.rq_opcnt = 0;
memcpy(&genl_rqstp.rq_daddr, svc_daddr(rqstp),
- sizeof(struct sockaddr));
+ sizeof(struct sockaddr_storage));
memcpy(&genl_rqstp.rq_saddr, svc_addr(rqstp),
- sizeof(struct sockaddr));
+ sizeof(struct sockaddr_storage));
#ifdef CONFIG_NFSD_V4
if (rqstp->rq_vers == NFS4_VERSION &&
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 160/713] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 159/713] nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 161/713] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
` (563 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc upstream.
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This causes nfsd_setattr() to skip
fh_want_write(), so notify_change() runs without a mount write
reference.
Add the missing fh_want_write() call after the early fh_verify().
Fixes: cc265089ce1b ("nfsd: Disable NFSv2 timestamp workaround for NFSv3+")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-11-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsproc.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -82,6 +82,7 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
.na_iattr = iap,
};
struct svc_fh *fhp;
+ int hosterr;
dprintk("nfsd: SETATTR %s, valid=%x, size=%ld\n",
SVCFH_fmt(&argp->fh),
@@ -117,6 +118,12 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
if (resp->status != nfs_ok)
goto out;
+ hosterr = fh_want_write(fhp);
+ if (hosterr) {
+ resp->status = nfserrno(hosterr);
+ goto out;
+ }
+
if (delta < 0)
delta = -delta;
if (delta < MAX_TOUCH_TIME_ERROR &&
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 161/713] nfsd: add filehandle match check to nfsd4_delegreturn()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 160/713] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 162/713] nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Greg Kroah-Hartman
` (562 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 04cce9d79f2b1a114f7128e08bf60a473e10f1ec upstream.
nfsd4_delegreturn() is the only stateful NFSv4 operation that does
not call nfs4_check_fh() to verify the delegation's file matches
cstate->current_fh. A client can DELEGRETURN with a mismatched
filehandle, destroying the correct delegation but waking the wrong
inode's waiters.
Add the missing nfs4_check_fh() call after the generation check.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-6-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -8043,6 +8043,10 @@ nfsd4_delegreturn(struct svc_rqst *rqstp
if (status)
goto put_stateid;
+ status = nfs4_check_fh(&cstate->current_fh, &dp->dl_stid);
+ if (status)
+ goto put_stateid;
+
trace_nfsd_deleg_return(stateid);
destroy_delegation(dp);
smp_mb__after_atomic();
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 162/713] nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 161/713] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 163/713] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
` (561 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit a71f161a857117e8e0264deb7d14fff5c98adcf5 upstream.
The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()
is missing a read memory barrier (smp_rmb) before its second counter
check. The standard kernel read_seqcount_retry() includes smp_rmb()
to ensure that all data reads complete before the counter is re-checked.
Without this barrier, on weakly-ordered architectures (ARM, POWER),
the CPU may reorder field reads past the second counter check, making
the retry logic ineffective: it could observe a consistent counter pair
while reading fields that have been concurrently modified by the writer.
Add smp_rmb() before the second counter check to order the field reads
ahead of it, matching the barrier semantics of the standard seqcount
read-side. The begin-side smp_load_acquire() already pairs with the
smp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering
the field reads, the retry check no longer needs acquire semantics and
reads the counter with a plain READ_ONCE(), as read_seqcount_retry()
does.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: Use READ_ONCE instead of smp_load_acquire() ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-2-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1576,11 +1576,14 @@ int nfsd_nl_rpc_status_get_dumpit(struct
#endif /* CONFIG_NFSD_V4 */
/*
- * Acquire rq_status_counter before reporting the rqst
- * fields to the user.
+ * Read-side load-load fence: order the field reads
+ * above before the counter re-read below, mirroring
+ * the smp_rmb() in the standard seqcount retry. The
+ * begin-side smp_load_acquire() above pairs with the
+ * smp_store_release() in nfsd_dispatch().
*/
- if (smp_load_acquire(&rqstp->rq_status_counter) !=
- status_counter)
+ smp_rmb();
+ if (READ_ONCE(rqstp->rq_status_counter) != status_counter)
continue;
ret = nfsd_genl_rpc_status_compose_msg(skb, cb,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 163/713] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 162/713] nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 164/713] nfsd: cap decoded POSIX ACL count to bound sort cost Greg Kroah-Hartman
` (560 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit c59738a00aa51b16adc1b5ceb7c80877168efb4d upstream.
When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export both NULL if fh_verify() returns
nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag
is set, but the compound dispatch loop only uses this flag to bypass
the nfserr_nofilehandle check -- it does not prevent subsequent ops
from running with a NULL fh_dentry.
A remote client can exploit this by crafting a COMPOUND that includes
an inter-SSC COPY (which causes check_if_stalefh_allowed() to set
no_verify=true on the saved PUTFH) with an additional op inserted
between the source PUTFH and SAVEFH. For example, SETATTR calls
fh_want_write() which dereferences fh_export->ex_path.mnt without
calling fh_verify() first, causing a NULL pointer dereference in the
nfsd kthread.
Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set
and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)
and ops with ALLOWED_WITHOUT_FH (which don't need a resolved
filehandle) may proceed. All other ops receive nfserr_stale, per
RFC 7862 Section 15.2.3 which specifies that foreign filehandle
validation is deferred to the consuming operation and NFS4ERR_STALE
returned at that point.
Fixes: b9e8638e3d9e ("NFSD: allow inter server COPY to have a STALE source server fh")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-putfh_foreign_fh_null_deref_consumers-v1-1-1b8a5aa28c59@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -3121,9 +3121,22 @@ nfsd4_proc_compound(struct svc_rqst *rqs
op->status = nfsd4_open_omfg(rqstp, cstate, op);
goto encode_op;
}
- if (!current_fh->fh_dentry &&
- !HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
- if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ if (!current_fh->fh_dentry) {
+ if (HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
+ /*
+ * FOREIGN fh from inter-SSC PUTFH: only
+ * SAVEFH may proceed with a NULL fh_dentry.
+ * Per RFC 7862 S15.2.3, validation of a
+ * foreign fh is deferred to the operation
+ * that consumes it, and NFS4ERR_STALE is
+ * returned at that point.
+ */
+ if (op->opnum != OP_SAVEFH &&
+ !(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ op->status = nfserr_stale;
+ goto encode_op;
+ }
+ } else if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
op->status = nfserr_nofilehandle;
goto encode_op;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 164/713] nfsd: cap decoded POSIX ACL count to bound sort cost
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 163/713] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 165/713] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
` (559 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 4bc1108e876153a2dd6d874052b99182c3603135 upstream.
nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range(). The latter is
an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in
the server's compound processing path.
nfsd4_decode_posixacl()
xdr_stream_decode_u32(&count) /* uncapped u32 */
posix_acl_alloc(count, GFP_KERNEL)
sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */
The encoder side in the same file already rejects ACLs whose a_count
exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit
5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
omitted the symmetric check.
Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with
nfserr_inval, before any allocation, so the sort is bounded by
NFS_ACL_MAX_ENTRIES^2 comparisons.
While we're in here, also fix the nfserr_resource return if
posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change
it to return nfserr_jukebox as that's more appropriate for memory
allocation failures.
Fixes: 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-8-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index e17488a911f7..09068ca61b00 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -449,9 +449,18 @@ nfsd4_decode_posixacl(struct nfsd4_compoundargs *argp, struct posix_acl **acl)
if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
return nfserr_bad_xdr;
+ /*
+ * The NFSv4 POSIX ACL draft doesn't define a max number of ACE's, but
+ * the NFSACL spec does. For NFSv4, cap the number of entries to the v3
+ * limit, as we want to ensure that ACLs set via NFSv4 POSIX ACL
+ * extensions are retrievable via NFSACL.
+ */
+ if (count > NFS_ACL_MAX_ENTRIES)
+ return nfserr_inval;
+
*acl = posix_acl_alloc(count, GFP_KERNEL);
if (*acl == NULL)
- return nfserr_resource;
+ return nfserr_jukebox;
(*acl)->a_count = count;
for (ace = (*acl)->a_entries; ace < (*acl)->a_entries + count; ace++) {
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 165/713] nfsd: check client ownership when cancelling a copy-notify stateid
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 164/713] nfsd: cap decoded POSIX ACL count to bound sort cost Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 166/713] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Greg Kroah-Hartman
` (558 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf upstream.
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.
Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-5-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7504,10 +7504,20 @@ __be32 manage_cpntf_state(struct nfsd_ne
state = NULL;
goto unlock;
}
- if (!clp)
+ if (!clp) {
refcount_inc(&state->cp_stateid.cs_count);
- else
+ } else if (memcmp(&clp->cl_clientid, &state->cp_p_clid,
+ sizeof(clientid_t))) {
+ /*
+ * OFFLOAD_CANCEL: only the creating client may cancel.
+ * so_id is guessable, so without this check any client
+ * could free another's cpntf state.
+ */
+ state = NULL;
+ goto unlock;
+ } else {
_free_cpntf_state_locked(nn, state);
+ }
}
unlock:
spin_unlock(&nn->s2s_cp_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 166/713] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 165/713] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 167/713] nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Greg Kroah-Hartman
` (557 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2c7912732184773dbd371a411da87af1cc080b86 upstream.
nfsd4_create() stores the return value of nfsd4_acl_to_attr() in
status, but the switch(create->cr_type) block unconditionally
overwrites it in every branch. ACL translation errors are silently
discarded, and the CREATE proceeds without the requested ACL.
Add an early exit check after nfsd4_acl_to_attr(), matching the
pattern already used in nfsd4_setattr().
Fixes: c0cbe70742f4 ("NFSD: add posix ACLs to struct nfsd_attrs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-5-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -839,6 +839,20 @@ nfsd4_create(struct svc_rqst *rqstp, str
if (status)
goto out_aftermask;
+ /* Sanitize cr_type to avoid returning ATTRNOTSUPP. */
+ switch (create->cr_type) {
+ case NF4LNK:
+ case NF4BLK:
+ case NF4CHR:
+ case NF4SOCK:
+ case NF4FIFO:
+ case NF4DIR:
+ break;
+ default:
+ status = nfserr_badtype;
+ goto out_aftermask;
+ }
+
if (create->cr_acl) {
if (attrs.na_dpacl || attrs.na_pacl) {
status = nfserr_inval;
@@ -846,6 +860,8 @@ nfsd4_create(struct svc_rqst *rqstp, str
}
status = nfsd4_acl_to_attr(create->cr_type, create->cr_acl,
&attrs);
+ if (status != nfs_ok)
+ goto out_aftermask;
}
current->fs->umask = create->cr_umask;
switch (create->cr_type) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 167/713] nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 166/713] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 168/713] nfsd: clear opcnt on compound arg release to prevent OOB read Greg Kroah-Hartman
` (556 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96 upstream.
nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then calls nfsd4_run_cb() to queue
the recall. When the queue attempt fails the refcount bump is undone,
but the RUNNING bit is left set. The only site that clears the bit is
nfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the
workqueue and is therefore unreachable when nothing was queued.
The bit becomes a permanent latch on dp->dl_recall.cb_flags: every
subsequent break_lease() on the same delegation hits the early-return
guard in nfsd_break_one_deleg() and silently skips the recall, so the
delegation is never broken and the conflicting open or lock stalls.
Fix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside
the refcount_dec.
Fixes: 1054e8ffc5c4 ("nfsd: prevent callback tasks running concurrently")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-cb_recall_any_callback_running_stuck-v1-2-310011a028f3@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5616,8 +5616,10 @@ static void nfsd_break_one_deleg(struct
refcount_inc(&dp->dl_stid.sc_count);
queued = nfsd4_run_cb(&dp->dl_recall);
WARN_ON_ONCE(!queued);
- if (!queued)
+ if (!queued) {
refcount_dec(&dp->dl_stid.sc_count);
+ clear_bit(NFSD4_CALLBACK_RUNNING, &dp->dl_recall.cb_flags);
+ }
}
/* Called from break_lease() with flc_lock held. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 168/713] nfsd: clear opcnt on compound arg release to prevent OOB read
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 167/713] nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 169/713] nfsd: convert nfsd_net boolean flags to unsigned long flags word Greg Kroah-Hartman
` (555 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a upstream.
nfsd4_release_compoundargs() resets args->ops to the inline iops[8]
array when the dynamically-allocated ops buffer is freed, but leaves
args->opcnt at its original value (which can be up to 200 for NFSv4.1+
compounds).
If rq_status_counter is stuck at an odd value (which can happen when
nfsd_dispatch() hits an error path after setting it odd), the RPC
status dumpit handler reads min(opcnt, 16) entries from args->ops[].
Since iops only has 8 elements and is the last field in struct
nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory
and leaks it to userspace via netlink.
Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale
compound metadata is never exposed through the status interface.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-1-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6454,6 +6454,7 @@ void nfsd4_release_compoundargs(struct s
{
struct nfsd4_compoundargs *args = rqstp->rq_argp;
+ args->opcnt = 0;
if (args->ops != args->iops) {
vfree(args->ops);
args->ops = args->iops;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 169/713] nfsd: convert nfsd_net boolean flags to unsigned long flags word
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 168/713] nfsd: clear opcnt on compound arg release to prevent OOB read Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 170/713] nfsd: dedup nfs4_client_to_reclaim inserts Greg Kroah-Hartman
` (554 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 11a5fe42e1811f793e04ef885b639ea7668f439d upstream.
nfsd_net contains several boolean fields that are accessed from
concurrent contexts without serialization. In particular,
nfsd4_end_grace() guards its drain path with a plain bool:
if (nn->grace_ended)
return;
nn->grace_ended = true;
The read and the write are independent, and nothing in struct
nfsd_net serializes them. At least two contexts can reach this
code with no lock held:
laundromat path
laundry_wq kworker
nfs4_laundromat()
nfsd4_end_grace()
RECLAIM_COMPLETE path
nfsd compound kthread
nfsd4_reclaim_complete()
inc_reclaim_complete()
nfsd4_end_grace()
Both callers can observe grace_ended == false on different CPUs,
both store true, and both proceed into nfsd4_record_grace_done(),
which invokes the active client_tracking_ops->grace_done callback.
For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops
via nfsd4_recdir_purge_old, and the cld v1+ ops via
nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),
which walks every bucket of reclaim_str_hashtbl with no lock and
calls nfs4_remove_reclaim_record() (list_del + kfree) on each
entry. Two concurrent walkers corrupt the list and double-free
every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()
iterating the same bucket reads through freed memory.
A third call site exists in nfs4_state_start_net() on the
skip_grace startup path, but it runs under nfsd_mutex before any
client has connected and before the laundromat's first delayed
work fires, so it cannot race with the two callers above.
Replace the scattered boolean fields in nfsd_net with a single
unsigned long flags word and an enum nfsd_net_flag for the bit
positions. The grace_ended race is fixed by using
test_and_set_bit(), which is atomic on all architectures. The
remaining flags (grace_end_forced, in_grace, somebody_reclaimed,
track_reclaim_completes, nfsd_net_up, lockd_up) are converted to
use test_bit/set_bit/clear_bit for consistency. This avoids
sub-word cmpxchg issues on architectures like Hexagon that only
support word-sized atomic operations.
Fixes: 362063a595be ("nfsd: keep a tally of RECLAIM_COMPLETE operations when using nfsdcld")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-3-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/netns.h | 19 +++++++++++--------
fs/nfsd/nfs4proc.c | 2 +-
fs/nfsd/nfs4recover.c | 12 ++++++------
fs/nfsd/nfs4state.c | 40 ++++++++++++++++++++++++----------------
fs/nfsd/nfsctl.c | 2 +-
fs/nfsd/nfssvc.c | 22 +++++++++++-----------
6 files changed, 54 insertions(+), 43 deletions(-)
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -28,6 +28,16 @@ struct cld_net;
struct nfsd_net_cb;
struct nfsd4_client_tracking_ops;
+enum nfsd_net_flag {
+ NFSD_NET_GRACE_ENDED,
+ NFSD_NET_GRACE_END_FORCED,
+ NFSD_NET_IN_GRACE,
+ NFSD_NET_SOMEBODY_RECLAIMED,
+ NFSD_NET_TRACK_RECLAIM_COMPLETES,
+ NFSD_NET_UP,
+ NFSD_NET_LOCKD_UP,
+};
+
enum {
/* cache misses due only to checksum comparison failures */
NFSD_STATS_PAYLOAD_MISSES,
@@ -66,8 +76,7 @@ struct nfsd_net {
struct cache_detail *nametoid_cache;
struct lock_manager nfsd4_manager;
- bool grace_ended;
- bool grace_end_forced;
+ unsigned long flags;
time64_t boot_time;
struct dentry *nfsd_client_dir;
@@ -117,19 +126,13 @@ struct nfsd_net {
spinlock_t blocked_locks_lock;
struct file *rec_file;
- bool in_grace;
const struct nfsd4_client_tracking_ops *client_tracking_ops;
time64_t nfsd4_lease;
time64_t nfsd4_grace;
- bool somebody_reclaimed;
- bool track_reclaim_completes;
atomic_t nr_reclaim_complete;
- bool nfsd_net_up;
- bool lockd_up;
-
seqlock_t writeverf_lock;
unsigned char writeverf[8];
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -663,7 +663,7 @@ nfsd4_open(struct svc_rqst *rqstp, struc
pr_warn("nfsd4_process_open2 failed to open newly-created file: status=%u\n",
be32_to_cpu(status));
if (reclaim && !status)
- nn->somebody_reclaimed = true;
+ set_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
out:
if (open->op_filp) {
fput(open->op_filp);
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -167,7 +167,7 @@ out_end:
end_creating(dentry);
out:
if (status == 0) {
- if (nn->in_grace)
+ if (test_bit(NFSD_NET_IN_GRACE, &nn->flags))
__nfsd4_create_reclaim_record_grace(clp, dname, nn);
vfs_fsync(nn->rec_file, 0);
} else {
@@ -317,7 +317,7 @@ nfsd4_remove_clid_dir(struct nfs4_client
nfs4_reset_creds(original_cred);
if (status == 0) {
vfs_fsync(nn->rec_file, 0);
- if (nn->in_grace)
+ if (test_bit(NFSD_NET_IN_GRACE, &nn->flags))
__nfsd4_remove_reclaim_record_grace(dname,
HEXDIR_LEN, nn);
}
@@ -373,7 +373,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *
{
int status;
- nn->in_grace = false;
+ clear_bit(NFSD_NET_IN_GRACE, &nn->flags);
if (!nn->rec_file)
return;
status = mnt_want_write_file(nn->rec_file);
@@ -455,7 +455,7 @@ nfsd4_init_recdir(struct net *net)
nfs4_reset_creds(original_cred);
if (!status)
- nn->in_grace = true;
+ set_bit(NFSD_NET_IN_GRACE, &nn->flags);
return status;
}
@@ -1362,7 +1362,7 @@ nfs4_cld_state_init(struct net *net)
for (i = 0; i < CLIENT_HASH_SIZE; i++)
INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
nn->reclaim_str_hashtbl_size = 0;
- nn->track_reclaim_completes = true;
+ set_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags);
atomic_set(&nn->nr_reclaim_complete, 0);
return 0;
@@ -1373,7 +1373,7 @@ nfs4_cld_state_shutdown(struct net *net)
{
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- nn->track_reclaim_completes = false;
+ clear_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags);
kfree(nn->reclaim_str_hashtbl);
}
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2675,7 +2675,7 @@ static void inc_reclaim_complete(struct
{
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
- if (!nn->track_reclaim_completes)
+ if (!test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags))
return;
if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
return;
@@ -5018,8 +5018,6 @@ nfsd4_init_leases_net(struct nfsd_net *n
nn->nfsd4_lease = 90; /* default lease time */
nn->nfsd4_grace = 90;
- nn->somebody_reclaimed = false;
- nn->track_reclaim_completes = false;
nn->clverifier_counter = get_random_u32();
nn->clientid_base = get_random_u32();
nn->clientid_counter = nn->clientid_base + 1;
@@ -6731,12 +6729,21 @@ nfsd4_renew(struct svc_rqst *rqstp, stru
static void
nfsd4_end_grace(struct nfsd_net *nn)
{
- /* do nothing if grace period already ended */
- if (nn->grace_ended)
+ /*
+ * nfsd4_end_grace() can be entered concurrently from the
+ * laundromat workqueue and from an nfsd compound thread
+ * handling RECLAIM_COMPLETE. Without serialization, both
+ * callers can observe NFSD_NET_GRACE_ENDED clear and proceed
+ * into nfsd4_record_grace_done(). For tracking ops whose
+ * grace_done drains reclaim_str_hashtbl, that results in
+ * list corruption and a double free of every
+ * nfs4_client_reclaim entry. Use an atomic test-and-set so
+ * exactly one caller proceeds.
+ */
+ if (test_and_set_bit(NFSD_NET_GRACE_ENDED, &nn->flags))
return;
trace_nfsd_grace_complete(nn);
- nn->grace_ended = true;
/*
* If the server goes down again right now, an NFSv4
* client will still be allowed to reclaim after it comes back up,
@@ -6777,10 +6784,10 @@ bool nfsd4_force_end_grace(struct nfsd_n
{
if (!nn->client_tracking_ops)
return false;
- if (READ_ONCE(nn->grace_ended))
+ if (test_bit(NFSD_NET_GRACE_ENDED, &nn->flags))
return false;
/* laundromat_work must be initialised now, though it might be disabled */
- WRITE_ONCE(nn->grace_end_forced, true);
+ set_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags);
/* mod_delayed_work() doesn't queue work after
* nfs4_state_shutdown_net() has called disable_delayed_work_sync()
*/
@@ -6797,15 +6804,15 @@ static bool clients_still_reclaiming(str
time64_t double_grace_period_end = nn->boot_time +
2 * nn->nfsd4_lease;
- if (READ_ONCE(nn->grace_end_forced))
+ if (test_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags))
return false;
- if (nn->track_reclaim_completes &&
+ if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags) &&
atomic_read(&nn->nr_reclaim_complete) ==
nn->reclaim_str_hashtbl_size)
return false;
- if (!nn->somebody_reclaimed)
+ if (!test_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
return false;
- nn->somebody_reclaimed = false;
+ clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
/*
* If we've given them *two* lease times to reclaim, and they're
* still not done, give up:
@@ -8610,7 +8617,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
nfs4_inc_and_copy_stateid(&lock->lk_resp_stateid, &lock_stp->st_stid);
status = 0;
if (lock->lk_reclaim)
- nn->somebody_reclaimed = true;
+ set_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
break;
case FILE_LOCK_DEFERRED:
kref_put(&nbl->nbl_kref, free_nbl);
@@ -9136,8 +9143,8 @@ static int nfs4_state_create_net(struct
nn->conf_name_tree = RB_ROOT;
nn->unconf_name_tree = RB_ROOT;
nn->boot_time = ktime_get_real_seconds();
- nn->grace_ended = false;
- nn->grace_end_forced = false;
+ clear_bit(NFSD_NET_GRACE_ENDED, &nn->flags);
+ clear_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags);
nn->nfsd4_manager.block_opens = true;
INIT_LIST_HEAD(&nn->nfsd4_manager.list);
INIT_LIST_HEAD(&nn->client_lru);
@@ -9223,7 +9230,8 @@ nfs4_state_start_net(struct net *net)
nfsd4_client_tracking_init(net);
/* safe for laundromat to run now */
enable_delayed_work(&nn->laundromat_work);
- if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
+ if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags) &&
+ nn->reclaim_str_hashtbl_size == 0)
goto skip_grace;
printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
nn->nfsd4_grace, net->ns.inum);
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1115,7 +1115,7 @@ static ssize_t write_v4_end_grace(struct
}
return scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%c\n",
- nn->grace_ended ? 'Y' : 'N');
+ test_bit(NFSD_NET_GRACE_ENDED, &nn->flags) ? 'Y' : 'N');
}
#endif
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -351,7 +351,7 @@ static int nfsd_startup_net(struct net *
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
int ret;
- if (nn->nfsd_net_up)
+ if (test_bit(NFSD_NET_UP, &nn->flags))
return 0;
ret = nfsd_startup_generic();
@@ -364,11 +364,11 @@ static int nfsd_startup_net(struct net *
goto out_socks;
}
- if (nfsd_needs_lockd(nn) && !nn->lockd_up) {
+ if (nfsd_needs_lockd(nn) && !test_bit(NFSD_NET_LOCKD_UP, &nn->flags)) {
ret = lockd_up(net, cred);
if (ret)
goto out_socks;
- nn->lockd_up = true;
+ set_bit(NFSD_NET_LOCKD_UP, &nn->flags);
}
ret = nfsd_file_cache_start_net(net);
@@ -386,7 +386,7 @@ static int nfsd_startup_net(struct net *
if (ret)
goto out_reply_cache;
- nn->nfsd_net_up = true;
+ set_bit(NFSD_NET_UP, &nn->flags);
return 0;
out_reply_cache:
@@ -394,9 +394,9 @@ out_reply_cache:
out_filecache:
nfsd_file_cache_shutdown_net(net);
out_lockd:
- if (nn->lockd_up) {
+ if (test_bit(NFSD_NET_LOCKD_UP, &nn->flags)) {
lockd_down(net);
- nn->lockd_up = false;
+ clear_bit(NFSD_NET_LOCKD_UP, &nn->flags);
}
out_socks:
nfsd_shutdown_generic();
@@ -407,7 +407,7 @@ static void nfsd_shutdown_net(struct net
{
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- if (nn->nfsd_net_up) {
+ if (test_bit(NFSD_NET_UP, &nn->flags)) {
percpu_ref_kill_and_confirm(&nn->nfsd_net_ref, nfsd_net_done);
wait_for_completion(&nn->nfsd_net_confirm_done);
@@ -415,18 +415,18 @@ static void nfsd_shutdown_net(struct net
nfs4_state_shutdown_net(net);
nfsd_reply_cache_shutdown(nn);
nfsd_file_cache_shutdown_net(net);
- if (nn->lockd_up) {
+ if (test_bit(NFSD_NET_LOCKD_UP, &nn->flags)) {
lockd_down(net);
- nn->lockd_up = false;
+ clear_bit(NFSD_NET_LOCKD_UP, &nn->flags);
}
wait_for_completion(&nn->nfsd_net_free_done);
}
percpu_ref_exit(&nn->nfsd_net_ref);
- if (nn->nfsd_net_up)
+ if (test_bit(NFSD_NET_UP, &nn->flags))
nfsd_shutdown_generic();
- nn->nfsd_net_up = false;
+ clear_bit(NFSD_NET_UP, &nn->flags);
}
static DEFINE_SPINLOCK(nfsd_notifier_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 170/713] nfsd: dedup nfs4_client_to_reclaim inserts
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 169/713] nfsd: convert nfsd_net boolean flags to unsigned long flags word Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 171/713] nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Greg Kroah-Hartman
` (553 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9b57793863f69c608691c98e57c2f9be2db9dfed upstream.
nfs4_client_to_reclaim() unconditionally allocates a new
nfs4_client_reclaim, prepends it to reclaim_str_hashtbl[], and bumps
reclaim_str_hashtbl_size with no check for an existing entry for the
same client name. After a reboot with a populated recovery directory
that inflates the counter by one for every client that reclaims:
boot: load_recdir()
nfs4_client_to_reclaim(name) /* entry #1, size++ */
grace: RECLAIM_COMPLETE
__nfsd4_create_reclaim_record_grace()
nfs4_client_to_reclaim(name) /* entry #2, size++ */
inc_reclaim_complete() ends the grace period early only when
atomic_inc_return(&nn->nr_reclaim_complete) ==
nn->reclaim_str_hashtbl_size
With reclaim_str_hashtbl_size at 2N and nr_reclaim_complete capped at
N, the equality never holds and the fast end-of-grace path is dead.
The grace period always runs out the full 90-second laundromat timer,
and the shadow entry left in the hash table carries a dangling cr_clp
for any reader that walks it.
Fix nfs4_client_to_reclaim() to look the name up with
nfsd4_find_reclaim_client() first and, on a hit, fold the new
princhash into the existing record (if it lacks one) and return that
record without allocating or touching reclaim_str_hashtbl_size. On
kmemdup() failure during the fold-in, return NULL so
__cld_pipe_inprogress_downcall() surfaces -EFAULT to nfsdcld, matching
the miss-path contract.
Add an rw_semaphore (reclaim_str_hashtbl_lock) to struct nfsd_net that
serialises all access to reclaim_str_hashtbl[] and
reclaim_str_hashtbl_size. Writers (nfs4_client_to_reclaim,
nfs4_remove_reclaim_record callers) hold the write side; readers
(nfsd4_cld_check*, inc_reclaim_complete, clients_still_reclaiming,
nfs4_has_reclaimed_state, nfsd4_check_legacy_client) hold the read
side. All call sites are in sleepable context, and none is a hot
path, so the rwsem cost is negligible.
Reported-by: Chris Mason <clm@meta.com>
Fixes: 362063a595be ("nfsd: keep a tally of RECLAIM_COMPLETE operations when using nfsdcld")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-4-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/netns.h | 6 ++++
fs/nfsd/nfs4recover.c | 36 +++++++++++++++++++++++------
fs/nfsd/nfs4state.c | 61 +++++++++++++++++++++++++++++++++++++++++++++-----
3 files changed, 89 insertions(+), 14 deletions(-)
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -93,6 +93,7 @@ struct nfsd_net {
*/
struct list_head *reclaim_str_hashtbl;
int reclaim_str_hashtbl_size;
+ struct rw_semaphore reclaim_str_hashtbl_lock;
struct list_head *conf_id_hashtbl;
struct rb_root conf_name_tree;
struct list_head *unconf_id_hashtbl;
@@ -105,7 +106,10 @@ struct nfsd_net {
* close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
* for last close replay.
*
- * All of the above fields are protected by the client_mutex.
+ * reclaim_str_hashtbl[], reclaim_str_hashtbl_size are protected by
+ * reclaim_str_hashtbl_lock.
+ *
+ * All of the remaining fields are protected by the client_lock.
*/
struct list_head client_lru;
struct list_head close_lru;
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -285,10 +285,12 @@ __nfsd4_remove_reclaim_record_grace(cons
return;
}
name.len = len;
+ down_write(&nn->reclaim_str_hashtbl_lock);
crp = nfsd4_find_reclaim_client(name, nn);
- kfree(name.data);
if (crp)
nfs4_remove_reclaim_record(crp, nn);
+ up_write(&nn->reclaim_str_hashtbl_lock);
+ kfree(name.data);
}
static void
@@ -484,6 +486,7 @@ nfs4_legacy_state_init(struct net *net)
for (i = 0; i < CLIENT_HASH_SIZE; i++)
INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
nn->reclaim_str_hashtbl_size = 0;
+ init_rwsem(&nn->reclaim_str_hashtbl_lock);
return 0;
}
@@ -598,13 +601,16 @@ nfsd4_check_legacy_client(struct nfs4_cl
goto out_enoent;
}
name.len = HEXDIR_LEN;
+ down_read(&nn->reclaim_str_hashtbl_lock);
crp = nfsd4_find_reclaim_client(name, nn);
- kfree(name.data);
if (crp) {
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
crp->cr_clp = clp;
- return 0;
}
+ up_read(&nn->reclaim_str_hashtbl_lock);
+ kfree(name.data);
+ if (crp)
+ return 0;
out_enoent:
return -ENOENT;
@@ -1176,6 +1182,7 @@ nfsd4_cld_check(struct nfs4_client *clp)
return 0;
/* look for it in the reclaim hashtable otherwise */
+ down_read(&nn->reclaim_str_hashtbl_lock);
crp = nfsd4_find_reclaim_client(clp->cl_name, nn);
if (crp)
goto found;
@@ -1191,6 +1198,7 @@ nfsd4_cld_check(struct nfs4_client *clp)
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
}
name.len = HEXDIR_LEN;
@@ -1201,9 +1209,11 @@ nfsd4_cld_check(struct nfs4_client *clp)
}
#endif
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
found:
crp->cr_clp = clp;
+ up_read(&nn->reclaim_str_hashtbl_lock);
return 0;
}
@@ -1215,6 +1225,7 @@ nfsd4_cld_check_v2(struct nfs4_client *c
struct cld_net *cn = nn->cld_net;
#endif
struct nfs4_client_reclaim *crp;
+ unsigned int princhashlen;
char *principal = NULL;
/* did we already find that this client is stable? */
@@ -1222,6 +1233,7 @@ nfsd4_cld_check_v2(struct nfs4_client *c
return 0;
/* look for it in the reclaim hashtable otherwise */
+ down_read(&nn->reclaim_str_hashtbl_lock);
crp = nfsd4_find_reclaim_client(clp->cl_name, nn);
if (crp)
goto found;
@@ -1237,6 +1249,7 @@ nfsd4_cld_check_v2(struct nfs4_client *c
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data\n",
__func__);
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
}
name.len = HEXDIR_LEN;
@@ -1247,23 +1260,31 @@ nfsd4_cld_check_v2(struct nfs4_client *c
}
#endif
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
found:
- if (crp->cr_princhash.len) {
+ princhashlen = crp->cr_princhash.len;
+ if (princhashlen) {
u8 digest[SHA256_DIGEST_SIZE];
+ u8 *pdata;
if (clp->cl_cred.cr_raw_principal)
principal = clp->cl_cred.cr_raw_principal;
else if (clp->cl_cred.cr_principal)
principal = clp->cl_cred.cr_principal;
- if (principal == NULL)
+ if (principal == NULL) {
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
+ }
sha256(principal, strlen(principal), digest);
- if (memcmp(crp->cr_princhash.data, digest,
- crp->cr_princhash.len))
+ pdata = crp->cr_princhash.data;
+ if (memcmp(pdata, digest, princhashlen)) {
+ up_read(&nn->reclaim_str_hashtbl_lock);
return -ENOENT;
+ }
}
crp->cr_clp = clp;
+ up_read(&nn->reclaim_str_hashtbl_lock);
return 0;
}
@@ -1362,6 +1383,7 @@ nfs4_cld_state_init(struct net *net)
for (i = 0; i < CLIENT_HASH_SIZE; i++)
INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
nn->reclaim_str_hashtbl_size = 0;
+ init_rwsem(&nn->reclaim_str_hashtbl_lock);
set_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags);
atomic_set(&nn->nr_reclaim_complete, 0);
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2677,14 +2677,21 @@ static void inc_reclaim_complete(struct
if (!test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags))
return;
- if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
+
+ down_read(&nn->reclaim_str_hashtbl_lock);
+ if (!nfsd4_find_reclaim_client(clp->cl_name, nn)) {
+ up_read(&nn->reclaim_str_hashtbl_lock);
return;
+ }
if (atomic_inc_return(&nn->nr_reclaim_complete) ==
nn->reclaim_str_hashtbl_size) {
+ up_read(&nn->reclaim_str_hashtbl_lock);
printk(KERN_INFO "NFSD: all clients done reclaiming, ending NFSv4 grace period (net %x)\n",
clp->net->ns.inum);
nfsd4_end_grace(nn);
+ return;
}
+ up_read(&nn->reclaim_str_hashtbl_lock);
}
static void expire_client(struct nfs4_client *clp)
@@ -6806,10 +6813,15 @@ static bool clients_still_reclaiming(str
if (test_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags))
return false;
- if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags) &&
- atomic_read(&nn->nr_reclaim_complete) ==
- nn->reclaim_str_hashtbl_size)
- return false;
+ if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags)) {
+ int size;
+
+ down_read(&nn->reclaim_str_hashtbl_lock);
+ size = nn->reclaim_str_hashtbl_size;
+ up_read(&nn->reclaim_str_hashtbl_lock);
+ if (atomic_read(&nn->nr_reclaim_complete) == size)
+ return false;
+ }
if (!test_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
return false;
clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
@@ -8993,9 +9005,13 @@ bool
nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
{
struct nfs4_client_reclaim *crp;
+ bool found;
+ down_read(&nn->reclaim_str_hashtbl_lock);
crp = nfsd4_find_reclaim_client(name, nn);
- return (crp && crp->cr_clp);
+ found = (crp && crp->cr_clp);
+ up_read(&nn->reclaim_str_hashtbl_lock);
+ return found;
}
/*
@@ -9008,10 +9024,39 @@ nfs4_client_to_reclaim(struct xdr_netobj
unsigned int strhashval;
struct nfs4_client_reclaim *crp;
+ down_write(&nn->reclaim_str_hashtbl_lock);
+
+ /*
+ * A reclaim record for this client name may already exist (for
+ * example, populated at boot from the recovery directory before
+ * an in-grace RECLAIM_COMPLETE or an nfsdcld downcall delivers
+ * the same name). Dedup here so reclaim_str_hashtbl_size stays
+ * equal to the number of distinct client names; inc_reclaim_complete
+ * relies on that equality to end the grace period via the fast path.
+ */
+ crp = nfsd4_find_reclaim_client(name, nn);
+ if (crp) {
+ if (princhash.len && crp->cr_princhash.len == 0) {
+ void *pdata = kmemdup(princhash.data, princhash.len,
+ GFP_KERNEL);
+ if (pdata) {
+ crp->cr_princhash.data = pdata;
+ crp->cr_princhash.len = princhash.len;
+ } else {
+ dprintk("%s: failed to allocate memory for princhash.data!\n",
+ __func__);
+ crp = NULL;
+ }
+ }
+ up_write(&nn->reclaim_str_hashtbl_lock);
+ return crp;
+ }
+
name.data = kmemdup(name.data, name.len, GFP_KERNEL);
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
+ up_write(&nn->reclaim_str_hashtbl_lock);
return NULL;
}
if (princhash.len) {
@@ -9020,6 +9065,7 @@ nfs4_client_to_reclaim(struct xdr_netobj
dprintk("%s: failed to allocate memory for princhash.data!\n",
__func__);
kfree(name.data);
+ up_write(&nn->reclaim_str_hashtbl_lock);
return NULL;
}
} else
@@ -9039,6 +9085,7 @@ nfs4_client_to_reclaim(struct xdr_netobj
kfree(name.data);
kfree(princhash.data);
}
+ up_write(&nn->reclaim_str_hashtbl_lock);
return crp;
}
@@ -9058,6 +9105,7 @@ nfs4_release_reclaim(struct nfsd_net *nn
struct nfs4_client_reclaim *crp = NULL;
int i;
+ down_write(&nn->reclaim_str_hashtbl_lock);
for (i = 0; i < CLIENT_HASH_SIZE; i++) {
while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
crp = list_entry(nn->reclaim_str_hashtbl[i].next,
@@ -9066,6 +9114,7 @@ nfs4_release_reclaim(struct nfsd_net *nn
}
}
WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
+ up_write(&nn->reclaim_str_hashtbl_lock);
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 171/713] nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 170/713] nfsd: dedup nfs4_client_to_reclaim inserts Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 172/713] nfsd: defer vfree of compound ops to fix rpc_status UAF Greg Kroah-Hartman
` (552 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 108969960dc54de673869814c5f37c22f6cf404a upstream.
deleg_reaper() sets NFSD4_CALLBACK_RUNNING before checking the
5-second rate limit and cl_cb_state gates. When either gate fires
the loop continues without queuing callback work, so the bit's only
clear site in nfsd41_destroy_cb() is never reached and RECALL_ANY
dispatch is permanently disabled for the affected client.
Move the test_and_set_bit() below both non-queueing gates so the
bit is taken only when nfsd4_run_cb() will be called.
Fixes: 424dd3df1f99 ("nfsd: eliminate cl_ra_cblist and NFSD4_CLIENT_CB_RECALL_ANY")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-cb_recall_any_callback_running_stuck-v1-1-310011a028f3@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7223,12 +7223,12 @@ deleg_reaper(struct nfsd_net *nn)
continue;
if (atomic_read(&clp->cl_delegs_in_recall))
continue;
- if (test_and_set_bit(NFSD4_CALLBACK_RUNNING, &clp->cl_ra->ra_cb.cb_flags))
- continue;
if (ktime_get_boottime_seconds() - clp->cl_ra_time < 5)
continue;
if (clp->cl_cb_state != NFSD4_CB_UP)
continue;
+ if (test_and_set_bit(NFSD4_CALLBACK_RUNNING, &clp->cl_ra->ra_cb.cb_flags))
+ continue;
/* release in nfsd4_cb_recall_any_release */
kref_get(&clp->cl_nfsdfs.cl_ref);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 172/713] nfsd: defer vfree of compound ops to fix rpc_status UAF
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 171/713] nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 173/713] nfsd: dont free session slots that are still in use Greg Kroah-Hartman
` (551 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit fca26a3fc19ed02278aa2a150af82d43db0302cb upstream.
The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums out of
args->ops[]. But args->ops is a separate vmalloc buffer freed
synchronously by vfree() in nfsd4_release_compoundargs() at the end
of every compound. The dumpit's rcu_read_lock pins the svc_rqst
struct itself (freed via kfree_rcu), but nothing defers the vfree
of the ops buffer across the RCU grace period. A concurrent compound
completion can therefore free the buffer while the dumpit is reading
it — a use-after-free on vmalloc memory.
The trailing seqcount recheck (smp_load_acquire of rq_status_counter)
cannot undo a load that already retired against freed memory.
Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which
defers the free until after an RCU grace period. This makes the
existing rcu_read_lock in the dumpit sufficient to protect the read.
The tradeoff is that completed compound ops buffers (up to
200 * sizeof(struct nfsd4_op)) persist in memory slightly longer,
across one grace period, before being reclaimed.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-1-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6456,8 +6456,10 @@ void nfsd4_release_compoundargs(struct s
args->opcnt = 0;
if (args->ops != args->iops) {
- vfree(args->ops);
+ void *old_ops = args->ops;
+
args->ops = args->iops;
+ kvfree_rcu_mightsleep(old_ops);
}
while (args->to_free) {
struct svcxdr_tmpbuf *tb = args->to_free;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 173/713] nfsd: dont free session slots that are still in use
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 172/713] nfsd: defer vfree of compound ops to fix rpc_status UAF Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 174/713] nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Greg Kroah-Hartman
` (550 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f5d22e372f4ac3eb287037a488c29691d52a6330 upstream.
nfsd4_sequence() can free the very slot it is currently processing.
When the session shrinker has reduced se_target_maxslots below
se_fchannel.maxreqs, the shrink path checks three conditions before
calling free_session_slots():
1. se_target_maxslots < maxreqs (shrink was advertised)
2. slot->sl_generation == se_slot_gen (slot is up-to-date)
3. seq->maxslots <= se_target_maxslots (client acknowledges)
However, seq->slotid is never checked against se_target_maxslots.
A client using a slot in the range [se_target_maxslots, maxreqs) can
satisfy all three conditions: its slot has the current generation
(set by a prior SEQUENCE), and it sends sa_highest_slotid <=
se_target_maxslots to acknowledge the reduction.
free_session_slots() then kfrees every slot at index >=
se_target_maxslots, including the caller's own slot. The function
continues to write sl_seqid, sl_flags, sl_generation, and stores the
dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry()
copies up to maxresp_cached bytes of the compound reply into the freed
sl_data[] array, corrupting whatever slab object now occupies that
address.
Additionally, a concurrent thread processing SEQUENCE on a different
high-numbered slot can have its slot freed out from under it.
NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is
released, so any concurrent thread past SEQUENCE will have its slot
marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE
before freeing.
Fix both problems by:
1. Checking that the current request's slotid is below the shrink
boundary.
2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and
deferring the shrink if any are active.
Fixes: fc8738c68d0b ("nfsd: add support for freeing unused session-DRC slots")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-nfsd4_sequence_shrink_uaf_on_loaded_slot-v2-1-74a89db0639e@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4503,6 +4503,19 @@ static void nfsd4_construct_sequence_res
seq->status_flags |= SEQ4_STATUS_ADMIN_STATE_REVOKED;
}
+static bool nfsd4_slots_inuse(struct nfsd4_session *ses, int from)
+{
+ int i;
+
+ for (i = from; i < ses->se_fchannel.maxreqs; i++) {
+ struct nfsd4_slot *slot = xa_load(&ses->se_slots, i);
+
+ if (slot->sl_flags & NFSD4_SLOT_INUSE)
+ return true;
+ }
+ return false;
+}
+
__be32
nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
union nfsd4_op_u *u)
@@ -4582,7 +4595,9 @@ nfsd4_sequence(struct svc_rqst *rqstp, s
if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
slot->sl_generation == session->se_slot_gen &&
- seq->maxslots <= session->se_target_maxslots)
+ seq->maxslots <= session->se_target_maxslots &&
+ seq->slotid < session->se_target_maxslots &&
+ !nfsd4_slots_inuse(session, session->se_target_maxslots))
/* Client acknowledged our reduce maxreqs */
free_session_slots(session, session->se_target_maxslots);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 174/713] nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 173/713] nfsd: dont free session slots that are still in use Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 175/713] nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file Greg Kroah-Hartman
` (549 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 5e4627d3513e60accfce9d5f4c7fa95251ef93d6 upstream.
In nfs4_preprocess_seqid_op() the stateid is obtained from
nfsd4_lookup_stateid(), which holds a reference on the nfs4_stid
(sc_count) but takes no reference on the stateowner. openlockstateid()
merely casts that stid and likewise takes no reference.
When nfsd4_cstate_assign_replay() returns -EAGAIN (the replay owner is
being torn down, RP_UNHASHED) it has not taken a stateowner reference on
that path. The error handling nevertheless called
nfs4_put_stateowner(stp->st_stateowner), dropping an so_count reference
the function never acquired -- risking a stateowner refcount underflow and
use-after-free -- while leaking the sc_count reference held on the stid.
The leaked stid reference can also stall a concurrent
nfsd4_close_open_stateid() waiting for sc_count to drop.
Drop the reference actually held -- the stid -- before retrying. The
stateowner stays alive through the reference held by the stid. This mirrors
the open path in nfsd4_process_open1(), where the put balances a reference
that path explicitly holds on the stateowner.
Fixes: eec762080008 ("nfsd: replace rp_mutex to avoid deadlock in move_to_close_lru()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-21-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7840,7 +7840,7 @@ retry:
return status;
stp = openlockstateid(s);
if (nfsd4_cstate_assign_replay(cstate, stp->st_stateowner) == -EAGAIN) {
- nfs4_put_stateowner(stp->st_stateowner);
+ nfs4_put_stid(&stp->st_stid);
goto retry;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 175/713] nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 174/713] nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 176/713] nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Greg Kroah-Hartman
` (548 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Chuck Lever, Jeff Layton,
Benjamin Coddington
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
commit 5859cc01fee06a2cd7458905a9593082fbab06e1 upstream.
->atomic_open is permitted to return success without actually opening
the file. It indicates this by calling finish_no_open().
This means dentry_create() can return a file which hasn't been opened.
This is extremely unlikely as ->atomic_open handlers typically
use finish_no_open() only for already existing files, and dentry_create()
isn't called in that case, and the parent being locked should prevent
races.
However out of an abundance of caution it seems wise to teach nfsd to
only use the file returned by dentry_create() if FMODE_OPENED is set,
indicating that it has in fact been opened.
Fixes: 64a989dbd144 ("VFS/knfsd: Teach dentry_create() to use atomic_open()")
Cc: stable@vger.kernel.org
Signed-off-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260526053004.4014491-3-neilb@ownmail.net
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -1236,7 +1236,7 @@ open_file:
nf->nf_mark = nfsd_file_mark_find_or_create(inode);
if (type != S_IFREG || nf->nf_mark) {
- if (file) {
+ if (file && (file->f_mode & FMODE_OPENED)) {
get_file(file);
nf->nf_file = file;
status = nfs_ok;
@@ -1383,12 +1383,12 @@ nfsd_file_acquire_local(struct net *net,
* @rqstp: the RPC transaction being executed
* @fhp: the NFS filehandle of the file just created
* @may_flags: NFSD_MAY_ settings for the file
- * @file: cached, already-open file (may be NULL)
+ * @file: cached, already-open file (may be NULL or not yet opened)
* @pnf: OUT: new or found "struct nfsd_file" object
*
* Acquire a nfsd_file object that is not GC'ed. If one doesn't already exist,
- * and @file is non-NULL, use it to instantiate a new nfsd_file instead of
- * opening a new one.
+ * and @file has FMODE_OPENED set, use it to instantiate a new nfsd_file
+ * instead of opening a new one.
*
* Return values:
* %nfs_ok - @pnf points to an nfsd_file with its reference
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 176/713] nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 175/713] nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 177/713] nfsd: fix clock domain mismatch in clients_still_reclaiming() Greg Kroah-Hartman
` (547 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit ca94ba36172046be6a694a7986f6931e47ed4d51 upstream.
nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding
fi_lock when the parent stateid is a delegation. A concurrent delegation
revoke via the laundromat can clear fi_deleg_file under fi_lock, causing
nfsd_file_get() to return NULL and triggering the BUG_ON.
This race is client-reachable: two NFS clients can trigger it by having
one hold a delegation while another opens the same file to force a
recall. When the first client doesn't respond to the recall, the
laundromat revokes it. A concurrent LAYOUTGET from any client using the
delegation stateid hits the race window.
Fix this by taking fi_lock around the fi_deleg_file read in the
SC_TYPE_DELEG path, matching the locking discipline of the
find_any_file() arm, and replacing the BUG_ON with a graceful error
return that cleans up the partially-initialized layout stateid.
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-1-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4layouts.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -247,11 +247,17 @@ nfsd4_alloc_layout_stateid(struct nfsd4_
nfsd4_init_cb(&ls->ls_recall, clp, &nfsd4_cb_layout_ops,
NFSPROC4_CLNT_CB_LAYOUT);
- if (parent->sc_type == SC_TYPE_DELEG)
+ if (parent->sc_type == SC_TYPE_DELEG) {
+ spin_lock(&fp->fi_lock);
ls->ls_file = nfsd_file_get(fp->fi_deleg_file);
- else
+ spin_unlock(&fp->fi_lock);
+ } else {
ls->ls_file = find_any_file(fp);
- BUG_ON(!ls->ls_file);
+ }
+ if (!ls->ls_file) {
+ nfs4_put_stid(stp);
+ return NULL;
+ }
ls->ls_fenced = false;
ls->ls_fence_delay = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 177/713] nfsd: fix clock domain mismatch in clients_still_reclaiming()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 176/713] nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 178/713] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
` (546 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 09ea3eb9a518565f5bca386e81b993ed8825f5e8 upstream.
clients_still_reclaiming() computes a deadline from nn->boot_time
(CLOCK_REALTIME, ~1.7 billion) but compares it against
ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot).
The comparison is always false — it would take ~54 years of uptime
for BOOTTIME to exceed the REALTIME-derived deadline.
This means any client can hold the server in grace indefinitely by
sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim
operations for all other clients.
Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time
and use it for the deadline computation. boot_time (CLOCK_REALTIME)
is preserved for its cl_boot clientid-nonce role.
Fixes: 20b7d86f29d3 ("nfsd: use boottime for lease expiry calculation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-12-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/netns.h | 1 +
fs/nfsd/nfs4state.c | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -78,6 +78,7 @@ struct nfsd_net {
struct lock_manager nfsd4_manager;
unsigned long flags;
time64_t boot_time;
+ time64_t boot_time_bt; /* same instant in CLOCK_BOOTTIME */
struct dentry *nfsd_client_dir;
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6823,7 +6823,7 @@ bool nfsd4_force_end_grace(struct nfsd_n
*/
static bool clients_still_reclaiming(struct nfsd_net *nn)
{
- time64_t double_grace_period_end = nn->boot_time +
+ time64_t double_grace_period_end = nn->boot_time_bt +
2 * nn->nfsd4_lease;
if (test_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags))
@@ -9207,6 +9207,7 @@ static int nfs4_state_create_net(struct
nn->conf_name_tree = RB_ROOT;
nn->unconf_name_tree = RB_ROOT;
nn->boot_time = ktime_get_real_seconds();
+ nn->boot_time_bt = ktime_get_boottime_seconds();
clear_bit(NFSD_NET_GRACE_ENDED, &nn->flags);
clear_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags);
nn->nfsd4_manager.block_opens = true;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 178/713] nfsd: fix cpntf publish race in nfs4_init_cp_state
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 177/713] nfsd: fix clock domain mismatch in clients_still_reclaiming() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 179/713] nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Greg Kroah-Hartman
` (545 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit be3a5c1d857b0dcbc11796cea603ef25834f75b2 upstream.
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then
took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap
the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as
cnr_stateid, so any NFSv4.2 client can drive it) reaches
manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on
the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical
section as idr_alloc_cyclic(), so a concurrent lookup either misses the
entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after
allocation and switch _free_cpntf_state_locked() to list_del_init() so a
stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and
skips the list_add, preserving NFS4_COPY_STID semantics.
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-1-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 35 +++++++++++++++++++++++++----------
1 file changed, 25 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -939,7 +939,7 @@ out_free:
* Create a unique stateid_t to represent each COPY.
*/
static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
- unsigned char cs_type)
+ unsigned char cs_type, struct nfs4_stid *p_stid)
{
int new_id;
@@ -949,19 +949,34 @@ static int nfs4_init_cp_state(struct nfs
idr_preload(GFP_KERNEL);
spin_lock(&nn->s2s_cp_lock);
new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
- stid->cs_stid.si_opaque.so_id = new_id;
- stid->cs_stid.si_generation = 1;
+ if (new_id >= 0) {
+ stid->cs_stid.si_opaque.so_id = new_id;
+ stid->cs_stid.si_generation = 1;
+ /*
+ * Set cs_type and link onto sc_cp_list under the same lock
+ * that installed the IDR entry, so a concurrent
+ * manage_cpntf_state() sees either no entry or a fully
+ * linked cp_list.
+ */
+ stid->cs_type = cs_type;
+ if (p_stid) {
+ struct nfs4_cpntf_state *cps =
+ container_of(stid, struct nfs4_cpntf_state,
+ cp_stateid);
+
+ list_add(&cps->cp_list, &p_stid->sc_cp_list);
+ }
+ }
spin_unlock(&nn->s2s_cp_lock);
idr_preload_end();
if (new_id < 0)
return 0;
- stid->cs_type = cs_type;
return 1;
}
int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
{
- return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID);
+ return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID, NULL);
}
struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn,
@@ -972,13 +987,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init
cps = kzalloc_obj(struct nfs4_cpntf_state);
if (!cps)
return NULL;
+ /* So a stale list_del_init() before linking is a no-op. */
+ INIT_LIST_HEAD(&cps->cp_list);
cps->cpntf_time = ktime_get_boottime_seconds();
refcount_set(&cps->cp_stateid.cs_count, 1);
- if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID))
+ if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID,
+ p_stid))
goto out_free;
- spin_lock(&nn->s2s_cp_lock);
- list_add(&cps->cp_list, &p_stid->sc_cp_list);
- spin_unlock(&nn->s2s_cp_lock);
return cps;
out_free:
kfree(cps);
@@ -7512,7 +7527,7 @@ _free_cpntf_state_locked(struct nfsd_net
WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
return;
- list_del(&cps->cp_list);
+ list_del_init(&cps->cp_list);
idr_remove(&nn->s2s_cp_stateids,
cps->cp_stateid.cs_stid.si_opaque.so_id);
kfree(cps);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 179/713] nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 178/713] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 180/713] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Greg Kroah-Hartman
` (544 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 6247023fbbec1325029f2d5f2a7cdc0f9f9ea15a upstream.
nfsd_set_fh_dentry() leaks the dentry reference from
exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE
switch cases detect NFSEXP_V4ROOT and goto out. The out: label
calls exp_put() but never dput(dentry), and fhp->fh_dentry was
never assigned so fh_put() cannot compensate.
A crafted NFSv3 filehandle targeting a V4ROOT export's fsid
triggers the leak on every request.
Fixes: ef7f6c4904d0 ("nfsd: move V4ROOT version check to nfsd_set_fh_dentry()")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260531-nfsd-testing-v1-4-7bfa481b0540@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsfh.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -342,15 +342,19 @@ static __be32 nfsd_set_fh_dentry(struct
if (dentry->d_sb->s_export_op->flags & EXPORT_OP_NOWCC)
fhp->fh_no_wcc = true;
fhp->fh_64bit_cookies = true;
- if (exp->ex_flags & NFSEXP_V4ROOT)
+ if (exp->ex_flags & NFSEXP_V4ROOT) {
+ dput(dentry);
goto out;
+ }
break;
case NFS_FHSIZE:
fhp->fh_no_wcc = true;
if (EX_WGATHER(exp))
fhp->fh_use_wgather = true;
- if (exp->ex_flags & NFSEXP_V4ROOT)
+ if (exp->ex_flags & NFSEXP_V4ROOT) {
+ dput(dentry);
goto out;
+ }
}
fhp->fh_dentry = dentry;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 180/713] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 179/713] nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 181/713] nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Greg Kroah-Hartman
` (543 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4 upstream.
nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventing the shrinker and GC worker from
bearing the cost of closing files (see ffb402596147). However, the
queue lives in a separately-allocated struct nfsd_fcache_disposal that
is freed by nfsd_free_fcache_disposal_net() during per-net teardown.
The global shrinker, laundrette, and fsnotify callbacks can still be
inside nfsd_file_dispose_list_delayed() dereferencing that pointer,
causing a use-after-free.
Inline the spinlock and freeme list directly into struct nfsd_net (as
fcache_dispose_lock and fcache_dispose_list), eliminating the separately
allocated struct nfsd_fcache_disposal entirely. These fields now have
the same lifetime as the net namespace itself, so there is no dangling
pointer to chase.
nfsd_file_cache_start_net() now just initializes the inline fields and
cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains
the inline list directly instead of freeing a separate struct. The
alloc/free helpers are removed.
Fixes: 1463b38e7cf3 ("NFSD: simplify per-net file cache management")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-7-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 77 ++++++++++++++--------------------------------------
fs/nfsd/netns.h | 3 +-
2 files changed, 24 insertions(+), 56 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -62,11 +62,6 @@ static DEFINE_PER_CPU(unsigned long, nfs
static DEFINE_PER_CPU(unsigned long, nfsd_file_total_age);
static DEFINE_PER_CPU(unsigned long, nfsd_file_evictions);
-struct nfsd_fcache_disposal {
- spinlock_t lock;
- struct list_head freeme;
-};
-
static struct kmem_cache *nfsd_file_slab;
static struct kmem_cache *nfsd_file_mark_slab;
static struct list_lru nfsd_file_lru;
@@ -419,25 +414,25 @@ nfsd_file_dispose_list(struct list_head
}
/**
- * nfsd_file_dispose_list_delayed - move list of dead files to net's freeme list
+ * nfsd_file_dispose_list_delayed - queue dead files for nfsd thread disposal
* @dispose: list of nfsd_files to be disposed
*
- * Transfers each file to the "freeme" list for its nfsd_net, to eventually
- * be disposed of by the per-net garbage collector.
+ * Transfers each file to the dispose list in its nfsd_net and wakes an nfsd
+ * thread to do the actual close. This keeps the cost of fput() in the nfsd
+ * threads rather than in the shrinker or GC worker.
*/
static void
nfsd_file_dispose_list_delayed(struct list_head *dispose)
{
- while(!list_empty(dispose)) {
+ while (!list_empty(dispose)) {
struct nfsd_file *nf = list_first_entry(dispose,
struct nfsd_file, nf_gc);
struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
- struct nfsd_fcache_disposal *l = nn->fcache_disposal;
struct svc_serv *serv;
- spin_lock(&l->lock);
- list_move_tail(&nf->nf_gc, &l->freeme);
- spin_unlock(&l->lock);
+ spin_lock(&nn->fcache_dispose_lock);
+ list_move_tail(&nf->nf_gc, &nn->fcache_dispose_list);
+ spin_unlock(&nn->fcache_dispose_lock);
/*
* The filecache laundrette is shut down after the
@@ -461,17 +456,15 @@ nfsd_file_dispose_list_delayed(struct li
*/
void nfsd_file_net_dispose(struct nfsd_net *nn)
{
- struct nfsd_fcache_disposal *l = nn->fcache_disposal;
-
- if (!list_empty(&l->freeme)) {
+ if (!list_empty(&nn->fcache_dispose_list)) {
LIST_HEAD(dispose);
int i;
- spin_lock(&l->lock);
- for (i = 0; i < 8 && !list_empty(&l->freeme); i++)
- list_move(l->freeme.next, &dispose);
- spin_unlock(&l->lock);
- if (!list_empty(&l->freeme)) {
+ spin_lock(&nn->fcache_dispose_lock);
+ for (i = 0; i < 8 && !list_empty(&nn->fcache_dispose_list); i++)
+ list_move(nn->fcache_dispose_list.next, &dispose);
+ spin_unlock(&nn->fcache_dispose_lock);
+ if (!list_empty(&nn->fcache_dispose_list)) {
/*
* Wake up another thread to share the work
* *before* doing any actual disposing.
@@ -695,11 +688,11 @@ nfsd_file_queue_for_close(struct inode *
}
/**
- * nfsd_file_close_inode - attempt a delayed close of a nfsd_file
+ * nfsd_file_close_inode - attempt a deferred close of a nfsd_file
* @inode: inode of the file to attempt to remove
*
* Close out any open nfsd_files that can be reaped for @inode. The
- * actual freeing is deferred to the dispose_list_delayed infrastructure.
+ * actual freeing is deferred to the nfsd service threads.
*
* This is used by the fsnotify callbacks and setlease notifier.
*/
@@ -949,42 +942,14 @@ __nfsd_file_cache_purge(struct net *net)
nfsd_file_dispose_list(&dispose);
}
-static struct nfsd_fcache_disposal *
-nfsd_alloc_fcache_disposal(void)
-{
- struct nfsd_fcache_disposal *l;
-
- l = kmalloc_obj(*l);
- if (!l)
- return NULL;
- spin_lock_init(&l->lock);
- INIT_LIST_HEAD(&l->freeme);
- return l;
-}
-
-static void
-nfsd_free_fcache_disposal(struct nfsd_fcache_disposal *l)
-{
- nfsd_file_dispose_list(&l->freeme);
- kfree(l);
-}
-
-static void
-nfsd_free_fcache_disposal_net(struct net *net)
-{
- struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- struct nfsd_fcache_disposal *l = nn->fcache_disposal;
-
- nfsd_free_fcache_disposal(l);
-}
-
int
nfsd_file_cache_start_net(struct net *net)
{
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- nn->fcache_disposal = nfsd_alloc_fcache_disposal();
- return nn->fcache_disposal ? 0 : -ENOMEM;
+ spin_lock_init(&nn->fcache_dispose_lock);
+ INIT_LIST_HEAD(&nn->fcache_dispose_list);
+ return 0;
}
/**
@@ -1003,8 +968,10 @@ nfsd_file_cache_purge(struct net *net)
void
nfsd_file_cache_shutdown_net(struct net *net)
{
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
nfsd_file_cache_purge(net);
- nfsd_free_fcache_disposal_net(net);
+ nfsd_file_dispose_list(&nn->fcache_dispose_list);
}
void
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -217,7 +217,8 @@ struct nfsd_net {
/* utsname taken from the process that starts the server */
char nfsd_name[UNX_MAXNODENAME+1];
- struct nfsd_fcache_disposal *fcache_disposal;
+ spinlock_t fcache_dispose_lock;
+ struct list_head fcache_dispose_list;
siphash_key_t siphash_key;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 181/713] nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 180/713] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 182/713] nfsd: fix layout fence worker double-reference race Greg Kroah-Hartman
` (542 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 246a90a5109bb2857db41f491277882ee2743b26 upstream.
The FL_SLEEP guard uses lk_type & (NFS4_READW_LT | NFS4_WRITEW_LT) which
computes lk_type & 7, non-zero for all valid lock types including
non-blocking ones. This was introduced by commit 7e64c5bc497c
("NLM/NFSD: Fix lock notifications for async-capable filesystems") when
refactoring from per-case switch arms.
Replace the bitmask test with explicit equality checks.
Fixes: 7e64c5bc497c ("NLM/NFSD: Fix lock notifications for async-capable filesystems")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-10-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -8614,10 +8614,11 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
goto out;
}
- if (lock->lk_type & (NFS4_READW_LT | NFS4_WRITEW_LT) &&
- nfsd4_has_session(cstate) &&
- locks_can_async_lock(nf->nf_file->f_op))
- flags |= FL_SLEEP;
+ if ((lock->lk_type == NFS4_READW_LT ||
+ lock->lk_type == NFS4_WRITEW_LT) &&
+ nfsd4_has_session(cstate) &&
+ locks_can_async_lock(nf->nf_file->f_op))
+ flags |= FL_SLEEP;
nbl = find_or_allocate_block(lock_sop, &fp->fi_fhandle, nn);
if (!nbl) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 182/713] nfsd: fix layout fence worker double-reference race
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 181/713] nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 183/713] nfsd: fix netlink dumpit error handling for rpc_status_get Greg Kroah-Hartman
` (541 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 8580571227451384399b3fa53fcde19848c48e5a upstream.
The workqueue core clears WORK_STRUCT_PENDING before the callback
is invoked, so delayed_work_pending() in lm_breaker_timedout() can
return false while the fence worker is already running. This lets
the breaker take a duplicate sc_count reference and schedule a new
worker that coalesces with the in-progress one. The extra reference
is never put, leaking the layout stateid.
Replace the racy delayed_work_pending() check with an
ls_fence_inflight boolean set atomically with
refcount_inc_not_zero() under ls_lock, and cleared under ls_lock
before the final nfs4_put_stid() on the dispose path; the retry
path intentionally retains it. Remove the self-rearm
mod_delayed_work() at the top of the worker.
Fixes: f52792f484ba ("NFSD: Enforce timeout on layout recall and integrate lease manager fencing")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260531-nfsd-testing-v1-6-7bfa481b0540@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4layouts.c | 27 +++++++++++++++------------
fs/nfsd/state.h | 1 +
2 files changed, 16 insertions(+), 12 deletions(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 1de2f6cd1f09..279ff1e9dffb 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -260,6 +260,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
}
ls->ls_fenced = false;
+ ls->ls_fence_inflight = false;
ls->ls_fence_delay = 0;
INIT_DELAYED_WORK(&ls->ls_fence_work, nfsd4_layout_fence_worker);
@@ -797,15 +798,6 @@ nfsd4_layout_fence_worker(struct work_struct *work)
struct nfs4_client *clp;
struct nfsd_net *nn;
- /*
- * The workqueue clears WORK_STRUCT_PENDING before invoking
- * this callback. Re-arm immediately so that
- * delayed_work_pending() returns true while the fence
- * operation is in progress, preventing
- * lm_breaker_timedout() from taking a duplicate reference.
- */
- mod_delayed_work(system_dfl_wq, &ls->ls_fence_work, 0);
-
spin_lock(&ls->ls_lock);
if (list_empty(&ls->ls_layouts)) {
spin_unlock(&ls->ls_lock);
@@ -815,6 +807,9 @@ nfsd4_layout_fence_worker(struct work_struct *work)
nfsd4_close_layout(ls);
ls->ls_fenced = true;
+ spin_lock(&ls->ls_lock);
+ ls->ls_fence_inflight = false;
+ spin_unlock(&ls->ls_lock);
nfs4_put_stid(&ls->ls_stid);
return;
}
@@ -900,18 +895,26 @@ nfsd4_layout_lm_breaker_timedout(struct file_lease *fl)
if ((!nfsd4_layout_ops[ls->ls_layout_type]->fence_client) ||
ls->ls_fenced)
return true;
- if (delayed_work_pending(&ls->ls_fence_work))
- return false;
/*
* Make sure layout has not been returned yet before
- * taking a reference count on the layout stateid.
+ * taking a reference count on the layout stateid. The
+ * ls_fence_inflight flag is set together with the sc_count
+ * increment under ls_lock so that a fence worker invocation
+ * already in progress (which has cleared WORK_STRUCT_PENDING
+ * but not yet reached dispose:) cannot be coalesced with a
+ * fresh schedule that takes an extra unmatched reference.
*/
spin_lock(&ls->ls_lock);
+ if (ls->ls_fence_inflight) {
+ spin_unlock(&ls->ls_lock);
+ return false;
+ }
if (list_empty(&ls->ls_layouts) ||
!refcount_inc_not_zero(&ls->ls_stid.sc_count)) {
spin_unlock(&ls->ls_lock);
return true;
}
+ ls->ls_fence_inflight = true;
spin_unlock(&ls->ls_lock);
mod_delayed_work(system_dfl_wq, &ls->ls_fence_work, 0);
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index ac6fd0d6d099..f44ea672670f 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -755,6 +755,7 @@ struct nfs4_layout_stateid {
struct delayed_work ls_fence_work;
unsigned int ls_fence_delay;
bool ls_fenced;
+ bool ls_fence_inflight;
};
static inline struct nfs4_layout_stateid *layoutstateid(struct nfs4_stid *s)
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 183/713] nfsd: fix netlink dumpit error handling for rpc_status_get
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 182/713] nfsd: fix layout fence worker double-reference race Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 184/713] nfsd: fix nfsd_file leak on inter-server COPY setup failure Greg Kroah-Hartman
` (540 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit e13d505af73a1e013aa81806652d4378b21cfca2 upstream.
nfsd_genl_rpc_status_compose_msg() returns -ENOBUFS on nla_put failure
without calling genlmsg_cancel(), leaving a partial message in the skb.
The caller then propagates -ENOBUFS directly, which the netlink dump
infrastructure treats as a fatal error, aborting the entire dump.
The correct netlink dump convention is:
- Cancel any partial message with genlmsg_cancel()
- If prior messages were added to the skb (skb->len > 0), save the
current iterator position and return skb->len to paginate
- Only return a negative errno when no messages fit at all
Fix compose_msg to cancel the partial message on all nla_put failure
paths, and fix the caller to paginate when possible rather than
returning a fatal error.
A second defect surfaces once pagination actually works: cb->args[1]
records the resume index within the pool named by cb->args[0], but the
inner loop applied it to every pool from cb->args[0] onward. After a
mid-pool pause, a later dump call drains the resume pool and continues
into subsequent pools within the same call, where the stale cb->args[1]
caused the first N threads of each following pool to be skipped. On
per-CPU or per-node pool configurations this silently dropped active
requests from the dump. Apply the saved thread index only to the pool
matching cb->args[0], and start every subsequent pool from thread 0.
Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: fold in 20/21 to avoid bisect hazard ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-3-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1452,7 +1452,7 @@ static int nfsd_genl_rpc_status_compose_
nla_put_s64(skb, NFSD_A_RPC_STATUS_SERVICE_TIME,
ktime_to_us(genl_rqstp->rq_stime),
NFSD_A_RPC_STATUS_PAD))
- return -ENOBUFS;
+ goto out_cancel;
switch (genl_rqstp->rq_saddr.ss_family) {
case AF_INET: {
@@ -1468,7 +1468,7 @@ static int nfsd_genl_rpc_status_compose_
s_in->sin_port) ||
nla_put_be16(skb, NFSD_A_RPC_STATUS_DPORT,
d_in->sin_port))
- return -ENOBUFS;
+ goto out_cancel;
break;
}
case AF_INET6: {
@@ -1484,7 +1484,7 @@ static int nfsd_genl_rpc_status_compose_
s_in->sin6_port) ||
nla_put_be16(skb, NFSD_A_RPC_STATUS_DPORT,
d_in->sin6_port))
- return -ENOBUFS;
+ goto out_cancel;
break;
}
}
@@ -1492,10 +1492,14 @@ static int nfsd_genl_rpc_status_compose_
for (i = 0; i < genl_rqstp->rq_opcnt; i++)
if (nla_put_u32(skb, NFSD_A_RPC_STATUS_COMPOUND_OPS,
genl_rqstp->rq_opnum[i]))
- return -ENOBUFS;
+ goto out_cancel;
genlmsg_end(skb, hdr);
return 0;
+
+out_cancel:
+ genlmsg_cancel(skb, hdr);
+ return -ENOBUFS;
}
/**
@@ -1523,10 +1527,20 @@ int nfsd_nl_rpc_status_get_dumpit(struct
for (i = 0; i < nn->nfsd_serv->sv_nrpools; i++) {
struct svc_rqst *rqstp;
+ long thread_skip = 0;
if (i < cb->args[0]) /* already consumed */
continue;
+ /*
+ * The saved thread index only applies to the pool the dump
+ * was resumed in. Subsequent pools must start from thread 0,
+ * otherwise their first cb->args[1] threads are silently
+ * skipped.
+ */
+ if (i == cb->args[0])
+ thread_skip = cb->args[1];
+
rqstp_index = 0;
list_for_each_entry_rcu(rqstp,
&nn->nfsd_serv->sv_pools[i].sp_all_threads,
@@ -1534,7 +1548,7 @@ int nfsd_nl_rpc_status_get_dumpit(struct
struct nfsd_genl_rqstp genl_rqstp = {};
unsigned int status_counter;
- if (rqstp_index++ < cb->args[1]) /* already consumed */
+ if (rqstp_index++ < thread_skip) /* already consumed */
continue;
/*
* Acquire rq_status_counter before parsing the rqst
@@ -1588,8 +1602,14 @@ int nfsd_nl_rpc_status_get_dumpit(struct
ret = nfsd_genl_rpc_status_compose_msg(skb, cb,
&genl_rqstp);
- if (ret)
+ if (ret) {
+ if (skb->len) {
+ cb->args[0] = i;
+ cb->args[1] = rqstp_index - 1;
+ ret = skb->len;
+ }
goto out;
+ }
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 184/713] nfsd: fix nfsd_file leak on inter-server COPY setup failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 183/713] nfsd: fix netlink dumpit error handling for rpc_status_get Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 185/713] nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Greg Kroah-Hartman
` (539 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 88a76145451d703eedd867b5989bf73d17340399 upstream.
When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns
nfserr_offload_denied directly, bypassing the out: label where
release_copy_files() would drop the nf_dst reference taken by
nfs4_preprocess_stateid_op(). Each failed inter-server COPY
leaks one nfsd_file, pinning file/inode/dentry/vfsmount.
Fix by setting status and jumping to out: instead of returning
directly.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260531-nfsd-testing-v1-3-7bfa481b0540@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2171,16 +2171,14 @@ nfsd4_copy(struct svc_rqst *rqstp, struc
}
status = nfsd4_setup_inter_ssc(rqstp, cstate, copy);
if (status) {
- trace_nfsd_copy_done(copy, status);
- return nfserr_offload_denied;
+ status = nfserr_offload_denied;
+ goto out;
}
} else {
trace_nfsd_copy_intra(copy);
status = nfsd4_setup_intra_ssc(rqstp, cstate, copy);
- if (status) {
- trace_nfsd_copy_done(copy, status);
- return status;
- }
+ if (status)
+ goto out;
}
memcpy(©->fh, &cstate->current_fh.fh_handle,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 185/713] nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 184/713] nfsd: fix nfsd_file leak on inter-server COPY setup failure Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 186/713] nfsd: fix partial-write detection in nfsd_direct_write Greg Kroah-Hartman
` (538 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nikol Kuklev, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikol Kuklev <nikolk202@gmail.com>
commit fe456c8c0931bb3e8a03d429920e87fd85747fba upstream.
When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or
FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()
sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate
the stateid.
If the client supplies the NFSv4 "one stateid" (all-0xFF bytes),
check_special_stateids() returns nfs_ok without populating the output
nfs4_stid pointer, because the special-stateid path in
nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the
"if (s)" block that would set *cstid is skipped. The local variable `st`
remains NULL.
Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally
dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.
This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,
SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})].
No authentication, delegation, or prior state is required.
Fix by adding a NULL check before the dereference. A special stateid is
not a delegation stateid, so the existing nfserr_bad_stateid return value
is already correct; we only need to guard the pointer dereference itself.
Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Nikol Kuklev <nikolk202@gmail.com>
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1269,7 +1269,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, st
if (deleg_attrs) {
status = nfserr_bad_stateid;
- if (st->sc_type & SC_TYPE_DELEG) {
+ if (st && (st->sc_type & SC_TYPE_DELEG)) {
struct nfs4_delegation *dp = delegstateid(st);
/* Only for *_ATTRS_DELEG flavors */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 186/713] nfsd: fix partial-write detection in nfsd_direct_write
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 185/713] nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 187/713] nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() Greg Kroah-Hartman
` (537 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 250ec14932d5cfe102f68a57892bb566eee7f83e upstream.
nfsd_direct_write() walks a list of write segments and, after each
vfs_iocb_iter_write(), tries to detect a short write so the loop can
stop before placing the next segment at a wrong file offset:
host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
if (host_err < 0)
return host_err;
*cnt += host_err;
if (host_err < segments[i].iter.count)
break; /* partial write */
vfs_iocb_iter_write() runs the iter through ->write_iter(), which
advances the iter by the number of bytes written. By the time the
check runs, segments[i].iter.count is the residual, not the original
request length:
before write_iter: iter.count == original_len
after write_iter: iter.count == original_len - host_err
The condition then reduces to host_err < original_len - host_err, so
the break fires only when less than half of the segment was written.
Any short write completing between 50% and 99% of the segment slips
through; the loop advances to the next segment with kiocb->ki_pos
only bumped by the short amount, writing the next segment's payload
at the wrong offset and over-reporting *cnt to the NFS client.
Snapshot the segment's byte count before the write and compare
host_err against that snapshot so any short write breaks the loop.
Fixes: 06c5c97293e3 ("NFSD: Implement NFSD_IO_DIRECT for NFS WRITE")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-7-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1382,6 +1382,7 @@ nfsd_direct_write(struct svc_rqst *rqstp
struct file *file = nf->nf_file;
unsigned int nsegs, i;
ssize_t host_err;
+ size_t expected;
nsegs = nfsd_write_dio_iters_init(nf, rqstp->rq_bvec, nvecs,
kiocb, *cnt, segments);
@@ -1403,11 +1404,13 @@ nfsd_direct_write(struct svc_rqst *rqstp
kiocb->ki_flags |= IOCB_DONTCACHE;
}
+ expected = iov_iter_count(&segments[i].iter);
+
host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
if (host_err < 0)
return host_err;
*cnt += host_err;
- if (host_err < segments[i].iter.count)
+ if (host_err < (ssize_t)expected)
break; /* partial write */
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 187/713] nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 186/713] nfsd: fix partial-write detection in nfsd_direct_write Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 188/713] nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Greg Kroah-Hartman
` (536 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Chuck Lever, Jeff Layton,
Benjamin Coddington
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
commit 3e2c79360c6a89975ec5b5a7d4ef937e4db91a27 upstream.
dentry_create() can hypothetically provide a different dentry than the
one passed in. This could happen, for example, if the exported
filesystem is NFS, and the server returned to OPEN a filehandle which
matched a directory that was already in the dcache. Clearly this would
not be expected!
If this were to happen the dentry (child) that was already stored in
resfhp could be freed and later dereferenced.
We shouldn't call fh_compose() until we are certain that we have the
final dentry, so this patch moved the fh_compose() call to two places:
one for the case where the target already exists, and one after
dentry_create() where it was created.
Fixes: 64a989dbd144 ("VFS/knfsd: Teach dentry_create() to use atomic_open()")
Cc: stable@vger.kernel.org
Signed-off-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260526053004.4014491-2-neilb@ownmail.net
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3024d51d6fb7..c16ccb403a8d 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -306,10 +306,6 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
goto out;
}
- status = fh_compose(resfhp, fhp->fh_export, child, fhp);
- if (status != nfs_ok)
- goto out;
-
v_mtime = 0;
v_atime = 0;
if (nfsd4_create_is_exclusive(open->op_createmode)) {
@@ -335,6 +331,10 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
if (status != nfs_ok)
goto out;
+ status = fh_compose(resfhp, fhp->fh_export, child, fhp);
+ if (status != nfs_ok)
+ goto out;
+
switch (open->op_createmode) {
case NFS4_CREATE_UNCHECKED:
if (!d_is_reg(child))
@@ -385,6 +385,10 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
open->op_created = true;
fh_fill_post_attrs(fhp);
+ status = fh_compose(resfhp, fhp->fh_export, child, fhp);
+ if (status != nfs_ok)
+ goto out;
+
/* A newly created file already has a file size of zero. */
if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
iap->ia_valid &= ~ATTR_SIZE;
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 188/713] nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 187/713] nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 189/713] nfsd: fix reply size estimate for GET_DIR_DELEGATION Greg Kroah-Hartman
` (535 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 30c2df3005c99819e117402dc492db4a2a696c2f upstream.
nfsd_file_lru_add() unconditionally increments nf_ref before attempting
to insert the nfsd_file into the LRU via list_lru_add_obj(). If the
insertion fails (the item is already linked), the incremented reference
is never released, permanently inflating the refcount.
The LRU shrinker callback (nfsd_file_lru_cb) uses refcount_dec_if_one()
to reclaim entries, which requires nf_ref == 1. An inflated refcount
therefore blocks eviction of the affected file cache entry for the
lifetime of the nfsd instance.
While this failure path is currently unreachable -- the sole caller in
nfsd_file_do_acquire() operates on freshly-allocated objects that cannot
already be on the LRU -- it represents a latent bug that would become
exploitable if a future change adds another call site or alters the
PENDING protocol.
Fix this by:
- Adding a compensating refcount_dec() on the failure path. Bare
refcount_dec (rather than nfsd_file_put) is correct here because
the caller in nfsd_file_do_acquire still holds its own construction
reference, so the count goes from 2 back to 1 without risk of
reaching zero.
- Changing WARN_ON(1) to WARN_ON_ONCE(1) to prevent log flooding if
this path is ever hit repeatedly.
- Returning early on failure to skip the unnecessary call to
nfsd_file_schedule_laundrette(), since no entry was added to the LRU.
Fixes: 56221b42d717 ("nfsd: filecache: don't repeatedly add/remove files on the lru list")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-6-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -322,8 +322,11 @@ static void nfsd_file_lru_add(struct nfs
refcount_inc(&nf->nf_ref);
if (list_lru_add_obj(&nfsd_file_lru, &nf->nf_lru))
trace_nfsd_file_lru_add(nf);
- else
- WARN_ON(1);
+ else {
+ refcount_dec(&nf->nf_ref);
+ WARN_ON_ONCE(1);
+ return;
+ }
nfsd_file_schedule_laundrette();
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 189/713] nfsd: fix reply size estimate for GET_DIR_DELEGATION
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 188/713] nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 190/713] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Greg Kroah-Hartman
` (534 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 46f929b907b3bc488593c006f0c97e35baba9ea4 upstream.
nfsd4_get_dir_delegation_rsize() returns its estimate in XDR words, but
the COMPOUND reply-size machinery works in bytes: every other op's
_rsize helper multiplies its word count by sizeof(__be32). Since
GET_DIR_DELEGATION is OP_MODIFIES_SOMETHING, this estimate is consulted
before the op executes to ensure the reply will fit. The ~4x too-small
estimate lets a compound near the session/reply limit pass the check,
grant a directory delegation, and then fail to encode the reply with
NFS4ERR_RESOURCE/REP_TOO_BIG, leaving the client without the returned
stateid.
Multiply the estimate by sizeof(__be32) like the other _rsize helpers.
Fixes: 33a1e6ea73e5 ("nfsd: trivial GET_DIR_DELEGATION support")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260616-dir-deleg-v7-17-6cbc7eac0ade@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -3540,7 +3540,7 @@ static u32 nfsd4_get_dir_delegation_rsiz
op_encode_stateid_maxsz +
2 /* gddr_notification */ +
2 /* gddr_child_attributes */ +
- 2 /* gddr_dir_attributes */);
+ 2 /* gddr_dir_attributes */) * sizeof(__be32);
}
#ifdef CONFIG_NFSD_PNFS
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 190/713] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 189/713] nfsd: fix reply size estimate for GET_DIR_DELEGATION Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 191/713] nfsd: fix UAF in async copy cancel and shutdown Greg Kroah-Hartman
` (533 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit d0beaee498e11880e72826026db0e9c9890fc114 upstream.
For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before
dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at
&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is
reused by the next request. dup_copy_fields() copies only the value into
async_copy, so the IDR slot dangled at the transient buffer for the whole
background copy. Any IDR walker then dereferences reused request memory:
the laundromat reads cs_type from it and, if the bytes look like an
expired NFS4_COPYNOTIFY_STID, follows into
refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has
the same exposure via idr_find().
Duplicate the fields first, then register the stateid on the stable
async_copy. result->cb_stateid is unchanged.
Fixes: e0639dc5805a ("NFSD introduce async copy feature")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-3-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2202,11 +2202,12 @@ nfsd4_copy(struct svc_rqst *rqstp, struc
async_copy->cp_src = kmalloc_obj(*async_copy->cp_src);
if (!async_copy->cp_src)
goto out_dec_async_copy_err;
- if (!nfs4_init_copy_state(nn, copy))
+ dup_copy_fields(copy, async_copy);
+
+ if (!nfs4_init_copy_state(nn, async_copy))
goto out_dec_async_copy_err;
- memcpy(&result->cb_stateid, ©->cp_stateid.cs_stid,
+ memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid,
sizeof(result->cb_stateid));
- dup_copy_fields(copy, async_copy);
if ((READ_ONCE(copy->nf_dst->nf_file->f_mode) &
FMODE_NOCMTIME) != 0)
async_copy->attr_update = true;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 191/713] nfsd: fix UAF in async copy cancel and shutdown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 190/713] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 192/713] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
` (532 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 62c0f6eaf050bb9284c1f9cac6ed1770092e6b95 upstream.
An async copy could be freed or used after free while a teardown caller
(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the
copy kthread:
- find_async_copy() bumped copy->refcount but left the copy on
clp->async_copies, so the reaper's cleanup_async_copy() could run
release_copy_files() concurrently with a cancel/shutdown caller. Both
put and NULL nf_src/nf_dst without a common lock, double-putting the
nfsd_file and freeing it early.
- nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses
of the copy (nfsd_update_cmtime_attr() on copy->nf_dst,
nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit
as "kthread done, skip kthread_stop()", so a teardown caller ran
release_copy_files() -- which puts and NULLs nf_dst -- while the
kthread still dereferenced it (NULL/UAF).
- copy->copy_task was never pinned. The one-shot kthread self-reaps on
return, so kthread_stop()'s get_task_struct() could touch a freed
task_struct.
- co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a
reference only on the client, so a concurrent teardown could free
the copy while the CB_OFFLOAD callback was in flight.
Fix the teardown lifetime as a whole:
- find_async_copy() unlinks the copy (clear cp_clp, list_del_init)
under async_lock; the cancel, shutdown, and sb-cancel paths drop the
list-membership reference via nfs4_put_copy() after nfsd4_stop_copy().
Drop the now-redundant list_del fixup from cleanup_async_copy().
- Because unlinking hides the copy from the reaper, its
cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids
entry; the cancel/shutdown/sb-cancel paths now call
nfs4_free_copy_state() themselves (while cp_clp is still valid) so
the entry does not dangle at freed memory for the laundromat and
manage_cpntf_state() to dereference.
- Give the kthread its own reference, taken in nfsd4_copy() before
wake_up_process() and dropped at the end of nfsd4_do_async_copy();
call wake_up_process() before list_add().
- Pin the task_struct with get_task_struct() in nfsd4_copy(), released
in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread
exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now
always kthread_stop()s before release_copy_files(); completion is
still reported via NFSD4_COPY_F_COMPLETED, so
nfsd4_has_active_async_copies() is unaffected. Each teardown caller
removes the copy from clp->async_copies first, so kthread_stop() runs
exactly once.
- Take a copy reference in nfsd4_send_cb_offload(), dropped in
nfsd4_cb_offload_release(). The kthread still holds its own reference
there, so the refcount_inc() cannot race the final free.
- Read cp_clp with smp_load_acquire() to pair with the unordered
set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst).
Fixes: e0639dc5805a ("NFSD introduce async copy feature")
Cc: stable@vger.kernel.org
Fixes: ac0514f4d198 ("NFSD: Add a laundromat reaper for async copy state")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-2-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 120 +++++++++++++++++++++++++++++++++++++----------------
1 file changed, 85 insertions(+), 35 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1514,6 +1514,9 @@ static void nfs4_put_copy(struct nfsd4_c
{
if (!refcount_dec_and_test(©->refcount))
return;
+ /* Drop the task_struct pinned in nfsd4_copy(); NULL on sync copies. */
+ if (copy->copy_task)
+ put_task_struct(copy->copy_task);
kfree(copy->cp_src);
kfree(copy);
}
@@ -1523,20 +1526,18 @@ static void release_copy_files(struct nf
static void nfsd4_stop_copy(struct nfsd4_copy *copy)
{
trace_nfsd_copy_async_cancel(copy);
- if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, ©->cp_flags)) {
- kthread_stop(copy->copy_task);
- if (!test_bit(NFSD4_COPY_F_CB_ERROR, ©->cp_flags))
- copy->nfserr = nfs_ok;
- set_bit(NFSD4_COPY_F_COMPLETED, ©->cp_flags);
- }
-
/*
- * The copy was removed from async_copies before this function
- * was called, so the reaper cannot clean it up. Release files
- * here regardless of who won the STOPPED race. If the thread
- * set STOPPED, it has finished using the files. If STOPPED
- * was set here, kthread_stop() waited for the thread to exit.
+ * Join the kthread before releasing its resources. The task_struct is
+ * pinned in nfsd4_copy(), so kthread_stop() is safe even after the
+ * one-shot kthread has exited. The caller already unlinked the copy,
+ * so this runs once per copy.
*/
+ set_bit(NFSD4_COPY_F_STOPPED, ©->cp_flags);
+ kthread_stop(copy->copy_task);
+ if (!test_bit(NFSD4_COPY_F_CB_ERROR, ©->cp_flags))
+ copy->nfserr = nfs_ok;
+ set_bit(NFSD4_COPY_F_COMPLETED, ©->cp_flags);
+
release_copy_files(copy);
nfs4_put_copy(copy);
}
@@ -1550,7 +1551,13 @@ static struct nfsd4_copy *nfsd4_unhash_c
copy = list_first_entry(&clp->async_copies, struct nfsd4_copy,
copies);
refcount_inc(©->refcount);
- copy->cp_clp = NULL;
+ /*
+ * Unlinking hides the copy from the reaper, so drop its
+ * s2s_cp_stateids entry here while cp_clp is still valid.
+ */
+ nfs4_free_copy_state(copy);
+ /* Pairs with smp_load_acquire() in nfsd4_send_cb_offload(). */
+ smp_store_release(©->cp_clp, NULL);
if (!list_empty(©->copies))
list_del_init(©->copies);
}
@@ -1562,8 +1569,11 @@ void nfsd4_shutdown_copy(struct nfs4_cli
{
struct nfsd4_copy *copy;
- while ((copy = nfsd4_unhash_copy(clp)) != NULL)
+ while ((copy = nfsd4_unhash_copy(clp)) != NULL) {
nfsd4_stop_copy(copy);
+ /* Reaper can't reach the unhashed copy; drop its membership ref. */
+ nfs4_put_copy(copy);
+ }
}
static bool nfsd4_copy_on_sb(const struct nfsd4_copy *copy,
@@ -1626,7 +1636,11 @@ void nfsd4_cancel_copy_by_sb(struct net
struct nfs4_client *clp = copy->cp_clp;
list_del_init(©->copies);
+ /* Reaper can't reach it; drop the s2s entry while cp_clp is valid. */
+ nfs4_free_copy_state(copy);
nfsd4_stop_copy(copy);
+ /* Drop the membership ref the reaper would have dropped. */
+ nfs4_put_copy(copy);
nfsd4_put_client(clp);
}
}
@@ -1921,6 +1935,8 @@ static void nfsd4_cb_offload_release(str
set_bit(NFSD4_COPY_F_OFFLOAD_DONE, ©->cp_flags);
nfsd4_put_client(cb->cb_clp);
+ /* Drop the copy reference taken in nfsd4_send_cb_offload(). */
+ nfs4_put_copy(copy);
}
static int nfsd4_cb_offload_done(struct nfsd4_callback *cb,
@@ -2052,28 +2068,29 @@ static void release_copy_files(struct nf
}
}
+/*
+ * Called from the reaper and from nfsd4_copy()'s error path; in both
+ * cases the copy is already unreachable from clp->async_copies.
+ */
static void cleanup_async_copy(struct nfsd4_copy *copy)
{
nfs4_free_copy_state(copy);
release_copy_files(copy);
- if (copy->cp_clp) {
- spin_lock(©->cp_clp->async_lock);
- if (!list_empty(©->copies))
- list_del_init(©->copies);
- spin_unlock(©->cp_clp->async_lock);
- }
nfs4_put_copy(copy);
}
static void nfsd4_send_cb_offload(struct nfsd4_copy *copy)
{
struct nfsd4_cb_offload *cbo = ©->cp_cb_offload;
- struct nfs4_client *clp = copy->cp_clp;
+ struct nfs4_client *clp;
/*
- * cp_clp is NULL when called via nfsd4_shutdown_copy() during
- * client destruction. Skip the callback; the client is gone.
+ * Pairs with smp_store_release(&cp_clp) in find_async_copy() and
+ * nfsd4_unhash_copy(); the set_bit/clear_bit writers are unordered.
+ * cp_clp is NULL once the copy was canceled; skip the callback, the
+ * canceling path owns the notification.
*/
+ clp = smp_load_acquire(©->cp_clp);
if (!clp) {
set_bit(NFSD4_COPY_F_OFFLOAD_DONE, ©->cp_flags);
return;
@@ -2085,10 +2102,12 @@ static void nfsd4_send_cb_offload(struct
cbo->co_retries = 5;
/*
- * Hold a reference on the client while the callback is in flight.
- * Released in nfsd4_cb_offload_release().
+ * Hold the client and the copy across the in-flight callback; co_cb is
+ * embedded in the copy, so it must outlive the callback. Both are
+ * dropped in nfsd4_cb_offload_release().
*/
kref_get(&clp->cl_nfsdfs.cl_ref);
+ refcount_inc(©->refcount);
nfsd4_init_cb(&cbo->co_cb, clp, &nfsd4_cb_offload_ops,
NFSPROC4_CLNT_CB_OFFLOAD);
@@ -2140,16 +2159,20 @@ static int nfsd4_do_async_copy(void *dat
do_callback:
if (!test_bit(NFSD4_COPY_F_CB_ERROR, ©->cp_flags))
copy->nfserr = nfserr;
- /* The kthread exits forthwith. Ensure that a subsequent
- * OFFLOAD_CANCEL won't try to kill it again. */
- set_bit(NFSD4_COPY_F_STOPPED, ©->cp_flags);
-
+ /*
+ * Don't set NFSD4_COPY_F_STOPPED here: it tells a teardown caller it
+ * may skip kthread_stop(), which would then release nf_dst and the
+ * client while still in use. Only nfsd4_stop_copy() sets it, after
+ * joining.
+ */
set_bit(NFSD4_COPY_F_COMPLETED, ©->cp_flags);
trace_nfsd_copy_async_done(copy);
atomic_dec(©->cp_nn->pending_async_copies);
if (copy->cp_res.wr_bytes_written > 0 && copy->attr_update)
nfsd_update_cmtime_attr(copy->nf_dst->nf_file, 0);
nfsd4_send_cb_offload(copy);
+ /* Drop the kthread's reference (taken in nfsd4_copy()); copy may be freed after this. */
+ nfs4_put_copy(copy);
return 0;
}
@@ -2188,6 +2211,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc
memcpy(©->fh, &cstate->current_fh.fh_handle,
sizeof(struct knfsd_fh));
if (nfsd4_copy_is_async(copy)) {
+ struct task_struct *task;
+
async_copy = kzalloc_obj(struct nfsd4_copy);
if (!async_copy)
goto out_err;
@@ -2216,15 +2241,27 @@ nfsd4_copy(struct svc_rqst *rqstp, struc
NFS4_MAX_SESSIONID_LEN);
async_copy->cp_cb_offload.co_referring_slotid = cstate->slot->sl_index;
async_copy->cp_cb_offload.co_referring_seqno = cstate->slot->sl_seqid;
- async_copy->copy_task = kthread_create(nfsd4_do_async_copy,
- async_copy, "%s", "copy thread");
- if (IS_ERR(async_copy->copy_task))
+ task = kthread_create(nfsd4_do_async_copy, async_copy,
+ "%s", "copy thread");
+ if (IS_ERR(task))
goto out_dec_async_copy_err;
+ /*
+ * Pin the task_struct so kthread_stop() is safe after this
+ * one-shot kthread exits. Released by nfs4_put_copy().
+ */
+ get_task_struct(task);
+ async_copy->copy_task = task;
+ /*
+ * Take the kthread's ref and wake it before publishing, so the
+ * publisher touches async_copy no further and teardown can
+ * drain it.
+ */
+ refcount_inc(&async_copy->refcount);
+ wake_up_process(async_copy->copy_task);
spin_lock(&async_copy->cp_clp->async_lock);
list_add(&async_copy->copies,
&async_copy->cp_clp->async_copies);
spin_unlock(&async_copy->cp_clp->async_lock);
- wake_up_process(async_copy->copy_task);
status = nfs_ok;
} else {
status = nfsd4_do_copy(copy, copy->nf_src->nf_file,
@@ -2278,8 +2315,18 @@ find_async_copy(struct nfs4_client *clp,
spin_lock(&clp->async_lock);
copy = find_async_copy_locked(clp, stateid);
- if (copy)
+ if (copy) {
refcount_inc(©->refcount);
+ nfs4_free_copy_state(copy);
+ /*
+ * Mirror nfsd4_unhash_copy(): unlink and clear cp_clp under
+ * async_lock so the reaper can't reach it. Caller drops the
+ * membership ref after nfsd4_stop_copy().
+ */
+ smp_store_release(©->cp_clp, NULL);
+ if (!list_empty(©->copies))
+ list_del_init(©->copies);
+ }
spin_unlock(&clp->async_lock);
return copy;
}
@@ -2298,8 +2345,11 @@ nfsd4_offload_cancel(struct svc_rqst *rq
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
return manage_cpntf_state(nn, &os->stateid, clp, NULL);
- } else
+ } else {
nfsd4_stop_copy(copy);
+ /* find_async_copy() unlinked it from the reaper; drop the membership ref. */
+ nfs4_put_copy(copy);
+ }
return nfs_ok;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 192/713] nfsd: fix version mismatch loops in nfsd_acl_init_request()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 191/713] nfsd: fix UAF in async copy cancel and shutdown Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 193/713] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
` (531 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9bc761051dcd9a4a8b59e64b2b185172d13c716d upstream.
The loops that compute the supported version range for PROG_MISMATCH
test nfsd_support_acl_version(rqstp->rq_vers) instead of
nfsd_support_acl_version(i), so every iteration fails and the
function returns rpc_prog_unavail instead of rpc_prog_mismatch.
Replace rqstp->rq_vers with the loop variable i, matching the
pattern used by the sibling nfsd_init_request() function.
Fixes: e333f3bbefe3 ("nfsd: Allow containers to set supported nfs versions")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-9-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfssvc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -815,7 +815,7 @@ nfsd_acl_init_request(struct svc_rqst *r
ret->mismatch.lovers = NFSD_ACL_NRVERS;
for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.lovers = i;
break;
@@ -825,7 +825,7 @@ nfsd_acl_init_request(struct svc_rqst *r
return rpc_prog_unavail;
ret->mismatch.hivers = NFSD_ACL_MINVERS;
for (i = NFSD_ACL_NRVERS - 1; i >= NFSD_ACL_MINVERS; i--) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.hivers = i;
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 193/713] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 192/713] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 194/713] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
` (530 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f9868174af49d207fbaf0c5e055d088a983684af upstream.
The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
multiple errors that can result in either an out-of-bounds write or
leaking uninitialized kernel memory to the client:
- fh_len doesn't account for XDR padding on the file handle data
- uid and gid lengths use "8 + len" but xdr_encode_opaque() actually
writes "4 + xdr_align_size(len)" bytes
- ds_len omits the flags and stats_collect_hint fields (8 bytes),
while len's header constant overestimates by 8 bytes -- these
partially cancel but leave a net mismatch
The worst case occurs with short strings (e.g. uid=0, gid=0 with an
odd-sized file handle), where the function writes up to 5 bytes past
the reserved XDR buffer. Conversely, when string lengths happen to be
4-byte aligned, the reservation is too large and stale buffer content
is sent to the client.
Fix this by breaking out every encoded field explicitly in the ds_len
calculation, using xdr_align_size() for all variable-length opaque
fields, and correcting the header constants.
Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-pnfs-fixes-v1-1-8a1255ae2f16@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/flexfilelayoutxdr.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -30,19 +30,24 @@ nfsd4_ff_encode_layoutget(struct xdr_str
struct ff_idmap uid;
struct ff_idmap gid;
- fh_len = 4 + fl->fh.size;
+ fh_len = 4 + xdr_align_size(fl->fh.size);
uid.len = sprintf(uid.buf, "%u", from_kuid(&init_user_ns, fl->uid));
gid.len = sprintf(gid.buf, "%u", from_kgid(&init_user_ns, fl->gid));
- /* 8 + len for recording the length, name, and padding */
- ds_len = 20 + sizeof(stateid_opaque_t) + 4 + fh_len +
- 8 + uid.len + 8 + gid.len;
+ /* data server entry: deviceid + efficiency + stateid + fh list +
+ * user + group + flags + stats_collect_hint
+ */
+ ds_len = 16 + 4 + 4 + sizeof(stateid_opaque_t) + 4 + fh_len +
+ 4 + xdr_align_size(uid.len) +
+ 4 + xdr_align_size(gid.len) +
+ 4 + 4;
+ /* mirror: ds_count + ds */
mirror_len = 4 + ds_len;
- /* The layout segment */
- len = 20 + mirror_len;
+ /* stripe_unit + mirror_count + mirror */
+ len = 12 + mirror_len;
p = xdr_reserve_space(xdr, sizeof(__be32) + len);
if (!p)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 194/713] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 193/713] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 195/713] nfsd: gate nfs2 setacl by argp->mask Greg Kroah-Hartman
` (529 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 8b989aaec85e1293a871d602590c951fe44b8647 upstream.
nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation
as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque()
calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes.
The mismatch means the declared da_addr_body length exceeds the actual
encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply,
leaking stale reply-page content to the client and mis-aligning the
subsequent version list decode.
Use xdr_align_size() for each string length to match what
xdr_encode_opaque() actually writes.
Fixes: efcae97fa425 ("NFSD: da_addr_body field missing in some GETDEVICEINFO replies")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-pnfs-fixes-v1-1-784f39dc1eca@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/flexfilelayoutxdr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -99,7 +99,8 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr
}
/* len + padding for two strings */
- addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
+ addr_len = 8 + xdr_align_size(da->netaddr.netid_len) +
+ xdr_align_size(da->netaddr.addr_len);
ver_len = 20;
len = 4 + ver_len + 4 + addr_len;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 195/713] nfsd: gate nfs2 setacl by argp->mask
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 194/713] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 196/713] nfsd: gate nfs3 " Greg Kroah-Hartman
` (528 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit a3a7e20ed66d3f04d37883c398da8a113b430769 upstream.
The NFSACL v2 SETACL path shares the decoder convention used by its
v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access
only when NFS_ACL is set in the request mask and argp->acl_default
only when NFS_DFACL is set, leaving the other pointer NULL because
the argument buffer is zeroed up to pc_argzero before decode.
nfsacld_proc_setacl() then hands both pointers to set_posix_acl()
unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS
"remove this ACL type" operation, so an omitted arm is
indistinguishable from an explicit request to delete that ACL. A
SETACL carrying only NFS_ACL silently strips the directory's default
ACL; mask=0 strips both.
This is the same defect just fixed in nfsd3_proc_setacl(); apply the
same remedy. Gate each set_posix_acl() call on its mask bit and
initialize error to 0 so that a request with neither bit set leaves
the on-disk ACLs untouched and returns success. The out_drop_lock
path and the unconditional posix_acl_release() in
nfsaclsvc_release_setacl() already tolerate the skipped arms.
Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs2acl.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -115,14 +115,19 @@ static __be32 nfsacld_proc_setacl(struct
inode_lock(inode);
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry, ACL_TYPE_ACCESS,
- argp->acl_access);
- if (error)
- goto out_drop_lock;
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry, ACL_TYPE_DEFAULT,
- argp->acl_default);
- if (error)
- goto out_drop_lock;
+ error = 0;
+ if (argp->mask & NFS_ACL) {
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_ACCESS, argp->acl_access);
+ if (error)
+ goto out_drop_lock;
+ }
+ if (argp->mask & NFS_DFACL) {
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, argp->acl_default);
+ if (error)
+ goto out_drop_lock;
+ }
inode_unlock(inode);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 196/713] nfsd: gate nfs3 setacl by argp->mask
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 195/713] nfsd: gate nfs2 setacl by argp->mask Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 197/713] nfsd: hold rcu across localio cmpxchg retry Greg Kroah-Hartman
` (527 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 453d7198a0ab07a12d46e0575861ac7b932da17e upstream.
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and
argp->acl_default verbatim. The NFSv3 ACL decoder only populates
those pointers when the corresponding mask bit is set:
nfs3svc_decode_setaclargs()
if (args->mask & NFS_ACL) decode into acl_access
if (args->mask & NFS_DFACL) decode into acl_default
/* otherwise the pointer stays NULL (pc_argzero) */
nfsd3_proc_setacl()
set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)
set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)
set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this
ACL type" operation. A NULL pointer that means "the client did not
send this arm" is therefore indistinguishable from "the client
asked to remove this ACL". A SETACL with mask=NFS_ACL silently
drops the directory's default ACL; mask=0 drops both.
The sibling nfsd3_proc_getacl() already consults argp->mask before
touching each arm; mirror that in setacl.
Fix by wrapping each set_posix_acl() call in the matching mask bit
check and initializing error to 0 before inode_lock so that a
request with neither bit set leaves the on-disk ACLs untouched and
returns nfs_ok. The out_drop_lock path and the unconditional
posix_acl_release() at out: are preserved; both NULL-tolerate the
skipped arms.
Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-5-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs3acl.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -105,12 +105,17 @@ static __be32 nfsd3_proc_setacl(struct s
inode_lock(inode);
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry, ACL_TYPE_ACCESS,
- argp->acl_access);
- if (error)
- goto out_drop_lock;
- error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry, ACL_TYPE_DEFAULT,
- argp->acl_default);
+ error = 0;
+ if (argp->mask & NFS_ACL) {
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_ACCESS, argp->acl_access);
+ if (error)
+ goto out_drop_lock;
+ }
+ if (argp->mask & NFS_DFACL) {
+ error = set_posix_acl(&nop_mnt_idmap, fh->fh_dentry,
+ ACL_TYPE_DEFAULT, argp->acl_default);
+ }
out_drop_lock:
inode_unlock(inode);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 197/713] nfsd: hold rcu across localio cmpxchg retry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 196/713] nfsd: gate nfs3 " Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 198/713] nfsd: initialize copy-notify stateid before publishing it Greg Kroah-Hartman
` (526 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 58884694978a3d7d111edb433d7fd6a6c5af2f34 upstream.
nfsd_file objects are freed via call_rcu (filecache.c:296), and
nfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU
(KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page
backing a freed nfsd_file becomes freely reclaimable once the RCU
grace period elapses.
The again: retry block in nfsd_open_local_fh() loads a pointer with
cmpxchg and then calls nfsd_file_get(new) (which is
refcount_inc_not_zero) without holding rcu_read_lock. The sole caller
nfs_open_local_fh() drops rcu_read_lock before invoking this helper,
so no outer reader-side critical section covers the load.
CPU 0 (nfsd_open_local_fh) CPU 1 (nfsd_file_put_local)
----- -----
new = cmpxchg(pnf, NULL, ...)
nf = xchg(pnf, NULL)
nfsd_file_put(nf)
last ref -> call_rcu()
/* grace period elapses;
slab page recycled */
nfsd_file_get(new)
refcount_inc_not_zero(&new->nf_ref)
/* operates on recycled memory */
A non-zero word at the nf_ref offset of the recycled object makes the
refcount bump appear to succeed, and the caller then dereferences
new->nf_net and new->nf_file out of freed memory.
Fix by taking rcu_read_lock() immediately before the cmpxchg and
releasing it on all three exits of the if (new) block: the goto-again
retry, the lost-race cleanup path, and the install-succeeded path.
nfsd_file_put() and nfsd_net_put() stay outside the RCU section so
they remain free to block.
Fixes: e6f7e1487ab5 ("nfs_localio: simplify interface to nfsd for getting nfsd_file")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260602-nfsd-testing-v2-2-e4ea62e3cd5c@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/localio.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/nfsd/localio.c
+++ b/fs/nfsd/localio.c
@@ -97,11 +97,15 @@ nfsd_open_local_fh(struct net *net, stru
}
nfsd_file_get(localio);
again:
+ rcu_read_lock();
new = unrcu_pointer(cmpxchg(pnf, NULL, RCU_INITIALIZER(localio)));
if (new) {
/* Some other thread installed an nfsd_file */
- if (nfsd_file_get(new) == NULL)
+ if (nfsd_file_get(new) == NULL) {
+ rcu_read_unlock();
goto again;
+ }
+ rcu_read_unlock();
/*
* Drop the ref we were going to install (both file and
* net) and the one we were going to return (only file).
@@ -110,6 +114,8 @@ nfsd_open_local_fh(struct net *net, stru
nfsd_net_put(net);
nfsd_file_put(localio);
localio = new;
+ } else {
+ rcu_read_unlock();
}
} else
nfsd_net_put(net);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 198/713] nfsd: initialize copy-notify stateid before publishing it
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 197/713] nfsd: hold rcu across localio cmpxchg retry Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 199/713] nfsd: initialize DRC hash table before registering shrinker Greg Kroah-Hartman
` (525 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 129643893b79f8a3c6b72045f933fbab5ee424ca upstream.
nfsd4_copy_notify() finished initializing the cpntf state after
nfs4_alloc_init_cpntf_state() had already linked it into the
s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the
membership reference) and none held for the caller. A racing
OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable
so_id) could reach manage_cpntf_state() and free the entry, turning the
caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid
writes into use-after-free. The owning clientid was also only recorded
after publication, so it could not gate an ownership check in that window.
Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()
before nfs4_init_cp_state() publishes the entry, and return it with an
extra reference. The caller reads the stateid under that reference and
drops it with nfs4_put_cpntf_state(); on a late error the laundromat
reaps the entry.
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-4-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 16 +++++++++-------
fs/nfsd/nfs4state.c | 10 +++++++++-
2 files changed, 18 insertions(+), 8 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2363,7 +2363,6 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
struct nfs4_stid *stid = NULL;
struct nfs4_cpntf_state *cps;
- struct nfs4_client *clp = cstate->clp;
status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
&cn->cpn_src_stateid, RD_STATE, NULL,
@@ -2377,12 +2376,14 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
cn->cpn_lease_time.tv_nsec = 0;
status = nfserrno(-ENOMEM);
+ /*
+ * The returned cps is published and fully initialized, and carries an
+ * extra reference for us; drop it once we are done with it.
+ */
cps = nfs4_alloc_init_cpntf_state(nn, stid);
if (!cps)
goto out;
memcpy(&cn->cpn_cnr_stateid, &cps->cp_stateid.cs_stid, sizeof(stateid_t));
- memcpy(&cps->cp_p_stateid, &stid->sc_stateid, sizeof(stateid_t));
- memcpy(&cps->cp_p_clid, &clp->cl_clientid, sizeof(clientid_t));
/* For now, only return one server address in cpn_src, the
* address used by the client to connect to this server.
@@ -2391,10 +2392,11 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
status = nfsd4_set_netaddr((struct sockaddr *)&rqstp->rq_daddr,
&cn->cpn_src->u.nl4_addr);
WARN_ON_ONCE(status);
- if (status) {
- nfs4_put_cpntf_state(nn, cps);
- goto out;
- }
+ /*
+ * Drop our extra reference. The membership reference keeps the entry
+ * alive for a later inter-server READ, or until the laundromat reaps it.
+ */
+ nfs4_put_cpntf_state(nn, cps);
out:
nfs4_put_stid(stid);
return status;
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -990,7 +990,15 @@ struct nfs4_cpntf_state *nfs4_alloc_init
/* So a stale list_del_init() before linking is a no-op. */
INIT_LIST_HEAD(&cps->cp_list);
cps->cpntf_time = ktime_get_boottime_seconds();
- refcount_set(&cps->cp_stateid.cs_count, 1);
+ /*
+ * Fully initialize the entry before nfs4_init_cp_state() publishes it,
+ * since a concurrent OFFLOAD_CANCEL could then free it. Take an extra
+ * reference for the caller (dropped with nfs4_put_cpntf_state()).
+ */
+ memcpy(&cps->cp_p_stateid, &p_stid->sc_stateid, sizeof(stateid_t));
+ memcpy(&cps->cp_p_clid, &p_stid->sc_client->cl_clientid,
+ sizeof(clientid_t));
+ refcount_set(&cps->cp_stateid.cs_count, 2);
if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID,
p_stid))
goto out_free;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 199/713] nfsd: initialize DRC hash table before registering shrinker
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 198/713] nfsd: initialize copy-notify stateid before publishing it Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 200/713] nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Greg Kroah-Hartman
` (524 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit b0c58934f5cc4f05b63ef6605dd10c1d0d489e88 upstream.
shrinker_register() precedes the INIT_LIST_HEAD loop and the
drc_hashsize store. On weakly-ordered architectures (arm64, ppc),
a shrinker scan can observe drc_hashsize before the bucket list
heads are initialized, causing a NULL deref in the DRC shrinker
callback.
Move bucket initialization and the drc_hashsize store before
shrinker_register() so the hash table is fully initialized before
it becomes visible to the shrinker.
Fixes: 8eea99a81c6f ("nfsd: dynamically allocate the nfsd-reply shrinker")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-18-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfscache.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -200,14 +200,14 @@ int nfsd_reply_cache_init(struct nfsd_ne
nn->nfsd_reply_cache_shrinker->seeks = 1;
nn->nfsd_reply_cache_shrinker->private_data = nn;
- shrinker_register(nn->nfsd_reply_cache_shrinker);
-
for (i = 0; i < hashsize; i++) {
INIT_LIST_HEAD(&nn->drc_hashtbl[i].lru_head);
spin_lock_init(&nn->drc_hashtbl[i].cache_lock);
}
nn->drc_hashsize = hashsize;
+ shrinker_register(nn->nfsd_reply_cache_shrinker);
+
return 0;
out_shrinker:
kvfree(nn->drc_hashtbl);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 200/713] nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 199/713] nfsd: initialize DRC hash table before registering shrinker Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 201/713] nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Greg Kroah-Hartman
` (523 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2c390c8a1764d67095fe444401861fac4c049362 upstream.
nfsd_debugfs_init() runs before nfsd4_init_slabs() in init_nfsd().
If the slab allocation fails, the bare "return retval" bypasses
nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops
pointers into the freed module text.
Move nfsd_debugfs_init() to after the slab init succeeds, so the
early return has no debugfs state to clean up.
Since debugfs is now the more recently initialized of the two, also
update the unwind paths to match reverse-initialization (LIFO) order:
run nfsd_debugfs_exit() before nfsd4_free_slabs() in both the
init_nfsd() error path and exit_nfsd(). The nfsd debugfs files only
reference module-global state and have no dependency on the slab
caches, so that reordering is a cleanup with no functional change.
Fixes: 9fe5ea760e64 ("NFSD: Add /sys/kernel/debug/nfsd")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-17-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -2592,11 +2592,12 @@ static int __init init_nfsd(void)
{
int retval;
- nfsd_debugfs_init();
-
retval = nfsd4_init_slabs();
if (retval)
return retval;
+
+ nfsd_debugfs_init();
+
retval = nfsd4_init_pnfs();
if (retval)
goto out_free_slabs;
@@ -2641,8 +2642,8 @@ out_free_lockd:
out_free_pnfs:
nfsd4_exit_pnfs();
out_free_slabs:
- nfsd4_free_slabs();
nfsd_debugfs_exit();
+ nfsd4_free_slabs();
return retval;
}
@@ -2657,9 +2658,9 @@ static void __exit exit_nfsd(void)
unregister_pernet_subsys(&nfsd_net_ops);
nfsd_drc_slab_free();
nfsd_lockd_shutdown();
- nfsd4_free_slabs();
nfsd4_exit_pnfs();
nfsd_debugfs_exit();
+ nfsd4_free_slabs();
}
MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 201/713] nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 200/713] nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 202/713] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Greg Kroah-Hartman
` (522 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 40162cfea79b9510380decfdd1795b754dc9f972 upstream.
The shrinker, GC worker, and fsnotify/lease callbacks can unhash an
nfsd_file from the rhashtable and then call
nfsd_file_dispose_list_delayed() to move it to the per-net dispose list.
If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk
misses the already-unhashed file, and its drain of the per-net dispose
list can run before the file has been queued. The file then sits on
the per-net list with no thread to drain it, leaking both the file and
its associated state.
The GC worker and shrinker already hold nfsd_gc_lock while walking the
LRU, but in the original code they release it before calling
nfsd_file_dispose_list_delayed(). The fsnotify/lease path
(nfsd_file_close_inode) has no synchronization at all.
Fix this by:
1. Widening nfsd_gc_lock in both nfsd_file_gc() and nfsd_file_lru_scan()
to cover the nfsd_file_dispose_list_delayed() call.
2. Wrapping nfsd_file_close_inode() in nfsd_gc_lock so that all three
callers of nfsd_file_dispose_list_delayed() hold the lock.
3. Adding a spin_lock/unlock(nfsd_gc_lock) barrier in
nfsd_file_cache_shutdown_net() after the purge, so that any
in-progress disposal has fully completed before the per-net list
is drained.
All operations inside the lock are non-sleeping (rhashtable lookups,
atomic bit/refcount ops, list moves, svc_wake_up), so the spinlock is
appropriate.
Fixes: ffb402596147 ("nfsd: Don't leave work of closing files to a work queue")
Cc: stable@vger.kernel.org # v6.15+
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Assisted-by: Claude:claude-opus-4-8
Link: https://patch.msgid.link/20260604-nfsd-testing-v4-1-3aeb1479c5bb@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/filecache.c | 38 +++++++++++++++++++++++++++++---------
1 file changed, 29 insertions(+), 9 deletions(-)
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -55,6 +55,17 @@
/* We only care about NFSD_MAY_READ/WRITE for this cache */
#define NFSD_FILE_MAY_MASK (NFSD_MAY_READ|NFSD_MAY_WRITE|NFSD_MAY_LOCALIO)
+/* If the shrinker runs between calls to list_lru_walk_node() in
+ * nfsd_file_gc(), the "remaining" count will be wrong. This could
+ * result in premature freeing of some files. This may not matter much
+ * but is easy to fix with this spinlock which temporarily disables
+ * the shrinker.
+ *
+ * It also serializes callers of nfsd_file_dispose_list_delayed()
+ * against per-net shutdown.
+ */
+static DEFINE_SPINLOCK(nfsd_gc_lock);
+
static DEFINE_PER_CPU(unsigned long, nfsd_file_cache_hits);
static DEFINE_PER_CPU(unsigned long, nfsd_file_acquisitions);
static DEFINE_PER_CPU(unsigned long, nfsd_file_allocations);
@@ -423,10 +434,16 @@ nfsd_file_dispose_list(struct list_head
* Transfers each file to the dispose list in its nfsd_net and wakes an nfsd
* thread to do the actual close. This keeps the cost of fput() in the nfsd
* threads rather than in the shrinker or GC worker.
+ *
+ * All callers must hold nfsd_gc_lock, so that nfsd_file_cache_shutdown_net()
+ * can synchronize against them before draining the per-net dispose list.
+ * This guarantees nf_net is still live when we call net_generic().
*/
static void
nfsd_file_dispose_list_delayed(struct list_head *dispose)
{
+ lockdep_assert_held(&nfsd_gc_lock);
+
while (!list_empty(dispose)) {
struct nfsd_file *nf = list_first_entry(dispose,
struct nfsd_file, nf_gc);
@@ -557,13 +574,6 @@ nfsd_file_gc_cb(struct list_head *item,
return nfsd_file_lru_cb(item, lru, arg);
}
-/* If the shrinker runs between calls to list_lru_walk_node() in
- * nfsd_file_gc(), the "remaining" count will be wrong. This could
- * result in premature freeing of some files. This may not matter much
- * but is easy to fix with this spinlock which temporarily disables
- * the shrinker.
- */
-static DEFINE_SPINLOCK(nfsd_gc_lock);
static void
nfsd_file_gc(void)
{
@@ -586,9 +596,9 @@ nfsd_file_gc(void)
remaining = 0;
}
}
+ nfsd_file_dispose_list_delayed(&dispose);
spin_unlock(&nfsd_gc_lock);
trace_nfsd_file_gc_removed(ret, list_lru_count(&nfsd_file_lru));
- nfsd_file_dispose_list_delayed(&dispose);
}
static void
@@ -616,9 +626,9 @@ nfsd_file_lru_scan(struct shrinker *s, s
ret = list_lru_shrink_walk(&nfsd_file_lru, sc,
nfsd_file_lru_cb, &dispose);
+ nfsd_file_dispose_list_delayed(&dispose);
spin_unlock(&nfsd_gc_lock);
trace_nfsd_file_shrinker_removed(ret, list_lru_count(&nfsd_file_lru));
- nfsd_file_dispose_list_delayed(&dispose);
return ret;
}
@@ -704,8 +714,10 @@ nfsd_file_close_inode(struct inode *inod
{
LIST_HEAD(dispose);
+ spin_lock(&nfsd_gc_lock);
nfsd_file_queue_for_close(inode, &dispose);
nfsd_file_dispose_list_delayed(&dispose);
+ spin_unlock(&nfsd_gc_lock);
}
/**
@@ -974,6 +986,14 @@ nfsd_file_cache_shutdown_net(struct net
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
nfsd_file_cache_purge(net);
+ /*
+ * Ensure any in-progress shrinker, GC, or fsnotify/lease callback
+ * (all of which hold nfsd_gc_lock while calling
+ * nfsd_file_dispose_list_delayed()) has fully completed before
+ * draining the per-net dispose list.
+ */
+ spin_lock(&nfsd_gc_lock);
+ spin_unlock(&nfsd_gc_lock);
nfsd_file_dispose_list(&nn->fcache_dispose_list);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 202/713] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 201/713] nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 203/713] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Greg Kroah-Hartman
` (521 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robbie Ko, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <robbieko@synology.com>
commit eb0eca7720662ba5847df1510e73801f7f473094 upstream.
A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD
carrying an atime or mtime whose nseconds field is out of range. The
value is well-formed on the wire and decodes cleanly into a valid
uint32, but it is not a valid timespec64: tv_nsec must be less than
NSEC_PER_SEC.
Nothing in the setattr path clamps it. notify_change() runs the time
through timestamp_truncate(), which does not reduce tv_nsec below
NSEC_PER_SEC when the filesystem supports nanosecond granularity
(s_time_gran == 1), and the inode atime/mtime setters store it verbatim
(only ctime is normalized, via inode_set_ctime_to_ts()). The
un-normalized value then corrupts on-disk metadata: ext4's
ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which
overflows the 32-bit extra field and clobbers the seconds-epoch bits, so
the stored seconds (and thus the year) are wrong on read-back. XFS with
bigtime mis-stores the timestamp for the same reason.
Validate the client-supplied atime/mtime in the proc handlers and return
NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL
for SETATTR and describes it as the error for a value the server 'can
not store ... in its own representation'; the client maps it to EINVAL.
Checking in the proc handlers, rather than in nfsd_setattr(), keeps the
rejection in front of object creation. The create operations create the
object before nfsd_create_setattr() runs, so a late failure would leave
the new object behind and turn a non-idempotent request into a namespace
change that reports failure. The check is therefore done up front, for
the create operations before the object is created.
tv_nsec is a long, so the comparison casts it to unsigned long (the same
width) rather than to u32, matching timespec64_valid(). A u32 cast would
truncate on 64-bit; the unsigned long cast also rejects a value that
became negative when an out-of-range u32 wire nseconds was assigned to a
32-bit long.
Only client-supplied times are checked: SET_TO_SERVER_TIME requests
carry no client value. The sattrguard3 ctime is deliberately left alone:
an out-of-range guard simply never matches the object's ctime and yields
NFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the
protocol-correct outcome rather than rejecting the request.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Robbie Ko <robbieko@synology.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260616054027.2360930-2-robbieko@synology.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs3proc.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -29,6 +29,25 @@ static int nfs3_ftypes[] = {
S_IFIFO, /* NF3FIFO */
};
+/*
+ * Reject a client-supplied atime or mtime whose nanoseconds field is out
+ * of range. Such a value is well-formed on the wire but is not a valid
+ * timespec64, and storing it verbatim can corrupt on-disk timestamps.
+ * tv_nsec is a long, so it is cast to unsigned long (the same width) to
+ * catch both an over-large value and one that became negative when an
+ * out-of-range u32 wire nseconds was assigned to a 32-bit long.
+ */
+static bool nfsd3_time_in_range(const struct iattr *iap)
+{
+ if ((iap->ia_valid & ATTR_ATIME_SET) &&
+ (unsigned long)iap->ia_atime.tv_nsec >= NSEC_PER_SEC)
+ return false;
+ if ((iap->ia_valid & ATTR_MTIME_SET) &&
+ (unsigned long)iap->ia_mtime.tv_nsec >= NSEC_PER_SEC)
+ return false;
+ return true;
+}
+
static __be32 nfsd3_map_status(__be32 status)
{
switch (status) {
@@ -101,9 +120,14 @@ nfsd3_proc_setattr(struct svc_rqst *rqst
SVCFH_fmt(&argp->fh));
fh_copy(&resp->fh, &argp->fh);
+ if (!nfsd3_time_in_range(&argp->attrs)) {
+ resp->status = nfserr_inval;
+ goto out;
+ }
if (argp->check_guard)
guardtime = &argp->guardtime;
resp->status = nfsd_setattr(rqstp, &resp->fh, &attrs, guardtime);
+out:
resp->status = nfsd3_map_status(resp->status);
return rpc_success;
}
@@ -265,6 +289,8 @@ nfsd3_create_file(struct svc_rqst *rqstp
trace_nfsd_vfs_create(rqstp, fhp, S_IFREG, argp->name, argp->len);
+ if (!nfsd3_time_in_range(iap))
+ return nfserr_inval;
if (isdotent(argp->name, argp->len))
return nfserr_exist;
if (!(iap->ia_valid & ATTR_MODE))
@@ -400,8 +426,13 @@ nfsd3_proc_mkdir(struct svc_rqst *rqstp)
argp->attrs.ia_valid &= ~ATTR_SIZE;
fh_copy(&resp->dirfh, &argp->fh);
fh_init(&resp->fh, NFS3_FHSIZE);
+ if (!nfsd3_time_in_range(&argp->attrs)) {
+ resp->status = nfserr_inval;
+ goto out;
+ }
resp->status = nfsd_create(rqstp, &resp->dirfh, argp->name, argp->len,
&attrs, S_IFDIR, 0, &resp->fh);
+out:
resp->status = nfsd3_map_status(resp->status);
return rpc_success;
}
@@ -415,6 +446,10 @@ nfsd3_proc_symlink(struct svc_rqst *rqst
.na_iattr = &argp->attrs,
};
+ if (!nfsd3_time_in_range(&argp->attrs)) {
+ resp->status = nfserr_inval;
+ goto out;
+ }
if (argp->tlen == 0) {
resp->status = nfserr_inval;
goto out;
@@ -471,6 +506,11 @@ nfsd3_proc_mknod(struct svc_rqst *rqstp)
goto out;
}
+ if (!nfsd3_time_in_range(&argp->attrs)) {
+ resp->status = nfserr_inval;
+ goto out;
+ }
+
type = nfs3_ftypes[argp->ftype];
resp->status = nfsd_create(rqstp, &resp->dirfh, argp->name, argp->len,
&attrs, type, rdev, &resp->fh);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 203/713] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 202/713] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 204/713] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Greg Kroah-Hartman
` (520 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robbie Ko, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <robbieko@synology.com>
commit 26709c8ffe73772eb69e68d553ac71d91228dccc upstream.
The NFSv2 sattr decoder converts the wire useconds to nanoseconds in
svcxdr_decode_sattr():
iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;
tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in
unsigned long. On ILP32 that is 32 bits, and an out-of-range useconds
value such as 4294968 wraps to tv_nsec == 704. The corruption therefore
happens during decode, before any proc function can inspect the value,
and a later range check on tv_nsec would see an in-range result and
accept it. Rejecting in the decoder yields an RPC GARBAGE_ARGS reply.
NFSv2 defines no NFSERR_INVAL, so there is no NFS-level status to return
for a malformed time argument, and the check cannot move to the proc
function the way the v3/v4 nsec range checks do.
Guard the raw useconds before the multiplication and reject values
greater than 1000000. useconds == 1000000 is kept: it is the Sun
convention for "set to the current server time", and the in-tree Linux
NFSv2 client emits it in both the atime and the mtime field for a plain
touch / utimes(file, NULL) (see encode_sattr() and
xdr_encode_current_server_time() in fs/nfs/nfs2xdr.c). Rejecting 1000000
would turn that common operation into a hard decode failure for both
SETATTR and CREATE. 1000000 * NSEC_PER_USEC is 10^9, which does not wrap
on ILP32, so the Sun convention value passes through safely. Only
genuinely out-of-range values (> 1000000) are rejected. The atime and
mtime guards are therefore symmetric.
The decoder only applied the Sun convention in the mtime block, which
clears ATTR_ATIME_SET|ATTR_MTIME_SET when mtime useconds == 1000000. If a
client puts 1000000 in the atime field but not in the mtime field, the
atime block stored an out-of-range tv_nsec (10^9) and left ATTR_ATIME_SET
set, so the bogus value reached the filesystem. Apply the convention in
the atime block as well, clearing ATTR_ATIME_SET so the server uses its
current time and ignores the value. Only ATTR_ATIME_SET is cleared there.
The mtime block keeps its existing behavior, where 1000000 means "set
both atime and mtime to now".
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Robbie Ko <robbieko@synology.com>
[ cel: various tweaks, addenda, and clean-ups ]
Link: https://patch.msgid.link/20260616054027.2360930-1-robbieko@synology.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsxdr.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -10,6 +10,16 @@
#include "auth.h"
/*
+ * Sun convention: a sattr time-useconds field of one full second (an
+ * otherwise out-of-range value) means "set this time to the current
+ * server time." It's needed to make permissions checks for the "touch"
+ * program across NFSv2 mounts work correctly. See description of
+ * sattr in section 6.1 of "NFS Illustrated" by Brent Callaghan,
+ * Addison-Wesley, ISBN 0-201-32750-5
+ */
+#define NFS2_SATTR_SET_TO_SERVER_TIME (1000000)
+
+/*
* Mapping of S_IF* types to NFS file types
*/
static const u32 nfs_ftypes[] = {
@@ -172,27 +182,29 @@ svcxdr_decode_sattr(struct svc_rqst *rqs
tmp1 = be32_to_cpup(p++);
tmp2 = be32_to_cpup(p++);
if (tmp1 != (u32)-1 && tmp2 != (u32)-1) {
+ /*
+ * Range test here to prevent the multiplication from
+ * wrapping to a valid (but incorrect) value on 32-bit
+ * platforms.
+ */
+ if (tmp2 > NFS2_SATTR_SET_TO_SERVER_TIME)
+ return false;
iap->ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
iap->ia_atime.tv_sec = tmp1;
iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;
+ if (tmp2 == NFS2_SATTR_SET_TO_SERVER_TIME)
+ iap->ia_valid &= ~ATTR_ATIME_SET;
}
tmp1 = be32_to_cpup(p++);
tmp2 = be32_to_cpup(p++);
if (tmp1 != (u32)-1 && tmp2 != (u32)-1) {
+ if (tmp2 > NFS2_SATTR_SET_TO_SERVER_TIME)
+ return false;
iap->ia_valid |= ATTR_MTIME | ATTR_MTIME_SET;
iap->ia_mtime.tv_sec = tmp1;
iap->ia_mtime.tv_nsec = tmp2 * NSEC_PER_USEC;
- /*
- * Passing the invalid value useconds=1000000 for mtime
- * is a Sun convention for "set both mtime and atime to
- * current server time". It's needed to make permissions
- * checks for the "touch" program across v2 mounts to
- * Solaris and Irix boxes work correctly. See description of
- * sattr in section 6.1 of "NFS Illustrated" by
- * Brent Callaghan, Addison-Wesley, ISBN 0-201-32750-5
- */
- if (tmp2 == 1000000)
+ if (tmp2 == NFS2_SATTR_SET_TO_SERVER_TIME)
iap->ia_valid &= ~(ATTR_ATIME_SET|ATTR_MTIME_SET);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 204/713] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 203/713] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 205/713] nfsd: release OPEN-decoded posix ACLs via op_release Greg Kroah-Hartman
` (519 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2327ba1d9546727a35b17888777e991f68a9b305 upstream.
nfsd4_lock() only checks the namespace-wide grace flag when deciding
whether to accept a reclaim LOCK. It does not check the per-client
NFSD4_CLIENT_RECLAIM_COMPLETE bit. An NFSv4.1+ client that has
already sent RECLAIM_COMPLETE can submit lk_reclaim=1 while grace is
still active (e.g. lockd holds the grace list open), and the server
accepts it instead of returning NFS4ERR_NO_GRACE as required by
RFC 8881 section 18.51.3.
The OPEN path already enforces both tiers: the grace check plus the
per-client RECLAIM_COMPLETE check in nfs4_check_open_reclaim(). Add
the equivalent per-client check to the LOCK path.
Fixes: 3b3e7b72239a ("nfsd: reject reclaim request when client has already sent RECLAIM_COMPLETE")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: Correct the RFC citations in the commit message ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-14-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -8586,6 +8586,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
status = nfserr_no_grace;
if (!locks_in_grace(net) && lock->lk_reclaim)
goto out;
+ if (lock->lk_reclaim &&
+ test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags))
+ goto out;
if (lock->lk_reclaim)
flags |= FL_RECLAIM;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 205/713] nfsd: release OPEN-decoded posix ACLs via op_release
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 204/713] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 206/713] nfsd: revoke copy-notify stateids before dropping their reference Greg Kroah-Hartman
` (518 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, NeilBrown, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 8215892993ea9f5231da4fa9eb42428a286fce8b upstream.
nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
refcounted struct posix_acl objects via posix_acl_alloc() and stores
them in open->op_pacl and open->op_dpacl. These pointers must be
released once the OPEN compound finishes.
When nfsd4_decode_open_claim4() returns a non-seqid-mutating error,
the dispatcher short-circuits before op_func runs:
nfsd4_proc_compound()
if (op->status && op->opnum == OP_OPEN)
op->status = nfsd4_open_omfg(...)
if (!seqid_mutating_err(ntohl(op->status)))
return op->status; /* nfsd4_open() never runs */
...
opdesc->op_release(&op->u) /* must still release op_pacl/op_dpacl */
Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the
release pair lived inside nfsd4_open() at its out_err: label. On the
short-circuit path nfsd4_open() is never invoked, so both posix_acl
refs leak on every malformed OPEN compound that carries valid POSIX
ACL createhow4 attributes.
Add nfsd4_open_release() and wire it as .op_release for OP_OPEN.
posix_acl_release() is NULL-safe, so the single release site covers
both the normal path and the nfsd4_open_omfg short-circuit. Remove
the matching posix_acl_release() pair from nfsd4_open()'s out_err:
label to avoid double-releasing.
The compound loop has two encoding branches: nfsd4_encode_operation()
for normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.
op_release was only called from nfsd4_encode_operation(), so resources
attached to op->u leak on the replay path.
Move the op_release() call out of nfsd4_encode_operation() and the
replay branch, placing it after the if-else in nfsd4_proc_compound().
This gives a single call site in a fairly obviously-correct place,
covering both the normal encoding and replay paths.
Fixes: 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260601-nfsd-testing-v3-1-a31cd10bdd4f@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 13 +++++++++++--
fs/nfsd/nfs4xdr.c | 3 ---
2 files changed, 11 insertions(+), 5 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -681,8 +681,6 @@ out:
nfsd4_cleanup_open_state(cstate, open);
nfsd4_bump_seqid(cstate, status);
out_err:
- posix_acl_release(open->op_dpacl);
- posix_acl_release(open->op_pacl);
return status;
}
@@ -704,6 +702,13 @@ static __be32 nfsd4_open_omfg(struct svc
return nfsd4_open(rqstp, cstate, &op->u);
}
+static void
+nfsd4_open_release(union nfsd4_op_u *u)
+{
+ posix_acl_release(u->open.op_dpacl);
+ posix_acl_release(u->open.op_pacl);
+}
+
/*
* filehandle-manipulating ops.
*/
@@ -3271,6 +3276,9 @@ encode_op:
status = op->status;
}
+ if (op->opdesc && op->opdesc->op_release)
+ op->opdesc->op_release(&op->u);
+
trace_nfsd_compound_status(args->client_opcnt, resp->opcnt,
status, nfsd4_op_name(op->opnum));
@@ -3770,6 +3778,7 @@ static const struct nfsd4_operation nfsd
},
[OP_OPEN] = {
.op_func = nfsd4_open,
+ .op_release = nfsd4_open_release,
.op_flags = OP_HANDLES_WRONGSEC | OP_MODIFIES_SOMETHING,
.op_name = "OP_OPEN",
.op_rsize_bop = nfsd4_open_rsize,
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6420,9 +6420,6 @@ status:
write_bytes_to_xdr_buf(xdr->buf, op_status_offset,
&op->status, XDR_UNIT);
release:
- if (opdesc && opdesc->op_release)
- opdesc->op_release(&op->u);
-
/*
* Account for pages consumed while encoding this operation.
* The xdr_stream primitives don't manage rq_next_page.
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 206/713] nfsd: revoke copy-notify stateids before dropping their reference
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 205/713] nfsd: release OPEN-decoded posix ACLs via op_release Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 207/713] NFSD: Prevent lock owner use-after-free during client teardown Greg Kroah-Hartman
` (517 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7 upstream.
Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent
stid's sc_cp_list, pinned by a single membership reference.
_free_cpntf_state_locked() only unlinks an entry once its refcount reaches
zero, so any revoke path that runs while a concurrent
find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops
the reference without unlinking, leaving the entry discoverable with its
membership reference already consumed. A second revoke or a laundromat tick
then frees it while the reader still holds the pointer -- a
KASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().
This affected all three revoke paths:
- The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called
_free_cpntf_state_locked() on the first list entry; a holder that had
bumped cs_count made it return early, so the next iteration
re-decremented and burned the holder's reference.
- OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise
used _free_cpntf_state_locked() and could drop 2->1 without unlinking.
Add revoke_cpntf_state_locked(), which unhashes the entry from the IDR and
sc_cp_list first (deferring the final free to any holder), and use it from
all three revoke paths. The drain now walks with list_for_each_entry_safe()
and revokes each entry unconditionally, so it terminates in one pass per
entry regardless of cs_count. The unhash is gated on
!list_empty(&cps->cp_list); the idr_remove() gate matters because
idr_alloc_cyclic() may have recycled the so_id by then. Keep
_free_cpntf_state_locked() for the reference-holder put path only, where a
concurrent revoke may already have unlinked the entry (its list_del_init()
then a no-op).
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-6-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 78 +++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 62 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1021,18 +1021,66 @@ void nfs4_free_copy_state(struct nfsd4_c
spin_unlock(&nn->s2s_cp_lock);
}
+/*
+ * Drop the parent's reference on an already-unlinked cpntf entry. If a
+ * concurrent holder still owns a reference, its nfs4_put_cpntf_state() does
+ * the final free.
+ *
+ * nn->s2s_cp_lock must be held.
+ */
+static void put_cpntf_state_unlinked_locked(struct nfs4_cpntf_state *cps)
+{
+ WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
+ WARN_ON_ONCE(!list_empty(&cps->cp_list));
+
+ if (refcount_dec_and_test(&cps->cp_stateid.cs_count))
+ kfree(cps);
+}
+
+/*
+ * Unhash from the IDR and sc_cp_list. Gated on list_empty() to avoid
+ * evicting a recycled so_id.
+ */
+static void nfsd4_unhash_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
+{
+ lockdep_assert_held(&nn->s2s_cp_lock);
+
+ if (!list_empty(&cps->cp_list)) {
+ list_del_init(&cps->cp_list);
+ idr_remove(&nn->s2s_cp_stateids, cps->cp_stateid.cs_stid.si_opaque.so_id);
+ }
+}
+
+/*
+ * Revoke a copy-notify stateid: unlink it from the IDR and sc_cp_list first
+ * so no new finder can discover it, then drop the membership reference. Every
+ * revoke path (cancel, laundromat, drain) must use this rather than
+ * _free_cpntf_state_locked(), which unlinks only at refcount zero and so could
+ * let a second revoke free the entry under a concurrent reader.
+ *
+ * nn->s2s_cp_lock must be held.
+ */
+static void revoke_cpntf_state_locked(struct nfsd_net *nn,
+ struct nfs4_cpntf_state *cps)
+{
+ nfsd4_unhash_cpntf_state(nn, cps);
+ put_cpntf_state_unlinked_locked(cps);
+}
+
static void nfs4_free_cpntf_statelist(struct net *net, struct nfs4_stid *stid)
{
- struct nfs4_cpntf_state *cps;
+ struct nfs4_cpntf_state *cps, *tmp;
struct nfsd_net *nn;
nn = net_generic(net, nfsd_net_id);
spin_lock(&nn->s2s_cp_lock);
- while (!list_empty(&stid->sc_cp_list)) {
- cps = list_first_entry(&stid->sc_cp_list,
- struct nfs4_cpntf_state, cp_list);
- _free_cpntf_state_locked(nn, cps);
- }
+ /*
+ * Revoke unlinks each entry before dropping the parent's reference, so
+ * the drain terminates in one pass per entry regardless of cs_count; a
+ * concurrent holder does the final kfree via nfs4_put_cpntf_state().
+ */
+ list_for_each_entry_safe(cps, tmp, &stid->sc_cp_list, cp_list)
+ revoke_cpntf_state_locked(nn, cps);
spin_unlock(&nn->s2s_cp_lock);
}
@@ -7142,7 +7190,7 @@ nfs4_laundromat(struct nfsd_net *nn)
cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid);
if (cps->cp_stateid.cs_type == NFS4_COPYNOTIFY_STID &&
state_expired(<, cps->cpntf_time))
- _free_cpntf_state_locked(nn, cps);
+ revoke_cpntf_state_locked(nn, cps);
}
spin_unlock(&nn->s2s_cp_lock);
nfsd4_async_copy_reaper(nn);
@@ -7529,16 +7577,14 @@ nfs4_check_file(struct svc_rqst *rqstp,
out:
return status;
}
-static void
-_free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
+
+static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
{
WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
- if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
- return;
- list_del_init(&cps->cp_list);
- idr_remove(&nn->s2s_cp_stateids,
- cps->cp_stateid.cs_stid.si_opaque.so_id);
- kfree(cps);
+ if (refcount_dec_and_test(&cps->cp_stateid.cs_count)) {
+ nfsd4_unhash_cpntf_state(nn, cps);
+ kfree(cps);
+ }
}
/*
* A READ from an inter server to server COPY will have a
@@ -7575,7 +7621,7 @@ __be32 manage_cpntf_state(struct nfsd_ne
state = NULL;
goto unlock;
} else {
- _free_cpntf_state_locked(nn, state);
+ revoke_cpntf_state_locked(nn, state);
}
}
unlock:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 207/713] NFSD: Prevent lock owner use-after-free during client teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 206/713] nfsd: revoke copy-notify stateids before dropping their reference Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 208/713] NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Greg Kroah-Hartman
` (516 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfgang Walter, NeilBrown,
Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 5e2fa29d223a9a1e6a948e40b109d09081d1decd upstream.
__destroy_client() releases a client's open owners, but a lock owner
whose only reference is a blocked lock (nbl) stays on
cl_ownerstr_hashtbl. client_has_state() does not count a bare owner,
so DESTROY_CLIENTID can reach __destroy_client() with such owners
present.
__destroy_client() then walks the table, calling remove_blocked_locks()
on each owner without a reference. Freeing a blocked lock drops the
owner reference held via flc_owner. The per-net laundromat reaps
blocked locks from nn->blocked_locks_lru independently of client state.
The two paths share blocked_locks_lock only for the list splice, not
the owner's lifetime. The laundromat therefore frees the owner as
__destroy_client() dereferences it, a NULL dereference in
remove_blocked_locks().
nfsd4_release_lockowner() holds a reference across the same call;
__destroy_client() does not. Hold cl_lock across the walk, taking a
reference and unhashing each owner, then drop it before
remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock.
Reported-by: Wolfgang Walter <linux@stwm.de>
Closes: https://lore.kernel.org/linux-nfs/6eccafaaaa60651ef091257c3439c46b@stwm.de/
Fixes: 68ef3bc31664 ("nfsd: remove blocked locks on client teardown")
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260709-cel-v4-1-1d519d9be0cb@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2712,14 +2712,24 @@ __destroy_client(struct nfs4_client *clp
release_openowner(oo);
}
for (i = 0; i < OWNER_HASH_SIZE; i++) {
- struct nfs4_stateowner *so, *tmp;
+ struct nfs4_stateowner *so;
- list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
- so_strhash) {
+ spin_lock(&clp->cl_lock);
+ while (!list_empty(&clp->cl_ownerstr_hashtbl[i])) {
+ so = list_first_entry(&clp->cl_ownerstr_hashtbl[i],
+ struct nfs4_stateowner, so_strhash);
/* Should be no openowners at this point */
WARN_ON_ONCE(so->so_is_open_owner);
+ nfs4_get_stateowner(so);
+ unhash_lockowner_locked(lockowner(so));
+ spin_unlock(&clp->cl_lock);
+
remove_blocked_locks(lockowner(so));
+ nfs4_put_stateowner(so);
+
+ spin_lock(&clp->cl_lock);
}
+ spin_unlock(&clp->cl_lock);
}
nfsd4_return_all_client_layouts(clp);
nfsd4_shutdown_copy(clp);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 208/713] NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 207/713] NFSD: Prevent lock owner use-after-free during client teardown Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 209/713] NFSD: Prevent client use-after-free during admin state revocation Greg Kroah-Hartman
` (515 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Musaab Khan, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 292d915d3ba6fd15eeb88351fa10581683073109 upstream.
Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs
nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the
handler confirms that nn->nfsd_serv is set. Once nfsd has shut down,
nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the
pointer intact, so the cancel helper iterates freed slab memory as an
array of struct list_head and then dereferences a bogus nfs4_client
when it takes clp->async_lock. A local administrator holding
CAP_SYS_ADMIN can reach this use-after-free by stopping the server and
then writing to unlock_filesystem; KASAN reports a slab-use-after-free
read in nfsd4_cancel_copy_by_sb().
nfsd4_revoke_states() walks the same state tables and for that reason
already runs only under nfsd_mutex with nn->nfsd_serv confirmed
present. Move the async COPY cancel into that protected section so
every NFSv4 state-table walker on this path observes a running server.
Async copies exist only while the server runs, so gating the cancel on
nn->nfsd_serv loses nothing.
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Fixes: 3daab3112f03 ("nfsd: cancel async COPY operations when admin revokes filesystem state")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260613-unlock-filesystem-uaf-v1-1-462b9bec8c84@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -296,14 +296,15 @@ static ssize_t write_unlock_fs(struct fi
* 2. Is that directory a mount point, or
* 3. Is that directory the root of an exported file system?
*/
- nfsd4_cancel_copy_by_sb(netns(file), path.dentry->d_sb);
error = nlmsvc_unlock_all_by_sb(path.dentry->d_sb);
mutex_lock(&nfsd_mutex);
nn = net_generic(netns(file), nfsd_net_id);
- if (nn->nfsd_serv)
+ if (nn->nfsd_serv) {
+ nfsd4_cancel_copy_by_sb(netns(file), path.dentry->d_sb);
nfsd4_revoke_states(nn, path.dentry->d_sb);
- else
+ } else {
error = -EINVAL;
+ }
mutex_unlock(&nfsd_mutex);
path_put(&path);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 209/713] NFSD: Prevent client use-after-free during admin state revocation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 208/713] NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 210/713] NFSD: Prevent client use-after-free during delegation revoke Greg Kroah-Hartman
` (514 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit e270e5a0778e5bff852c8862ce9576ce70359393 upstream.
A stateid holds only a bare pointer to its nfs4_client; a stateid
reference does not pin it. The client survives only because
__destroy_client() drains its stateids before free_client() runs.
nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(),
which dereferences the client to revoke a stateid and read
clp->cl_minorversion. A teardown racing the dropped lock can free
the client first.
Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and
EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero.
force_expire_client() ignores it: once its wait for cl_rpc_users to
reach zero has passed, a later pin goes unnoticed.
Under client_lock, skip a client whose cl_time is already zero --
force_expire_client() clears it there before waiting -- otherwise pin
cl_rpc_users before dropping the lock. The walk then either sees the
expiry and skips, or pins in time for that wait to cover the revoke.
Fixes: 1c13bf9f2e3c ("nfsd: allow lock state ids to be revoked and then freed")
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260709-cel-v4-3-1d519d9be0cb@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1960,9 +1960,19 @@ void nfsd4_revoke_states(struct nfsd_net
struct nfs4_client *clp;
retry:
list_for_each_entry(clp, head, cl_idhash) {
- struct nfs4_stid *stid = find_one_sb_stid(clp, sb,
- sc_types);
+ struct nfs4_stid *stid;
+
+ /*
+ * force_expire_client() ignores cl_rpc_users once
+ * its wait_event() has passed, so pinning cannot
+ * keep an already-expiring client alive; the
+ * expiry path revokes its states instead.
+ */
+ if (is_client_expired(clp))
+ continue;
+ stid = find_one_sb_stid(clp, sb, sc_types);
if (stid) {
+ atomic_inc(&clp->cl_rpc_users);
spin_unlock(&nn->client_lock);
revoke_one_stid(nn, clp, stid);
nfs4_put_stid(stid);
@@ -1975,6 +1985,9 @@ void nfsd4_revoke_states(struct nfsd_net
*/
nn->nfs40_last_revoke =
ktime_get_boottime_seconds();
+ if (atomic_dec_and_test(&clp->cl_rpc_users) &&
+ is_client_expired(clp))
+ wake_up_all(&expiry_wq);
goto retry;
}
}
@@ -3347,6 +3360,11 @@ static void force_expire_client(struct n
trace_nfsd_clid_admin_expired(&clp->cl_clientid);
+ /*
+ * cl_time is cleared under client_lock before the wait so a
+ * revocation walk pinning cl_rpc_users under it either skips
+ * this client or is seen by this wait_event().
+ */
spin_lock(&nn->client_lock);
clp->cl_time = 0;
spin_unlock(&nn->client_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 210/713] NFSD: Prevent client use-after-free during delegation revoke
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 209/713] NFSD: Prevent client use-after-free during admin state revocation Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 211/713] NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Greg Kroah-Hartman
` (513 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 4683ca76b3b7e5808338491c6eb3c20e6b4894d5 upstream.
A delegation stateid holds only a bare pointer to its owning
nfs4_client and does not keep it alive. The client survives its
stateids only because __destroy_client() drains cl_delegations and
cl_revoked before free_client() runs.
nfs4_laundromat() breaks that invariant: it unhashes an
expired delegation from cl_delegations, drops deleg_lock, then
revoke_delegation() relinks it onto cl_revoked under cl_lock. In that
window the delegation is on neither list, so client_has_state() can
report no remaining state.
Every teardown path first requires cl_rpc_users to be zero, but
the laundromat holds no such reference. A client whose recalled
delegation has just timed out can therefore reach free_client()
while revoke_delegation() is still about to dereference cl_lock,
a use-after-free.
Pin the client with cl_rpc_users across the revoke so teardown blocks
until it completes, then reap the delegation from cl_revoked. A client
already expiring reaps its own, so skip it and leave the delegation on
del_recall_lru.
Fixes: 3bd64a5ba171 ("nfsd4: implement SEQ4_STATUS_RECALLABLE_STATE_REVOKED")
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260709-cel-v4-2-1d519d9be0cb@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/netns.h | 6 ++++--
fs/nfsd/nfs4state.c | 23 +++++++++++++++++++++++
2 files changed, 27 insertions(+), 2 deletions(-)
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -115,7 +115,8 @@ struct nfsd_net {
struct list_head client_lru;
struct list_head close_lru;
- /* protects del_recall_lru and delegation hash/unhash */
+ /* protects del_recall_lru and delegation hash/unhash;
+ * nests outside client_lock */
spinlock_t deleg_lock ____cacheline_aligned;
struct list_head del_recall_lru;
@@ -124,7 +125,8 @@ struct nfsd_net {
struct delayed_work laundromat_work;
- /* client_lock protects the client lru list and session hash table */
+ /* client_lock protects the client lru list and session hash
+ * table; nests inside deleg_lock */
spinlock_t client_lock;
/* protects blocked_locks_lru */
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7204,6 +7204,7 @@ nfs4_laundromat(struct nfsd_net *nn)
.new_timeo = nn->nfsd4_lease
};
struct nfs4_cpntf_state *cps;
+ struct nfs4_client *clp;
copy_stateid_t *cps_t;
int i;
@@ -7232,6 +7233,18 @@ nfs4_laundromat(struct nfsd_net *nn)
dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
if (!state_expired(<, dp->dl_time))
break;
+ clp = dp->dl_stid.sc_client;
+ spin_lock(&nn->client_lock);
+ if (is_client_expired(clp)) {
+ spin_unlock(&nn->client_lock);
+ continue;
+ }
+ /*
+ * Pin without reviving: get_client_locked() would
+ * flip a courtesy client back to NFSD4_ACTIVE.
+ */
+ atomic_inc(&clp->cl_rpc_users);
+ spin_unlock(&nn->client_lock);
refcount_inc(&dp->dl_stid.sc_count);
unhash_delegation_locked(dp, SC_STATUS_REVOKED);
list_add(&dp->dl_recall_lru, &reaplist);
@@ -7240,8 +7253,18 @@ nfs4_laundromat(struct nfsd_net *nn)
while (!list_empty(&reaplist)) {
dp = list_first_entry(&reaplist, struct nfs4_delegation,
dl_recall_lru);
+ clp = dp->dl_stid.sc_client;
list_del_init(&dp->dl_recall_lru);
revoke_delegation(dp);
+ /*
+ * Unpin without renewing: put_client_renew() would
+ * renew the reaped client's lease.
+ */
+ if (atomic_dec_and_lock(&clp->cl_rpc_users, &nn->client_lock)) {
+ if (is_client_expired(clp))
+ wake_up_all(&expiry_wq);
+ spin_unlock(&nn->client_lock);
+ }
}
spin_lock(&nn->client_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 211/713] NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 210/713] NFSD: Prevent client use-after-free during delegation revoke Greg Kroah-Hartman
@ 2026-09-04 4:52 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 212/713] nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update Greg Kroah-Hartman
` (512 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 7b4f8a1586c42d3afc3c0ac779af2db7ab1a5c55 upstream.
nfs40_clean_admin_revoked() takes a stateid reference under
clp->cl_lock, drops nn->client_lock, and calls
nfsd4_drop_revoked_stid(), which dereferences the stateid's client
through s->sc_client->cl_lock. The stateid reference does not pin the
client, so a teardown racing the dropped lock can free the client
while nfsd4_drop_revoked_stid() is still using it.
This cleanup runs from the laundromat, so a periodic sweep can race
force_expire_client() driven by a write to the clients/<id>/ctl file.
Skip a client that is already expiring and otherwise pin it with
cl_rpc_users under client_lock before dropping the lock, matching
nfsd4_revoke_states().
Fixes: d688d8585e6b ("nfsd: allow admin-revoked NFSv4.0 state to be freed.")
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260709-cel-v4-5-1d519d9be0cb@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7174,16 +7174,22 @@ retry:
if (atomic_read(&clp->cl_admin_revoked) == 0)
continue;
+ if (is_client_expired(clp))
+ continue;
spin_lock(&clp->cl_lock);
idr_for_each_entry_ul(&clp->cl_stateids, stid, tmp, id)
if (stid->sc_status & SC_STATUS_ADMIN_REVOKED) {
refcount_inc(&stid->sc_count);
+ atomic_inc(&clp->cl_rpc_users);
spin_unlock(&nn->client_lock);
/* this function drops ->cl_lock */
nfsd4_drop_revoked_stid(stid);
nfs4_put_stid(stid);
spin_lock(&nn->client_lock);
+ if (atomic_dec_and_test(&clp->cl_rpc_users) &&
+ is_client_expired(clp))
+ wake_up_all(&expiry_wq);
goto retry;
}
spin_unlock(&clp->cl_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 212/713] nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-09-04 4:52 ` [PATCH 7.2 211/713] NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 213/713] libceph: validate OSD extent maps before cursor advance Greg Kroah-Hartman
` (511 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 0a5a548861ab09e79a6b3062ac17e410323af3cd upstream.
clients_still_reclaiming() uses separate test_bit() and clear_bit()
calls on NFSD_NET_SOMEBODY_RECLAIMED. A concurrent set_bit() from
the OPEN or LOCK reclaim path arriving between the test and clear
is silently lost, causing the next laundromat tick to end grace
prematurely.
Replace with test_and_clear_bit() to make the read-and-clear atomic.
Fixes: 8c67a210c90c ("nfsd: convert nfsd_net boolean flags to unsigned long flags word")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-13-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6936,9 +6936,8 @@ static bool clients_still_reclaiming(str
if (atomic_read(&nn->nr_reclaim_complete) == size)
return false;
}
- if (!test_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
+ if (!test_and_clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
return false;
- clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
/*
* If we've given them *two* lease times to reclaim, and they're
* still not done, give up:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 213/713] libceph: validate OSD extent maps before cursor advance
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 212/713] nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 214/713] libceph: reject buckets with mismatched CRUSH ids Greg Kroah-Hartman
` (510 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 9ec08b7499a62c6d4afa93d36ab47a43fcad57d1 upstream.
net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read
data length matches the summed extent lengths, but it does not validate
that each OSD-supplied extent is monotonic and lies inside the original
request range. A malformed authenticated OSD reply can advertise a
far-forward nonzero extent offset with a matching data length and make
the client advance the message-data cursor beyond the request buffer.
This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from
the client receive path.
Impact: A malicious or compromised authenticated Ceph OSD peer can crash
a kernel Ceph client via a malformed sparse-read reply.
Reject sparse extent maps that overflow, move backwards, overlap, or
extend outside the original sparse-read request before advancing the
cursor.
[ idryomov: perform sparse_extent_map_valid() check a bit earlier,
in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE
state ]
Cc: stable@vger.kernel.org
Fixes: f628d7999727 ("libceph: add sparse read support to OSD client")
Assisted-by: Codex:gpt-5-5-xhigh
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osd_client.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -6,6 +6,7 @@
#include <linux/err.h>
#include <linux/highmem.h>
#include <linux/mm.h>
+#include <linux/overflow.h>
#include <linux/pagemap.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
@@ -5802,6 +5803,31 @@ static inline void convert_extent_map(st
}
#endif
+static bool sparse_extent_map_valid(struct ceph_sparse_read *sr)
+{
+ u64 req_end, pos;
+ int i;
+
+ if (check_add_overflow(sr->sr_req_off, sr->sr_req_len, &req_end))
+ return false;
+
+ pos = sr->sr_req_off;
+ for (i = 0; i < sr->sr_count; i++) {
+ struct ceph_sparse_extent *ext = &sr->sr_extent[i];
+ u64 end;
+
+ if (ext->off < pos)
+ return false;
+ if (check_add_overflow(ext->off, ext->len, &end))
+ return false;
+ if (end > req_end)
+ return false;
+ pos = end;
+ }
+
+ return true;
+}
+
static int osd_sparse_read(struct ceph_connection *con,
struct ceph_msg_data_cursor *cursor,
char **pbuf)
@@ -5852,6 +5878,10 @@ next_op:
fallthrough;
case CEPH_SPARSE_READ_DATA_LEN:
convert_extent_map(sr);
+ if (!sparse_extent_map_valid(sr)) {
+ pr_warn_ratelimited("invalid sparse extent map\n");
+ return -EREMOTEIO;
+ }
ret = sizeof(sr->sr_datalen);
*pbuf = (char *)&sr->sr_datalen;
sr->sr_state = CEPH_SPARSE_READ_DATA_PRE;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 214/713] libceph: reject buckets with mismatched CRUSH ids
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 213/713] libceph: validate OSD extent maps before cursor advance Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 215/713] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Greg Kroah-Hartman
` (509 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 3cde4a8302301679937474a5f7a851394cc1bd11 upstream.
crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.
For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().
Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.
Cc: stable@vger.kernel.org
Fixes: 66a0e2d579db ("crush: remove mutable part of CRUSH map")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osdmap.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -517,6 +517,8 @@ static struct crush_map *crush_decode(vo
ceph_decode_need(p, end, 4*sizeof(u32), bad);
b->id = ceph_decode_32(p);
+ if (b->id != -1 - i)
+ goto bad;
b->type = ceph_decode_16(p);
if (b->type == 0)
goto bad;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 215/713] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 214/713] libceph: reject buckets with mismatched CRUSH ids Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 216/713] ceph: fix UAF in check_new_map() on session " Greg Kroah-Hartman
` (508 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiubo Li, Viacheslav Dubeyko,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <xiubo.li@clyso.com>
commit 7af4c4f01305b0935adf6d4301b1ec407025485d upstream.
list_for_each_entry() iterates ci->i_cap_flush_list but drops
i_ceph_lock to send cap messages. During the unlock window,
handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries
with tid <= flush_tid from the list, release i_ceph_lock, and free
them via ceph_free_cap_flush() outside any lock. When the original
thread reacquires i_ceph_lock and the for-loop macro advances via
cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next
on freed memory.
The race timeline:
__kick_flushing_caps() handle_cap_flush_ack()
----------------------- -----------------------
holds i_ceph_lock <---
iterates to cf (tid=10)
prepares FLUSH message
drops i_ceph_lock <---
__send_cap() ── FLUSH(tid=10)
MDS sends FLUSH_ACK(tid=10)
---> acquires i_ceph_lock
cf->tid(10) <= flush_tid(10),
detaches cf from i_cap_flush_list
drops i_ceph_lock
ceph_free_cap_flush(cf) <- frees it!
acquires i_ceph_lock <---
for-loop advances:
cf = list_next_entry(cf, i_list)
-- UAF on freed cf->i_list.next
The cf was just sent by __kick_flushing_caps itself via __send_cap().
The MDS may respond with FLUSH_ACK quickly enough that
handle_cap_flush_ack() frees cf before __kick_flushing_caps can
finish the iteration.
Fix by converting to a manual while loop: save the next pointer
under i_ceph_lock before dropping it, then use the saved pointer
after reacquiring, so the potentially-freed cf is never accessed again.
Cc: stable@vger.kernel.org
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/caps.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2589,9 +2589,14 @@ static void __kick_flushing_caps(struct
}
}
- list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) {
- if (cf->tid < first_tid)
+ cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list);
+ while (&cf->i_list != &ci->i_cap_flush_list) {
+ struct ceph_cap_flush *next;
+
+ if (cf->tid < first_tid) {
+ cf = list_next_entry(cf, i_list);
continue;
+ }
cap = ci->i_auth_cap;
if (!(cap && cap->session == session)) {
@@ -2601,6 +2606,7 @@ static void __kick_flushing_caps(struct
}
first_tid = cf->tid + 1;
+ next = list_next_entry(cf, i_list);
if (!cf->is_capsnap) {
struct cap_msg_args arg;
@@ -2641,6 +2647,7 @@ static void __kick_flushing_caps(struct
}
spin_lock(&ci->i_ceph_lock);
+ cf = next;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 216/713] ceph: fix UAF in check_new_map() on session freed during unlock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 215/713] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 217/713] ceph: force a cap message when a deferred revoke cant be acked immediately Greg Kroah-Hartman
` (507 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiubo Li, Viacheslav Dubeyko,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <xiubo.li@clyso.com>
commit ee611a7509554c4ca1f54f6aefe592fb1df7ea70 upstream.
check_new_map() iterates mdsc->sessions[] and for each active session
drops mdsc->mutex to perform per-session operations. The forced-close
path (rank removed from map) correctly takes a reference on s via
ceph_get_mds_session() before releasing mdsc->mutex, but three other
paths do not:
Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)
Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)
Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)
Without the extra reference, another thread can acquire mdsc->mutex
during the unlock window, call __unregister_session() which drops the
last reference on s, and free it. The original thread then accesses
freed memory via s->s_mutex.
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
ceph_put_mds_session(s) after the corresponding mutex_lock, matching
the pattern already used in the forced-close path.
Race timeline (Path A):
Thread A (check_new_map) Thread B (another map update
holds mdsc->mutex or session teardown)
-------------------------- --------------------------
s = mdsc->sessions[i]
(refcount == 1, held only by
sessions[] array)
mutex_unlock(&mdsc->mutex)
---> acquires mdsc->mutex
__unregister_session(mdsc, s)
sessions[i] = NULL
ceph_put_mds_session(s)
refcount: 1 -> 0
kfree(s) <--- freed!
mutex_lock(&s->s_mutex)
UAF on freed s->s_mutex
Cc: stable@vger.kernel.org
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -5834,9 +5834,11 @@ static void check_new_map(struct ceph_md
ceph_mdsmap_get_addr(newmap, i),
sizeof(struct ceph_entity_addr))) {
/* just close it */
+ ceph_get_mds_session(s);
mutex_unlock(&mdsc->mutex);
mutex_lock(&s->s_mutex);
mutex_lock(&mdsc->mutex);
+ ceph_put_mds_session(s);
ceph_con_close(&s->s_con);
mutex_unlock(&s->s_mutex);
s->s_state = CEPH_MDS_SESSION_RESTARTING;
@@ -5851,6 +5853,7 @@ static void check_new_map(struct ceph_md
newstate >= CEPH_MDS_STATE_RECONNECT) {
int rc;
+ ceph_get_mds_session(s);
mutex_unlock(&mdsc->mutex);
clear_bit(i, targets);
rc = send_mds_reconnect(mdsc, s);
@@ -5859,6 +5862,7 @@ static void check_new_map(struct ceph_md
"mds%d reconnect failed: %d\n",
i, rc);
mutex_lock(&mdsc->mutex);
+ ceph_put_mds_session(s);
}
/*
@@ -5871,9 +5875,11 @@ static void check_new_map(struct ceph_md
pr_info_client(cl, "mds%d recovery completed\n",
s->s_mds);
kick_requests(mdsc, i);
+ ceph_get_mds_session(s);
mutex_unlock(&mdsc->mutex);
mutex_lock(&s->s_mutex);
mutex_lock(&mdsc->mutex);
+ ceph_put_mds_session(s);
ceph_kick_flushing_caps(mdsc, s);
mutex_unlock(&s->s_mutex);
wake_up_session_caps(s, RECONNECT);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 217/713] ceph: force a cap message when a deferred revoke cant be acked immediately
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 216/713] ceph: fix UAF in check_new_map() on session " Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 218/713] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Greg Kroah-Hartman
` (506 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Alex Markuze,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit 8fdf946445732c2bcd685abc8bd0e509d2ebc158 upstream.
When the MDS revokes capabilities, handle_cap_grant() normally
guarantees a response by setting `CHECK_CAPS_FLUSH_FORCE` (see
commit 31634d7597d8 ("ceph: force sending a cap update msg back to MDS
for revoke op")), so ceph_check_caps() sends a cap message even if the
client would otherwise decide it has nothing to do. That guarantee is
skipped whenever the revoke has to be deferred (via revoke_wait):
revoking Fb while dirty data is still buffered (writeback is queued
first) or revoking Fc while pages are cached (async invalidation is
queued first).
In those cases, the ack is left to the deferred completion
(ceph_put_wrbuffer_cap_refs() after writeback, or the invalidate
worker after invalidation); both of which call ceph_check_caps(ci,0)
i.e. without `CHECK_CAPS_FLUSH_FORCE`. Nothing gets sent under one
of the following conditions:
- the inode is retaining caps because the file was used recently
(file_wanted != 0; retain |= CEPH_CAP_ANY)
- the revoked cap is still used because the page was re-cached (e.g. a
file being re-read)
- the MDS has meanwhile re-granted, so `issued==implemented` and the
client sees nothing being revoked
The client then never emits the cap message which the MDS is waiting
for. The MDS blocks on the revoke indefinitely and logs, for minutes
or hours:
client.NNN isn't responding to mclientcaps(revoke), ino 0x... pending
pAsxLsXsxFsxcrwb issued pAsxLsXsxFsxcrwb, sent 964.899182 seconds ago
The client-side state at that point shows the full cap set still
issued, nothing in the revoking/flushing sets. Thus nothing gets
sent.
This patch fixes it by remembering that a forced response is expected.
When a revoke is deferred, set `CEPH_I_FLUSH_FORCE` on the inode.
ceph_check_caps() replays it as `CHECK_CAPS_FLUSH_FORCE`, so whichever
path re-checks the inode next (the writeback/invalidate completion,
the delayed worker, or any other caller) is guaranteed to send a cap
message to the MDS. __prep_cap() clears the flag once a message is
actually built.
This is the deferred-path counterpart of the existing
`CHECK_CAPS_FLUSH_FORCE` handling; a normal (non-deferred) revoke
still forces the response inline as before.
Cc: stable@vger.kernel.org
Fixes: 31634d7597d8 ("ceph: force sending a cap update msg back to MDS for revoke op")
Fixes: 257e6172ab36 ("ceph: don't let check_caps skip sending responses for revoke msgs")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/caps.c | 63 +++++++++++++++++++++++++++++++++++++++++++++++++-------
fs/ceph/super.h | 5 ++++
2 files changed, 61 insertions(+), 7 deletions(-)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -979,6 +979,27 @@ int __ceph_caps_revoking_other(struct ce
return 0;
}
+/*
+ * Return true if any cap of this inode holds caps which the MDS has
+ * revoked, but which we have not released yet.
+ */
+static bool __ceph_is_any_revoking(const struct ceph_inode_info *ci)
+{
+ const struct rb_node *p;
+
+ lockdep_assert_held(&ci->i_ceph_lock);
+
+ for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+ const struct ceph_cap *cap =
+ rb_entry(p, struct ceph_cap, ci_node);
+
+ if (cap->implemented & ~cap->issued)
+ return true;
+ }
+
+ return false;
+}
+
int __ceph_caps_used(struct ceph_inode_info *ci)
{
int used = 0;
@@ -1421,6 +1442,9 @@ static void __prep_cap(struct cap_msg_ar
cap->implemented &= cap->issued | used;
cap->mds_wanted = want;
+ if ((ci->i_ceph_flags & CEPH_I_FLUSH_FORCE) != 0 && !__ceph_is_any_revoking(ci))
+ clear_bit(CEPH_I_FLUSH_FORCE_BIT, &ci->i_ceph_flags);
+
arg->session = cap->session;
arg->ino = ceph_vino(inode).ino;
arg->cid = cap->cap_id;
@@ -2038,6 +2062,14 @@ void ceph_check_caps(struct ceph_inode_i
if (ci->i_ceph_flags & CEPH_I_FLUSH)
flags |= CHECK_CAPS_FLUSH;
+ /*
+ * A revoke whose response was deferred (see handle_cap_grant()) must
+ * still be acknowledged. Replay the forced flush here so that even a
+ * check triggered by writeback/invalidation completion sends a cap
+ * message to the MDS.
+ */
+ if (ci->i_ceph_flags & CEPH_I_FLUSH_FORCE)
+ flags |= CHECK_CAPS_FLUSH_FORCE;
retry:
/* Caps wanted by virtue of active open files. */
file_wanted = __ceph_caps_file_wanted(ci);
@@ -3764,13 +3796,30 @@ static void handle_cap_grant(struct inod
BUG_ON(cap->issued & ~cap->implemented);
/* don't let check_caps skip sending a response to MDS for revoke msgs */
- if (!revoke_wait && le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) {
- cap->mds_wanted = 0;
- flags |= CHECK_CAPS_FLUSH_FORCE;
- if (cap == ci->i_auth_cap)
- check_caps = 1; /* check auth cap only */
- else
- check_caps = 2; /* check all caps */
+ if (le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) {
+ if (revoke_wait) {
+ /*
+ * We can't ack the revoke yet: the response is deferred
+ * until the writeback or cache invalidation queued above
+ * completes. Set the CEPH_I_FLUSH_FORCE flag to remember
+ * that a forced cap message is owed so that deferred
+ * completion (ceph_put_wrbuffer_cap_refs() or the
+ * invalidate worker, both of which call ceph_check_caps())
+ * actually sends one, even if by then the revoked caps look
+ * unused, the inode is retaining caps, or the MDS has
+ * re-granted them. Without this, the cap message is never
+ * sent and the MDS hangs ("isn't responding to
+ * mclientcaps(revoke)").
+ */
+ set_bit(CEPH_I_FLUSH_FORCE_BIT, &ci->i_ceph_flags);
+ } else {
+ cap->mds_wanted = 0;
+ flags |= CHECK_CAPS_FLUSH_FORCE;
+ if (cap == ci->i_auth_cap)
+ check_caps = 1; /* check auth cap only */
+ else
+ check_caps = 2; /* check all caps */
+ }
}
if (extra_info->inline_version > 0 &&
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -687,6 +687,10 @@ static inline struct inode *ceph_find_in
#define CEPH_I_ASYNC_CREATE_BIT (12) /* async create in flight for this */
#define CEPH_I_SHUTDOWN_BIT (13) /* inode is no longer usable */
#define CEPH_I_ASYNC_CHECK_CAPS_BIT (14) /* check caps after async creating finishes */
+#define CEPH_I_FLUSH_FORCE_BIT (15) /* a revoke's response was deferred;
+ * force a cap message to the MDS once
+ * the deferred work completes
+ */
#define CEPH_I_DIR_ORDERED (1 << CEPH_I_DIR_ORDERED_BIT)
#define CEPH_I_FLUSH (1 << CEPH_I_FLUSH_BIT)
@@ -699,6 +703,7 @@ static inline struct inode *ceph_find_in
#define CEPH_I_ODIRECT (1 << CEPH_I_ODIRECT_BIT)
#define CEPH_I_ASYNC_CREATE (1 << CEPH_I_ASYNC_CREATE_BIT)
#define CEPH_I_SHUTDOWN (1 << CEPH_I_SHUTDOWN_BIT)
+#define CEPH_I_FLUSH_FORCE (1 << CEPH_I_FLUSH_FORCE_BIT)
/*
* Masks of ceph inode work.
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 218/713] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 217/713] ceph: force a cap message when a deferred revoke cant be acked immediately Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 219/713] ceph: bound copied dentry name length in NFS export get_name Greg Kroah-Hartman
` (505 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit aedc9053d909508a5f56c3f49f885fc030df4730 upstream.
MDSMap export_targets entries are monitor controlled. check_new_map()
uses each entry as a bit number in a fixed stack bitmap, so a rank
outside the protocol namespace can make set_bit() write past the end of
the array.
Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not
validate against possible_max_rank here because maps may legitimately
reference ranks beyond a temporarily reduced max_mds.
Cc: stable@vger.kernel.org
Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mdsmap.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -264,6 +264,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(s
goto nomem;
for (j = 0; j < num_export_targets; j++) {
target = ceph_decode_32(&pexport_targets);
+ if (target >= CEPH_MAX_MDS) {
+ err = -EIO;
+ goto corrupt;
+ }
info->export_targets[j] = target;
}
} else {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 219/713] ceph: bound copied dentry name length in NFS export get_name
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 218/713] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 220/713] ceph: bound MDSCapAuth path and fs_name decode in handle_session() Greg Kroah-Hartman
` (504 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit eff8013c5a8916613c742ae5a2cc341cb605c0ae upstream.
ceph_get_name() copies the MDS-supplied name into the caller's
NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len)
and then writes name[rinfo->dname_len] = 0, without checking dname_len
against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply
with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies
rde->name / rde->name_len the same unchecked way.
Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name
buffer in a client's NFS-export get_name path, a slab out-of-bounds write
reported by KASAN. Reachable when a CephFS mount is re-exported over NFS.
Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with
-ENAMETOOLONG before the copy, and use it in both ceph_get_name() and
__get_snap_name().
Cc: stable@vger.kernel.org
Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/export.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -442,6 +442,16 @@ static struct dentry *ceph_fh_to_parent(
return dentry;
}
+static int ceph_export_copy_name(char *name, const char *src, u32 len)
+{
+ if (len > NAME_MAX)
+ return -ENAMETOOLONG;
+
+ memcpy(name, src, len);
+ name[len] = '\0';
+ return 0;
+}
+
static int __get_snap_name(struct dentry *parent, char *name,
struct dentry *child)
{
@@ -513,9 +523,8 @@ static int __get_snap_name(struct dentry
BUG_ON(!rde->inode.in);
if (ceph_snap(inode) ==
le64_to_cpu(rde->inode.in->snapid)) {
- memcpy(name, rde->name, rde->name_len);
- name[rde->name_len] = '\0';
- err = 0;
+ err = ceph_export_copy_name(name, rde->name,
+ rde->name_len);
goto out;
}
}
@@ -580,8 +589,8 @@ static int ceph_get_name(struct dentry *
rinfo = &req->r_reply_info;
if (!IS_ENCRYPTED(dir)) {
- memcpy(name, rinfo->dname, rinfo->dname_len);
- name[rinfo->dname_len] = 0;
+ err = ceph_export_copy_name(name, rinfo->dname,
+ rinfo->dname_len);
} else {
struct fscrypt_str oname = FSTR_INIT(NULL, 0);
struct ceph_fname fname = { .dir = dir,
@@ -595,10 +604,9 @@ static int ceph_get_name(struct dentry *
goto out;
err = ceph_fname_to_usr(&fname, NULL, &oname, NULL);
- if (!err) {
- memcpy(name, oname.name, oname.len);
- name[oname.len] = 0;
- }
+ if (!err)
+ err = ceph_export_copy_name(name, oname.name,
+ oname.len);
ceph_fname_free_buffer(dir, &oname);
}
out:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 220/713] ceph: bound MDSCapAuth path and fs_name decode in handle_session()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 219/713] ceph: bound copied dentry name length in NFS export get_name Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 221/713] ceph: bound num_export_targets array for mds info v2/v3 Greg Kroah-Hartman
` (503 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 77933e22adfe813be2bd10be08d6e950103c3967 upstream.
handle_session() decodes the MDSCapAuth records carried by a
CEPH_SESSION_OPEN message (msg_version >= 6). For each record the
match.path and match.fs_name byte strings are read by first decoding a
32-bit length and then copying that many bytes with the bare
ceph_decode_copy(). Unlike the surrounding fields, which all use the
_safe decode variants, these two copies are not preceded by a
ceph_decode_need() bounds check, and the enclosing MDSCapAuth and
MDSCapMatch struct_len fields are skipped rather than enforced as an
upper bound. A length larger than the bytes remaining in the message
front makes ceph_decode_copy() read past the end of the front buffer.
The message front is a dedicated allocation (ceph_msg_new2() ->
kvmalloc), so the over-read runs off that object. A malicious or
compromised MDS can trigger this with the first post-connect message on
mount, with no client-side user interaction; under KASAN it is reported
as a slab-out-of-bounds read in handle_session().
Impact: a malicious MDS can force the kernel client to read up to 4 GiB
past the message front allocation during session setup, crashing the
client (out-of-bounds read).
Switch both copies to ceph_decode_copy_safe(), which performs the
ceph_decode_need() bounds check before the copy and branches to the
existing bad label, matching the rest of the decoder and the error path
that frees the partially decoded cap_auths array.
Cc: stable@vger.kernel.org
Fixes: 1d17de9534cb ("ceph: save cap_auths in MDS client when session is opened")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4441,7 +4441,9 @@ static void handle_session(struct ceph_m
pr_err_client(cl, "No memory for path\n");
goto fail;
}
- ceph_decode_copy(&p, cap_auths[i].match.path, _len);
+ ceph_decode_copy_safe(&p, end,
+ cap_auths[i].match.path,
+ _len, bad);
/* Remove the tailing '/' */
while (_len && cap_auths[i].match.path[_len - 1] == '/') {
@@ -4458,7 +4460,9 @@ static void handle_session(struct ceph_m
pr_err_client(cl, "No memory for fs_name\n");
goto fail;
}
- ceph_decode_copy(&p, cap_auths[i].match.fs_name, _len);
+ ceph_decode_copy_safe(&p, end,
+ cap_auths[i].match.fs_name,
+ _len, bad);
}
ceph_decode_8_safe(&p, end, cap_auths[i].match.root_squash, bad);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 221/713] ceph: bound num_export_targets array for mds info v2/v3
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 220/713] ceph: bound MDSCapAuth path and fs_name decode in handle_session() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 222/713] ceph: bound xattr value length in __build_xattrs() Greg Kroah-Hartman
` (502 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit a3eb169ee297aa99670ba927c659990bd1e453f3 upstream.
ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from
each per-mds info record and advances the decode cursor by
num_export_targets * sizeof(u32) without first checking that many bytes
remain. The only upper-bound check that catches a runaway cursor
(*p > info_end) is gated on info_v >= 4, because info_end is left NULL
for info_v 2 and 3. When the monitor sends an MDS map whose per-mds
info version is 2 or 3 with an oversized num_export_targets, the cursor
moves past the message front buffer and the later export-targets loop
calls the unchecked ceph_decode_32() on out-of-bounds memory.
A kernel client processes CEPH_MSG_MDS_MAP from its monitor session
(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to
ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and
calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an
on-path attacker on an unsigned/unencrypted messenger session, can
therefore drive an out-of-bounds read in the client kernel; on x86_64
with KASAN it is reported as a slab-out-of-bounds read in
ceph_mdsmap_decode(). The decoded values land in the internal
info->export_targets[] array, so the consequence is a kernel
out-of-bounds read, not an information leak to the attacker.
Impact: a malicious or compromised Ceph monitor sending an MDS map with
a per-mds info version of 2 or 3 and an oversized num_export_targets
field triggers an out-of-bounds read in the CephFS client kernel.
Add a ceph_decode_need() for the export-targets array before advancing
the cursor, so the bound is enforced for every info_v >= 2, not only
info_v >= 4. This mirrors the count-then-need idiom already used for
m_data_pg_pools later in the same function.
Compute the export-targets byte count with size_mul() and reuse that
checked length when advancing the cursor, so the attacker-controlled
num_export_targets multiplication fails closed on overflow rather than
relying on the later kcalloc() guard.
Cc: stable@vger.kernel.org
Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mdsmap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -3,6 +3,7 @@
#include <linux/bug.h>
#include <linux/err.h>
+#include <linux/overflow.h>
#include <linux/random.h>
#include <linux/slab.h>
#include <linux/types.h>
@@ -126,6 +127,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(s
u8 mdsmap_v;
u16 mdsmap_ev;
u32 target;
+ size_t export_targets_len;
m = kzalloc_obj(*m, GFP_NOFS);
if (!m)
@@ -224,8 +226,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(s
*p += namelen;
if (info_v >= 2) {
ceph_decode_32_safe(p, end, num_export_targets, bad);
+ export_targets_len = size_mul(num_export_targets,
+ sizeof(u32));
+ ceph_decode_need(p, end, export_targets_len, bad);
pexport_targets = *p;
- *p += num_export_targets * sizeof(u32);
+ *p += export_targets_len;
} else {
num_export_targets = 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 222/713] ceph: bound xattr value length in __build_xattrs()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 221/713] ceph: bound num_export_targets array for mds info v2/v3 Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 223/713] ceph: cap delegated inode count in ceph_parse_deleg_inos() Greg Kroah-Hartman
` (501 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 68d541754d6cd3bb98d1fd8314f57e5eb533557d upstream.
__build_xattrs() decodes the MDS-supplied xattr blob one attribute at a
time. For each attribute it reads a 32-bit name length, advances past the
name bytes, reads a 32-bit value length, records the value pointer, and
advances past the value bytes. The two length fields are read with
ceph_decode_32_safe(), but the value bytes themselves are advanced over
with a bare "p += len" and no ceph_decode_need() check that "len" bytes
remain in the blob.
For every attribute except the last, the next iteration's
ceph_decode_32_safe() on the following name length implicitly verifies
that the previous value did not run past the blob end. The final
attribute has no successor, so its decoded value length is never checked
against the blob bounds. A malicious or compromised metadata server can
set the last attribute's value length larger than the bytes actually
present in the blob.
The blob is a dedicated kvmalloc() allocation sized to the wire length
(ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the
oversized length in xattr->val_len verbatim, and a later getxattr(2) runs
memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer,
copying bytes past the end of the allocation back to user space.
Impact: a malicious metadata server discloses adjacent kernel heap bytes
to a local user via getxattr(2) on a CephFS file. Add the missing
ceph_decode_need() so an out-of-bounds value length on the final
attribute fails the decode and returns -EIO instead of being stored.
Cc: stable@vger.kernel.org
Fixes: 355da1eb7a1f ("ceph: inode operations")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/xattr.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -848,6 +848,7 @@ start:
name = p;
p += len;
ceph_decode_32_safe(&p, end, len, bad);
+ ceph_decode_need(&p, end, len, bad);
val = p;
p += len;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 223/713] ceph: cap delegated inode count in ceph_parse_deleg_inos()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 222/713] ceph: bound xattr value length in __build_xattrs() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 224/713] ceph: do not repeat ceph_trim_dentries() if no progress possible Greg Kroah-Hartman
` (500 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viacheslav Dubeyko,
Michael Bommarito, Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 upstream.
ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers
from an MDS create-with-delegation reply. For each set it reads a 64-bit
start and a 64-bit len with ceph_decode_64_safe(), which only validates
that the eight bytes are present in the message, not the value, and then
loops over len while inserting entries into s_delegated_inos.
len is fully attacker controlled. A malicious or compromised MDS can send
one huge interval, many intervals in one reply, duplicate intervals, or
repeated replies that accumulate delegated inodes on the same session.
The original code bounded none of these and could spin the insert loop or
grow the xarray without limit.
Bound both dimensions with a single enforcement point. Track the number
of delegated inodes held by each MDS session in an atomic counter and
grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless()
to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper
is the only place the counter grows, the per-session population can never
exceed the cap, so no separate per-session pre-check is needed. The
counter is decremented when async create consumes a delegated inode or
when an insert fails, incremented when a delegated inode is restored,
initialized with the session xarray, and reset when reconnect destroys
the xarray.
A per-session cap alone still lets one reply spin the insert loop on
duplicate ranges without growing the counter, so also cap the aggregate
interval length accepted from a single reply. Together these bound both
the loop trip count per reply and the xarray population across replies.
The cap is a fixed, client-chosen constant rather than a value derived
from the MDS. mds_client_prealloc_inos is a userspace MDS configuration
option; it is never sent to the kernel client on the wire, and a
server-supplied bound could not be trusted for a defensive limit in any
case. The constant is set well above that option's documented default of
1000 (a generous multiple), so legitimate refill behavior is unaffected
while the CPU and xarray memory a malformed delegation stream can consume
stays bounded.
Impact: a malicious or compromised Ceph MDS can no longer make a client
spin through an unbounded delegated-inode interval or grow one session's
delegated-inode xarray without limit.
Cc: stable@vger.kernel.org
Fixes: d48464878708 ("ceph: decode interval_sets for delegated inos")
Suggested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 59 +++++++++++++++++++++++++++++++++++++++++++++------
fs/ceph/mds_client.h | 1
fs/ceph/super.h | 9 +++++++
3 files changed, 63 insertions(+), 6 deletions(-)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -615,10 +615,36 @@ bad:
#define DELEGATED_INO_AVAILABLE xa_mk_value(1)
+static int ceph_insert_deleg_ino(struct ceph_mds_session *s, u64 ino)
+{
+ struct ceph_client *cl = s->s_mdsc->fsc->client;
+ int err;
+
+ /*
+ * Cap how many delegated inodes a single session may hold. This is
+ * the only place that grows the count, so atomic_add_unless() bounds
+ * it at exactly CEPH_MAX_DELEG_INOS; s_num_deleg_inos can never exceed
+ * that.
+ */
+ if (!atomic_add_unless(&s->s_num_deleg_inos, 1, CEPH_MAX_DELEG_INOS)) {
+ pr_warn_ratelimited_client(cl,
+ "MDS session already holds %d delegated inodes\n",
+ CEPH_MAX_DELEG_INOS);
+ return -EOVERFLOW;
+ }
+
+ err = xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE,
+ GFP_KERNEL);
+ if (err)
+ atomic_dec(&s->s_num_deleg_inos);
+ return err;
+}
+
static int ceph_parse_deleg_inos(void **p, void *end,
struct ceph_mds_session *s)
{
struct ceph_client *cl = s->s_mdsc->fsc->client;
+ u64 msg_deleg_inos = 0;
u32 sets;
ceph_decode_32_safe(p, end, sets, bad);
@@ -636,16 +662,34 @@ static int ceph_parse_deleg_inos(void **
start, len);
continue;
}
+
+ /*
+ * Bound the number of inodes one reply may delegate.
+ * ceph_insert_deleg_ino() separately caps the per-session
+ * population, so this only has to stop one reply from spinning
+ * the insert loop under an attacker-controlled len.
+ */
+ if (len > (u64)CEPH_MAX_DELEG_INOS ||
+ msg_deleg_inos > (u64)CEPH_MAX_DELEG_INOS - len) {
+ pr_warn_ratelimited_client(cl,
+ "MDS reply delegates too many inodes (have %llu, +%llu, max %d)\n",
+ msg_deleg_inos, len, CEPH_MAX_DELEG_INOS);
+ return -EIO;
+ }
+ msg_deleg_inos += len;
+
while (len--) {
- int err = xa_insert(&s->s_delegated_inos, start++,
- DELEGATED_INO_AVAILABLE,
- GFP_KERNEL);
+ int err = ceph_insert_deleg_ino(s, start++);
+
if (!err) {
doutc(cl, "added delegated inode 0x%llx\n", start - 1);
} else if (err == -EBUSY) {
pr_warn_client(cl,
"MDS delegated inode 0x%llx more than once.\n",
start - 1);
+ } else if (err == -EOVERFLOW) {
+ /* ceph_insert_deleg_ino() already warned. */
+ return -EIO;
} else {
return err;
}
@@ -663,16 +707,17 @@ u64 ceph_get_deleg_ino(struct ceph_mds_s
xa_for_each(&s->s_delegated_inos, ino, val) {
val = xa_erase(&s->s_delegated_inos, ino);
- if (val == DELEGATED_INO_AVAILABLE)
+ if (val == DELEGATED_INO_AVAILABLE) {
+ atomic_dec(&s->s_num_deleg_inos);
return ino;
+ }
}
return 0;
}
int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino)
{
- return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE,
- GFP_KERNEL);
+ return ceph_insert_deleg_ino(s, ino);
}
#else /* BITS_PER_LONG == 64 */
/*
@@ -1059,6 +1104,7 @@ static struct ceph_mds_session *register
INIT_LIST_HEAD(&s->s_waiting);
INIT_LIST_HEAD(&s->s_unsafe);
xa_init(&s->s_delegated_inos);
+ atomic_set(&s->s_num_deleg_inos, 0);
INIT_LIST_HEAD(&s->s_cap_releases);
INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work);
@@ -5110,6 +5156,7 @@ static int send_mds_reconnect(struct cep
/* Serialized by s_mutex against concurrent ceph_get_deleg_ino(). */
xa_destroy(&session->s_delegated_inos);
+ atomic_set(&session->s_num_deleg_inos, 0);
if (session->s_state == CEPH_MDS_SESSION_CLOSED ||
session->s_state == CEPH_MDS_SESSION_REJECTED) {
pr_info_client(cl, "mds%d skipping reconnect, session %s\n",
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -300,6 +300,7 @@ struct ceph_mds_session {
struct list_head s_waiting; /* waiting requests */
struct list_head s_unsafe; /* unsafe requests */
struct xarray s_delegated_inos;
+ atomic_t s_num_deleg_inos;
};
/*
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -641,6 +641,15 @@ static inline int ceph_ino_compare(struc
#define CEPH_MDS_INO_LOG_OFFSET (2 * CEPH_MAX_MDS)
#define CEPH_INO_SYSTEM_BASE ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY))
+/*
+ * Upper bound on the number of delegated inodes a single MDS session may
+ * hold. The MDS normally hands out a small preallocation window (the
+ * userspace mds_client_prealloc_inos option defaults to 1000) and refills
+ * it as the client consumes entries. This leaves generous headroom while
+ * bounding the CPU and memory a malformed delegation interval can consume.
+ */
+#define CEPH_MAX_DELEG_INOS 8192
+
static inline bool ceph_vino_is_reserved(const struct ceph_vino vino)
{
if (vino.ino >= CEPH_INO_SYSTEM_BASE ||
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 224/713] ceph: do not repeat ceph_trim_dentries() if no progress possible
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 223/713] ceph: cap delegated inode count in ceph_parse_deleg_inos() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 225/713] ceph: fix leaked inode reference on writeback abort at umount Greg Kroah-Hartman
` (499 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Alex Markuze,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit e7d7aa7b730178278109c41fa1b17b06873065d5 upstream.
ceph_cap_reclaim_work() re-queues itself for as long as
ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease
walk exhausts its `nr_to_scan` budget. This creates a busy loop that
consumes CPU without making any progress when there is nothing to
reclaim: with no cap pressure (`count==0`) and every scanned lease
still valid, each pass runs the full scan budget down to zero and
returns `-EAGAIN`, only to be queued again immediately.
The dir-lease walk made this worse. When `expire_dir_lease` is
`false` (i.e. we have no intention of reclaiming dir leases),
__dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH`
moves the dentry to the tail of the list and resets `di->time` via
__dentry_dir_lease_touch(), so a walk over N valid leases pointlessly
rewrote the list, refreshed the timestamps (preventing them from ever
aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN`
requeue.
Fix this in three steps:
- Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is
`false`. If we are not going to reclaim the lease, leave it in
place instead of churning the list and resetting its timestamp; the
walk then terminates naturally (or via `STOP` at the first fresh
lease).
- Only return `-EAGAIN` from the first (dentry-lease) walk when something
was actually freed. A full batch that frees nothing means retrying
the same list immediately is futile; fall through to the dir-lease
walk instead.
- After both walks, bail out with success (0) when nothing was freed
and there is no cap pressure (`count==0`). There is no reason to
keep retrying when we are not over the cap limit and made no
progress.
Under real cap pressure (`count>0`) the reclaim path is unchanged and
still retries via `-EAGAIN`.
Without this patch, I saw 500 ceph_trim_dentries() calls per second on
our web servers. This is very visible in `/proc/lock_stat` (5 minute
capture):
class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
&mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00
-----------------------
&mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8
&mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8
&mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8
&mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0
-----------------------
&mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8
&mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8
&mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0
&mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8
With this patch:
class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
&mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27
-----------------------
&mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8
&mdsc->dentry_list_lock 169 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0
&mdsc->dentry_list_lock 16 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8
&mdsc->dentry_list_lock 1 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8
-----------------------
&mdsc->dentry_list_lock 158 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0
&mdsc->dentry_list_lock 858 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8
&mdsc->dentry_list_lock 182 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8
&mdsc->dentry_list_lock 17 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8
__dentry_leases_walk() is almost gone. The total wait time is reduced
by a factor of 483. That will give some latency gains to
ceph_readdir().
Cc: stable@vger.kernel.org
Fixes: 37c4efc1ddf9 ("ceph: periodically trim stale dentries")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/dir.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1764,11 +1764,11 @@ static int __dir_lease_check(const struc
if (ret > 0) {
if (time_before(jiffies, di->time + lwc->dir_lease_ttl))
return STOP;
+ if (!lwc->expire_dir_lease)
+ return KEEP;
/* Move dentry to tail of dir lease list if we don't want
* to delete it. So dentries in the list are checked in a
* round robin manner */
- if (!lwc->expire_dir_lease)
- return TOUCH;
if (dentry->d_lockref.count > 0 ||
(di->flags & CEPH_DENTRY_REFERENCED))
return TOUCH;
@@ -1795,7 +1795,7 @@ int ceph_trim_dentries(struct ceph_mds_c
lwc.dir_lease = false;
lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE * 2;
freed = __dentry_leases_walk(mdsc, &lwc);
- if (!lwc.nr_to_scan) /* more invalid leases */
+ if (freed > 0 && !lwc.nr_to_scan) /* more invalid leases */
return -EAGAIN;
if (lwc.nr_to_scan < CEPH_CAPS_PER_RELEASE)
@@ -1805,6 +1805,10 @@ int ceph_trim_dentries(struct ceph_mds_c
lwc.expire_dir_lease = freed < count;
lwc.dir_lease_ttl = mdsc->fsc->mount_options->caps_wanted_delay_max * HZ;
freed +=__dentry_leases_walk(mdsc, &lwc);
+ if (freed == 0 && count == 0)
+ /* no progress possible currently, retry futile */
+ return 0;
+
if (!lwc.nr_to_scan) /* more to check */
return -EAGAIN;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 225/713] ceph: fix leaked inode reference on writeback abort at umount
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 224/713] ceph: do not repeat ceph_trim_dentries() if no progress possible Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 226/713] btrfs: drop recovered reloc root refs on recovery failure Greg Kroah-Hartman
` (498 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthew Brown, Xiubo Li,
Ilya Dryomov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brown <matthew@bargrove.com>
commit c25aee9c630fb86f98d79eccb75765067079b972 upstream.
ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it
bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and
attaches the snap_context to folio->private. That claim is released only
by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from
writepages_finish().
In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which
happens during umount -- the request is aborted before submission: the
already-collected folios are only redirtied and unlocked, so
writepages_finish() never runs and the claim is leaked.
redirty_page_for_writepage() -> folio_redirty_for_writepage() ->
filemap_dirty_folio() sets PG_dirty directly and does not go through
->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.
Because every subsequent writeback also fails the osd_stopping_blocker,
i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the
inode cannot be evicted:
VFS: Busy inodes after unmount of ceph
kernel BUG at fs/super.c:650!
Release the orphaned claim in the abort path before redirtying, via
ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer
reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop
the snap_context reference -- i.e. do what writepages_finish() would have
done for these never-submitted folios.
Only the locked_pages entries are undone; folios still in the fbatch were
never dirty-cleared by this call (folio_clear_dirty_for_io() is the
ownership-transfer point, and a successful move NULLs the fbatch slot), so
they hold no claim this call owns.
Cc: stable@vger.kernel.org
Fixes: fd7449d937e7 ("ceph: fix generic/421 test failure")
Signed-off-by: Matthew Brown <matthew@bargrove.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/addr.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1426,6 +1426,16 @@ void ceph_shift_unused_folios_left(struc
fbatch->nr = n;
}
+static void ceph_undo_wrbuffer_claim(struct inode *inode, struct folio *folio)
+{
+ struct ceph_snap_context *snapc = folio_detach_private(folio);
+
+ if (!snapc)
+ return;
+ ceph_put_wrbuffer_cap_refs(ceph_inode(inode), 1, snapc);
+ ceph_put_snap_context(snapc);
+}
+
static
int ceph_submit_write(struct address_space *mapping,
struct writeback_control *wbc,
@@ -1489,6 +1499,7 @@ new_request:
if (!page)
continue;
+ ceph_undo_wrbuffer_claim(inode, page_folio(page));
redirty_page_for_writepage(wbc, page);
unlock_page(page);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 226/713] btrfs: drop recovered reloc root refs on recovery failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 225/713] ceph: fix leaked inode reference on writeback abort at umount Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 227/713] btrfs: fix extent map leak in NOCOW direct I/O write Greg Kroah-Hartman
` (497 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guanghui Yang, David Sterba
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Yang <3497809730@qq.com>
commit 6d8ba4572922e336f0b59a80751b018e1e135164 upstream.
During relocation recovery, each fs root gets a reference to its relocation
root. If loading or adding a later root fails, or if the first transaction
commit fails, btrfs_recover_relocation() jumps to out_unset before
merge_reloc_roots() and clean_dirty_subvols().
put_reloc_control() drops the list-owned relocation root references, but it
does not clear fs_root->reloc_root or drop the references owned by those
pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an
error such as -ENOMEM while processing a later root can leave references
behind.
Keep temporary references to the fs roots associated during recovery. On
failure, clear their reloc_root pointers and drop the corresponding
references. Once the first transaction commit succeeds, drop only the
temporary fs root references and let the normal merge and cleanup paths
handle the relocation roots.
Fault injection on a pending-relocation image confirmed the cleanup gap.
With an injected first-commit failure, 25 fs roots had reloc_root set with
fs_error=0. With this fix, the same failure path drops that count to 0
before mount fails.
Fixes: f44deb7442ed ("btrfs: hold a ref on the root->reloc_root")
CC: stable@vger.kernel.org
Signed-off-by: Guanghui Yang <3497809730@qq.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/relocation.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -5555,6 +5555,24 @@ static noinline_for_stack int mark_garba
return ret;
}
+static void release_recovered_fs_roots(struct list_head *roots, bool drop_reloc_refs)
+{
+ struct btrfs_root *root;
+ struct btrfs_root *next;
+
+ list_for_each_entry_safe(root, next, roots, reloc_dirty_list) {
+ list_del_init(&root->reloc_dirty_list);
+ if (drop_reloc_refs) {
+ struct btrfs_root *reloc_root = root->reloc_root;
+
+ ASSERT(reloc_root);
+ root->reloc_root = NULL;
+ btrfs_put_root(reloc_root);
+ }
+ btrfs_put_root(root);
+ }
+}
+
/*
* recover relocation interrupted by system crash.
*
@@ -5564,6 +5582,7 @@ static noinline_for_stack int mark_garba
int btrfs_recover_relocation(struct btrfs_fs_info *fs_info)
{
LIST_HEAD(reloc_roots);
+ LIST_HEAD(recovered_roots);
struct btrfs_key key;
struct btrfs_root *fs_root;
struct btrfs_root *reloc_root;
@@ -5680,7 +5699,7 @@ int btrfs_recover_relocation(struct btrf
ret = PTR_ERR(fs_root);
list_add_tail(&reloc_root->root_list, &reloc_roots);
btrfs_end_transaction(trans);
- goto out_unset;
+ goto out_drop_reloc_refs;
}
ret = __add_reloc_root(reloc_root, rc);
@@ -5689,15 +5708,17 @@ int btrfs_recover_relocation(struct btrf
list_add_tail(&reloc_root->root_list, &reloc_roots);
btrfs_put_root(fs_root);
btrfs_end_transaction(trans);
- goto out_unset;
+ goto out_drop_reloc_refs;
}
+ ASSERT(list_empty(&fs_root->reloc_dirty_list));
fs_root->reloc_root = btrfs_grab_root(reloc_root);
- btrfs_put_root(fs_root);
+ list_add_tail(&fs_root->reloc_dirty_list, &recovered_roots);
}
ret = btrfs_commit_transaction(trans);
if (ret)
- goto out_unset;
+ goto out_drop_reloc_refs;
+ release_recovered_fs_roots(&recovered_roots, false);
merge_reloc_roots(rc);
@@ -5713,6 +5734,8 @@ out_clean:
ret2 = clean_dirty_subvols(rc);
if (ret2 < 0 && !ret)
ret = ret2;
+out_drop_reloc_refs:
+ release_recovered_fs_roots(&recovered_roots, true);
out_unset:
unset_reloc_control(rc);
reloc_chunk_end(fs_info);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 227/713] btrfs: fix extent map leak in NOCOW direct I/O write
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 226/713] btrfs: drop recovered reloc root refs on recovery failure Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 228/713] btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Greg Kroah-Hartman
` (496 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
Shuangpeng Bai, David Sterba
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 3f950867c307c5413d628a153ac44915bd117ffd upstream.
btrfs_dio_iomap_begin() calls btrfs_get_extent(), which returns an
extent map reference that must be dropped on all exit paths.
For direct writes into a NOCOW range, btrfs_get_blocks_direct_write()
keeps using that extent map and asks btrfs_create_dio_extent() to
allocate the ordered extent. If that fails, for example because
btrfs_alloc_ordered_extent() fails, the function returns the error
without dropping the input extent map. The PREALLOC path avoided this by
dropping the input extent map before replacing it with the newly created
one.
Check the error from btrfs_create_dio_extent() before replacing the
map and drop the input extent map on failure.
Fixes: 5f9a8a51d8b9 ("Btrfs: add semaphore to synchronize direct IO writes with fsync")
CC: stable@vger.kernel.org
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/direct-io.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
--- a/fs/btrfs/direct-io.c
+++ b/fs/btrfs/direct-io.c
@@ -281,17 +281,24 @@ static int btrfs_get_blocks_direct_write
em2 = btrfs_create_dio_extent(BTRFS_I(inode), dio_data, start,
&file_extent, type);
btrfs_dec_nocow_writers(bg);
- if (type == BTRFS_ORDERED_PREALLOC) {
- btrfs_free_extent_map(em);
- *map = em2;
- em = em2;
- }
-
if (IS_ERR(em2)) {
ret = PTR_ERR(em2);
+ btrfs_free_extent_map(em);
+ *map = NULL;
goto out;
}
+ /*
+ * True NOCOW writes don't need to create a new extent map,
+ * while PREALLOC writes must replace the existing one.
+ */
+ if (em2) {
+ ASSERT(type == BTRFS_ORDERED_PREALLOC);
+ btrfs_free_extent_map(em);
+ *map = em2;
+ em = em2;
+ }
+
dio_data->nocow_done = true;
} else {
/* Our caller expects us to free the input extent map. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 228/713] btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 227/713] btrfs: fix extent map leak in NOCOW direct I/O write Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 229/713] audit: avoid dropping live tree ref on fsnotify rule autoremove Greg Kroah-Hartman
` (495 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Filipe Manana, Qu Wenruo,
David Sterba
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
commit 15f7c86215e8d5f14b24127fa88af6c79363d50e upstream.
[TEST FAILURE]
The test case generic/628 will fail if MOUNT_OPTIONS is set to
"-o nodatasum":
FSTYP -- btrfs
PLATFORM -- Linux/x86_64 btrfs-vm 7.1.0-rc4-custom+ #383 SMP PREEMPT_DYNAMIC Sat May 30 07:35:42 ACST 2026
MKFS_OPTIONS -- -O bgt -K /dev/mapper/test-scratch1
MOUNT_OPTIONS -- -o nodatasum /dev/mapper/test-scratch1 /mnt/scratch
# generic/628 1s ... - output mismatch (see /home/adam/xfstests/results//generic/628.out.bad)
# --- tests/generic/628.out 2022-05-11 11:25:30.816666664 +0930
# +++ /home/adam/xfstests/results//generic/628.out.bad 2026-06-08 18:56:49.878542927 +0930
# @@ -8,8 +8,9 @@
# 310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/a
# 310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/d
# test reflink flag not set iflag
# +XFS_IOC_CLONE: Invalid argument
# 310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/a
# -310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/b
# +d41d8cd98f00b204e9800998ecf8427e SCRATCH_MNT/b
# ...
[CAUSE]
The direct cause is that after "chattr +S", the btrfs inode will lose its
NODATASUM flag inherited from the mount option. E.g.:
# mkfs.btrfs -f $dev
# mount $dev $mnt -o nodatasum
# touch $mnt/foobar
# sync
# btrfs ins dump-tree -t 5 $dev | grep "(257 INODE_ITEM 0) itemoff" -A 3
item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160
generation 9 transid 9 size 0 nbytes 0
block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0
sequence 1 flags 0x1(NODATASUM)
^^^^^^^^^ Proper NODATASUM flag
# chattr +S $mnt/foobar
# sync
# btrfs ins dump-tree -t 5 $dev | grep "(257 INODE_ITEM 0) itemoff" -A 3
item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160
generation 9 transid 10 size 0 nbytes 0
block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0
sequence 2 flags 0x20(SYNC)
^^^^ Only the new SYNC flag
This makes the inode drop the old NODATASUM flag, while the new reflink
destination will still inherit the NODATASUM flag. The mismatching
NODATASUM flags will cause the reflink to fail.
The root cause is that, inside btrfs_fileattr_set() if no FS_NOCOW_FL is
set, we remove both NODATASUM and NODATACOW flag.
However we should not touch NODATASUM flag, as data COW doesn't require
checksum. Only NODATACOW implies NODATASUM, but DATACOW doesn't imply
DATASUM.
The deeper problems are:
- Fileattr API is too binary
It either clears or sets a flag, there is no "do not change" option.
So that why "chattr +S" implies "chattr -C", and is forcing us to
change NODATACOW along with NODATASUM flag.
- No way to change NODATASUM through fileattr API
In fact NODATASUM can only be modified through mount option.
The deeper problems are much harder to attack.
[FIX]
Remove NODATACOW flag when FS_NOCOW_FL is not set, but only remove
NODATASUM if "nodatasum" mount option is not set.
This allows the existing "chattr +C" then "chattr -C" to remove
both NODATACOW and NODATASUM flags on a default mount.
But for a mount with "nodatasum" option, the NODATASUM inode flag will
persist through either "chattr +C" and "chattr -C".
Fixes: 7e97b8daf634 ("btrfs: allow setting NOCOW for a zero sized file via ioctl")
Cc: stable@vger.kernel.org
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ioctl.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -356,14 +356,21 @@ int btrfs_fileattr_set(struct mnt_idmap
inode_flags |= BTRFS_INODE_NODATACOW;
}
} else {
- /*
- * Revert back under same assumptions as above
- */
- if (S_ISREG(inode->vfs_inode.i_mode)) {
- if (inode->vfs_inode.i_size == 0)
- inode_flags &= ~(BTRFS_INODE_NODATACOW |
- BTRFS_INODE_NODATASUM);
- } else {
+ /* We can only change NODATACOW for zero-sized regular file. */
+ if (S_ISREG(inode->vfs_inode.i_mode) && (inode->vfs_inode.i_size == 0)) {
+ inode_flags &= ~BTRFS_INODE_NODATACOW;
+ /*
+ * There is currently no way to change NODATASUM flag
+ * through fileattr API. If we unconditionally keep the
+ * current NODATASUM flag, chattr +C then chattr -C will
+ * keep the NODATASUM flag, and no way to remove that
+ * flag.
+ *
+ * So respect the current mount option for NODATASUM flag.
+ */
+ if (!btrfs_test_opt(fs_info, NODATASUM))
+ inode_flags &= ~BTRFS_INODE_NODATASUM;
+ } else if (!S_ISREG(inode->vfs_inode.i_mode)) {
inode_flags &= ~BTRFS_INODE_NODATACOW;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 229/713] audit: avoid dropping live tree ref on fsnotify rule autoremove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 228/713] btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 230/713] cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Greg Kroah-Hartman
` (494 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jérémy Jean,
Ricardo Robaina, Paul Moore
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 783f0f0974c156aca630f4ffff248671082a098d upstream.
audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree.
Cc: stable@kernel.org
Fixes: 34d99af52ad4 ("audit: implement audit by executable")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Tested-by: Ricardo Robaina <rrobaina@redhat.com>
[PM: dropped unnecessary comment for line length reasons]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/auditfilter.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1023,7 +1023,6 @@ static inline int audit_add_rule(struct
int audit_del_rule(struct audit_entry *entry)
{
struct audit_entry *e;
- struct audit_tree *tree = entry->rule.tree;
struct list_head *list;
int ret = 0;
#ifdef CONFIG_AUDITSYSCALL
@@ -1071,9 +1070,6 @@ int audit_del_rule(struct audit_entry *e
out:
mutex_unlock(&audit_filter_mutex);
- if (tree)
- audit_put_tree(tree); /* that's the temporary one */
-
return ret;
}
@@ -1158,6 +1154,8 @@ int audit_rule_change(int type, int seq,
}
if (err || type == AUDIT_DEL_RULE) {
+ if (type == AUDIT_DEL_RULE && entry->rule.tree)
+ audit_put_tree(entry->rule.tree);
if (entry->rule.exe)
audit_remove_mark(entry->rule.exe);
audit_free_rule(entry);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 230/713] cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 229/713] audit: avoid dropping live tree ref on fsnotify rule autoremove Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 231/713] cifs: call pagecache_isize_extended() in cifs_setsize() when extending Greg Kroah-Hartman
` (493 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Paulo Alcantara,
Frank Sorenson, Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 32a7af68df7361fe7cf153cf36124d04b94aec00 upstream.
cifs_setsize() calls fscache_resize_cookie() without holding i_rwsem.
When the fscache cookie is active (FSCACHE_COOKIE_IS_CACHING is set),
fscache_resize_cookie() performs a real resize that requires i_rwsem
held exclusively. If another file descriptor has the same inode open,
fscache_use_cookie() was already called from that cifs_open(), making
the cookie active. In that case, calling cifs_setsize() from
cifs_do_truncate() (invoked from cifs_open() without i_rwsem) races
against concurrent fscache I/O.
Strip fscache_resize_cookie() from cifs_setsize(), making it a pure
size/page-cache helper. Add cifs_resize_file_locked() for callers
that already hold i_rwsem: it calls netfs_resize_file() and
cifs_setsize(), then temporarily activates the cookie with
fscache_use_cookie() to perform the resize under the lock, then
deactivates it with cifs_fscache_unuse_inode_cookie(). Using
fscache_use_cookie() before the resize ensures correctness whether or
not another fd already holds the cookie active.
Switch cifs_file_set_size(), smb2_duplicate_extents(), and both size-
extension branches of smb3_simple_falloc() to the new wrapper; those
paths already hold i_rwsem via VFS setattr, lock_two_nondirectories(),
or cifs_fallocate() respectively. cifs_do_truncate() continues to
call cifs_setsize() followed by cifs_invalidate_cache(), since it runs
without i_rwsem.
Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()")
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsfs.h | 1 +
fs/smb/client/inode.c | 24 +++++++++++++++++++-----
fs/smb/client/smb2ops.c | 9 +++------
3 files changed, 23 insertions(+), 11 deletions(-)
--- a/fs/smb/client/cifsfs.h
+++ b/fs/smb/client/cifsfs.h
@@ -147,6 +147,7 @@ ssize_t cifs_file_copychunk_range(unsign
long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg);
void cifs_setsize(struct inode *inode, loff_t offset);
+void cifs_resize_file_locked(struct inode *inode, loff_t offset);
struct fs_context;
struct smb3_fs_context;
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -3059,7 +3059,23 @@ void cifs_setsize(struct inode *inode, l
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
truncate_pagecache(inode, offset);
netfs_wait_for_outstanding_io(inode);
- fscache_resize_cookie(cifs_inode_cookie(inode), offset);
+}
+
+void cifs_resize_file_locked(struct inode *inode, loff_t offset)
+{
+ struct fscache_cookie *cookie = cifs_inode_cookie(inode);
+
+ lockdep_assert_held_write(&inode->i_rwsem);
+
+ netfs_resize_file(netfs_inode(inode), offset, true);
+ cifs_setsize(inode, offset);
+
+ if (!cookie)
+ return;
+
+ fscache_use_cookie(cookie, true);
+ fscache_resize_cookie(cookie, offset);
+ cifs_fscache_unuse_inode_cookie(inode, true);
}
int cifs_file_set_size(const unsigned int xid, struct dentry *dentry,
@@ -3125,10 +3141,8 @@ int cifs_file_set_size(const unsigned in
cifs_put_tlink(tlink);
set_size_out:
- if (rc == 0) {
- netfs_resize_file(&cifsInode->netfs, size, true);
- cifs_setsize(inode, size);
- }
+ if (rc == 0)
+ cifs_resize_file_locked(inode, size);
return rc;
}
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -2222,8 +2222,7 @@ smb2_duplicate_extents(const unsigned in
rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false);
if (rc)
goto duplicate_extents_out;
- netfs_resize_file(netfs_inode(inode), dest_off + len, true);
- cifs_setsize(inode, dest_off + len);
+ cifs_resize_file_locked(inode, dest_off + len);
}
rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
trgtfile->fid.volatile_fid,
@@ -3776,8 +3775,7 @@ static long smb3_simple_falloc(struct fi
}
new_eof = off + len;
- netfs_resize_file(&cifsi->netfs, new_eof, true);
- cifs_setsize(inode, new_eof);
+ cifs_resize_file_locked(inode, new_eof);
qrc = SMB2_query_info(xid, tcon,
cfile->fid.persistent_fid,
@@ -3825,8 +3823,7 @@ static long smb3_simple_falloc(struct fi
if (rc)
goto out;
- netfs_resize_file(&cifsi->netfs, new_eof, true);
- cifs_setsize(inode, new_eof);
+ cifs_resize_file_locked(inode, new_eof);
qrc = SMB2_query_info(xid, tcon,
cfile->fid.persistent_fid,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 231/713] cifs: call pagecache_isize_extended() in cifs_setsize() when extending
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 230/713] cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 232/713] cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Greg Kroah-Hartman
` (492 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Frank Sorenson,
Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit c510edb9734af1c274d18f4f31a471a166bbc7e8 upstream.
cifs_setsize() calls truncate_pagecache() but skips
pagecache_isize_extended() on extension. truncate_setsize() shows
the correct pattern:
i_size_write(inode, newsize);
if (newsize > oldsize)
pagecache_isize_extended(inode, oldsize, newsize);
truncate_pagecache(inode, newsize);
pagecache_isize_extended() zeroes the tail of the page straddling old
EOF. Without it, dirty bytes in that region can be written back to
the server, exposing stale data in the newly extended range.
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/inode.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -3057,6 +3057,8 @@ void cifs_setsize(struct inode *inode, l
inode->i_blocks = blocks;
spin_unlock(&inode->i_lock);
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
+ if (offset > old_size)
+ pagecache_isize_extended(inode, old_size, offset);
truncate_pagecache(inode, offset);
netfs_wait_for_outstanding_io(inode);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 232/713] cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 231/713] cifs: call pagecache_isize_extended() in cifs_setsize() when extending Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 233/713] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Greg Kroah-Hartman
` (491 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara, Frank Sorenson,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit b96db32fed8dfb2478d7c208f89bf383beed1535 upstream.
When the else branch of cifs_file_set_size() finds a writable file handle
via find_writable_file(), it borrows tcon and server from the handle's
tlink, attempts the handle-based set_file_size() RPC, and then releases
the handle with cifsFileInfo_put().
If set_file_size() fails, execution falls through to the path-based
fallback, which reuses the borrowed tcon and server under the
"if (tcon == NULL)" guard. Since tcon is not NULL at that point, the
guard is skipped. If cifsFileInfo_put() dropped the last reference on a
tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE
cleared, as happens during reconnection or session teardown),
cifs_put_tlink() will have freed tcon; the subsequent set_path_size()
call is then a use-after-free.
Setting tcon = NULL after cifsFileInfo_put() causes the existing guard
to take the cifs_sb_tlink() path, which acquires a fresh reference for
the path-based operation or fails cleanly if the session is gone.
Fixes: 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC")
Cc: stable@vger.kernel.org
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/inode.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -3118,6 +3118,7 @@ int cifs_file_set_size(const unsigned in
size, false);
cifs_dbg(FYI, "%s: set_file_size: rc = %d\n", __func__, rc);
cifsFileInfo_put(open_file);
+ tcon = NULL;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 233/713] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 232/713] cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 234/713] cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Greg Kroah-Hartman
` (490 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Sorenson, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 6c322f5cf7476ded7a9a20f7be72462065a03c68 upstream.
With len == 0 (clone to EOF), the effective length is computed as:
len = src_inode->i_size - off;
If off > i_size, this is a negative loff_t, corrupting the ByteCount
in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range
in filemap_write_and_wait_range(). The existing off >= i_size check
fires only after the ioctl has already been sent.
Snapshot i_size_read() once for both the bounds check and the length
calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject
off > src_size with -EINVAL. Treat off == src_size as a no-op,
consistent with __generic_remap_file_range_prep().
Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsfs.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -1413,8 +1413,19 @@ static loff_t cifs_remap_file_range(stru
*/
lock_two_nondirectories(target_inode, src_inode);
- if (len == 0)
- len = src_inode->i_size - off;
+ if (len == 0) {
+ loff_t src_size = i_size_read(src_inode);
+
+ if (off > src_size) {
+ rc = -EINVAL;
+ goto unlock;
+ }
+ len = src_size - off;
+ if (!len) {
+ rc = 0;
+ goto unlock;
+ }
+ }
cifs_dbg(FYI, "clone range\n");
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 234/713] cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 233/713] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 235/713] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions Greg Kroah-Hartman
` (489 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Paulo Alcantara,
Frank Sorenson, Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 364b183230586a62660a7280c1eb20138338eeb5 upstream.
cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it
cannot use cifs_resize_file_locked() to perform a proper fscache cookie
resize. Instead, add cifs_invalidate_cache() after cifs_setsize().
cifs_invalidate_cache() calls fscache_invalidate(), which works without
holding i_rwsem: it unconditionally increments inval_counter and sets
FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not
served once the cookie is later activated by fscache_use_cookie().
Truncation to zero leaves no valid cached data, making invalidation the
correct semantic here.
Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()")
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/file.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -1016,6 +1016,7 @@ static int cifs_do_truncate(const unsign
if (!rc) {
netfs_resize_file(&cinode->netfs, 0, true);
cifs_setsize(inode, 0);
+ cifs_invalidate_cache(inode, 0);
}
}
if (cfile)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 235/713] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 234/713] cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 236/713] smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Greg Kroah-Hartman
` (488 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 upstream.
When a file has the setuid or setgid bit set and is written to, the VFS
strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID
together with an ATTR_MODE carrying the already-cleared mode.
Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped
ATTR_MODE in that case:
/* skip mode change if it's just for clearing setuid/setgid */
if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
attrs->ia_valid &= ~ATTR_MODE;
This is fine for the default mount, where the mode is only emulated via
the DOS read-only attribute and cannot represent the setuid/setgid bits
anyway. However, with the "cifsacl" or "modefromsid" mount options the
mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with
the SMB3.1.1 POSIX extensions the mode is sent to the server directly,
and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent
via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means
the cleared mode is never pushed to the server, so the setuid/setgid bit
survives the write.
This is a security issue: on local filesystems the setuid bit is stripped
when a file is written, but over these cifs.ko mounts the bit persists on
the server, potentially allowing an unexpected privilege escalation on
subsequent execution.
Fix this in two places:
1. cifs_setattr_nounix(): only take the "skip mode change" shortcut
when the mode is emulated via the DOS read-only attribute (i.e.
neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are
in effect), so that the cleared mode is propagated to the server
in the ACL / POSIX cases.
2. cifs_setattr_unix(): this function is only called when Unix
extensions are in effect, so the mode is always stored on the
server. Remove the shortcut entirely so that the cleared mode is
always pushed.
Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/inode.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -3231,9 +3231,13 @@ cifs_setattr_unix(struct dentry *direntr
attrs->ia_valid &= ~(ATTR_CTIME | ATTR_MTIME);
}
- /* skip mode change if it's just for clearing setuid/setgid */
- if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
- attrs->ia_valid &= ~ATTR_MODE;
+ /*
+ * This function is only called when Unix extensions are in effect,
+ * so the mode is always sent to and stored on the server. Do not
+ * skip the mode change when clearing setuid/setgid bits: dropping
+ * ATTR_MODE here would leave those bits set on the server after a
+ * write, which is a security issue.
+ */
args = kmalloc_obj(*args);
if (args == NULL) {
@@ -3442,8 +3446,23 @@ cifs_setattr_nounix(struct dentry *diren
attrs->ia_valid &= ~(ATTR_UID | ATTR_GID);
}
- /* skip mode change if it's just for clearing setuid/setgid */
- if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
+ /*
+ * Skip the mode change if it is only being done to clear the
+ * setuid/setgid bits *and* the mode is emulated via the DOS
+ * read-only attribute (the default, non-ACL case), which cannot
+ * represent the setuid/setgid bits anyway.
+ *
+ * When the mode is instead stored on the server - i.e. with the
+ * cifsacl or modefromsid mount options (via an ACL) or with the
+ * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to
+ * the server. Dropping ATTR_MODE here would leave the setuid/
+ * setgid bit set on the server after a write, which is a security
+ * issue (the bits are not stripped as they are on local
+ * filesystems).
+ */
+ if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
+ !((sbflags & (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) ||
+ cifs_sb_master_tcon(cifs_sb)->posix_extensions))
attrs->ia_valid &= ~ATTR_MODE;
if (attrs->ia_valid & ATTR_MODE) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 236/713] smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 235/713] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 237/713] smb: client: clear ce->tgthint in free_tgts() Greg Kroah-Hartman
` (487 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Sorenson, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 730d0bb19507b9e19c2fe5343109ac618e2fbce5 upstream.
When a valid primary TRANSACT2 response has been received (mid->resp_buf
set, mid->multiRsp true) and a subsequent secondary response causes
cifs_check_trans2() to return false -- either because the SMB header is
invalid (malformed != 0) or because check2ndT2() rejects the PDU --
handle_mid() overwrites mid->resp_buf with the new buffer (leaking the
primary buffer) and, because mid->multiRsp is set, skips the
server->smallbuf/bigbuf NULL-out. When the user thread frees
mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the
demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already
set, abort the pending transaction inline: set multiEnd, call
dequeue_mid() with malformed=true, and return true so handle_mid() exits
without touching mid->resp_buf or the server buffer pointers.
Fixes: 316cf94a910f ("CIFS: Move trans2 processing to ops struct")
Cc: stable@vger.kernel.org # cifs_check_trans2() is in smb1ops.c on kernels < 7.0
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb1transport.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/fs/smb/client/smb1transport.c
+++ b/fs/smb/client/smb1transport.c
@@ -430,10 +430,18 @@ bool
cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server,
char *buf, int malformed)
{
- if (malformed)
- return false;
- if (check2ndT2(buf) <= 0)
+ if (malformed || check2ndT2(buf) <= 0) {
+ /* mid->multiRsp blocks the server buf detach in handle_mid();
+ * returning false here would leak resp_buf and leave a dangling
+ * server->smallbuf/bigbuf after the user thread frees resp_buf.
+ */
+ if (mid->multiRsp) {
+ mid->multiEnd = true;
+ dequeue_mid(server, mid, true);
+ return true;
+ }
return false;
+ }
mid->multiRsp = true;
if (mid->resp_buf) {
/* merge response - fix up 1st*/
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 237/713] smb: client: clear ce->tgthint in free_tgts()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 236/713] smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 238/713] ksmbd: only rebind the reopened files own oplock on durable reconnect Greg Kroah-Hartman
` (486 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fredric Cover, ChenXiaoSong,
Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredric Cover <fredric.cover.lkernel@gmail.com>
commit b1b741cf8e7ce1b91d937e23decd3d3358748700 upstream.
When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.
If ce->tgthint is not reset before it is used later, it results
in a use-after-free.
Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.
Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines")
Cc: stable@vger.kernel.org # depends on: smb: client: harden DFS cache against invalid target hints
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/dfs_cache.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/dfs_cache.c
+++ b/fs/smb/client/dfs_cache.c
@@ -122,6 +122,8 @@ static inline void free_tgts(struct cach
kfree(t->name);
kfree(t);
}
+
+ WRITE_ONCE(ce->tgthint, NULL);
}
static inline void flush_cache_ent(struct cache_entry *ce)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 238/713] ksmbd: only rebind the reopened files own oplock on durable reconnect
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 237/713] smb: client: clear ce->tgthint in free_tgts() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 239/713] smb: client: fix ALIGN() overflow in symlink_data() error context loop Greg Kroah-Hartman
` (485 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, ChenXiaoSong,
Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 3f220a0a62e6b9b391c9d1f0e6580b05173cc7f7 upstream.
ksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every
detached oplock to the reconnecting session:
list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
lockdep_is_held(&ci->m_lock)) {
if (op->conn)
continue;
op->conn = ksmbd_conn_get(fp->conn);
op->sess = work->sess;
}
The only key is op->conn == NULL, which every detached durable handle on
that inode matches, not just the one owned by fp. When two sessions hold
durable handles on the same file and both disconnect, reconnecting one of
them adopts the other session's oplock: op->sess is overwritten with the
reconnecting session without taking a reference on it, while op->conn
pins the connection.
The sibling teardown path, session_fd_check(), keys on the identity of
the connection being torn down (op->conn == conn) rather than on shared
state, and so does not have this problem.
Once the adopting session is destroyed, ksmbd_session_destroy() frees it
while the foreign oplock still points at it. The reader in
ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is
still live thanks to the reference taken above, and then dereferences the
stale session:
if (!opinfo->conn) {
up_read(&fp->f_ci->m_lock);
goto out;
}
ft = &opinfo->sess->file_table;
write_lock(&ft->lock);
BUG: KASAN: slab-use-after-free in _raw_write_lock+0x74/0xd0
Write of size 4 at addr ffff88810a970528 by task kworker/0:0/9
Workqueue: ksmbd-io handle_ksmbd_work
Call Trace:
_raw_write_lock+0x74/0xd0
ksmbd_close_fd_app_instance_id+0x183/0x410
smb2_open+0x1346/0x4430
handle_ksmbd_work+0x2bb/0x7b0
Reached from an authenticated session against a share with the default
durable-handle and oplock configuration: two sessions open the same file
with a durable-v2 handle and an RH lease under distinct AppInstanceIds,
both log off, one reconnects with DH2C, and a later durable-v2 create
carrying the other AppInstanceId walks into the freed session.
Constrain the loop to the oplock owned by the file being reopened.
Fixes: f363a0fb134a ("ksmbd: fix app-instance durable supersede session UAF")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs_cache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1722,7 +1722,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd
down_write(&ci->m_lock);
list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
lockdep_is_held(&ci->m_lock)) {
- if (op->conn)
+ if (op->conn || op->o_fp != fp)
continue;
op->conn = ksmbd_conn_get(fp->conn);
op->sess = work->sess;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 239/713] smb: client: fix ALIGN() overflow in symlink_data() error context loop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 238/713] ksmbd: only rebind the reopened files own oplock on durable reconnect Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 240/713] smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Greg Kroah-Hartman
` (484 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Sorenson, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 62656b024efc21c3230eade1a847f25871c3d2bb upstream.
The check added by commit 7d9a7f1f96cd ("smb/client: fix possible
infinite loop and oob read in symlink_data()") compared the post-ALIGN
length against the remaining buffer, but ALIGN() itself can overflow:
for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8)
wraps to 0, so the subsequent bounds check passes, and the loop
advances by zero bytes leaving 'p' pointing into stale data.
Fix by checking the raw ErrorDataLength against the remaining space
before applying ALIGN(), then checking again after. Since raw_len is
bounded by the buffer, raw_len + 7 cannot overflow, so the second check
is an exact post-alignment bounds guard.
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2file.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/smb/client/smb2file.c
+++ b/fs/smb/client/smb2file.c
@@ -61,7 +61,10 @@ static struct smb2_symlink_err_rsp *syml
cifs_dbg(FYI, "%s: skipping unhandled error context: 0x%x\n",
__func__, le32_to_cpu(p->ErrorId));
- len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
+ len = le32_to_cpu(p->ErrorDataLength);
+ if (len > end - ((u8 *)p + sizeof(*p)))
+ return ERR_PTR(-EINVAL);
+ len = ALIGN(len, 8);
if (len > end - ((u8 *)p + sizeof(*p)))
return ERR_PTR(-EINVAL);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 240/713] smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 239/713] smb: client: fix ALIGN() overflow in symlink_data() error context loop Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 241/713] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Greg Kroah-Hartman
` (483 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara, Frank Sorenson,
Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 5d14030b46af1a958fd104b020fbb93631c98822 upstream.
The LXDEV block in cifs_query_path_info() uses SMB2_WSL_XATTR_MODE_SIZE
(4) instead of SMB2_WSL_XATTR_DEV_SIZE (8), undercounting eas_len by 4
bytes per $LXDEV EA.
eas_len is used only as a zero/non-zero presence flag so there is no
current functional impact, but the value is incorrect and misleading.
Fixes: 97db41604555 ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
Cc: stable@vger.kernel.org
Cc: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb1ops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/client/smb1ops.c
+++ b/fs/smb/client/smb1ops.c
@@ -717,7 +717,7 @@ static int cifs_query_path_info(const un
ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE);
memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1);
data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
- SMB2_WSL_XATTR_MODE_SIZE, 4);
+ SMB2_WSL_XATTR_DEV_SIZE, 4);
rc = 0;
} else if (rc >= 0) {
/* It is an error if EA $LXDEV has wrong size. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 241/713] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 240/713] smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 242/713] smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() Greg Kroah-Hartman
` (482 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shen Yongchao, Frank Sorenson,
Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 6343c1da561962688f203362d80d6a3bfa39fa1b upstream.
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
...
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.
The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.
Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.
Fixes: e4eb295d38b5 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2")
Cc: stable@vger.kernel.org
Reported-by: Shen Yongchao <grayhat@foxmail.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb1transport.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
--- a/fs/smb/client/smb1transport.c
+++ b/fs/smb/client/smb1transport.c
@@ -375,12 +375,31 @@ coalesce_t2(char *second_buf, struct smb
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
- /* validate target area */
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
+ /*
+ * DataOffset fields are server-supplied and not validated against
+ * buffer bounds; check both data pointers before mutating the
+ * target header.
+ */
+ if (data_area_of_tgt < (char *)target_hdr +
+ sizeof(struct smb_t2_rsp) + sizeof(__le16) ||
+ data_area_of_tgt + total_in_src >
+ (char *)target_hdr + CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
+ cifs_dbg(VFS, "%s: target data area out of bounds\n", __func__);
+ return -EPROTO;
+ }
+ if (data_area_of_src < second_buf +
+ sizeof(struct smb_t2_rsp) + sizeof(__le16) ||
+ data_area_of_src + total_in_src >
+ second_buf + smbCalcSize((struct smb_hdr *)second_buf)) {
+ cifs_dbg(VFS, "%s: secondary data area out of bounds\n", __func__);
+ return -EPROTO;
+ }
+
total_in_tgt += total_in_src;
/* is the result too big for the field? */
if (total_in_tgt > USHRT_MAX) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 242/713] smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 241/713] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 243/713] smb: client: harden DFS cache against invalid target hints Greg Kroah-Hartman
` (481 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Sorenson, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <sorenson@redhat.com>
commit 05f78e6cf34ea3a285053bd5999e08e8ac298bd5 upstream.
reparse_buf_ptr() reads buf->ReparseDataLength before checking that
count covers the full fixed header:
buf = (struct reparse_data_buffer *)((u8 *)io + off);
len = sizeof(*buf); /* 8 bytes */
rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */
if (count < len || count < rdlen + len) /* check comes after */
struct reparse_data_buffer has ReparseDataLength at offset 4. If a
server returns OutputCount < 6, the read at offset 4-5 reaches past
the end of the received data. The off+count bounds against iov_len
were already validated, but that does not protect against count being
smaller than sizeof(*buf).
Split the check: verify count >= sizeof(*buf) before reading
ReparseDataLength, then verify count covers the data region.
Fixes: a158bb66b137 ("smb: client: optimise reparse point querying")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2inode.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -40,9 +40,11 @@ static struct reparse_data_buffer *repar
buf = (struct reparse_data_buffer *)((u8 *)io + off);
len = sizeof(*buf);
- rdlen = le16_to_cpu(buf->ReparseDataLength);
+ if (count < len)
+ return ERR_PTR(smb_EIO2(smb_eio_trace_reparse_rdlen, count, 0));
- if (count < len || count < rdlen + len)
+ rdlen = le16_to_cpu(buf->ReparseDataLength);
+ if (count < rdlen + len)
return ERR_PTR(smb_EIO2(smb_eio_trace_reparse_rdlen, count, rdlen));
return buf;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 243/713] smb: client: harden DFS cache against invalid target hints
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 242/713] smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 244/713] smb: client: reject a tree connect response whose byte count is too small Greg Kroah-Hartman
` (480 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fredric Cover, ChenXiaoSong,
Namjae Jeon, Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredric Cover <fredric.cover.lkernel@gmail.com>
commit bf86c08123c6ab8c61cc0be1dad7540db93738ff upstream.
Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is
NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always
valid.
In preparation for clearing ce->tgthint in free_tgts(), harden callers
of get_tgt_name() against ERR_PTR results and harden
dfs_cache_noreq_update_tgthint() against NULL pointer dereferences.
Cc: stable@vger.kernel.org
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/dfs_cache.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
--- a/fs/smb/client/dfs_cache.c
+++ b/fs/smb/client/dfs_cache.c
@@ -871,13 +871,22 @@ int dfs_cache_find(const unsigned int xi
goto out_free_path;
}
- if (ref)
- rc = setup_referral(path, ce, ref, get_tgt_name(ce));
- else
+ if (ref) {
+ char *target = get_tgt_name(ce);
+
+ if (IS_ERR(target)) {
+ rc = PTR_ERR(target);
+ goto out_unlock;
+ }
+ rc = setup_referral(path, ce, ref, target);
+ } else {
rc = 0;
+ }
+
if (!rc && tgt_list)
rc = get_targets(ce, tgt_list);
+out_unlock:
up_read(&htable_rw_lock);
out_free_path:
@@ -917,10 +926,17 @@ int dfs_cache_noreq_find(const char *pat
goto out_unlock;
}
- if (ref)
- rc = setup_referral(path, ce, ref, get_tgt_name(ce));
- else
+ if (ref) {
+ char *target = get_tgt_name(ce);
+
+ if (IS_ERR(target)) {
+ rc = PTR_ERR(target);
+ goto out_unlock;
+ }
+ rc = setup_referral(path, ce, ref, target);
+ } else {
rc = 0;
+ }
if (!rc && tgt_list)
rc = get_targets(ce, tgt_list);
@@ -961,7 +977,8 @@ void dfs_cache_noreq_update_tgthint(cons
t = READ_ONCE(ce->tgthint);
- if (unlikely(!strcasecmp(it->it_name, t->name)))
+ /* Check 't' in case ce->tgthint was cleared by free_tgts() */
+ if (t && unlikely(!strcasecmp(it->it_name, t->name)))
goto out_unlock;
list_for_each_entry(t, &ce->tlist, list) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 244/713] smb: client: reject a tree connect response whose byte count is too small
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 243/713] smb: client: harden DFS cache against invalid target hints Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 245/713] smb: client: restore the data_offset bound in is_valid_oplock_break() Greg Kroah-Hartman
` (479 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Namjae Jeon,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 65deb18359341141d37dc86fc7853511be3c87a7 upstream.
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.
Fixes: cc20c031bb06 ("cifs: convert CIFSTCon to use new unicode helper functions")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifssmb.c | 6 ++++++
fs/smb/client/trace.h | 3 ++-
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -615,6 +615,11 @@ CIFSTCon(const unsigned int xid, struct
tcon->tid = smb_buffer_response->Tid;
bcc_ptr = pByteArea(smb_buffer_response);
bytes_left = get_bcc(smb_buffer_response);
+ if (bytes_left < 2) {
+ rc = smb_EIO2(smb_eio_trace_tcon_bcc_too_small,
+ bytes_left, 2);
+ goto out;
+ }
length = strnlen(bcc_ptr, bytes_left - 2);
if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
is_unicode = true;
@@ -670,6 +675,7 @@ CIFSTCon(const unsigned int xid, struct
reset_cifs_unix_caps(xid, tcon, NULL, NULL);
}
}
+out:
cifs_buf_release(smb_buffer);
return rc;
}
--- a/fs/smb/client/trace.h
+++ b/fs/smb/client/trace.h
@@ -133,6 +133,7 @@
EM(smb_eio_trace_sym_slash, "sym_slash") \
EM(smb_eio_trace_sym_target_len, "sym_target_len") \
EM(smb_eio_trace_symlink_file_size, "symlink_file_size") \
+ EM(smb_eio_trace_tcon_bcc_too_small, "tcon_bcc_too_small") \
EM(smb_eio_trace_tdis_in_reconnect, "tdis_in_reconnect") \
EM(smb_eio_trace_tx_chained_async, "tx_chained_async") \
EM(smb_eio_trace_tx_compress_failed, "tx_compress_failed") \
@@ -213,7 +214,7 @@
#define EM(a, b) a,
#define E_(a, b) a
-enum smb_eio_trace { smb_eio_traces } __mode(byte);
+enum smb_eio_trace { smb_eio_traces };
enum smb3_rw_credits_trace { smb3_rw_credits_traces } __mode(byte);
enum smb3_tcon_ref_trace { smb3_tcon_ref_traces } __mode(byte);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 245/713] smb: client: restore the data_offset bound in is_valid_oplock_break()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 244/713] smb: client: reject a tree connect response whose byte count is too small Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 246/713] HID: apple: preserve keyboard backlight across T2 resume Greg Kroah-Hartman
` (478 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Bryam Vargas,
Paulo Alcantara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit ba22f575de9deeae4ae0859ca4315a7698226237 upstream.
Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against. It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length. The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.
len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1a0
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything. Use total_read, which is now the message length on its own.
Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
Cc: stable@kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb1misc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/smb1misc.c b/fs/smb/client/smb1misc.c
index ba56023010d8..cdfbbff24b72 100644
--- a/fs/smb/client/smb1misc.c
+++ b/fs/smb/client/smb1misc.c
@@ -80,7 +80,8 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
(struct smb_com_transaction_change_notify_rsp *)buf;
struct file_notify_information *pnotify;
__u32 data_offset = 0;
- size_t len = srv->total_read - srv->pdu_size;
+ /* total_read excludes the RFC1002 preamble */
+ size_t len = srv->total_read;
if (get_bcc(buf) > sizeof(struct file_notify_information)) {
data_offset = le32_to_cpu(pSMBr->DataOffset);
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 246/713] HID: apple: preserve keyboard backlight across T2 resume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 245/713] smb: client: restore the data_offset bound in is_valid_oplock_break() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 247/713] HID: corsair-void: Check size of status and firmware events before reading them Greg Kroah-Hartman
` (477 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andre Eikmeyer, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Eikmeyer <dev@deq.rocks>
commit 2b5d1495bd101f3d9c13caf3923754f48ee7371a upstream.
The T2 virtual USB host controller re-enumerates the internal keyboard
after system resume. The butterfly keyboard backlight currently uses
LED_CORE_SUSPENDRESUME, so the LED core sends a blocking request to the
old HID device while it is disappearing. That request fails with -ENODEV
and the newly probed device starts with its backlight off.
To fix this, we cache the requested brightness when the old HID device is
removed and restore it when the replacement is probed. We let
re-enumeration handle restoration instead of issuing a request through the
stale device.
Fixes: 1f95a6cd5ad7 ("HID: apple: ensure the keyboard backlight is off if suspending")
Cc: stable@vger.kernel.org
Signed-off-by: Andre Eikmeyer <dev@deq.rocks>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-apple.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -91,6 +91,9 @@ struct apple_sc_backlight {
struct hid_device *hdev;
};
+/* T2 VHCI re-enumerates the internal keyboard across system resume. */
+static int apple_backlight_resume_brightness = -1;
+
struct apple_backlight_config_report {
u8 report_id;
u8 version;
@@ -825,6 +828,7 @@ static int apple_backlight_led_set(struc
static int apple_backlight_init(struct hid_device *hdev)
{
int ret;
+ int brightness;
struct apple_sc *asc = hid_get_drvdata(hdev);
struct apple_backlight_config_report *rep;
@@ -860,13 +864,20 @@ static int apple_backlight_init(struct h
asc->backlight->cdev.name = "apple::kbd_backlight";
asc->backlight->cdev.max_brightness = rep->backlight_on_max;
asc->backlight->cdev.brightness_set_blocking = apple_backlight_led_set;
- asc->backlight->cdev.flags = LED_CORE_SUSPENDRESUME;
+ /* VHCI re-enumeration restores the cached brightness in the next probe. */
+
+ brightness = READ_ONCE(apple_backlight_resume_brightness);
+ if (brightness < 0)
+ brightness = LED_OFF;
+ else
+ brightness = min_t(int, brightness, rep->backlight_on_max);
- ret = apple_backlight_set(hdev, 0, 0);
+ ret = apple_backlight_set(hdev, brightness, 0);
if (ret < 0) {
hid_err(hdev, "backlight set request failed: %d\n", ret);
goto cleanup_and_exit;
}
+ asc->backlight->cdev.brightness = brightness;
ret = devm_led_classdev_register(&hdev->dev, &asc->backlight->cdev);
@@ -999,6 +1010,9 @@ static void apple_remove(struct hid_devi
if (asc->quirks & APPLE_RDESC_BATTERY)
timer_delete_sync(&asc->battery_timer);
+ if (asc->backlight)
+ WRITE_ONCE(apple_backlight_resume_brightness,
+ asc->backlight->cdev.brightness);
hid_hw_stop(hdev);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 247/713] HID: corsair-void: Check size of status and firmware events before reading them
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 246/713] HID: apple: preserve keyboard backlight across T2 resume Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 248/713] HID: picolcd: clamp eeprom debugfs read to bytes actually received Greg Kroah-Hartman
` (476 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stuart Hayhurst, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
commit 08d8814521885e67b1bdf6a3036ee264e3e58377 upstream.
Malformed status and firmware events could cause an out-of-bounds read since
the size wasn't being checked. Check the size and warn on unexpected values to
avoid this.
Fixes: 6ea2a6fd3872 ("HID: corsair-void: Add Corsair Void headset family driver")
Cc: stable@vger.kernel.org
Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-corsair-void.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/hid/hid-corsair-void.c
+++ b/drivers/hid/hid-corsair-void.c
@@ -92,6 +92,9 @@
#define CORSAIR_VOID_STATUS_REPORT_ID 0x64
#define CORSAIR_VOID_FIRMWARE_REPORT_ID 0x66
+#define CORSAIR_VOID_STATUS_REPORT_SIZE 5
+#define CORSAIR_VOID_FIRMWARE_REPORT_SIZE 5
+
#define CORSAIR_VOID_USB_SIDETONE_REQUEST 0x1
#define CORSAIR_VOID_USB_SIDETONE_REQUEST_TYPE 0x21
#define CORSAIR_VOID_USB_SIDETONE_VALUE 0x200
@@ -742,6 +745,13 @@ static int corsair_void_raw_event(struct
/* Description of packets are documented at the top of this file */
if (hid_report->id == CORSAIR_VOID_STATUS_REPORT_ID) {
+ if (size < CORSAIR_VOID_STATUS_REPORT_SIZE) {
+ hid_warn_ratelimited(hid_dev,
+ "unexpected status report of size %d",
+ size);
+ return 1;
+ }
+
drvdata->mic_up = FIELD_GET(CORSAIR_VOID_MIC_MASK, data[2]);
drvdata->connected = (data[3] == CORSAIR_VOID_WIRELESS_CONNECTED) ||
drvdata->is_wired;
@@ -750,6 +760,13 @@ static int corsair_void_raw_event(struct
FIELD_GET(CORSAIR_VOID_CAPACITY_MASK, data[2]),
data[3], data[4]);
} else if (hid_report->id == CORSAIR_VOID_FIRMWARE_REPORT_ID) {
+ if (size < CORSAIR_VOID_FIRMWARE_REPORT_SIZE) {
+ hid_warn_ratelimited(hid_dev,
+ "unexpected firmware report of size %d",
+ size);
+ return 1;
+ }
+
drvdata->fw_receiver_major = data[1];
drvdata->fw_receiver_minor = data[2];
drvdata->fw_headset_major = data[3];
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 248/713] HID: picolcd: clamp eeprom debugfs read to bytes actually received
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 247/713] HID: corsair-void: Check size of status and firmware events before reading them Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 249/713] HID: roccat: free buffered reports when destroying device Greg Kroah-Hartman
` (475 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit e9c667395ac1f8024f623250b32bae4c7af9caa0 upstream.
picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte
supplied by the device in its REPORT_EE_DATA reply -- clamped only to
the caller's read() count:
ret = resp->raw_data[2];
if (ret > s)
ret = s;
if (copy_to_user(u, resp->raw_data+3, ret))
It never checks resp->raw_size, the number of bytes picolcd_raw_event()
actually copied into the 64-byte raw_data[] of the kmalloc'd struct
picolcd_pending. A device (or a spoofed picoLCD) returning a length byte
of 0xff, read with a count >= 255, makes copy_to_user() read past
raw_data[] into adjacent slab memory and return it to userspace through
the debugfs "eeprom" file:
BUG: KASAN: slab-out-of-bounds in _copy_to_user
Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]
The debug-dump path in the same file already validates the device length
byte against the received size before trusting it; this read does not.
The file is created S_IRUSR (root-only) and a crafted device is needed,
so it is neither unprivileged- nor remotely-triggerable.
Clamp the copy length to resp->raw_size - 3 (the payload actually
received, minus the 3-byte header), floored at 0 for short replies.
Fixes: 9bbf2b98ba11 ("HID: add experimental access to PicoLCD device's EEPROM and FLASH")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-picolcd_debugfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/hid/hid-picolcd_debugfs.c
+++ b/drivers/hid/hid-picolcd_debugfs.c
@@ -99,6 +99,15 @@ static ssize_t picolcd_debug_eeprom_read
ret = resp->raw_data[2];
if (ret > s)
ret = s;
+ /*
+ * raw_data[2] is a device-supplied length; also clamp it to
+ * what picolcd_raw_event() actually stored (raw_size), or a
+ * hostile device overruns the raw_data[] buffer.
+ */
+ if (ret > resp->raw_size - 3)
+ ret = resp->raw_size - 3;
+ if (ret < 0)
+ ret = 0;
if (copy_to_user(u, resp->raw_data+3, ret))
ret = -EFAULT;
else
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 249/713] HID: roccat: free buffered reports when destroying device
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 248/713] HID: picolcd: clamp eeprom debugfs read to bytes actually received Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 250/713] HID: sensor: custom: Fix field sysfs group cleanup on failure Greg Kroah-Hartman
` (474 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit bbff0ccbff360a5498075525005f6a913239a3d7 upstream.
roccat_report_event() duplicates each report with kmemdup() and stores
the allocation in a circular-buffer slot. The allocation is released only
when that slot is reused.
The device destruction paths free struct roccat_device without releasing
reports still stored in cbuf[]. This makes those allocations unreachable
and leaks up to ROCCAT_CBUF_SIZE report buffers per device.
Add a small destructor that frees every buffered report before freeing the
device, and use it in both paths that can destroy a registered device.
Fixes: 206f5f2fcb5f ("HID: roccat: propagate special events of roccat hardware to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -70,6 +70,15 @@ static struct roccat_device *devices[ROC
/* protects modifications of devices array */
static DEFINE_MUTEX(devices_lock);
+static void roccat_free_device(struct roccat_device *device)
+{
+ int i;
+
+ for (i = 0; i < ROCCAT_CBUF_SIZE; i++)
+ kfree(device->cbuf[i].value);
+ kfree(device);
+}
+
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
@@ -226,7 +235,7 @@ static int roccat_release(struct inode *
hid_hw_power(device->hid, PM_HINT_NORMAL);
hid_hw_close(device->hid);
} else {
- kfree(device);
+ roccat_free_device(device);
}
}
@@ -374,7 +383,7 @@ void roccat_disconnect(int minor)
hid_hw_close(device->hid);
wake_up_interruptible(&device->wait);
} else {
- kfree(device);
+ roccat_free_device(device);
}
}
EXPORT_SYMBOL_GPL(roccat_disconnect);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 250/713] HID: sensor: custom: Fix field sysfs group cleanup on failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 249/713] HID: roccat: free buffered reports when destroying device Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 251/713] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Greg Kroah-Hartman
` (473 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Srinivas Pandruvada,
Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 3789d0802ddb4b3be04062caf4bfadd23496e9a7 upstream.
hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.
Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-custom.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attribu
&sensor_inst->fields[i].
hid_custom_attribute_group);
if (ret)
- break;
+ goto err_remove_groups;
/* For power or report field store indexes */
if (sensor_inst->fields[i].attribute.attrib_id ==
@@ -621,6 +621,13 @@ static int hid_sensor_custom_add_attribu
}
return ret;
+
+err_remove_groups:
+ while (--i >= 0)
+ sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
+ &sensor_inst->fields[i].hid_custom_attribute_group);
+ kfree(sensor_inst->fields);
+ return ret;
}
static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 251/713] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 250/713] HID: sensor: custom: Fix field sysfs group cleanup on failure Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 252/713] HID: universal-pidff: stop the device when force-feedback init fails Greg Kroah-Hartman
` (472 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Doruk Tan Ozturk, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <doruk@0sec.ai>
commit a26705bd2e2728833e7a538ce91e58a5eeff496a upstream.
For GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer:
ghl_magic_poke() (the timer callback) submits sc->ghl_urb, and the URB
completion ghl_magic_poke_cb() re-arms the timer with mod_timer().
sony_remove() drained the timer with timer_delete_sync() and then freed
the URB with usb_free_urb():
timer_delete_sync(&sc->ghl_poke_timer);
usb_free_urb(sc->ghl_urb);
timer_delete_sync() does not block re-arming, and while the URB is in
flight the timer is not pending, so the sync delete is a no-op. A URB
completion that runs after the delete re-arms the timer, and usb_free_urb()
only drops a reference -- it does not kill an in-flight URB. sc is
allocated with devm_kzalloc() and freed once sony_remove() returns, so the
re-armed ghl_poke_timer (embedded in sc) then fires on freed memory, a
use-after-free from timer softirq. This is a disconnect/rmmod race.
Poison the URB first, then shut the timer down, before freeing the URB.
usb_poison_urb() kills any in-flight URB and permanently rejects further
submissions, so a poke timer that is still pending cannot re-submit the
URB from ghl_magic_poke() in the window before timer_shutdown_sync() runs.
usb_kill_urb() would not suffice: it only cancels the in-flight URB and
leaves it submittable once it returns, so the pending timer could
re-submit it and put a fresh URB in flight over the freed sc.
timer_shutdown_sync() then drains any last callback and blocks re-arming.
The probe error path is unaffected: it is only reached before the timer
is armed.
Reproduced under KASAN on next-20260710 via dummy_hcd + raw-gadget
emulation of the GHL PS4 dongle (VID 0x1430 / PID 0x07bb): hid-sony binds
and arms the poke timer, the poke URB is held in flight, the driver is
unbound (freeing sc), then the URB is released. The completion re-arms the
timer on the freed sc, and the re-armed timer fires ~8 s later:
BUG: KASAN: slab-use-after-free in ghl_magic_poke+0x98/0xb0
Read of size 8 at addr ffff88810b02fd50 by task swapper/0/0
ghl_magic_poke+0x98/0xb0
call_timer_fn+0x35/0x2b0
__run_timers+0x69c/0x9a0
run_timer_softirq+0x173/0x2a0
Allocated by task 169: sony_probe
Freed by task 338: devres_release_group <- hid_device_remove (sony_remove)
Found by 0sec (https://0sec.ai) using automated source analysis.
Fixes: cc894ac55360 ("HID: sony: support for ghlive ps3/wii u dongles")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sony.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2424,7 +2424,9 @@ static void sony_remove(struct hid_devic
struct sony_sc *sc = hid_get_drvdata(hdev);
if (sc->quirks & (GHL_GUITAR_PS3WIIU | GHL_GUITAR_PS4)) {
- timer_delete_sync(&sc->ghl_poke_timer);
+ /* poison, not kill: a pending timer must not re-submit during teardown */
+ usb_poison_urb(sc->ghl_urb);
+ timer_shutdown_sync(&sc->ghl_poke_timer);
usb_free_urb(sc->ghl_urb);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 252/713] HID: universal-pidff: stop the device when force-feedback init fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 251/713] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 253/713] HID: mcp2221: stop device IO before hid_hw_stop Greg Kroah-Hartman
` (471 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baul Lee, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <baul.lee@xbow.com>
commit ce08c5555cabcd444d8b77fa69a7cb68bb05f611 upstream.
universal_pidff_probe() starts the device with hid_hw_start() and then, if
force-feedback initialisation fails, returns the error through a label that
only does "return error". The device is left started.
The HID core does not unwind on the driver's behalf. __hid_device_probe()
releases the devres group, closes the report and clears hdev->driver:
if (ret) {
devres_release_group(&hdev->dev, hdev->devres_group_id);
hid_close_report(hdev);
hdev->driver = NULL;
}
The hidraw character device that hid_hw_start() registered through
hid_connect() is allocated with kzalloc() and added with cdev_device_add(),
so it is not devres-managed and survives that. With hdev->driver NULL,
hid_device_remove() skips hid_hw_stop() as well, because it only unwinds
while a driver is still attached. The registration therefore outlives the
device on both paths.
Opening the surviving /dev/hidrawX writes into freed memory. KASAN reports
a use-after-free write from hidraw_open() -> hid_hw_open() -> the
transport's open callback, which takes a spinlock inside the freed object.
A descriptor that carries a PID usage page and no input reports is enough:
hidraw claims the device so hid_hw_start() succeeds, while hid->inputs
stays empty so force-feedback init fails. The other failure returns in
hid_pidff_init_with_quirks() - no output reports, an allocation failure,
pidff_init_fields(), pidff_check_autocenter(), an unusable effect count,
input_ff_create() - all reach the same label.
Stop the device on that path. hid-dr.c and hid-emsff.c, which start the
device with the same HID_CONNECT_DEFAULT & ~HID_CONNECT_FF mask, already do
this. The two earlier gotos must keep returning without hid_hw_stop(),
since neither has a started device, so give the path that fails after the
start its own label.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Fixes: f06bf8d94fff ("HID: Add hid-universal-pidff driver and supported device ids")
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-universal-pidff.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-universal-pidff.c
+++ b/drivers/hid/hid-universal-pidff.c
@@ -104,12 +104,14 @@ static int universal_pidff_probe(struct
error = init_function(hdev, id->driver_data);
if (error) {
hid_warn(hdev, "Error initialising force feedback\n");
- goto err;
+ goto err_stop;
}
hid_info(hdev, "Universal pidff driver loaded successfully!");
return 0;
+err_stop:
+ hid_hw_stop(hdev);
err:
return error;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 253/713] HID: mcp2221: stop device IO before hid_hw_stop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 252/713] HID: universal-pidff: stop the device when force-feedback init fails Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 254/713] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Greg Kroah-Hartman
` (470 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit dca151633c0fde90935311c60e7cfc064aa56134 upstream.
Quiesce device IO at the start of the devm cleanup callback
mcp2221_hid_unregister() so that incoming HID reports cannot race with
hardware teardown during probe failure or device removal, addressing a
potential use-after-free.
Guard the call to hid_device_io_stop() with io_started. On normal
removal hid_device_remove() has already cleared io_started before the
devres group is released, so an unconditional call would otherwise hit
the !io_started path and emit a spurious "io already stopped" warning
on every removal. The guard preserves the probe-failure balancing,
where io_started is still set after hid_device_io_start(), while
staying silent on the normal removal path.
Fixes: d4b50ac06ea6 ("HID: mcp2221: Allow IO to start during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -1049,6 +1049,8 @@ static void mcp2221_hid_unregister(void
{
struct hid_device *hdev = ptr;
+ if (hdev->io_started)
+ hid_device_io_stop(hdev);
hid_hw_close(hdev);
hid_hw_stop(hdev);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 254/713] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 253/713] HID: mcp2221: stop device IO before hid_hw_stop Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 255/713] HID: mcp2221: validate report size in mcp2221_raw_event() Greg Kroah-Hartman
` (469 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit db2333f88729c8aae062cb171ed058725ff5c901 upstream.
mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in
mcp->rxbuf for the duration of a transfer but never clears it when the
transfer finishes or times out. Once the caller frees or reuses the
buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious
MCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to
memcpy device data into the freed memory, causing a write
use-after-free.
Route all return paths through a single exit point that clears
mcp->rxbuf and mcp->rxbuf_size, so that the existing !mcp->rxbuf guard
in the raw_event handler can reject any report arriving after the
transfer has ended.
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -343,7 +343,7 @@ static int mcp_i2c_smbus_read(struct mcp
ret = mcp_send_data_req_status(mcp, mcp->txbuf, 4);
if (ret)
- return ret;
+ goto out;
mcp->rxbuf_idx = 0;
@@ -365,7 +365,7 @@ static int mcp_i2c_smbus_read(struct mcp
} else {
usleep_range(980, 1000);
mcp_cancel_last_cmd(mcp);
- return ret;
+ goto out;
}
} else {
retries = 0;
@@ -375,6 +375,10 @@ static int mcp_i2c_smbus_read(struct mcp
usleep_range(980, 1000);
ret = mcp_chk_last_cmd_status_free_bus(mcp);
+out:
+ mcp->rxbuf = NULL;
+ mcp->rxbuf_size = 0;
+
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 255/713] HID: mcp2221: validate report size in mcp2221_raw_event()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 254/713] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 256/713] HID: intel-thc-hid: intel-quickspi: validate report size before copy Greg Kroah-Hartman
` (468 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit 2c9a6998c19503626c57a2267bf279e204113079 upstream.
mcp2221_raw_event() never validates the size of incoming HID reports.
In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3]
as the copy length without checking that 4 + data[3] bytes actually
exist in the received report. A malicious or misbehaving USB device can
send a short report with a large data[3], causing the memcpy to read
past the valid report data in the HID transfer buffer and leak
uninitialized kernel memory back to userspace through the I2C/SMBus
read path.
Add a minimum size check at entry and validate that the source range
fits within the received report before the copy.
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -865,6 +865,9 @@ static int mcp2221_raw_event(struct hid_
u8 *buf;
struct mcp2221 *mcp = hid_get_drvdata(hdev);
+ if (size < 4)
+ return 0;
+
switch (data[0]) {
case MCP2221_I2C_WR_DATA:
@@ -930,6 +933,10 @@ static int mcp2221_raw_event(struct hid_
mcp->status = -EINVAL;
break;
}
+ if (4 + data[3] > size) {
+ mcp->status = -EINVAL;
+ break;
+ }
buf = mcp->rxbuf;
memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]);
mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 256/713] HID: intel-thc-hid: intel-quickspi: validate report size before copy
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 255/713] HID: mcp2221: validate report size in mcp2221_raw_event() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 257/713] HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer Greg Kroah-Hartman
` (467 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Even Xu, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit a59cf84441f9a17323c89452cec2bf16724c48a9 upstream.
write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap
buffer allocated in quickspi_alloc_report_buf() to the device-descriptor
derived max_report_len (a few hundred bytes for a touch controller). It
copies the caller-supplied report into that buffer:
memcpy(write_buf->content, report_buf, report_buf_len);
The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and
quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches
the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a
report larger than max_report_len therefore overflows report_buf with
attacker-controlled length and content.
Record the report_buf allocation size and reject reports that do not fit
before copying, matching the equivalent guard in the intel-quicki2c
sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix.
write_cmd_to_txdma() writes the output report header ahead of the content
in the same buffer, so size the allocation to cover the header as well.
That keeps the added bound from rejecting a maximum-sized report.
Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 9 ++++++++-
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 +
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 3 +++
3 files changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -555,7 +555,14 @@ static int quickspi_alloc_report_buf(str
max_report_len = max(le16_to_cpu(qsdev->dev_desc.max_output_len),
le16_to_cpu(qsdev->dev_desc.max_input_len));
- qsdev->report_buf = devm_kzalloc(qsdev->dev, max_report_len, GFP_KERNEL);
+ /*
+ * write_cmd_to_txdma() writes the output report header ahead of the
+ * content in this buffer, so it has to hold both.
+ */
+ qsdev->report_buf_size = HIDSPI_OUTPUT_REPORT_SIZE(max_report_len);
+
+ qsdev->report_buf = devm_kzalloc(qsdev->dev, qsdev->report_buf_size,
+ GFP_KERNEL);
if (!qsdev->report_buf)
return -ENOMEM;
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
@@ -157,6 +157,7 @@ struct quickspi_device {
u8 *report_descriptor;
u8 *input_buf;
u8 *report_buf;
+ u32 report_buf_size;
u32 report_len;
wait_queue_head_t reset_ack_wq;
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -30,6 +30,9 @@ static int write_cmd_to_txdma(struct qui
write_buf = (struct output_report *)qsdev->report_buf;
+ if (HIDSPI_OUTPUT_REPORT_SIZE(report_buf_len) > qsdev->report_buf_size)
+ return -EINVAL;
+
write_buf->output_hdr.report_type = report_type;
write_buf->output_hdr.content_len = cpu_to_le16(report_buf_len);
write_buf->output_hdr.content_id = report_id;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 257/713] HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 256/713] HID: intel-thc-hid: intel-quickspi: validate report size before copy Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 258/713] HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown Greg Kroah-Hartman
` (466 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko AI, HyeongJun An, Even Xu,
Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 035ec4a71cb8020a927c123bbe75c2f88d614986 upstream.
quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:
memcpy(buf, qsdev->report_buf, qsdev->report_len);
qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
with device-controlled content.
The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy. Do the same here.
Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 -
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 16 ++++++++---
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h | 2 -
3 files changed, 15 insertions(+), 5 deletions(-)
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
@@ -61,7 +61,7 @@ static int quickspi_hid_raw_request(stru
switch (reqtype) {
case HID_REQ_GET_REPORT:
- ret = quickspi_get_report(qsdev, rtype, reportnum, buf);
+ ret = quickspi_get_report(qsdev, rtype, reportnum, buf, len);
break;
case HID_REQ_SET_REPORT:
ret = quickspi_set_report(qsdev, rtype, reportnum, buf, len);
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -345,10 +345,12 @@ int reset_tic(struct quickspi_device *qs
}
int quickspi_get_report(struct quickspi_device *qsdev,
- u8 report_type, unsigned int report_id, void *buf)
+ u8 report_type, unsigned int report_id, void *buf,
+ u32 buf_len)
{
int rep_type;
int ret;
+ u32 report_len;
if (report_type == HID_INPUT_REPORT) {
rep_type = GET_INPUT_REPORT;
@@ -375,9 +377,17 @@ int quickspi_get_report(struct quickspi_
}
qsdev->get_report_cmpl = false;
- memcpy(buf, qsdev->report_buf, qsdev->report_len);
+ /* quickspi_handle_input_data() updates this from IRQ context. */
+ report_len = READ_ONCE(qsdev->report_len);
+ if (report_len > buf_len) {
+ dev_err_once(qsdev->dev, "Get report response too big, %u vs %u\n",
+ report_len, buf_len);
+ return -EINVAL;
+ }
+
+ memcpy(buf, qsdev->report_buf, report_len);
- return qsdev->report_len;
+ return report_len;
}
int quickspi_set_report(struct quickspi_device *qsdev,
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
@@ -12,7 +12,7 @@ struct quickspi_device;
void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
- unsigned int report_id, void *buf);
+ unsigned int report_id, void *buf, u32 buf_len);
int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
unsigned int report_id, void *buf, u32 buf_len);
int quickspi_get_report_descriptor(struct quickspi_device *qsdev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 258/713] HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 257/713] HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 259/713] HID: intel-thc-hid: intel-quickspi: " Greg Kroah-Hartman
` (465 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Even Xu, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 42a941e39432ef6766402ef68f1389dcfec4ee37 upstream.
quicki2c_probe() calls pm_runtime_use_autosuspend(), but
quicki2c_remove() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver
remove path.
This issue was found by manual code inspection.
Fixes: 5f420e8215c6 ("HID: intel-thc-hid: intel-quicki2c: Add PM implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -774,6 +774,7 @@ static void quicki2c_remove(struct pci_d
quicki2c_hid_remove(qcdev);
quicki2c_dma_deinit(qcdev);
+ pm_runtime_dont_use_autosuspend(qcdev->dev);
pm_runtime_get_noresume(qcdev->dev);
quicki2c_dev_deinit(qcdev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 259/713] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 258/713] HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 260/713] eventfs: Initialize ei->children and ei->list in init_ei() Greg Kroah-Hartman
` (464 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Even Xu, Jiri Kosina
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 05dffa55fd6dbed4bf2421fae5accc2b857e668d upstream.
quickspi_probe() calls pm_runtime_use_autosuspend(), but
quickspi_remove() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver
remove path.
This issue was found by manual code inspection.
Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -720,6 +720,7 @@ static void quickspi_remove(struct pci_d
quickspi_hid_remove(qsdev);
quickspi_dma_deinit(qsdev);
+ pm_runtime_dont_use_autosuspend(qsdev->dev);
pm_runtime_get_noresume(qsdev->dev);
quickspi_dev_deinit(qsdev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 260/713] eventfs: Initialize ei->children and ei->list in init_ei()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 259/713] HID: intel-thc-hid: intel-quickspi: " Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 261/713] fs/ntfs3: validate dirty page table on log replay Greg Kroah-Hartman
` (463 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3ef80b4ed02226d04a06,
Deepanshu Kartikey, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 1704aaaf5d22bc765c168402350d191e24e245bc upstream.
eventfs_create_dir() allocates the eventfs_inode and initializes it with
init_ei(). But this does not initialize the eventfs_inode list_heads. If
the eventfs_create_dir() fails due to memory pressure, it will call
free_ei() before it initialized the lists, and that checks to make sure
the eventfs_inode has no children. But because the list wasn't
initialized, it will give a false warning.
Fix it by moving the list initialization into init_ei().
Cc: stable@vger.kernel.org
Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode")
Reported-by: syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06
Link: https://patch.msgid.link/20260824144653.54044-1-kartikey406@gmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
[ Rewrote change log ]
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/tracefs/event_inode.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -438,6 +438,8 @@ static inline struct eventfs_inode *init
if (!ei->name)
return NULL;
kref_init(&ei->kref);
+ INIT_LIST_HEAD(&ei->children);
+ INIT_LIST_HEAD(&ei->list);
return ei;
}
@@ -725,8 +727,6 @@ struct eventfs_inode *eventfs_create_dir
ei->entries = entries;
ei->nr_entries = size;
ei->data = data;
- INIT_LIST_HEAD(&ei->children);
- INIT_LIST_HEAD(&ei->list);
scoped_guard(mutex, &eventfs_mutex) {
if (!parent->is_freed)
@@ -798,9 +798,6 @@ struct eventfs_inode *eventfs_create_eve
ei->attr.uid = uid;
ei->attr.gid = gid;
- INIT_LIST_HEAD(&ei->children);
- INIT_LIST_HEAD(&ei->list);
-
ti = get_tracefs(inode);
ti->flags |= TRACEFS_EVENT_INODE;
ti->private = ei;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 261/713] fs/ntfs3: validate dirty page table on log replay
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 260/713] eventfs: Initialize ei->children and ei->list in init_ei() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 262/713] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Greg Kroah-Hartman
` (462 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Konstantin Komarov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 006cb7713dec10368e699abc4367e5faa334c9a5 upstream.
Each DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk
lcns_follow field. check_rstbl() validates the table bookkeeping but never
checks that this array fits in the entry, so a crafted lcns_follow lets the
v0->v1 conversion memmove and later replay passes run off the entry.
Add check_dp_table() to reject, right after check_rstbl(), any entry larger
than its size claims via struct_size() (the same expression used to allocate
these entries, so the check is overflow-safe by construction). All consumers
can then trust lcns_follow as the real capacity. This covers every
page_lcns[] access whose index is bounded by the entry itself (the
conversion memmove, the HotFix store via find_dp(), and the self-bounded
scan loops). Accesses whose index comes from the log record need a separate
bound and are handled in a follow-up patch.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -789,6 +789,20 @@ static bool check_rstbl(const struct RES
return true;
}
+static bool check_dp_table(const struct RESTART_TABLE *dptbl)
+{
+ u32 rsize = le16_to_cpu(dptbl->size);
+ struct DIR_PAGE_ENTRY *dp = NULL;
+
+ while ((dp = enum_rstbl((struct RESTART_TABLE *)dptbl, dp))) {
+ if (struct_size(dp, page_lcns, le32_to_cpu(dp->lcns_follow)) >
+ rsize)
+ return false;
+ }
+
+ return true;
+}
+
/*
* free_rsttbl_idx - Free a previously allocated index a Restart Table.
*/
@@ -4294,6 +4308,11 @@ check_dirty_page_table:
err = -EINVAL;
goto out;
}
+
+ if (!check_dp_table(rt)) {
+ err = -EINVAL;
+ goto out;
+ }
dptbl = kmemdup(rt, t32, GFP_NOFS);
if (!dptbl) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 262/713] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 261/713] fs/ntfs3: validate dirty page table on log replay Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 263/713] fs/ntfs3: bound page_lcns[] index by the log record Greg Kroah-Hartman
` (461 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Samuel Page, Konstantin Komarov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <sam@bynar.io>
commit 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd upstream.
ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target
pages and then trusts decompress_lznt()'s return value:
unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,
frame_size);
if ((ssize_t)unc_size < 0) err = unc_size;
else if (!unc_size || unc_size > frame_size) err = -EINVAL;
decompress_lznt() stops as soon as the compressed stream is exhausted
(e.g. a zero chunk header) and returns the number of bytes it actually
wrote, which may be far less than frame_size. The bytes between unc_size
and frame_size are never written. The only memset() that follows zeroes
the region beyond i_valid; when the frame lies entirely within the file's
valid size that memset() does not run, so the gap retains whatever was in
the just-vmapped pages. All pages are then marked uptodate and returned
to userspace, disclosing uninitialized (recently-freed) kernel page
memory. A crafted compressed file whose stream decompresses to only a few
bytes leaks the remainder of every frame on a plain read(2), which is
enough to recover kernel pointers and defeat KASLR.
Zero the [unc_size, frame_size) tail immediately after a successful LZNT
decompress so the remainder reads back as zero.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Samuel Page <sam@bynar.io>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/frecord.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -2443,6 +2443,15 @@ int ni_read_frame(struct ntfs_inode *ni,
err = unc_size;
else if (!unc_size || unc_size > frame_size)
err = -EINVAL;
+ else if (unc_size < frame_size) {
+ /*
+ * Partial decompress: zero the [unc_size, frame_size)
+ * tail. decompress_lznt() leaves it untouched, so
+ * without this the freshly vmapped pages would expose
+ * uninitialized kernel memory to userspace.
+ */
+ memset(frame_mem + unc_size, 0, frame_size - unc_size);
+ }
}
if (!err && valid_size < frame_vbo + frame_size) {
size_t ok = valid_size - frame_vbo;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 263/713] fs/ntfs3: bound page_lcns[] index by the log record
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 262/713] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 264/713] ntfs: bound the free-cluster bitmap scan to the volume Greg Kroah-Hartman
` (460 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Konstantin Komarov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit 6f7b9dbdc1b7520206abce0049bdd143eb536e75 upstream.
The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,
where i runs up to the log record's lcns_follow. That count is checked only
against the record's own length, not the target entry, so check_dp_table()
(which validates the entry's lcns_follow) does not cover it: the copy_lcns
entry may even be freshly allocated after that check, and find_dp() bounds j
but not i. A crafted record thus overflows page_lcns[] of an otherwise valid
entry.
Add dp_range_ok() and reject, before each loop, any record whose run does
not fit the entry. These are the only two page_lcns[] accesses indexed by
the record rather than the entry, so together with the entry validation
every access is now bounded.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -648,6 +648,14 @@ static inline void *enum_rstbl(struct RE
}
/*
+ * dp_range_ok - true if [j, j + count) fits in a page_lcns[cap] array.
+ */
+static inline bool dp_range_ok(size_t j, u32 count, u32 cap)
+{
+ return j < cap && count <= cap - j;
+}
+
+/*
* find_dp - Search for a @vcn in Dirty Page Table.
*/
static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
@@ -5106,6 +5114,13 @@ find_dirty_page:
/* Shorten length by any Lcns which were deleted. */
saved_len = dlen;
+ if (!dp_range_ok(le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn),
+ le16_to_cpu(lrh->lcns_follow),
+ le32_to_cpu(dp->lcns_follow))) {
+ err = -EINVAL;
+ goto out;
+ }
+
for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
size_t j;
u32 alen, voff;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 264/713] ntfs: bound the free-cluster bitmap scan to the volume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 263/713] fs/ntfs3: bound page_lcns[] index by the log record Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 265/713] ntfs: reject invalid empty mapping pairs Greg Kroah-Hartman
` (459 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Hyunchul Lee,
Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 19cac7902a8ab748e15f98ddaafcf5f8882be21d upstream.
vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but
ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.
Those are independent on-disk quantities and the mount-time check only
rejects a $Bitmap that is too small, so an image whose $Bitmap covers more
clusters than the volume has lets the scan index past the array. A run
whose LCN lies in that gap takes the allocator straight there, since the
caller passes the file's own last LCN as its locality hint. KASAN reports
a slab out-of-bounds read when a file on such a volume is extended.
Clamp the scan to what that array covers, mirroring the max_index
calculation the mount-time scan already uses, and reject a decoded LCN
at or beyond nr_clusters in the mapping pairs decoder. Conforming
volumes are unaffected.
Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/lcnalloc.c | 7 ++++++-
fs/ntfs/runlist.c | 7 +++++++
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs/lcnalloc.c b/fs/ntfs/lcnalloc.c
index 835a041023a2..aa2e017a4384 100644
--- a/fs/ntfs/lcnalloc.c
+++ b/fs/ntfs/lcnalloc.c
@@ -298,7 +298,12 @@ struct runlist_element *ntfs_cluster_alloc(struct ntfs_volume *vol, const s64 st
clusters = count;
rlpos = rlsize = 0;
mapping = lcnbmp_vi->i_mapping;
- i_size = i_size_read(lcnbmp_vi);
+ /*
+ * lcn_empty_bits_per_page is sized from nr_clusters, but $Bitmap can
+ * cover more clusters than that; bound the scan by the array.
+ */
+ i_size = min_t(s64, i_size_read(lcnbmp_vi),
+ ((s64)vol->nr_clusters + 7) >> 3);
while (1) {
ntfs_debug("Start of outer while loop: done_zones 0x%x, search_zone %i, pass %i, zone_start 0x%llx, zone_end 0x%llx, bmp_initial_pos 0x%llx, bmp_pos 0x%llx, rlpos %i, rlsize %i.",
done_zones, search_zone, pass,
diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index 8e0fd400e7f7..17eb275a21ff 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -884,6 +884,13 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *
ntfs_error(vol->sb, "lcn == -1");
}
#endif
+ /* Check lcn is within the volume. */
+ if (unlikely(lcn >= (s64)vol->nr_clusters)) {
+ ntfs_error(vol->sb,
+ "LCN >= nr_clusters in mapping pairs array.");
+ goto err_out;
+ }
+
/* Check lcn is not below -1. */
if (unlikely(lcn < -1)) {
ntfs_error(vol->sb, "Invalid s64 < -1 in mapping pairs array.");
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 265/713] ntfs: reject invalid empty mapping pairs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 264/713] ntfs: bound the free-cluster bitmap scan to the volume Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 266/713] ntfs: reject invalid MFT LCNs from boot sector Greg Kroah-Hartman
` (458 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris, Hyunchul Lee,
Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
commit 766062a82e1ce4087c7dc077224144dfd34b3661 upstream.
Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.
Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/all/9519.1786907182@localhost/
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/runlist.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -772,6 +772,25 @@ struct runlist_element *ntfs_mapping_pai
return ERR_PTR(-EIO);
}
+ /*
+ * An empty mapping-pairs array is valid only for a zero-length
+ * attribute.
+ */
+ if (!*buf &&
+ (vcn ||
+ le64_to_cpu(attr->data.non_resident.highest_vcn) !=
+ (u64)(vcn - 1) ||
+ le64_to_cpu(attr->data.non_resident.allocated_size) ||
+ le64_to_cpu(attr->data.non_resident.data_size) ||
+ le64_to_cpu(attr->data.non_resident.initialized_size))) {
+ ntfs_error(vol->sb, "Invalid empty mapping pairs array.");
+ return ERR_PTR(-EIO);
+ }
+ if (!vcn && !*buf && old_runlist && old_runlist->rl) {
+ *new_rl_count = old_runlist->count;
+ return old_runlist->rl;
+ }
+
/* Current position in runlist array. */
rlpos = 0;
/* Allocate first page and set current runlist size to one page. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 266/713] ntfs: reject invalid MFT LCNs from boot sector
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 265/713] ntfs: reject invalid empty mapping pairs Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 267/713] ntfs: validate non-resident attribute offsets Greg Kroah-Hartman
` (457 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris, Hyunchul Lee,
Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
commit cc9d09fef78410bcd37ac05168cbd5f6dd75d3d2 upstream.
The NTFS boot sector stores the MFT and MFTMirr locations as unsigned
64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64.
A crafted high-bit value could therefore become negative and pass
the existing upper-bound check. The invalid value then propagated into
the MFT zone allocator and could result in an out-of-bounds access to
lcn_empty_bits_per_page.
Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/all/57514.1787000602@localhost
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/super.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 8abe7bee4c0d..cd8fa2c13370 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -645,7 +645,7 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
{
unsigned int sectors_per_cluster, sectors_per_cluster_bits, nr_hidden_sects;
int clusters_per_mft_record, clusters_per_index_record;
- s64 ll;
+ u64 ll;
vol->sector_size = le16_to_cpu(b->bpb.bytes_per_sector);
vol->sector_size_bits = ffs(vol->sector_size) - 1;
@@ -755,23 +755,23 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
* the same as it is much faster on 32-bit CPUs.
*/
ll = le64_to_cpu(b->number_of_sectors) >> sectors_per_cluster_bits;
- if ((u64)ll >= 1ULL << 32) {
+ if (ll >= 1ULL << 32) {
ntfs_error(vol->sb, "Cannot handle 64-bit clusters.");
return false;
}
vol->nr_clusters = ll;
ntfs_debug("vol->nr_clusters = 0x%llx", vol->nr_clusters);
ll = le64_to_cpu(b->mft_lcn);
- if (ll >= vol->nr_clusters) {
- ntfs_error(vol->sb, "MFT LCN (%lli, 0x%llx) is beyond end of volume. Weird.",
+ if (ll >= (u64)vol->nr_clusters) {
+ ntfs_error(vol->sb, "MFT LCN (%llu, 0x%llx) is beyond end of volume. Weird.",
ll, ll);
return false;
}
vol->mft_lcn = ll;
ntfs_debug("vol->mft_lcn = 0x%llx", vol->mft_lcn);
ll = le64_to_cpu(b->mftmirr_lcn);
- if (ll >= vol->nr_clusters) {
- ntfs_error(vol->sb, "MFTMirr LCN (%lli, 0x%llx) is beyond end of volume. Weird.",
+ if (ll >= (u64)vol->nr_clusters) {
+ ntfs_error(vol->sb, "MFTMirr LCN (%llu, 0x%llx) is beyond end of volume. Weird.",
ll, ll);
return false;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 267/713] ntfs: validate non-resident attribute offsets
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 266/713] ntfs: reject invalid MFT LCNs from boot sector Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 268/713] ntfs: verify run length exceeding volume boundary Greg Kroah-Hartman
` (456 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
commit a83e82b0ec3ae523028e24813f23f18b43e8fc1c upstream.
ntfs_attr_update_meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse also adds the
compressed_size field before the name and mapping pairs, requiring eight
additional bytes in the attribute record.
However, the validator does not check that name_offset is within safe
boundaries for these operations or that the additional space is available.
A malicious MFT record could set name_offset such that:
1. The name is positioned at the very end of a non-sparse attribute.
Converting to sparse would shift the name forward by 8 bytes,
writing beyond the attribute boundary.
2. The name overlaps with the mapping pairs, causing corruption during
conversion.
Add validation to ensure:
- For named attributes, name_offset is within valid bounds
- Name does not extend beyond the attribute or overlap with mapping pairs
- For non-sparse, non-compressed attributes, eight bytes are available
after mapping_pairs_offset for the compressed_size field
The space check also covers unnamed attributes, for which name_offset = 0
is valid and no name range needs to be checked.
Fixes: 7e2a1c554bc4 ("ntfs: Fix min_len for compressed/sparse attributes in ntfs_non_resident_attr_value_is_valid()")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Co-developed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/attrib.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -693,6 +693,8 @@ static bool ntfs_non_resident_attr_value
u32 attr_len;
u32 min_len;
u16 mp_offset;
+ u16 name_offset;
+ u32 name_end;
attr_len = le32_to_cpu(a->length);
min_len = offsetof(struct attr_record, data.non_resident.initialized_size) +
@@ -701,7 +703,27 @@ static bool ntfs_non_resident_attr_value
return false;
mp_offset = le16_to_cpu(a->data.non_resident.mapping_pairs_offset);
- return mp_offset >= min_len && mp_offset <= attr_len;
+ if (mp_offset < min_len || mp_offset > attr_len)
+ return false;
+
+ if (a->name_length) {
+ name_offset = le16_to_cpu(a->name_offset);
+
+ if (name_offset < min_len || name_offset >= attr_len)
+ return false;
+
+ name_end = name_offset + a->name_length * sizeof(__le16);
+ if (name_end > attr_len || name_end > mp_offset)
+ return false;
+ }
+
+ /* Ensure there's room for the compressed_size field if needed. */
+ if (!(a->flags & (ATTR_IS_SPARSE | ATTR_COMPRESSION_MASK)) &&
+ attr_len - mp_offset <
+ sizeof(a->data.non_resident.compressed_size))
+ return false;
+
+ return true;
}
static bool ntfs_attr_value_is_valid(struct ntfs_volume *vol,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 268/713] ntfs: verify run length exceeding volume boundary
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 267/713] ntfs: validate non-resident attribute offsets Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 269/713] eCryptfs: bound the packet-length peek to the user buffer Greg Kroah-Hartman
` (455 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Namjae Jeon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
commit fea9e4488f384c0ef1c0e3d96b565127c1b98447 upstream.
The mapping pairs decoder validates that the starting LCN is within the
volume but does not check if the run extends beyond the volume boundary.
A malformed NTFS image with a crafted mapping pairs array could cause
the kernel to access memory beyond the volume boundary, potentially leading
to memory corruption and privilege escalation.
Add validation to ensure lcn + length stays within nr_clusters.
Cc: stable@vger.kernel.org
Fixes: b4be3a47f8ba4 ("ntfs: bound the free-cluster bitmap scan to the volume")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/runlist.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -916,6 +916,28 @@ struct runlist_element *ntfs_mapping_pai
goto err_out;
}
+ if (lcn >= 0) {
+ s64 run_end;
+
+ /*
+ * Ensure that the run stays within the volume.
+ * A valid starting LCN is not sufficient because
+ * the run length comes from disk.
+ */
+ if (unlikely(check_add_overflow(lcn,
+ rl[rlpos].length,
+ &run_end))) {
+ ntfs_error(vol->sb,
+ "Run length overflow in mapping pairs array.");
+ goto err_out;
+ }
+ if (unlikely(run_end > (s64)vol->nr_clusters)) {
+ ntfs_error(vol->sb,
+ "Run extends beyond volume boundary.");
+ goto err_out;
+ }
+ }
+
/* chkdsk accepts zero-sized runs only for holes */
if ((lcn != -1) && !rl[rlpos].length) {
ntfs_error(vol->sb,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 269/713] eCryptfs: bound the packet-length peek to the user buffer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 268/713] ntfs: verify run length exceeding volume boundary Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 270/713] ecryptfs: fix tag 11 packet exact-fit size check Greg Kroah-Hartman
` (454 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 95540462e630edbc8504e9537d16453d6942d143 upstream.
ecryptfs_miscdev_write() accepts the minimum one-byte packet-length
encoding, but always copies the maximum two-byte encoding from userspace
before parsing it. A six-byte message therefore reads one byte beyond the
submitted user buffer.
Zero-initialize the peek buffer and copy only the packet-length bytes
present. The existing exact packet-size check still rejects truncated
two-byte encodings after the parser determines their encoded length.
Fixes: 8bf2debd5f7b ("eCryptfs: introduce device handle for userspace daemon communications")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/miscdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -360,7 +360,7 @@ ecryptfs_miscdev_write(struct file *file
u32 seq;
size_t packet_size, packet_size_length;
char *data;
- unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE];
+ unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE] = { };
ssize_t rc;
if (count == 0) {
@@ -376,7 +376,8 @@ ecryptfs_miscdev_write(struct file *file
}
if (copy_from_user(packet_size_peek, &buf[PKT_LEN_OFFSET],
- sizeof(packet_size_peek))) {
+ min_t(size_t, count - PKT_LEN_OFFSET,
+ sizeof(packet_size_peek)))) {
printk(KERN_WARNING "%s: Error while inspecting packet size\n",
__func__);
return -EFAULT;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 270/713] ecryptfs: fix tag 11 packet exact-fit size check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 269/713] eCryptfs: bound the packet-length peek to the user buffer Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 271/713] ecryptfs: hold msg ctx list lock when cleaning daemon queue Greg Kroah-Hartman
` (453 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 8b2ec0f56f55477f547d332526c9ae2a8fabc0a5 upstream.
parse_tag_11_packet() rejects a packet when the already-consumed tag and
length bytes plus the packet body exceed the caller supplied maximum
packet size. The check currently adds one extra byte, even though
*packet_size already includes the tag byte before the length is parsed.
Remove the extra byte so a tag 11 packet that exactly fits the available
buffer is accepted while oversized packets are still rejected.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1537,7 +1537,7 @@ parse_tag_11_packet(unsigned char *data,
}
(*packet_size) += length_size;
(*tag_11_contents_size) = (body_size - 14);
- if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) {
+ if (unlikely((*packet_size) + body_size > max_packet_size)) {
printk(KERN_ERR "Packet size exceeds max\n");
rc = -EINVAL;
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 271/713] ecryptfs: hold msg ctx list lock when cleaning daemon queue
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 270/713] ecryptfs: fix tag 11 packet exact-fit size check Greg Kroah-Hartman
@ 2026-09-04 4:53 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 272/713] ecryptfs: pass packet set buffer size to parser Greg Kroah-Hartman
` (452 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 779972513c2fa8c7938e54976f686091dafff22f upstream.
ecryptfs_exorcise_daemon() drops queued messages from a dying daemon
without holding ecryptfs_msg_ctx_lists_mux, but
ecryptfs_msg_ctx_alloc_to_free() requires that lock.
Take the list lock while moving the queued contexts back to the free
list to avoid racing with other global msg ctx list users.
Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/messaging.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -166,6 +166,7 @@ int ecryptfs_exorcise_daemon(struct ecry
mutex_unlock(&daemon->mux);
goto out;
}
+ mutex_lock(&ecryptfs_msg_ctx_lists_mux);
list_for_each_entry_safe(msg_ctx, msg_ctx_tmp,
&daemon->msg_ctx_out_queue, daemon_out_list) {
list_del(&msg_ctx->daemon_out_list);
@@ -174,6 +175,7 @@ int ecryptfs_exorcise_daemon(struct ecry
"the out queue of a dying daemon\n", __func__);
ecryptfs_msg_ctx_alloc_to_free(msg_ctx);
}
+ mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
hlist_del(&daemon->euid_chain);
mutex_unlock(&daemon->mux);
kfree_sensitive(daemon);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 272/713] ecryptfs: pass packet set buffer size to parser
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-09-04 4:53 ` [PATCH 7.2 271/713] ecryptfs: hold msg ctx list lock when cleaning daemon queue Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 273/713] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Greg Kroah-Hartman
` (451 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2 upstream.
ecryptfs_parse_packet_set() receives a pointer into the file header, but
it calculates the remaining packet buffer size from PAGE_SIZE - 8. For
version 1 headers the packet set starts later in the header, so this can
overstate the available buffer.
Pass the actual packet set buffer length from the caller and calculate
per-packet limits from the remaining bytes in that buffer. Recompute the
remaining length after consuming a tag 3 packet before parsing the
following tag 11 packet.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/crypto.c | 2 +-
fs/ecryptfs/ecryptfs_kernel.h | 3 ++-
fs/ecryptfs/keystore.c | 23 ++++++++++++++++++++---
3 files changed, 23 insertions(+), 5 deletions(-)
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1197,7 +1197,7 @@ static int ecryptfs_read_headers_virt(ch
} else
set_default_header_data(crypt_stat);
rc = ecryptfs_parse_packet_set(crypt_stat, (page_virt + offset),
- ecryptfs_dentry);
+ PAGE_SIZE - offset, ecryptfs_dentry);
out:
return rc;
}
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -580,7 +580,8 @@ int ecryptfs_generate_key_packet_set(cha
size_t *len, size_t max);
int
ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
- unsigned char *src, struct dentry *ecryptfs_dentry);
+ unsigned char *src, size_t src_size,
+ struct dentry *ecryptfs_dentry);
int ecryptfs_truncate(struct dentry *dentry, loff_t new_length);
ssize_t
ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1704,6 +1704,7 @@ out:
* ecryptfs_parse_packet_set
* @crypt_stat: The cryptographic context
* @src: Virtual address of region of memory containing the packets
+ * @src_size: Size of the packet set buffer
* @ecryptfs_dentry: The eCryptfs dentry associated with the packet set
*
* Get crypt_stat to have the file's session key if the requisite key
@@ -1714,7 +1715,7 @@ out:
* conditions.
*/
int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
- unsigned char *src,
+ unsigned char *src, size_t src_size,
struct dentry *ecryptfs_dentry)
{
size_t i = 0;
@@ -1736,7 +1737,11 @@ int ecryptfs_parse_packet_set(struct ecr
* added the our &auth_tok_list */
next_packet_is_auth_tok_packet = 1;
while (next_packet_is_auth_tok_packet) {
- size_t max_packet_size = ((PAGE_SIZE - 8) - i);
+ size_t max_packet_size;
+
+ if (i >= src_size)
+ break;
+ max_packet_size = src_size - i;
switch (src[i]) {
case ECRYPTFS_TAG_3_PACKET_TYPE:
@@ -1751,12 +1756,16 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
rc = parse_tag_11_packet((unsigned char *)&src[i],
sig_tmp_space,
ECRYPTFS_SIG_SIZE,
&tag_11_contents_size,
&tag_11_packet_size,
- max_packet_size);
+ src_size - i);
if (rc) {
ecryptfs_printk(KERN_ERR, "No valid "
"(ecryptfs-specific) literal "
@@ -1768,6 +1777,10 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += tag_11_packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
if (ECRYPTFS_SIG_SIZE != tag_11_contents_size) {
ecryptfs_printk(KERN_ERR, "Expected "
"signature of size [%d]; "
@@ -1793,6 +1806,10 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
crypt_stat->flags |= ECRYPTFS_ENCRYPTED;
break;
case ECRYPTFS_TAG_11_PACKET_TYPE:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 273/713] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 272/713] ecryptfs: pass packet set buffer size to parser Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 274/713] ecryptfs: reject too-small tag 70 packets Greg Kroah-Hartman
` (450 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HanQuan, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HanQuan <eilaimemedsnaimel@gmail.com>
commit 5babe9c177c364521e3e682b949c5a8c47f4a441 upstream.
parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body
without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When
encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key()
sets decrypted_key_size = encrypted_key_size and performs two
out-of-bounds writes:
1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into
decrypted_key[64] via scatterlist, overflowing into the parent
ecryptfs_auth_tok struct.
2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes
into crypt_stat->key[64], corrupting root_iv, keysig_list, and
mutexes in ecryptfs_crypt_stat.
Only AES-192 (cipher code 0x08) enables this because it sets
crypt_stat->key_size = 24 independently of encrypted_key_size,
allowing crypto_skcipher_setkey() to succeed while encrypted_key_size
exceeds ECRYPTFS_MAX_KEY_BYTES.
The PKI decryption path (parse_tag_65_packet) already validates
decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path
omits this check.
Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather
than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also
protects the 512-byte encrypted_key[] buffer, so the former 512-byte
check is removed as redundant.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
[tyhicks: Adjust the code comment to refer to macros representing the
buffer sizes rather than mentioning the buffer size values since they
may change in the future]
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1384,10 +1384,20 @@ parse_tag_3_packet(struct ecryptfs_crypt
}
(*new_auth_tok)->session_key.encrypted_key_size =
(body_size - (ECRYPTFS_SALT_SIZE + 5));
+ /*
+ * Although encrypted_key_size is copied into the
+ * encrypted_key[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES] buffer here,
+ * it later bounds operations on a smaller buffer:
+ * decrypt_passphrase_encrypted_session_key() sets decrypted_key_size =
+ * encrypted_key_size and decrypts into
+ * decrypted_key[ECRYPTFS_MAX_KEY_BYTES], then memcpy's into
+ * crypt_stat->key[ECRYPTFS_MAX_KEY_BYTES]. Limit to
+ * ECRYPTFS_MAX_KEY_BYTES to protect those smaller buffers.
+ */
if ((*new_auth_tok)->session_key.encrypted_key_size
- > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
+ > ECRYPTFS_MAX_KEY_BYTES) {
printk(KERN_WARNING "Tag 3 packet contains key larger "
- "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
+ "than ECRYPTFS_MAX_KEY_BYTES\n");
rc = -EINVAL;
goto out_free;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 274/713] ecryptfs: reject too-small tag 70 packets
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 273/713] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 275/713] ecryptfs: release message context on send failure Greg Kroah-Hartman
` (449 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f upstream.
ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the
parsed packet body size to derive the encrypted filename size. A
malformed packet with a body smaller than those fixed fields can underflow
that size calculation.
Reject tag 70 packets before the subtraction unless the body contains the
signature, cipher code, and at least one byte of encrypted filename data.
Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -894,6 +894,12 @@ ecryptfs_parse_tag_70_packet(char **file
"rc = [%d]\n", __func__, rc);
goto out;
}
+ if (s->parsed_tag_70_packet_size < (ECRYPTFS_SIG_SIZE + 2)) {
+ ecryptfs_printk(KERN_WARNING, "Invalid packet size [%zd]\n",
+ s->parsed_tag_70_packet_size);
+ rc = -EINVAL;
+ goto out;
+ }
s->block_aligned_filename_size = (s->parsed_tag_70_packet_size
- ECRYPTFS_SIG_SIZE - 1);
if ((1 + s->packet_size_len + s->parsed_tag_70_packet_size)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 275/713] ecryptfs: release message context on send failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 274/713] ecryptfs: reject too-small tag 70 packets Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 276/713] ecryptfs: show filename encryption options Greg Kroah-Hartman
` (448 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 219644a3ad5518217b2d62cad6d2c36a2308c949 upstream.
ecryptfs_send_message_locked() moves a message context from the free
list to the allocated list before sending the request to the userspace
daemon.
If ecryptfs_send_miscdev() fails, the context is left on the
allocated list and cannot be reused. Move it back to the free list on
failure and clear the caller's pointer.
Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/messaging.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -286,9 +286,16 @@ ecryptfs_send_message_locked(char *data,
mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
rc = ecryptfs_send_miscdev(data, data_len, *msg_ctx, msg_type, 0,
daemon);
- if (rc)
+ if (rc) {
printk(KERN_ERR "%s: Error attempting to send message to "
"userspace daemon; rc = [%d]\n", __func__, rc);
+ mutex_lock(&ecryptfs_msg_ctx_lists_mux);
+ mutex_lock(&(*msg_ctx)->mux);
+ ecryptfs_msg_ctx_alloc_to_free(*msg_ctx);
+ mutex_unlock(&(*msg_ctx)->mux);
+ mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
+ *msg_ctx = NULL;
+ }
out:
return rc;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 276/713] ecryptfs: show filename encryption options
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 275/713] ecryptfs: release message context on send failure Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 277/713] efivarfs: Rate limit statfs() handler Greg Kroah-Hartman
` (447 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 496ec2d0852a02d2e631771b5c439130b9c7dce7 upstream.
ecryptfs_show_options() prints most user-visible mount options but
omits the filename encryption cipher and key size.
Print ecryptfs_fn_cipher and ecryptfs_fn_key_bytes when filename
encryption is enabled so that the displayed mount options reflect the
active filename encryption settings.
Fixes: 87c94c4df014 ("eCryptfs: Filename Encryption: mount option")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/super.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -150,6 +150,13 @@ static int ecryptfs_show_options(struct
if (mount_crypt_stat->global_default_cipher_key_size)
seq_printf(m, ",ecryptfs_key_bytes=%zd",
mount_crypt_stat->global_default_cipher_key_size);
+ if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
+ seq_printf(m, ",ecryptfs_fn_cipher=%s",
+ mount_crypt_stat->global_default_fn_cipher_name);
+ if (mount_crypt_stat->global_default_fn_cipher_key_bytes)
+ seq_printf(m, ",ecryptfs_fn_key_bytes=%zd",
+ mount_crypt_stat->global_default_fn_cipher_key_bytes);
+ }
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)
seq_printf(m, ",ecryptfs_passthrough");
if (mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 277/713] efivarfs: Rate limit statfs() handler
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 276/713] ecryptfs: show filename encryption options Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 278/713] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
` (446 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ravi Bangoria, Anisse Astier,
Ard Biesheuvel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
commit b2326338dc683e8c1067c0cbf7a47986c4190902 upstream.
Ravi reports that statfs() may be called by unprivileged users on the
efivarfs mount point, which may result in a flood of calls to the
QueryVariableInfo() runtime service. These calls are disproportionately
costly on x86 systems where the variable store is backed by SMM, as each
SMM entry requires a rendez-vous of all the CPUs.
So rate limit the calls to QueryVariableInfo() at twice per second, and
return the most recently obtained value for calls that are elided.
Cc: <stable@vger.kernel.org>
Reported-by: Ravi Bangoria <ravi.bangoria@amd.com>
Fixes: d86ff3333cb1 ("efivarfs: expose used and total size")
Reviewed-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/efivarfs/super.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -89,12 +89,30 @@ static int efivarfs_statfs(struct dentry
/* Some UEFI firmware does not implement QueryVariableInfo() */
storage_space = remaining_space = 0;
if (efi_rt_services_supported(EFI_RT_SUPPORTED_QUERY_VARIABLE_INFO)) {
- status = efivar_query_variable_info(attr, &storage_space,
- &remaining_space,
- &max_variable_size);
- if (status != EFI_SUCCESS && status != EFI_UNSUPPORTED)
- pr_warn_ratelimited("query_variable_info() failed: 0x%lx\n",
- status);
+ static DEFINE_RATELIMIT_STATE(_rs, 2 * HZ, 5);
+ static u64 storage, remaining;
+ static DEFINE_SPINLOCK(lock);
+
+ if (!__ratelimit(&_rs)) {
+ ratelimit_set_flags(&_rs, RATELIMIT_MSG_ON_RELEASE);
+
+ spin_lock(&lock);
+ storage_space = storage;
+ remaining_space = remaining;
+ spin_unlock(&lock);
+ } else {
+ status = efivar_query_variable_info(attr, &storage_space,
+ &remaining_space,
+ &max_variable_size);
+ if (status != EFI_SUCCESS && status != EFI_UNSUPPORTED)
+ pr_warn("query_variable_info() failed: 0x%lx\n",
+ status);
+
+ spin_lock(&lock);
+ storage = storage_space;
+ remaining = remaining_space;
+ spin_unlock(&lock);
+ }
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 278/713] entry: Fix seccomp bypass after ptrace with TSYNC
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 277/713] efivarfs: Rate limit statfs() handler Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 279/713] erofs: skip sufficiently large global buffers when resizing Greg Kroah-Hartman
` (445 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Thomas Gleixner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 4a3591287fb7f808e209b4974ed337f609a2006b upstream.
Sashiko review pointed out the following issue.
If a thread is stopped in syscall_trace_enter() for ptrace, another
thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC
(e.g., via seccomp_attach_filter()). This will successfully set
SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()
evaluates a cached 'work' variable sampled on entry. Consequently,
the subsequent check for SYSCALL_WORK_SECCOMP misses the newly
assigned flag, and the filter is silently bypassed.
This race condition could allow an unprivileged process to execute
a prohibited system call (e.g., execve) that the newly installed filter
was intended to block, especially since the tracer might have modified
the system call number during the ptrace stop.
Fix this by re-reading the syscall_work flags after ptrace handling,
so that any new SYSCALL_WORK_SECCOMP flag set by another thread via
TSYNC during the ptrace stop is observed before the subsequent
seccomp check.
Fixes: 142781e108b1 ("entry: Provide generic syscall entry functionality")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260629132914.1135C1F000E9@smtp.kernel.org/
Link: https://patch.msgid.link/20260713025712.416366-1-ruanjinjie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/entry-common.h | 3 +++
1 file changed, 3 insertions(+)
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -96,6 +96,9 @@ static __always_inline long syscall_trac
ret = arch_ptrace_report_syscall_entry(regs);
if (ret || (work & SYSCALL_WORK_SYSCALL_EMU))
return -1L;
+
+ /* ptrace might have changed work flags */
+ work = READ_ONCE(current_thread_info()->syscall_work);
}
/* Do seccomp after ptrace, to catch any tracer changes. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 279/713] erofs: skip sufficiently large global buffers when resizing
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 278/713] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 280/713] ext2: Fix lost inode updates for IS_SYNC inodes Greg Kroah-Hartman
` (444 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nikhil Gurudasani, Gao Xiang,
Chao Yu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gurudasani <nikhilgurudasani314@gmail.com>
commit a7d097cf01301c5da37927c8f26123d006f0fd8a upstream.
z_erofs_gbuf_nrpages is advanced only after every global buffer has been
grown. If a resize fails after some buffers were enlarged, a retry
revisits those enlarged buffers.
Retrying the same size then returns -ENOMEM because alloc_pages_bulk()
has no pages to add and the unchanged return value is treated as a
failure. Retrying an intermediate size allocates a temporary pointer
array smaller than gbuf->nrpages and copies more existing pointers than
the array can hold.
Skip buffers that already satisfy the request. Once all remaining
buffers have caught up, advancing z_erofs_gbuf_nrpages again describes
the guaranteed minimum size across the pool.
Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()")
Cc: stable@vger.kernel.org # 6.10+
Signed-off-by: Nikhil Gurudasani <nikhilgurudasani314@gmail.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/zutil.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/erofs/zutil.c
+++ b/fs/erofs/zutil.c
@@ -79,6 +79,8 @@ int z_erofs_gbuf_growsize(unsigned int n
for (i = 0; i < z_erofs_gbuf_count; ++i) {
gbuf = &z_erofs_gbufpool[i];
+ if (gbuf->nrpages >= nrpages)
+ continue;
tmp_pages = kzalloc_objs(*tmp_pages, nrpages);
if (!tmp_pages)
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 280/713] ext2: Fix lost inode updates for IS_SYNC inodes
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 279/713] erofs: skip sufficiently large global buffers when resizing Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 281/713] fanotify: fix use-after-free of file range info Greg Kroah-Hartman
` (443 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara,
Christian Brauner (Amutable)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a upstream.
ext2_setsize() and ext2_xattr_set2() had a construct like:
if (IS_SYNC(inode)) {
sync_inode_metadata(inode, 1);
} else {
mark_inode_dirty(inode);
}
which leads to lost inode updates for IS_SYNC inodes because
sync_inode_metadata() does anything only if the inode is already dirty
and hence inode updates may be simply lost. Fix the problem by
unconditionally marking the inode dirty and *then* call
sync_inode_metadata().
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260727104923.3828017-26-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext2/inode.c | 7 ++-----
fs/ext2/xattr.c | 4 ++--
2 files changed, 4 insertions(+), 7 deletions(-)
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -1258,12 +1258,9 @@ static int ext2_setsize(struct inode *in
filemap_invalidate_unlock(inode->i_mapping);
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
- if (inode_needs_sync(inode)) {
- mmb_sync(&EXT2_I(inode)->i_metadata_bhs);
+ mark_inode_dirty(inode);
+ if (inode_needs_sync(inode))
sync_inode_metadata(inode, 1);
- } else {
- mark_inode_dirty(inode);
- }
return 0;
}
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -777,6 +777,7 @@ ext2_xattr_set2(struct inode *inode, str
/* Update the inode. */
EXT2_I(inode)->i_file_acl = new_bh ? new_bh->b_blocknr : 0;
inode_set_ctime_current(inode);
+ mark_inode_dirty(inode);
if (IS_SYNC(inode)) {
error = sync_inode_metadata(inode, 1);
/* In case sync failed due to ENOSPC the inode was actually
@@ -789,8 +790,7 @@ ext2_xattr_set2(struct inode *inode, str
}
goto cleanup;
}
- } else
- mark_inode_dirty(inode);
+ }
error = 0;
if (old_bh && old_bh != new_bh) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 281/713] fanotify: fix use-after-free of file range info
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 280/713] ext2: Fix lost inode updates for IS_SYNC inodes Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 282/713] fat: restore original value when fat_ent_write failed Greg Kroah-Hartman
` (442 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Chengfeng Ye
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851 upstream.
fsnotify_pre_content() builds its file_range on the triggering task's
stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the
heap-allocated permission event so copy_range_info_to_user() can report
the offset later.
The event reader can set the event state to FAN_EVENT_REPORTED and then
sleep while preparing the file descriptor. If a signal interrupts the
triggering task at that point, fanotify_get_response() changes the state
to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack
frame while the reader still owns the event. The reader then dereferences
pevent->ppos and copies the stale stack value to userspace.
KASAN reported:
BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970
Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95
Call Trace:
fanotify_read+0x293e/0x2970
vfs_read+0x177/0xa20
ksys_read+0xf7/0x1c0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Store the range position directly in the permission event and use
FANOTIFY_NO_RANGE when range information is unavailable. The event remains
alive until the reader finishes, so the reported offset no longer depends
on the triggering task's stack.
Fixes: 870499bc1d4d ("fanotify: report file range info with pre-content events")
Cc: stable@vger.kernel.org
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://patch.msgid.link/20260730134316.2085087-1-nicoyip.dev@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fanotify/fanotify.c | 3 +--
fs/notify/fanotify/fanotify.h | 6 ++++--
fs/notify/fanotify/fanotify_user.c | 5 +----
3 files changed, 6 insertions(+), 8 deletions(-)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -600,8 +600,7 @@ static struct fanotify_event *fanotify_a
pevent->hdr.len = 0;
pevent->state = FAN_EVENT_INIT;
pevent->path = *path;
- /* NULL ppos means no range info */
- pevent->ppos = range ? &range->pos : NULL;
+ pevent->pos = range ? range->pos : FANOTIFY_NO_RANGE;
pevent->count = range ? range->count : 0;
path_get(path);
--- a/fs/notify/fanotify/fanotify.h
+++ b/fs/notify/fanotify/fanotify.h
@@ -428,6 +428,8 @@ FANOTIFY_ME(struct fanotify_event *event
return container_of(event, struct fanotify_mnt_event, fae);
}
+#define FANOTIFY_NO_RANGE ((loff_t)-1)
+
/*
* Structure for permission fanotify events. It gets allocated and freed in
* fanotify_handle_event() since we wait there for user response. When the
@@ -438,7 +440,7 @@ FANOTIFY_ME(struct fanotify_event *event
struct fanotify_perm_event {
struct fanotify_event fae;
struct path path;
- const loff_t *ppos; /* optional file range info */
+ loff_t pos; /* FANOTIFY_NO_RANGE if unavailable */
size_t count;
u32 response; /* userspace answer to the event */
unsigned short state; /* state of the event */
@@ -468,7 +470,7 @@ static inline bool fanotify_event_has_ac
if (!(event->mask & FANOTIFY_PRE_CONTENT_EVENTS))
return false;
- return FANOTIFY_PERM(event)->ppos;
+ return FANOTIFY_PERM(event)->pos != FANOTIFY_NO_RANGE;
}
static inline struct fanotify_event *FANOTIFY_E(struct fsnotify_event *fse)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -675,12 +675,9 @@ static size_t copy_range_info_to_user(st
if (WARN_ON_ONCE(info_len > count))
return -EFAULT;
- if (WARN_ON_ONCE(!pevent->ppos))
- return -EINVAL;
-
info.hdr.info_type = FAN_EVENT_INFO_TYPE_RANGE;
info.hdr.len = info_len;
- info.offset = *(pevent->ppos);
+ info.offset = pevent->pos;
info.count = pevent->count;
if (copy_to_user(buf, &info, info_len))
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 282/713] fat: restore original value when fat_ent_write failed
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 281/713] fanotify: fix use-after-free of file range info Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 283/713] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Greg Kroah-Hartman
` (441 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yemu Lu, Ren Wei, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, OGAWA Hirofumi, Christian Brauner,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yemu Lu <prcups@krgm.moe>
commit 64d9183203eebe33de6188b70a8c1e91f52885db upstream.
fat_ent_write() may have committed the new link to the primary FAT but
then failed on the mirror copy, leaving the chain pointing to new_dclus
even though the caller will free it. Restore the original value to keep
the chain consistent.
Link: https://lore.kernel.org/20260525085649.781643-1-n05ec@lzu.edu.cn
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yemu Lu <prcups@krgm.moe>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fat/misc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -133,7 +133,11 @@ int fat_chain_add(struct inode *inode, i
ret = fat_ent_read(inode, &fatent, last);
if (ret >= 0) {
int wait = inode_needs_sync(inode);
+ int old = ret;
+
ret = fat_ent_write(inode, &fatent, new_dclus, wait);
+ if (ret < 0)
+ fat_ent_write(inode, &fatent, old, wait);
fatent_brelse(&fatent);
}
if (ret < 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 283/713] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 282/713] fat: restore original value when fat_ent_write failed Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 284/713] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Greg Kroah-Hartman
` (440 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit f8e43fe0f22b7137ce456e6fe3581d3098174f74 upstream.
dsicm_probe() registers the display before initializing ddata->lock.
Once omapdss_register_display() publishes the display, another consumer
can reach a dsicm callback that takes this mutex while it is still
uninitialized.
Initialize the mutex before registering the display so the published
callbacks always see a valid lock.
Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
@@ -1150,14 +1150,14 @@ static int dsicm_probe(struct platform_d
dssdev->caps = OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE |
OMAP_DSS_DISPLAY_CAP_TEAR_ELIM;
+ mutex_init(&ddata->lock);
+
r = omapdss_register_display(dssdev);
if (r) {
dev_err(dev, "Failed to register panel\n");
goto err_reg;
}
- mutex_init(&ddata->lock);
-
atomic_set(&ddata->do_update, 0);
ddata->reset_gpio = devm_gpiod_get(&pdev->dev, "reset", GPIOD_OUT_LOW);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 284/713] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 283/713] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 285/713] fbdev: ssd1307fb: defer I2C transfers from damage callbacks Greg Kroah-Hartman
` (439 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Florian Fuchs,
Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit 5dc2e70dd74b1f03e2e13bfb6922111d9e0adf90 upstream.
Add __user annotation to buf, as it is passed as a user pointer in
pin_user_pages_fast(). Use an empty initializer for the sentinel
board-table entry to avoid initializing a function pointer with an
integer literal.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607131247.fpQ6eTc7-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/pvr2fb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -639,7 +639,7 @@ static irqreturn_t __maybe_unused pvr2fb
}
#ifdef CONFIG_PVR2_DMA
-static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
+static ssize_t pvr2fb_write(struct fb_info *info, const char __user *buf,
size_t count, loff_t *ppos)
{
unsigned long dst, start, end, len;
@@ -1077,7 +1077,7 @@ static struct pvr2_board {
#ifdef CONFIG_PCI
{ pvr2fb_pci_init, pvr2fb_pci_exit, "PCI PVR2" },
#endif
- { 0, },
+ { },
};
static int __init pvr2fb_init(void)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 285/713] fbdev: ssd1307fb: defer I2C transfers from damage callbacks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 284/713] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 286/713] fbdev: uvesafb: unregister connector callback on init failure Greg Kroah-Hartman
` (438 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 9ad709afdfa32509ed64938a6d9cd00db3cd54c2 upstream.
The fbdev damage callbacks may run from fbcon while printk has disabled
preemption. They currently update the display synchronously, which enters
the sleeping I2C transfer path from atomic context.
A complete report from an RK3566 system follows:
[ 258.129004] watchdog: watchdog0: watchdog did not stop!
[ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003
[ 258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep
binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2
spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem
videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2
stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio
stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables
x_tables autofs4
[ 258.129215] Preemption disabled at:
[ 258.129216] [<ffff80008012f96c>] vprintk_emit+0x11c/0x340
[ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C
6.6.0-rc5-rockchip-rk356x #4
[ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT)
[ 258.129243] Call trace:
[ 258.129245] dump_backtrace+0xa0/0x128
[ 258.129252] show_stack+0x20/0x38
[ 258.129256] dump_stack_lvl+0x60/0xb0
[ 258.129265] dump_stack+0x18/0x28
[ 258.129269] __schedule_bug+0xa0/0xc8
[ 258.129274] __schedule+0x9ac/0xd30
[ 258.129279] schedule+0x60/0x100
[ 258.129282] schedule_timeout+0x194/0x338
[ 258.129289] rk3x_i2c_xfer_common.isra.0+0x384/0x498
[ 258.129296] rk3x_i2c_xfer+0x20/0x60
[ 258.129300] __i2c_transfer+0x194/0x648
[ 258.129308] i2c_transfer+0x9c/0x130
[ 258.129313] i2c_transfer_buffer_flags+0x64/0x98
[ 258.129318] ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb]
[ 258.129334] ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb]
[ 258.129343] soft_cursor+0x13c/0x210
[ 258.129350] bit_cursor+0x2dc/0x550
[ 258.129354] fbcon_cursor+0xec/0x108
[ 258.129359] hide_cursor+0x44/0xc8
[ 258.129365] vt_console_print+0x398/0x3b0
[ 258.129370] console_flush_all.isra.0+0x17c/0x410
[ 258.129377] console_unlock+0x4c/0x100
[ 258.129382] vprintk_emit+0x1c8/0x340
[ 258.129386] vprintk_default+0x40/0x58
[ 258.129389] vprintk+0xb8/0xd0
[ 258.129392] _printk+0x68/0x98
[ 258.129398] watchdog_release+0x170/0x230
[ 258.129404] __fput+0xbc/0x288
[ 258.129409] __fput_sync+0x58/0x70
[ 258.129413] __arm64_sys_close+0x40/0x90
[ 258.129419] invoke_syscall+0x4c/0x118
[ 258.129426] el0_svc_common.constprop.0+0x48/0xf0
[ 258.129432] do_el0_svc+0x24/0x38
[ 258.129437] el0_svc+0x48/0x100
[ 258.129443] el0t_64_sync_handler+0xc0/0xc8
[ 258.129448] el0t_64_sync+0x190/0x198
[ 258.573087] ------------[ cut here ]------------
[ 258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count())
[ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871
preempt_count_sub+0x9c/0x148
[ 258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep
binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2
spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem
videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2
stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio
stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables
x_tables autofs4
[ 258.573268] CPU: 0 PID: 1 Comm: systemd Tainted: G WC
6.6.0-rc5-rockchip-rk356x #4
[ 258.573274] Hardware name: Rockchip RK3566 OPi 3B (DT)
** 37 printk messages dropped **
[ 258.574064] Preemption disabled at:
** 42 printk messages dropped **
[ 259.190237] Preemption disabled at:
Track damage in the driver's private data under a spinlock and merge
multiple updates into a bounding rectangle. Queue the existing
deferred-I/O work immediately for damage reported by fbdev drawing and
write helpers, so allocation and I2C transfers run from process context
without adding the configured mmap refresh delay. Keep full-screen
updates for dirty mmap pages, for which no precise rectangle is available.
Tested on an RK3566 board with a 128x64 OLED by running five rounds of 250
KERN_EMERG messages in total while issuing framebuffer writes every 15 ms.
No atomic-sleep, preemption, or lockdep warning occurred. Kprobe tracing
also confirmed that cursor-only damage remained an 8x16 partial update.
Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/ssd1307fb.c | 72 +++++++++++++++++++++++++++++++++++++---
1 file changed, 67 insertions(+), 5 deletions(-)
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -14,6 +14,7 @@
#include <linux/module.h>
#include <linux/property.h>
#include <linux/pwm.h>
+#include <linux/spinlock.h>
#include <linux/uaccess.h>
#include <linux/regulator/consumer.h>
@@ -72,6 +73,13 @@ struct ssd1307fb_par {
struct i2c_client *client;
u32 height;
struct fb_info *info;
+ /* Pending damage, with exclusive x2/y2, protected by damage_lock. */
+ spinlock_t damage_lock;
+ bool damage_pending;
+ u32 damage_x1;
+ u32 damage_x2;
+ u32 damage_y1;
+ u32 damage_y2;
u8 lookup_table[4];
u32 page_offset;
u32 col_offset;
@@ -302,19 +310,49 @@ static int ssd1307fb_blank(int blank_mod
return ssd1307fb_write_cmd(par->client, SSD1307FB_DISPLAY_ON);
}
+static void ssd1307fb_schedule_damage(struct fb_info *info, u32 x, u32 y,
+ u32 width, u32 height)
+{
+ struct ssd1307fb_par *par = info->par;
+ unsigned long flags;
+ u32 x2, y2;
+
+ if (!width || !height || x >= par->width || y >= par->height)
+ return;
+
+ x2 = x + min(width, par->width - x);
+ y2 = y + min(height, par->height - y);
+
+ spin_lock_irqsave(&par->damage_lock, flags);
+ if (par->damage_pending) {
+ par->damage_x1 = min(par->damage_x1, x);
+ par->damage_y1 = min(par->damage_y1, y);
+ par->damage_x2 = max(par->damage_x2, x2);
+ par->damage_y2 = max(par->damage_y2, y2);
+ } else {
+ par->damage_x1 = x;
+ par->damage_y1 = y;
+ par->damage_x2 = x2;
+ par->damage_y2 = y2;
+ par->damage_pending = true;
+ }
+ spin_unlock_irqrestore(&par->damage_lock, flags);
+
+ /* Advance an already-pending mmap update as well. */
+ mod_delayed_work(system_wq, &info->deferred_work, 0);
+}
+
static void ssd1307fb_defio_damage_range(struct fb_info *info, off_t off, size_t len)
{
struct ssd1307fb_par *par = info->par;
- ssd1307fb_update_display(par);
+ ssd1307fb_schedule_damage(info, 0, 0, par->width, par->height);
}
static void ssd1307fb_defio_damage_area(struct fb_info *info, u32 x, u32 y,
u32 width, u32 height)
{
- struct ssd1307fb_par *par = info->par;
-
- ssd1307fb_update_rect(par, x, y, width, height);
+ ssd1307fb_schedule_damage(info, x, y, width, height);
}
FB_GEN_DEFAULT_DEFERRED_SYSMEM_OPS(ssd1307fb,
@@ -329,7 +367,30 @@ static const struct fb_ops ssd1307fb_ops
static void ssd1307fb_deferred_io(struct fb_info *info, struct list_head *pagereflist)
{
- ssd1307fb_update_display(info->par);
+ struct ssd1307fb_par *par = info->par;
+ unsigned long flags;
+ u32 x, y, width, height;
+
+ spin_lock_irqsave(&par->damage_lock, flags);
+ if (!list_empty(pagereflist)) {
+ x = 0;
+ y = 0;
+ width = par->width;
+ height = par->height;
+ par->damage_pending = false;
+ } else if (par->damage_pending) {
+ x = par->damage_x1;
+ y = par->damage_y1;
+ width = par->damage_x2 - par->damage_x1;
+ height = par->damage_y2 - par->damage_y1;
+ par->damage_pending = false;
+ } else {
+ spin_unlock_irqrestore(&par->damage_lock, flags);
+ return;
+ }
+ spin_unlock_irqrestore(&par->damage_lock, flags);
+
+ ssd1307fb_update_rect(par, x, y, width, height);
}
static int ssd1307fb_init(struct ssd1307fb_par *par)
@@ -601,6 +662,7 @@ static int ssd1307fb_probe(struct i2c_cl
par = info->par;
par->info = info;
par->client = client;
+ spin_lock_init(&par->damage_lock);
par->device_info = device_get_match_data(dev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 286/713] fbdev: uvesafb: unregister connector callback on init failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 285/713] fbdev: ssd1307fb: defer I2C transfers from damage callbacks Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 287/713] fonts: fixup font.h kernel-doc warnings Greg Kroah-Hartman
` (437 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit de8db23aa7c337e606fca9faf48b3ba72968597a upstream.
uvesafb_init() registers the v86d connector callback before registering
the platform driver. If platform_driver_register() fails, the function
returns the error directly and leaves the connector callback registered.
The later platform-device failure path already unregisters the callback.
Add the same cleanup before the final return when platform-driver
registration fails.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/uvesafb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1907,6 +1907,8 @@ static int uvesafb_init(void)
err = 0;
}
}
+ if (err)
+ cn_del_callback(&uvesafb_cn_id);
return err;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 287/713] fonts: fixup font.h kernel-doc warnings
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 286/713] fbdev: uvesafb: unregister connector callback on init failure Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 288/713] forcedeth: fix off-by-one when saving/restoring non-PCI config space Greg Kroah-Hartman
` (436 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
commit 048ad864d61feedc24129eeb976e973edcbc3aac upstream.
Use the typedef keyword when describing a typedef.
Add the missing function return value for font_glyph_size().
Warning: include/linux/font.h:84 cannot understand function prototype:
'typedef const unsigned char font_data_t;'
Warning: include/linux/font.h:53 No description found for return value
of 'font_glyph_size'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/font.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -49,6 +49,8 @@ static inline unsigned int font_glyph_pi
* scanlines, which is usually the glyph's height in scanlines. Fonts
* coming from user space can sometimes have a different vertical pitch
* with empty scanlines between two adjacent glyphs.
+ *
+ * Returns: the number of bytes per glyph
*/
static inline unsigned int font_glyph_size(unsigned int width, unsigned int vpitch)
{
@@ -60,7 +62,7 @@ static inline unsigned int font_glyph_si
*/
/**
- * font_data_t - Raw font data
+ * typedef font_data_t - Raw font data
*
* Values of type font_data_t store a pointer to raw font data. The format
* is monochrome. Each bit sets a pixel of a stored glyph. Font data does
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 288/713] forcedeth: fix off-by-one when saving/restoring non-PCI config space
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 287/713] fonts: fixup font.h kernel-doc warnings Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 289/713] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Greg Kroah-Hartman
` (435 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Czernohous, Simon Horman,
Zhu Yanjun, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
commit 9393f1d656a79693e0c123ff7bc7c5c0f708046d upstream.
nv_suspend() and nv_resume() walk the non-PCI configuration space with
for (i = 0; i <= np->register_size/sizeof(u32); i++)
which runs one iteration too many. saved_config_space is declared as
u32 saved_config_space[NV_PCI_REGSZ_MAX/4];
and NV_PCI_REGSZ_VER3 is equal to NV_PCI_REGSZ_MAX (0x604), so on a VER3
device register_size/sizeof(u32) is exactly the array length and the last
iteration addresses one element past the end.
The element it lands on is np->name_rx[0..3]: saved_config_space[] is
followed immediately by char name_rx[IFNAMSIZ + 3], and char needs no
padding. Nothing observable is corrupted by that, because nv_request_irq()
rewrites name_rx with sprintf() before it is ever passed to request_irq().
The bug is the out-of-bounds access itself, which UBSAN reports and which
CONFIG_UBSAN_TRAP=y turns into a trap that aborts the running kernel code,
plus an MMIO read and, on resume, an MMIO writel() to base + 0x604, one
dword past the range the driver mapped:
np->base = ioremap(addr, np->register_size);
VER1 and VER2 devices stay inside the array, but they too get the stray
read and the stray write one dword past their own window.
Caught by UBSAN on an Apple Macmini3,1 (MCP79) during a deep S3 cycle.
The splat below is trimmed: the build path in the file name, the CPU
and taint lines, the Workqueue line, the "?" hint frames, and the
frames below device_suspend are all cut. The kernel was tainted, with
an out-of-tree nouveau and CPU_OUT_OF_SPEC; forcedeth itself was the
stock module.
UBSAN: array-index-out-of-bounds in drivers/net/ethernet/nvidia/forcedeth.c:6225:25
index 385 is out of range for type 'u32 [385]'
Call Trace:
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x54/0x59
__this_module+0xe398c/0xe9010 [forcedeth]
pci_pm_suspend+0x80/0x170
dpm_run_callback+0x51/0x160
device_suspend+0x1a2/0x4a0
...
Both loops are hit. UBSAN reports each source location only once per module
load (__ubsan_handle_out_of_bounds() calls suppress_report(), which does
test_and_set_bit(REPORTED_BIT, ...) on the struct source_location), so the
two splats land in the first S3 cycle after the module is loaded and later
cycles are silent even though the access still runs off the end every time.
In that first cycle line 6225 is reported from pci_pm_suspend and line 6240
from pci_pm_resume.
The same off-by-one was fixed in nv_get_regs() by commit ba9aa134287f
("forcedeth: fix buffer overflow") in 2012; these two loops were missed.
The suspend and resume side was reported on LKML in September 2013 by Marc
Weber, with the same analysis and the same one-character fix, but the patch
was attached rather than sent inline and the thread ended there.
Use < instead of <=, which saves and restores exactly register_size bytes.
Fixes: 1a1ca86158ee ("[netdrvr] forcedeth: save/restore device configuration space")
Cc: stable@vger.kernel.org
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/178682367885.3748309.10595890901761762683@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/nvidia/forcedeth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -6221,7 +6221,7 @@ static int nv_suspend(struct device *dev
netif_device_detach(dev);
/* save non-pci configuration space */
- for (i = 0; i <= np->register_size/sizeof(u32); i++)
+ for (i = 0; i < np->register_size/sizeof(u32); i++)
np->saved_config_space[i] = readl(base + i*sizeof(u32));
return 0;
@@ -6236,7 +6236,7 @@ static int nv_resume(struct device *devi
int i, rc = 0;
/* restore non-pci configuration space */
- for (i = 0; i <= np->register_size/sizeof(u32); i++)
+ for (i = 0; i < np->register_size/sizeof(u32); i++)
writel(np->saved_config_space[i], base+i*sizeof(u32));
if (np->driver_data & DEV_NEED_MSI_FIX)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 289/713] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 288/713] forcedeth: fix off-by-one when saving/restoring non-PCI config space Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 290/713] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
` (434 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tien Sung Ang, Tze Yee Ng, Xu Yilun,
Xu Yilun
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tien Sung Ang <tien.sung.ang@altera.com>
commit c14a8b15c87b49efc3ef898cec8ac7c30336a080 upstream.
Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration.
Do not call stratix10_svc_done() at the end of write_init() on success, so
the SVC session remains active through write() and write_complete(). Call
stratix10_svc_done() on failure in write_init() and write() so the shared
SVC mailbox is released when reconfiguration aborts, allowing coexistence
with other SVC clients such as soc64-hwmon.
Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Tien Sung Ang <tien.sung.ang@altera.com>
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/stratix10-soc.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -195,20 +195,18 @@ static int s10_ops_write_init(struct fpg
ret = s10_svc_send_msg(priv, COMMAND_RECONFIG,
&ctype, sizeof(ctype));
if (ret < 0)
- goto init_done;
+ goto init_error;
- ret = wait_for_completion_timeout(
- &priv->status_return_completion, S10_RECONFIG_TIMEOUT);
- if (!ret) {
+ if (!wait_for_completion_timeout(&priv->status_return_completion,
+ S10_RECONFIG_TIMEOUT)) {
dev_err(dev, "timeout waiting for RECONFIG_REQUEST\n");
ret = -ETIMEDOUT;
- goto init_done;
+ goto init_error;
}
- ret = 0;
if (!test_and_clear_bit(SVC_STATUS_OK, &priv->status)) {
ret = -ETIMEDOUT;
- goto init_done;
+ goto init_error;
}
/* Allocate buffers from the service layer's pool. */
@@ -217,14 +215,16 @@ static int s10_ops_write_init(struct fpg
if (IS_ERR(kbuf)) {
s10_free_buffers(mgr);
ret = PTR_ERR(kbuf);
- goto init_done;
+ goto init_error;
}
priv->svc_bufs[i].buf = kbuf;
priv->svc_bufs[i].lock = 0;
}
-init_done:
+ return 0;
+
+init_error:
stratix10_svc_done(priv->chan);
return ret;
}
@@ -342,6 +342,9 @@ static int s10_ops_write(struct fpga_man
if (!s10_free_buffers(mgr))
dev_err(dev, "%s not all buffers were freed\n", __func__);
+ if (ret < 0)
+ stratix10_svc_done(priv->chan);
+
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 290/713] fsnotify: Fix stale object mask after concurrent mark updates
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 289/713] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 291/713] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Greg Kroah-Hartman
` (433 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Amir Goldstein,
Youngjae Kwon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youngjae Kwon <yjkwon0026@snu.ac.kr>
commit e422777fdd4746de1109575c51e65038d4c5c1be upstream.
When a mark gets a new event bit, fanotify and inotify may avoid
recalculating the object mask if the cached aggregate already contains that
bit. This is racy with a recalculation triggered by a concurrent update to
another mark on the same connector.
The concurrent scan can read the mark before the new bit is added, while
the updater reads the old aggregate before that scan publishes its result.
The updater then skips recalculation and the scan publishes a mask without
the bit, leaving the object mask stale after both updates complete.
This can be reproduced with two fanotify groups watching the same inode:
one thread removes FAN_MODIFY from one existing mark while another thread
adds FAN_MODIFY to the other mark. After both fanotify_mark() calls return,
writes can fail to produce FAN_MODIFY for the group whose mark now contains
the bit. This was reproduced on an unmodified v6.12.95 kernel. The
equivalent inotify interleaving loses IN_MODIFY events.
For normal fanotify additions, recalculate whenever the raw mark mask
changes. The normal mask is not cleared asynchronously, so an unchanged
addition cannot introduce missing interest. Always recalculate ignore-mask
updates because FS_MODIFY handling may clear the ignore mask without taking
mark->lock, making snapshot comparisons unreliable.
Always recalculate after updating an existing inotify watch. Its replace
path temporarily sets mark->mask to zero, so a concurrent scan can observe
zero even when the old and final masks are equal. Assigning the replacement
mask directly would avoid the transient zero, but existing-watch updates
are infrequent, so unconditional recalculation is simpler.
Link: https://lore.kernel.org/all/CACwKKmCZdiZDoFuYm6LZhQ=XvHPk0fNKH=X3LmoXMqakYqJaNw@mail.gmail.com/
Fixes: 63c882a05416 ("inotify: reimplement inotify using fsnotify")
Fixes: 912ee3946c5e ("fanotify: do not call fanotify_update_object_mask in fanotify_add_mark")
Cc: stable@vger.kernel.org # needs adjustments for <= 7.0
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Youngjae Kwon <yjkwon0026@snu.ac.kr>
Link: https://patch.msgid.link/20260802015801.2426818-1-yjkwon0026@snu.ac.kr
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fanotify/fanotify_user.c | 12 +++++++-----
fs/notify/inotify/inotify_user.c | 15 +--------------
2 files changed, 8 insertions(+), 19 deletions(-)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1313,16 +1313,18 @@ static bool fanotify_mark_update_flags(s
static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark,
__u32 mask, unsigned int fan_flags)
{
+ __u32 old_mask;
bool recalc;
spin_lock(&fsn_mark->lock);
- if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS))
+ if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) {
+ old_mask = fsn_mark->mask;
fsn_mark->mask |= mask;
- else
+ recalc = old_mask != fsn_mark->mask;
+ } else {
fsn_mark->ignore_mask |= mask;
-
- recalc = fsnotify_calc_mask(fsn_mark) &
- ~fsnotify_conn_mask(fsn_mark->connector);
+ recalc = true;
+ }
recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags);
spin_unlock(&fsn_mark->lock);
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -539,7 +539,6 @@ static int inotify_update_existing_watch
{
struct fsnotify_mark *fsn_mark;
struct inotify_inode_mark *i_mark;
- __u32 old_mask, new_mask;
int replace = !(arg & IN_MASK_ADD);
int create = (arg & IN_MASK_CREATE);
int ret;
@@ -555,27 +554,15 @@ static int inotify_update_existing_watch
i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
spin_lock(&fsn_mark->lock);
- old_mask = fsn_mark->mask;
if (replace) {
fsn_mark->mask = 0;
fsn_mark->flags &= ~INOTIFY_MARK_FLAGS;
}
fsn_mark->mask |= inotify_arg_to_mask(inode, arg);
fsn_mark->flags |= inotify_arg_to_flags(arg);
- new_mask = fsn_mark->mask;
spin_unlock(&fsn_mark->lock);
- if (old_mask != new_mask) {
- /* more bits in old than in new? */
- int dropped = (old_mask & ~new_mask);
- /* more bits in this fsn_mark than the inode's mask? */
- int do_inode = (new_mask & ~READ_ONCE(inode->i_fsnotify_mask));
-
- /* update the inode with this new fsn_mark */
- if (dropped || do_inode)
- fsnotify_recalc_mask(fsn_mark->connector);
-
- }
+ fsnotify_recalc_mask(fsn_mark->connector);
/* return the wd */
ret = i_mark->wd;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 291/713] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 290/713] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 292/713] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
` (432 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Merlijn Wajer, Ivaylo Dimitrov,
Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
commit e81250ec6b69248b00d38c523dc6a13efaf38aab upstream.
The OMAP SSI driver uses a synthetic HSI controller device allocated via
hsi_alloc_controller(), which does not go through the normal OF/platform
device initialization path.
As a result, the embedded struct device does not have a DMA mask
initialized by default.
After recent DMA API hardening changes, dma_map_sg() and related helpers
now require a valid dma_mask to be present, otherwise the driver may
crash or trigger warnings when attempting DMA mapping operations.
Fix this by explicitly initializing the DMA mask for the SSI controller
device and setting a 32-bit DMA mask, which matches the hardware
capabilities.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Reported-by: Merlijn Wajer <merlijn@wizzup.org>
Closes: https://lore.kernel.org/linux-omap/4ed95c71-2066-6b4c-ad1b-53ef02d79d53@wizzup.org/
Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Link: https://patch.msgid.link/20260724130522.706480-1-ivo.g.dimitrov.75@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hsi/controllers/omap_ssi_core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -502,6 +502,12 @@ static int ssi_probe(struct platform_dev
pm_runtime_enable(&pd->dev);
+ ssi->device.dma_mask = &ssi->device.coherent_dma_mask;
+
+ err = dma_set_mask_and_coherent(&ssi->device, DMA_BIT_MASK(32));
+ if (err)
+ goto out2;
+
err = ssi_hw_init(ssi);
if (err < 0)
goto out2;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 292/713] hugetlb: only adjust reservation during unmapping if mapcount is 0
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 291/713] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 293/713] accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Greg Kroah-Hartman
` (431 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume Morin, Breno Leitao,
Rik van Riel, Muchun Song, David Hildenbrand, Oscar Salvador,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Morin <guillaume@morinfr.org>
commit 5120b1e048d48596ffaec1a8412012a91adba73b upstream.
Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In
the case of folio mapped in both a parent and a child, if the parent
unmaps the range first, the reservation adjustment will result in an
underflow of the reserved count. Once the child unmaps the range, the
count is restored. Change __unmap_hugepage_range() to check the mapcount
before adjusting the reservation.
Link: https://lore.kernel.org/all/alEJkwn5VlTTH_ZX@bender.morinfr.org/
Link: https://lore.kernel.org/amkC_1Ya6OiUoiLZ@bender.morinfr.org
Fixes: df7a6d1f6405 ("mm/hugetlb: restore the reservation if needed")
Signed-off-by: Guillaume Morin <guillaume@morinfr.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5181,6 +5181,7 @@ void __unmap_hugepage_range(struct mmu_g
bool adjust_reservation;
unsigned long last_addr_mask;
+ i_mmap_assert_write_locked(vma->vm_file->f_mapping);
WARN_ON(!is_vm_hugetlb_page(vma));
BUG_ON(start & ~huge_page_mask(h));
BUG_ON(end & ~huge_page_mask(h));
@@ -5272,7 +5273,10 @@ void __unmap_hugepage_range(struct mmu_g
/*
* Restore the reservation for anonymous page, otherwise the
- * backing page could be stolen by someone.
+ * backing page could be stolen by someone. Restore only on the
+ * last unmap, otherwise the owner could empty its resv map
+ * while the folio is still mapped by a child. Note that holding
+ * i_mmap_lock_write is needed to check the number of mappings.
* If there we are freeing a surplus, do not set the restore
* reservation bit.
*/
@@ -5280,7 +5284,7 @@ void __unmap_hugepage_range(struct mmu_g
spin_lock_irq(&hugetlb_lock);
if (!h->surplus_huge_pages && __vma_private_lock(vma) &&
- folio_test_anon(folio)) {
+ !folio_mapped(folio) && folio_test_anon(folio)) {
folio_set_hugetlb_restore_reserve(folio);
/* Reservation to be adjusted after the spin lock */
adjust_reservation = true;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 293/713] accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 292/713] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 294/713] accel/rocket: initialize job domain before cleanup paths Greg Kroah-Hartman
` (430 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Tomeu Vizoso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit a85402bff218f2b8f0d806e46c16c2f3d49cdda7 upstream.
rocket_job_push() allocates a temporary array to hold all input and
output GEM object pointers:
bos = kvmalloc_array(job->in_bo_count + job->out_bo_count,
sizeof(void *), GFP_KERNEL);
memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));
memcpy(&bos[job->in_bo_count], job->out_bos, ...);
Two bugs exist:
1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and
the subsequent memcpy() dereferences it, causing a kernel NULL
pointer dereference.
2. Integer overflow: in_bo_count and out_bo_count are both u32, set
directly from userspace-supplied in_bo_handle_count and
out_bo_handle_count with no prior validation. Their sum is computed
in u32 arithmetic and can wrap to a smaller value, causing the
allocation count passed to kvmalloc_array() to be smaller than
intended. Subsequent uses still operate on the original counts when
copying and locking objects, which may lead to out-of-bounds accesses
on the temporary array.
Fix by using check_add_overflow() to detect count overflow before the
allocation, and adding a NULL check on the allocation result.
Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/r/20260524155716.90955-1-meatuni001@gmail.com
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/rocket/rocket_job.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -8,6 +8,7 @@
#include <drm/drm_gem.h>
#include <drm/rocket_accel.h>
#include <linux/interrupt.h>
+#include <linux/overflow.h>
#include <linux/iommu.h>
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
@@ -188,14 +189,19 @@ static int rocket_job_push(struct rocket
struct rocket_device *rdev = job->rdev;
struct drm_gem_object **bos;
struct ww_acquire_ctx acquire_ctx;
+ u32 bo_count;
int ret = 0;
- bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *),
- GFP_KERNEL);
+ if (check_add_overflow(job->in_bo_count, job->out_bo_count, &bo_count))
+ return -EINVAL;
+
+ bos = kvmalloc_array(bo_count, sizeof(*bos), GFP_KERNEL);
+ if (!bos)
+ return -ENOMEM;
memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));
memcpy(&bos[job->in_bo_count], job->out_bos, job->out_bo_count * sizeof(void *));
- ret = drm_gem_lock_reservations(bos, job->in_bo_count + job->out_bo_count, &acquire_ctx);
+ ret = drm_gem_lock_reservations(bos, bo_count, &acquire_ctx);
if (ret)
goto err;
@@ -220,7 +226,7 @@ static int rocket_job_push(struct rocket
rocket_attach_object_fences(job->out_bos, job->out_bo_count, job->inference_done_fence);
err_unlock:
- drm_gem_unlock_reservations(bos, job->in_bo_count + job->out_bo_count, &acquire_ctx);
+ drm_gem_unlock_reservations(bos, bo_count, &acquire_ctx);
err:
kvfree(bos);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 294/713] accel/rocket: initialize job domain before cleanup paths
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 293/713] accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 295/713] accel/rocket: Fix error path handling in rocket_job_run() Greg Kroah-Hartman
` (429 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuvam Pandey, Tomeu Vizoso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuvam Pandey <shuvampandey1@gmail.com>
commit 70e6a33d68a9b03335c5426332666e52d07f45d6 upstream.
rocket_ioctl_submit_job() releases rjob through rocket_job_put() on
allocation error paths. rocket_job_cleanup() unconditionally calls
rocket_iommu_domain_put(job->domain), but job->domain is assigned only
after task copying and BO lookups. A failure before that assignment can
therefore clean up a job with a NULL domain pointer.
Take the per-file domain reference before the first error path can release
rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so
the common cleanup path cannot free the task array again after a task-copy
error.
Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Link: https://lore.kernel.org/r/6a454b48.6a8fa39a.27019b.984b@mx.google.com
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/rocket/rocket_job.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -103,6 +103,7 @@ rocket_copy_tasks(struct drm_device *dev
fail:
kvfree(rjob->tasks);
+ rjob->tasks = NULL;
return ret;
}
@@ -555,6 +556,7 @@ static int rocket_ioctl_submit_job(struc
kref_init(&rjob->refcount);
rjob->rdev = rdev;
+ rjob->domain = rocket_iommu_domain_get(file_priv);
ret = drm_sched_job_init(&rjob->base,
&file_priv->sched_entity,
@@ -580,8 +582,6 @@ static int rocket_ioctl_submit_job(struc
rjob->out_bo_count = job->out_bo_handle_count;
- rjob->domain = rocket_iommu_domain_get(file_priv);
-
ret = rocket_job_push(rjob);
if (ret)
goto out_cleanup_job;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 295/713] accel/rocket: Fix error path handling in rocket_job_run()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 294/713] accel/rocket: initialize job domain before cleanup paths Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 296/713] acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks Greg Kroah-Hartman
` (428 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ZhaoJinming, Tomeu Vizoso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoJinming <zhaojinming@uniontech.com>
commit 9b2dedadf6a91ac3fc9fae268bb556a041222711 upstream.
In rocket_job_run(), after taking an extra fence reference for
job->done_fence via dma_fence_get(), the error paths have three bugs:
- The dma_fence reference held by job->done_fence is never released,
causing a reference leak.
- pm_runtime_get_sync() increments the usage counter even on failure,
but the error path does not decrement it, leaking the runtime PM
reference and preventing the NPU from suspending.
- A valid but unsignaled fence is returned to the DRM scheduler,
which triggers WARN("Fence ... released with pending signals!")
when the scheduler drops its reference.
Fix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get()
which auto-balances the usage counter on failure, releasing both fence
references on error, and returning ERR_PTR(ret) instead of the
unsignaled fence.
Cc: stable@vger.kernel.org
Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Link: https://lore.kernel.org/r/20260610071045.3414828-1-zhaojinming@uniontech.com
[tomeu: Refactored error paths to use consolidated goto labels]
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/rocket/rocket_job.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -317,13 +317,13 @@ static struct dma_fence *rocket_job_run(
dma_fence_put(job->done_fence);
job->done_fence = dma_fence_get(fence);
- ret = pm_runtime_get_sync(core->dev);
+ ret = pm_runtime_resume_and_get(core->dev);
if (ret < 0)
- return fence;
+ goto err_put_fences;
ret = iommu_attach_group(job->domain->domain, core->iommu_group);
if (ret < 0)
- return fence;
+ goto err_put_pm;
scoped_guard(mutex, &core->job_lock) {
core->in_flight_job = job;
@@ -331,6 +331,14 @@ static struct dma_fence *rocket_job_run(
}
return fence;
+
+err_put_pm:
+ pm_runtime_put(core->dev);
+err_put_fences:
+ dma_fence_put(job->done_fence);
+ job->done_fence = NULL;
+ dma_fence_put(fence);
+ return ERR_PTR(ret);
}
static void rocket_job_handle_irq(struct rocket_core *core)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 296/713] acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 295/713] accel/rocket: Fix error path handling in rocket_job_run() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 297/713] ACPI: APEI: Fix ERST timeout unit conversion Greg Kroah-Hartman
` (427 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Terry Bowman, Dave Jiang,
Jonathan Cameron, Tony Luck
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Bowman <terry.bowman@amd.com>
commit 6625ca499c3131ef63be3215f8f942d7a097ea3a upstream.
The CXL CPER work registration and unregistration helpers acquire
cxl_cper_work_lock and cxl_cper_prot_err_work_lock with a spinlock
guard(), which leaves local interrupts enabled. The corresponding post
paths (cxl_cper_post_event(), cxl_cper_post_prot_err()) execute in hard
IRQ context (they are called from the GHES error notification path) and
acquire the same locks with an irqsave guard().
If a CPU is holding one of these locks via a spinlock guard() when a GHES
interrupt arrives on the same CPU, the IRQ handler spins on the held lock
waiting for it to release, while the lock holder is preempted by the IRQ.
The result is a deadlock.
Convert both locks from spinlock_t to raw_spinlock_t and use guard() at
all call sites. On PREEMPT_RT kernels spinlock_t is backed by rt_mutex and
sleeping from hard IRQ context is not permitted; raw_spinlock_t is safe in
both contexts.
Add WARN_ONCE to both register functions to surface double-registration
bugs at runtime.
Restructure both unregister functions to clear the global work pointer
under the lock before calling cancel_work_sync(), closing the window
where a CPER interrupt could schedule work on a pointer about to be
freed. Add kfifo_reset() after cancel_work_sync() so stale entries
are not replayed on next module load.
Both kfifos are single-consumer: only one work_struct is registered at
a time, enforced by the WARN_ONCE guard in the register functions.
kfifo_reset() is safe outside the lock because cancel_work_sync() has
already quiesced the consumer, and no new consumer can register until
the current module exit completes and a fresh module init runs.
Remove the redundant cancel_work_sync() call from cxl_ras_exit() and
cxl_pci_driver_exit(). The CPER unregister functions now quiesce
the work internally.
Reported-by: Sashiko <sashiko@linuxfoundation.org>
Signed-off-by: Terry Bowman <terry.bowman@amd.com>
Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events")
Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors")
Cc: stable@vger.kernel.org
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://patch.msgid.link/20260803221810.3685703-4-terry.bowman@amd.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/apei/ghes.c | 50 +++++++++++++++++++++++++++++++----------------
drivers/cxl/core/ras.c | 1
drivers/cxl/pci.c | 1
3 files changed, 33 insertions(+), 19 deletions(-)
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -749,7 +749,7 @@ static DEFINE_KFIFO(cxl_cper_prot_err_fi
CXL_CPER_PROT_ERR_FIFO_DEPTH);
/* Synchronize schedule_work() with cxl_cper_prot_err_work changes */
-static DEFINE_SPINLOCK(cxl_cper_prot_err_work_lock);
+static DEFINE_RAW_SPINLOCK(cxl_cper_prot_err_work_lock);
struct work_struct *cxl_cper_prot_err_work;
static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err,
@@ -761,7 +761,7 @@ static void cxl_cper_post_prot_err(struc
if (cxl_cper_sec_prot_err_valid(prot_err))
return;
- guard(spinlock_irqsave)(&cxl_cper_prot_err_work_lock);
+ guard(raw_spinlock_irqsave)(&cxl_cper_prot_err_work_lock);
if (!cxl_cper_prot_err_work)
return;
@@ -780,10 +780,11 @@ static void cxl_cper_post_prot_err(struc
int cxl_cper_register_prot_err_work(struct work_struct *work)
{
- if (cxl_cper_prot_err_work)
- return -EINVAL;
+ guard(raw_spinlock_irqsave)(&cxl_cper_prot_err_work_lock);
- guard(spinlock)(&cxl_cper_prot_err_work_lock);
+ if (WARN_ONCE(cxl_cper_prot_err_work,
+ "CPER-CXL kfifo consumer already registered\n"))
+ return -EINVAL;
cxl_cper_prot_err_work = work;
return 0;
}
@@ -791,11 +792,18 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_register_p
int cxl_cper_unregister_prot_err_work(struct work_struct *work)
{
- if (cxl_cper_prot_err_work != work)
- return -EINVAL;
+ scoped_guard(raw_spinlock_irqsave, &cxl_cper_prot_err_work_lock) {
+ if (WARN_ONCE(cxl_cper_prot_err_work != work,
+ "CPER-CXL kfifo consumer mismatch on unregister\n"))
+ return -EINVAL;
+ cxl_cper_prot_err_work = NULL;
+ }
+
+ cancel_work_sync(work);
+
+ /* Discard stale entries so they are not replayed on next module load */
+ kfifo_reset(&cxl_cper_prot_err_fifo);
- guard(spinlock)(&cxl_cper_prot_err_work_lock);
- cxl_cper_prot_err_work = NULL;
return 0;
}
EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_prot_err_work, "CXL");
@@ -811,7 +819,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_prot_err_k
DEFINE_KFIFO(cxl_cper_fifo, struct cxl_cper_work_data, CXL_CPER_FIFO_DEPTH);
/* Synchronize schedule_work() with cxl_cper_work changes */
-static DEFINE_SPINLOCK(cxl_cper_work_lock);
+static DEFINE_RAW_SPINLOCK(cxl_cper_work_lock);
struct work_struct *cxl_cper_work;
static void cxl_cper_post_event(enum cxl_event_type event_type,
@@ -831,7 +839,7 @@ static void cxl_cper_post_event(enum cxl
return;
}
- guard(spinlock_irqsave)(&cxl_cper_work_lock);
+ guard(raw_spinlock_irqsave)(&cxl_cper_work_lock);
if (!cxl_cper_work)
return;
@@ -849,10 +857,11 @@ static void cxl_cper_post_event(enum cxl
int cxl_cper_register_work(struct work_struct *work)
{
- if (cxl_cper_work)
+ guard(raw_spinlock_irqsave)(&cxl_cper_work_lock);
+ if (WARN_ONCE(cxl_cper_work,
+ "CXL CPER kfifo consumer already registered\n"))
return -EINVAL;
- guard(spinlock)(&cxl_cper_work_lock);
cxl_cper_work = work;
return 0;
}
@@ -860,11 +869,18 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_register_w
int cxl_cper_unregister_work(struct work_struct *work)
{
- if (cxl_cper_work != work)
- return -EINVAL;
+ scoped_guard(raw_spinlock_irqsave, &cxl_cper_work_lock) {
+ if (WARN_ONCE(cxl_cper_work != work,
+ "CXL CPER kfifo consumer mismatch on unregister\n"))
+ return -EINVAL;
+ cxl_cper_work = NULL;
+ }
+
+ cancel_work_sync(work);
+
+ /* Discard stale entries so they are not replayed on next module load */
+ kfifo_reset(&cxl_cper_fifo);
- guard(spinlock)(&cxl_cper_work_lock);
- cxl_cper_work = NULL;
return 0;
}
EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_work, "CXL");
--- a/drivers/cxl/core/ras.c
+++ b/drivers/cxl/core/ras.c
@@ -137,7 +137,6 @@ int cxl_ras_init(void)
void cxl_ras_exit(void)
{
cxl_cper_unregister_prot_err_work(&cxl_cper_prot_err_work);
- cancel_work_sync(&cxl_cper_prot_err_work);
}
static void cxl_dport_map_ras(struct cxl_dport *dport)
--- a/drivers/cxl/pci.c
+++ b/drivers/cxl/pci.c
@@ -1083,7 +1083,6 @@ static int __init cxl_pci_driver_init(vo
static void __exit cxl_pci_driver_exit(void)
{
cxl_cper_unregister_work(&cxl_cper_work);
- cancel_work_sync(&cxl_cper_work);
pci_unregister_driver(&cxl_pci_driver);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 297/713] ACPI: APEI: Fix ERST timeout unit conversion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 296/713] acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 298/713] ACPI: APEI: GHES: fix ARM section length accounting after header Greg Kroah-Hartman
` (426 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Hanjun Guo,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
commit a685d8eea4a6899dc887e393927c16fa18ff5e9a upstream.
The ACPI specification defines bits 63:32 returned by
GET_EXECUTE_OPERATION_TIMINGS as the maximum execution time in
microseconds. erst_get_timeout() instead multiplies the value by
NSEC_PER_MSEC.
Use NSEC_PER_USEC to express the firmware-provided microsecond timeout
in the nanosecond units expected by erst_timedout().
Fixes: fac475aab70b ("ACPI: APEI: Use ERST timeout for slow devices")
Cc: stable@vger.kernel.org
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Link: https://patch.msgid.link/20260721182551.2434933-1-nirmoyd@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/apei/erst.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -108,7 +108,7 @@ static inline u64 erst_get_timeout(void)
if (erst_erange.attr & ERST_RANGE_SLOW) {
timeout = ((erst_erange.timings & ERST_EXEC_TIMING_MAX_MASK) >>
- ERST_EXEC_TIMING_MAX_SHIFT) * NSEC_PER_MSEC;
+ ERST_EXEC_TIMING_MAX_SHIFT) * NSEC_PER_USEC;
if (timeout < FIRMWARE_TIMEOUT)
timeout = FIRMWARE_TIMEOUT;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 298/713] ACPI: APEI: GHES: fix ARM section length accounting after header
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 297/713] ACPI: APEI: Fix ERST timeout unit conversion Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 299/713] ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ Greg Kroah-Hartman
` (425 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, TanZheng, Shuai Xue,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: TanZheng <tanzheng@kylinos.cn>
commit 903308ea40adf0577d82eab69882faf8836326ce upstream.
In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
header with (err + 1), the remaining length was reduced by sizeof(err)
(pointer size) instead of sizeof(*err) (structure size).
That overestimates the bytes left for cper_arm_err_info records and can
let the parser read past the CPER section when err_info_num is large
enough relative to error_data_length.
Use sizeof(*err) so the length accounting matches the pointer advance
and the earlier sizeof(*err) size check.
Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Cc: stable@vger.kernel.org
Signed-off-by: TanZheng <tanzheng@kylinos.cn>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Link: https://patch.msgid.link/20260806010944.32384-1-kensanya@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/apei/ghes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -576,7 +576,7 @@ static bool ghes_handle_arm_hw_error(str
return false;
p = (char *)(err + 1);
- length -= sizeof(err);
+ length -= sizeof(*err);
for (i = 0; i < err->err_info_num; i++) {
struct cper_arm_err_info *err_info;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 299/713] ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 298/713] ACPI: APEI: GHES: fix ARM section length accounting after header Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 300/713] ACPI: CPPC: Skip desired_perf read in cppc_get_perf() Greg Kroah-Hartman
` (424 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Gupta, Christian Loehle,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <christian.loehle@arm.com>
commit df5a1d4a8cdfda20eb2581a85e81c7d436866534 upstream.
When CPPC feedback counters cannot provide a usable sample, cppc-cpufreq
calls cppc_get_desired_perf() because some platforms repurpose Desired
Performance to report actual delivered performance.
ACPI 6.5 defines _CPC revision 3 and lists Read/Write as the Optional
Attribute of Desired Performance. ACPI 6.6 advances _CPC to revision 4 and
lists only Write, so invoking that workaround for revision 4 or later would
require a register read that the interface no longer specifies.
Make cppc_get_desired_perf() return -EOPNOTSUPP for _CPC revision 4 or
later. Use the revision retained in the per-CPU CPC descriptor rather than
the platform-wide FADT revision.
The _CPC revision may still not accurately describe the implemented
register semantics. If a nominally revision 3 platform implements a
non-readable Desired Performance register, a read may return zero and make
cppc_cpufreq_get_rate() report 0 kHz. Treat a zero read as unusable and
fall back to the cached OSPM request, just as for a failed read.
Fixes: c47195631960 ("cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged")
Cc: stable@vger.kernel.org
Suggested-by: Sumit Gupta <sumitg@nvidia.com>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Link: https://patch.msgid.link/20260803203531.1268651-2-christian.loehle@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/cppc_acpi.c | 17 ++++++++++++++++-
drivers/cpufreq/cppc_cpufreq.c | 2 +-
2 files changed, 17 insertions(+), 2 deletions(-)
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1316,15 +1316,30 @@ static int cppc_set_reg_val(int cpu, enu
return cpc_write(cpu, reg, val);
}
+static bool cppc_desired_perf_readable(const struct cpc_desc *cpc_desc)
+{
+ return cpc_desc->version < CPPC_V4_REV;
+}
+
/**
* cppc_get_desired_perf - Get the desired performance register value.
* @cpunum: CPU from which to get desired performance.
* @desired_perf: Return address.
*
- * Return: 0 for success, -EIO otherwise.
+ * Return: 0 for success, -EOPNOTSUPP for _CPC revision 4 or later, and a
+ * negative errno otherwise.
*/
int cppc_get_desired_perf(int cpunum, u64 *desired_perf)
{
+ struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpunum);
+
+ if (!cpc_desc)
+ return -ENODEV;
+
+ /* _CPC revision 4 no longer specifies Desired Performance as readable. */
+ if (!cppc_desired_perf_readable(cpc_desc))
+ return -EOPNOTSUPP;
+
return cppc_get_reg_val(cpunum, DESIRED_PERF, desired_perf);
}
EXPORT_SYMBOL_GPL(cppc_get_desired_perf);
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -836,7 +836,7 @@ out_invalid_counters:
* value first as some platforms may update the actual delivered perf
* there; if failed, resort to the cached desired perf.
*/
- if (cppc_get_desired_perf(cpu, &delivered_perf))
+ if (cppc_get_desired_perf(cpu, &delivered_perf) || !delivered_perf)
delivered_perf = cpu_data->perf_ctrls.desired_perf;
return cppc_perf_to_khz(&cpu_data->perf_caps, delivered_perf);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 300/713] ACPI: CPPC: Skip desired_perf read in cppc_get_perf()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 299/713] ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 301/713] ACPI: pfr_update: fix stack buffer overflow in query_capability() Greg Kroah-Hartman
` (423 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Christian Loehle,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <christian.loehle@arm.com>
commit d3576424e8fa702a15a1963718a07eb672db9be7 upstream.
ACPI 6.5 defines _CPC revision 3 and lists Read/Write as the Optional
Attribute of Desired Performance. ACPI 6.6 advances _CPC to revision 4 and
lists only Write. cppc_get_perf() nevertheless reads the register when
initializing performance controls, even though cppc-cpufreq overwrites the
value before using it.
Use the _CPC revision check from cppc_get_desired_perf() and leave
desired_perf zero instead of reading it for _CPC revision 4 or later. Also
exclude the register from PCC read-command detection so it cannot trigger
an otherwise unnecessary read command.
Fixes: 658fa7b1c47a ("ACPI: CPPC: Add cppc_get_perf() API to read performance controls")
Cc: stable@vger.kernel.org
Suggested-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Link: https://patch.msgid.link/20260803203531.1268651-3-christian.loehle@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/cppc_acpi.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 42aeb749ebe0..becb7e442b30 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1845,12 +1845,14 @@ int cppc_get_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
u64 desired_perf = 0, min = 0, max = 0, energy_perf = 0, auto_sel = 0;
int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
struct cppc_pcc_data *pcc_ss_data = NULL;
+ bool read_desired_perf;
int ret = 0, regs_in_pcc = 0;
if (!cpc_desc) {
pr_debug("No CPC descriptor for CPU:%d\n", cpu);
return -ENODEV;
}
+ read_desired_perf = cppc_desired_perf_readable(cpc_desc);
if (!perf_ctrls) {
pr_debug("Invalid perf_ctrls pointer\n");
@@ -1864,7 +1866,8 @@ int cppc_get_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
auto_sel_reg = &cpc_desc->cpc_regs[AUTO_SEL_ENABLE];
/* Are any of the regs PCC ?*/
- if (CPC_IN_PCC(desired_perf_reg) || CPC_IN_PCC(min_perf_reg) ||
+ if ((read_desired_perf && CPC_IN_PCC(desired_perf_reg)) ||
+ CPC_IN_PCC(min_perf_reg) ||
CPC_IN_PCC(max_perf_reg) || CPC_IN_PCC(energy_perf_reg) ||
CPC_IN_PCC(auto_sel_reg)) {
if (pcc_ss_id < 0) {
@@ -1896,7 +1899,7 @@ int cppc_get_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
}
perf_ctrls->min_perf = min;
- if (CPC_SUPPORTED(desired_perf_reg)) {
+ if (read_desired_perf && CPC_SUPPORTED(desired_perf_reg)) {
ret = cpc_read(cpu, desired_perf_reg, &desired_perf);
if (ret)
goto out_err;
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 301/713] ACPI: pfr_update: fix stack buffer overflow in query_capability()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 300/713] ACPI: CPPC: Skip desired_perf read in cppc_get_perf() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 302/713] ACPI: scan: Avoid registering platform devices with resource overlaps Greg Kroah-Hartman
` (422 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anirudh Prasad, Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anirudh Prasad <icarus@a0rg.com>
commit ced45be0073a8a31b30b4a7f68cd3a15734515de upstream.
query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:
memcpy(&cap_hdr->code_type,
elements[CAP_CODE_TYPE_IDX].buffer.pointer,
elements[CAP_CODE_TYPE_IDX].buffer.length);
The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.
struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.
Introduce a helper pointer to out_obj->package.elements and use it
to validate each buffer length against its destination field size
before copying, returning -EINVAL if the firmware supplies an
oversized buffer.
Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
Link: https://patch.msgid.link/1a001e1fee9.637da6dc3533246.238498880682901704@a0rg.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/pfr_update.c | 45 ++++++++++++++++++++++++---------------------
1 file changed, 24 insertions(+), 21 deletions(-)
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -120,7 +120,7 @@ static int query_capability(struct pfru_
struct pfru_device *pfru_dev)
{
acpi_handle handle = ACPI_HANDLE(pfru_dev->parent_dev);
- union acpi_object *out_obj;
+ union acpi_object *out_obj, *elem;
int ret = -EINVAL;
out_obj = acpi_evaluate_dsm_typed(handle, &pfru_guid,
@@ -150,7 +150,9 @@ static int query_capability(struct pfru_
goto free_acpi_buffer;
}
- cap_hdr->status = out_obj->package.elements[CAP_STATUS_IDX].integer.value;
+ elem = out_obj->package.elements;
+
+ cap_hdr->status = elem[CAP_STATUS_IDX].integer.value;
if (cap_hdr->status != DSM_SUCCEED) {
ret = -EBUSY;
dev_dbg(pfru_dev->parent_dev, "Query cap Error Status:%d\n",
@@ -158,29 +160,30 @@ static int query_capability(struct pfru_
goto free_acpi_buffer;
}
- cap_hdr->update_cap = out_obj->package.elements[CAP_UPDATE_IDX].integer.value;
+ if (elem[CAP_CODE_TYPE_IDX].buffer.length > sizeof(cap_hdr->code_type) ||
+ elem[CAP_DRV_TYPE_IDX].buffer.length > sizeof(cap_hdr->drv_type) ||
+ elem[CAP_PLAT_ID_IDX].buffer.length > sizeof(cap_hdr->platform_id) ||
+ elem[CAP_OEM_ID_IDX].buffer.length > sizeof(cap_hdr->oem_id))
+ goto free_acpi_buffer;
+
+ cap_hdr->update_cap = elem[CAP_UPDATE_IDX].integer.value;
memcpy(&cap_hdr->code_type,
- out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.pointer,
- out_obj->package.elements[CAP_CODE_TYPE_IDX].buffer.length);
- cap_hdr->fw_version =
- out_obj->package.elements[CAP_FW_VER_IDX].integer.value;
- cap_hdr->code_rt_version =
- out_obj->package.elements[CAP_CODE_RT_VER_IDX].integer.value;
+ elem[CAP_CODE_TYPE_IDX].buffer.pointer,
+ elem[CAP_CODE_TYPE_IDX].buffer.length);
+ cap_hdr->fw_version = elem[CAP_FW_VER_IDX].integer.value;
+ cap_hdr->code_rt_version = elem[CAP_CODE_RT_VER_IDX].integer.value;
memcpy(&cap_hdr->drv_type,
- out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.pointer,
- out_obj->package.elements[CAP_DRV_TYPE_IDX].buffer.length);
- cap_hdr->drv_rt_version =
- out_obj->package.elements[CAP_DRV_RT_VER_IDX].integer.value;
- cap_hdr->drv_svn =
- out_obj->package.elements[CAP_DRV_SVN_IDX].integer.value;
+ elem[CAP_DRV_TYPE_IDX].buffer.pointer,
+ elem[CAP_DRV_TYPE_IDX].buffer.length);
+ cap_hdr->drv_rt_version = elem[CAP_DRV_RT_VER_IDX].integer.value;
+ cap_hdr->drv_svn = elem[CAP_DRV_SVN_IDX].integer.value;
memcpy(&cap_hdr->platform_id,
- out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.pointer,
- out_obj->package.elements[CAP_PLAT_ID_IDX].buffer.length);
+ elem[CAP_PLAT_ID_IDX].buffer.pointer,
+ elem[CAP_PLAT_ID_IDX].buffer.length);
memcpy(&cap_hdr->oem_id,
- out_obj->package.elements[CAP_OEM_ID_IDX].buffer.pointer,
- out_obj->package.elements[CAP_OEM_ID_IDX].buffer.length);
- cap_hdr->oem_info_len =
- out_obj->package.elements[CAP_OEM_INFO_IDX].buffer.length;
+ elem[CAP_OEM_ID_IDX].buffer.pointer,
+ elem[CAP_OEM_ID_IDX].buffer.length);
+ cap_hdr->oem_info_len = elem[CAP_OEM_INFO_IDX].buffer.length;
ret = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 302/713] ACPI: scan: Avoid registering platform devices with resource overlaps
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 301/713] ACPI: pfr_update: fix stack buffer overflow in query_capability() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 303/713] ACPI: TAD: Add locking around AML evaluations Greg Kroah-Hartman
` (421 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julien, Paul Menzel, Andy Shevchenko,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit f234fdaae1cad8c39265e7ca0a14633076ec7154 upstream.
If acpi_dev_get_resources() returns overlapping I/O or memory resources,
the subsequent registration of a platform device will fail with -EBUSY
due to a resource conflict. This is reported to happen on Acer Aspire
ES1-572 [1].
Avoid that by adjusting resources returned by acpi_dev_get_resources()
to eliminate partial overlaps between them.
This has not been regarded as necessary before because putting
overlapping resources into the _CRS of one device is really pointless,
but now that the issue has been reported to actually happen in the
field, it needs to be done.
Fixes: ab06eb920401 ("ACPI: scan: Register platform devices for fixed event buttons")
Fixes: 48fe2cddc85c ("tpm_crb: Convert ACPI driver to a platform one")
Reported-by: Julien <julien82453@gmail.com>
Tested-by: Julien <julien82453@gmail.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Closes: https://lore.kernel.org/linux-integrity/CAJOGg3z6LJPDsdPNBxajgy8_wQxfhYBRxe4EiurZf3kPU5A5Bw@mail.gmail.com/ [1]
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ rjw: Tweaked the new message ]
Link: https://patch.msgid.link/12955541.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_platform.c | 39 ++++++++++++++++++++++++++++++++++--
1 file changed, 37 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index a09636a4168e..373c94de7590 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -12,6 +12,7 @@
#include <linux/bits.h>
#include <linux/device.h>
#include <linux/err.h>
+#include <linux/ioport.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/dma-mapping.h>
@@ -71,6 +72,36 @@ static struct notifier_block acpi_platform_notifier = {
.notifier_call = acpi_platform_device_remove_notify,
};
+static unsigned int acpi_platform_adjust_resources(struct acpi_device *adev,
+ struct resource *new_res,
+ struct resource *resources,
+ unsigned int count)
+{
+ unsigned int i;
+
+ if (!(new_res->flags & (IORESOURCE_IO | IORESOURCE_MEM)))
+ return count;
+
+ for (i = 0; i < count; ) {
+ struct resource *res = &resources[i];
+
+ if (resource_type(new_res) != resource_type(res) ||
+ !resource_union(new_res, res, new_res)) {
+ i++;
+ continue;
+ }
+
+ dev_info(&adev->dev, "%pR expanded due to overlap\n", new_res);
+ /*
+ * Eliminate the previously processed resource that overlapped
+ * with the new one because it is not necessary any more.
+ */
+ memmove(res, res + 1, (--count - i) * sizeof(*res));
+ }
+
+ return count;
+}
+
static void acpi_platform_fill_resource(struct acpi_device *adev,
const struct resource *src, struct resource *dest)
{
@@ -151,10 +182,14 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
return ERR_PTR(-ENOMEM);
}
count = 0;
- list_for_each_entry(rentry, &resource_list, node)
+ list_for_each_entry(rentry, &resource_list, node) {
+ count = acpi_platform_adjust_resources(adev,
+ rentry->res,
+ resources,
+ count);
acpi_platform_fill_resource(adev, rentry->res,
&resources[count++]);
-
+ }
acpi_dev_free_resource_list(&resource_list);
}
}
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 303/713] ACPI: TAD: Add locking around AML evaluations
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 302/713] ACPI: scan: Avoid registering platform devices with resource overlaps Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 304/713] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Greg Kroah-Hartman
` (420 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit a3df8bbe0a704fa5c1609b9666b594f350558fe0 upstream.
In the ACPI TAD driver, there are hidden assumptions that the ACPI
control methods used by it will not be evaluated concurrently due
to ACPICA namespace and interpreter locking.
However, that may not be the case since ACPICA may drop and re-acquire
the namespace and interpreter locks during the evaluation of a given
object in a few cases, including the one in which the AML in question
sleeps causing acpi_ex_system_do_sleep() to be called. In that case,
the evaluation of one control method may be started while the
evaluation of another one is still in progress.
For this reason, add a global lock to the ACPI TAD driver and
acquire it every time before evaluating an ACPI control method,
except for the initial evaluation of _GCP in acpi_tad_probe().
Fixes: 95c513ec84f7 ("ACPI: Add Time and Alarm Device (TAD) driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/12951141.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_tad.c | 48 +++++++++++++++++++++++++++++-------------------
1 file changed, 29 insertions(+), 19 deletions(-)
--- a/drivers/acpi/acpi_tad.c
+++ b/drivers/acpi/acpi_tad.c
@@ -27,6 +27,7 @@
#include <linux/kernel.h>
#include <linux/ktime.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
#include <linux/rtc.h>
@@ -86,6 +87,8 @@ static bool acpi_tad_rt_is_invalid(struc
rt->daylight > 3;
}
+static DEFINE_MUTEX(acpi_tad_aml_lock);
+
static int acpi_tad_set_real_time(struct device *dev, struct acpi_tad_rt *rt)
{
acpi_handle handle = ACPI_HANDLE(dev);
@@ -113,6 +116,8 @@ static int acpi_tad_set_real_time(struct
if (PM_RUNTIME_ACQUIRE_ERR(&pm))
return -ENXIO;
+ guard(mutex)(&acpi_tad_aml_lock);
+
status = acpi_evaluate_integer(handle, "_SRT", &arg_list, &retval);
if (ACPI_FAILURE(status) || retval)
return -EIO;
@@ -124,30 +129,27 @@ static int acpi_tad_evaluate_grt(struct
{
acpi_handle handle = ACPI_HANDLE(dev);
struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER };
- union acpi_object *out_obj;
- struct acpi_tad_rt *data;
acpi_status status;
int ret = -EIO;
- status = acpi_evaluate_object(handle, "_GRT", NULL, &output);
- if (ACPI_FAILURE(status))
- goto out_free;
-
- out_obj = output.pointer;
- if (out_obj->type != ACPI_TYPE_BUFFER)
- goto out_free;
-
- if (out_obj->buffer.length != sizeof(*rt))
- goto out_free;
-
- data = (struct acpi_tad_rt *)(out_obj->buffer.pointer);
- if (!data->valid)
- goto out_free;
+ guard(mutex)(&acpi_tad_aml_lock);
- memcpy(rt, data, sizeof(*rt));
- ret = 0;
+ status = acpi_evaluate_object(handle, "_GRT", NULL, &output);
+ if (ACPI_SUCCESS(status)) {
+ union acpi_object *out_obj;
-out_free:
+ out_obj = output.pointer;
+ if (out_obj->type == ACPI_TYPE_BUFFER &&
+ out_obj->buffer.length == sizeof(*rt)) {
+ struct acpi_tad_rt *data;
+
+ data = (struct acpi_tad_rt *)(out_obj->buffer.pointer);
+ if (data->valid) {
+ memcpy(rt, data, sizeof(*rt));
+ ret = 0;
+ }
+ }
+ }
ACPI_FREE(output.pointer);
return ret;
}
@@ -193,6 +195,8 @@ static int __acpi_tad_wake_set(struct de
args[0].integer.value = timer_id;
args[1].integer.value = value;
+ guard(mutex)(&acpi_tad_aml_lock);
+
status = acpi_evaluate_integer(handle, method, &arg_list, &retval);
if (ACPI_FAILURE(status) || retval)
return -EIO;
@@ -215,6 +219,8 @@ static int __acpi_tad_wake_read(struct d
args[0].integer.value = timer_id;
+ guard(mutex)(&acpi_tad_aml_lock);
+
status = acpi_evaluate_integer(handle, method, &arg_list, retval);
if (ACPI_FAILURE(status))
return -EIO;
@@ -416,6 +422,8 @@ static int acpi_tad_clear_status(struct
if (PM_RUNTIME_ACQUIRE_ERR(&pm))
return -ENXIO;
+ guard(mutex)(&acpi_tad_aml_lock);
+
status = acpi_evaluate_integer(handle, "_CWS", &arg_list, &retval);
if (ACPI_FAILURE(status) || retval)
return -EIO;
@@ -456,6 +464,8 @@ static ssize_t acpi_tad_status_read(stru
if (PM_RUNTIME_ACQUIRE_ERR(&pm))
return -ENXIO;
+ guard(mutex)(&acpi_tad_aml_lock);
+
status = acpi_evaluate_integer(handle, "_GWS", &arg_list, &retval);
if (ACPI_FAILURE(status))
return -EIO;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 304/713] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 303/713] ACPI: TAD: Add locking around AML evaluations Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 305/713] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Greg Kroah-Hartman
` (419 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 651fb94aaf245430590216d497fb8b02dd73d5f9 upstream.
pci_legacy_write() in arch/alpha/kernel/pci-sysfs.c passes its arguments to
outb(), outw() and outl() in the wrong order:
outb(port, val);
The Alpha I/O accessors in arch/alpha/include/asm/io.h take the value first
and the port second:
extern void outb(u8 b, unsigned long port);
So the port number is written as data to the I/O address taken from the
user-supplied value, and the intended write to the requested port never
happens.
The arguments have been reversed since the file was added, and the function
returns the access size regardless, so the caller sees success while the
requested port is left untouched.
Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260706175423.98305-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/pci-sysfs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -224,17 +224,17 @@ int pci_legacy_write(struct pci_bus *bus
switch(size) {
case 1:
- outb(port, val);
+ outb(val, port);
return 1;
case 2:
if (port & 1)
return -EINVAL;
- outw(port, val);
+ outw(val, port);
return 2;
case 4:
if (port & 3)
return -EINVAL;
- outl(port, val);
+ outl(val, port);
return 4;
}
return -EINVAL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 305/713] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 304/713] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 306/713] alpha: marvel: Fix lock ordering in init_io7_irqs() Greg Kroah-Hartman
` (418 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 3a3ac1f6c6a67b3803f2643584310f78301e58a8 upstream.
Pass base + i to irq_set_status_flags() to match the IRQ number
used in irq_set_chip_and_handler(). Previously, IRQ_LEVEL was set
on the wrong (low-numbered) IRQ descriptors rather than the IO7
IRQs at base + i.
Cc: stable@vger.kernel.org
Fixes: 08876fe8519c ("alpha: marvel: Convert irq_chip functions")
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260528230516.1839694-1-mattst88@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/sys_marvel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -275,7 +275,7 @@ init_io7_irqs(struct io7 *io7,
/* Set up the lsi irqs. */
for (i = 0; i < 128; ++i) {
irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
- irq_set_status_flags(i, IRQ_LEVEL);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
}
/* Disable the implemented irqs in hardware. */
@@ -289,7 +289,7 @@ init_io7_irqs(struct io7 *io7,
/* Set up the msi irqs. */
for (i = 128; i < (128 + 512); ++i) {
irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
- irq_set_status_flags(i, IRQ_LEVEL);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
}
for (i = 0; i < 16; ++i)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 306/713] alpha: marvel: Fix lock ordering in init_io7_irqs()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 305/713] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 307/713] ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Greg Kroah-Hartman
` (417 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 24d68db713d63dfe3660c56b50e887784844baea upstream.
Move irq_set_chip_and_handler() and irq_set_status_flags() calls
outside the io7->irq_lock raw spinlock. These functions take
sparse_irq_lock, which is a mutex, and taking a sleeping lock while
holding a raw spinlock is invalid. The raw spinlock only needs to
protect the hardware CSR accesses.
This fixes the following lockdep splat during boot:
[ BUG: Invalid wait context ]
swapper/0/0 is trying to lock:
sparse_irq_lock{....}-{4:4}, at: irq_mark_irq
other info that might help us debug this:
context-{5:5}
1 lock held by swapper/0/0:
#0: &io7->irq_lock{....}-{2:2}, at: init_io7_irqs.constprop.0
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260528230516.1839694-2-mattst88@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/sys_marvel.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -263,6 +263,18 @@ init_io7_irqs(struct io7 *io7,
*/
printk(" Interrupts reported to CPU at PE %u\n", boot_cpuid);
+ /* Set up the lsi irqs. */
+ for (i = 0; i < 128; ++i) {
+ irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
+ }
+
+ /* Set up the msi irqs. */
+ for (i = 128; i < (128 + 512); ++i) {
+ irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
+ }
+
raw_spin_lock(&io7->irq_lock);
/* set up the error irqs */
@@ -272,12 +284,6 @@ init_io7_irqs(struct io7 *io7,
io7_redirect_irq(io7, &io7->csrs->STV_CTL.csr, boot_cpuid);
io7_redirect_irq(io7, &io7->csrs->HEI_CTL.csr, boot_cpuid);
- /* Set up the lsi irqs. */
- for (i = 0; i < 128; ++i) {
- irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
- irq_set_status_flags(base + i, IRQ_LEVEL);
- }
-
/* Disable the implemented irqs in hardware. */
for (i = 0; i < 0x60; ++i)
init_one_io7_lsi(io7, i, boot_cpuid);
@@ -285,13 +291,6 @@ init_io7_irqs(struct io7 *io7,
init_one_io7_lsi(io7, 0x74, boot_cpuid);
init_one_io7_lsi(io7, 0x75, boot_cpuid);
-
- /* Set up the msi irqs. */
- for (i = 128; i < (128 + 512); ++i) {
- irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
- irq_set_status_flags(base + i, IRQ_LEVEL);
- }
-
for (i = 0; i < 16; ++i)
init_one_io7_msi(io7, i, boot_cpuid);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 307/713] ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 306/713] alpha: marvel: Fix lock ordering in init_io7_irqs() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 308/713] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Greg Kroah-Hartman
` (416 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ethan Nelson-Moore, Linus Walleij,
Russell King
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
commit 7e8ee82e69fde9d589272ec5e6f702358903be1f upstream.
The eBPF JIT unconditionally generates ldrh/strh instructions, which do
not function correctly on the Risc PC because its bus is unable to
signal half-word accesses. Work around this issue by disabling the eBPF
JIT when building for ARMv3 (the Risc PC is the only currently
supported machine whose kernel is built for ARMv3).
Comments from Ethan Nelson-Moore:
From LKML: https://lore.kernel.org/all/CAD++jL=0qYGoygUwGEXQL7C_ROnC7kfpRv8RA+H5tNWwYu+pQA@mail.gmail.com/
The commit message has been updated slightly relative to the version on LKML to clarify that the Risc PC is not actually ARMv3.
Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -98,7 +98,7 @@ config ARM
select HAVE_ARCH_TRACEHOOK
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if ARM_LPAE
select HAVE_ARM_SMCCC if CPU_V7
- select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32
+ select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 && !CPU_32v3
select HAVE_CONTEXT_TRACKING_USER
select HAVE_C_RECORDMCOUNT
select HAVE_BUILDTIME_MCOUNT_SORT
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 308/713] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 307/713] ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 309/713] auxdisplay: charlcd: cancel backlight work on registration failure Greg Kroah-Hartman
` (415 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Niklas Cassel,
Damien Le Moal
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 79cce911e623c0baa0fde307ce3a434e084b881a upstream.
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the
UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM
descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte
ata_scsi_rbuf staging buffer, and the number of bytes copied is compared
against the logical sector size by the caller:
size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
if (size != len) /* len == sdp->sector_size */
goto invalid_param_len;
ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE
(2048). On a device whose logical sector size exceeds that (e.g. a 4Kn
device, where sector_size == 4096) the function can never return more than
2048, while the caller expects it to return sector_size. The comparison
therefore always fails, so every TRIM is rejected with "Parameter list
length error" and WARN_ON() splats on each attempt. TRIM / discard is
thus completely broken on such devices.
The descriptor was incorrectly sized from the logical sector size. A DSM
TRIM payload is a list of 512-byte pages, each holding up to
ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical
sector size. The Block Limits VPD page already advertises a single such
page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical
blocks), so the block layer never sends a request that needs more than one
page.
Emit exactly one 512-byte page, independent of the logical sector size,
and transfer only that page (COUNT == 1). For a 512-byte-sector device
this is unchanged; devices with larger logical sectors now work instead of
failing every TRIM.
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Fixes: ef2d7392c4ec ("libata: SCT Write Same / DSM Trim")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3545,17 +3545,13 @@ static unsigned int ata_scsi_pass_thru(s
static size_t ata_format_dsm_trim_descr(struct scsi_cmnd *cmd, u32 trmax,
u64 sector, u32 count)
{
- struct scsi_device *sdp = cmd->device;
- size_t len = sdp->sector_size;
+ size_t len = ATA_SECT_SIZE;
size_t r;
__le64 *buf;
u32 i = 0;
unsigned long flags;
- WARN_ON(len > ATA_SCSI_RBUF_SIZE);
-
- if (len > ATA_SCSI_RBUF_SIZE)
- len = ATA_SCSI_RBUF_SIZE;
+ BUILD_BUG_ON(ATA_SECT_SIZE > ATA_SCSI_RBUF_SIZE);
spin_lock_irqsave(&ata_scsi_rbuf_lock, flags);
buf = ((void *)ata_scsi_rbuf);
@@ -3590,13 +3586,11 @@ static unsigned int ata_scsi_write_same_
{
struct ata_taskfile *tf = &qc->tf;
struct scsi_cmnd *scmd = qc->scsicmd;
- struct scsi_device *sdp = scmd->device;
- size_t len = sdp->sector_size;
struct ata_device *dev = qc->dev;
const u8 *cdb = scmd->cmnd;
u64 block;
u32 n_block;
- const u32 trmax = len >> 3;
+ const u32 trmax = ATA_MAX_TRIM_RNUM;
u32 size;
u16 fp;
u8 bp = 0xff;
@@ -3640,13 +3634,13 @@ static unsigned int ata_scsi_write_same_
goto invalid_param_len;
/*
- * size must match sector size in bytes
- * For DATA SET MANAGEMENT TRIM in ACS-2 nsect (aka count)
- * is defined as number of 512 byte blocks to be transferred.
+ * The TRIM descriptor is a single 512-byte page, which is the maximum
+ * WRITE SAME length advertised in the Block Limits VPD page. For DATA
+ * SET MANAGEMENT TRIM the COUNT field (aka nsect) is the number of
+ * 512-byte blocks to be transferred.
*/
-
size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
- if (size != len)
+ if (size != ATA_SECT_SIZE)
goto invalid_param_len;
if (ata_ncq_enabled(dev) && ata_fpdma_dsm_supported(dev)) {
@@ -3672,6 +3666,12 @@ static unsigned int ata_scsi_write_same_
ATA_TFLAG_WRITE;
ata_qc_set_pc_nbytes(qc);
+ /*
+ * The DSM TRIM payload is a single 512-byte page, which may be smaller
+ * than the WRITE SAME data-out buffer (one logical block); only
+ * transfer that page so the length matches the COUNT field.
+ */
+ qc->nbytes = size;
return 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 309/713] auxdisplay: charlcd: cancel backlight work on registration failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 308/713] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 310/713] backlight: aw99706: Fix DT property names to match binding Greg Kroah-Hartman
` (414 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Hongyan Xu,
Andy Shevchenko
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
commit e3e3bf40916c1e810df03958cfa7ba6883cdce79 upstream.
With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
charlcd_register() calls misc_register(). If registration fails, the
caller frees the charlcd object while delayed work still contains its
address.
Add charlcd_deinit() to cancel the delayed work and turn the backlight
off. Use it for both registration rollback and normal unregistration.
Fixes: 39f8ea46724e ("auxdisplay: charlcd: Extract character LCD core from misc/panel")
Cc: stable@vger.kernel.org
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/auxdisplay/charlcd.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -595,6 +595,16 @@ static int charlcd_init(struct charlcd *
return 0;
}
+static void charlcd_deinit(struct charlcd *lcd)
+{
+ struct charlcd_priv *priv = charlcd_to_priv(lcd);
+
+ if (lcd->ops->backlight) {
+ cancel_delayed_work_sync(&priv->bl_work);
+ lcd->ops->backlight(lcd, CHARLCD_OFF);
+ }
+}
+
struct charlcd *charlcd_alloc(unsigned int drvdata_size)
{
struct charlcd_priv *priv;
@@ -654,8 +664,10 @@ int charlcd_register(struct charlcd *lcd
return ret;
ret = misc_register(&charlcd_dev);
- if (ret)
+ if (ret) {
+ charlcd_deinit(lcd);
return ret;
+ }
the_charlcd = lcd;
register_reboot_notifier(&panel_notifier);
@@ -665,16 +677,11 @@ EXPORT_SYMBOL_GPL(charlcd_register);
int charlcd_unregister(struct charlcd *lcd)
{
- struct charlcd_priv *priv = charlcd_to_priv(lcd);
-
unregister_reboot_notifier(&panel_notifier);
charlcd_puts(lcd, "\x0cLCD driver unloaded.\x1b[Lc\x1b[Lb\x1b[L-");
misc_deregister(&charlcd_dev);
the_charlcd = NULL;
- if (lcd->ops->backlight) {
- cancel_delayed_work_sync(&priv->bl_work);
- priv->lcd.ops->backlight(&priv->lcd, CHARLCD_OFF);
- }
+ charlcd_deinit(lcd);
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 310/713] backlight: aw99706: Fix DT property names to match binding
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 309/713] auxdisplay: charlcd: cancel backlight work on registration failure Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 311/713] backlight: aw99706: Honor the core blank state in update_status() Greg Kroah-Hartman
` (413 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junjie Cao,
Daniel Thompson (RISCstar), Lee Jones
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@linux.dev>
commit daf120e464386f750b3870dc04d5bc6a786f0000 upstream.
The driver reads four tuning properties without the unit suffixes that
the binding mandates: "awinic,sw-freq" instead of "awinic,sw-freq-hz",
"awinic,sw-ilmt" instead of "awinic,sw-ilmt-microamp", "awinic,iled-max"
instead of "awinic,iled-max-microamp", and "awinic,uvlo-thres" instead
of "awinic,uvlo-thres-microvolt".
As a result, device_property_read_u32() never finds these properties in
a binding-conformant device tree and silently falls back to the compiled-in
defaults for switching frequency, switching current limit, max LED current,
and UVLO threshold.
Fix by aligning the property name strings in aw99706_dt_props[] with the
binding. No value/range changes are needed since both sides already use
the same units and enumerations.
Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight")
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260804030255.1934470-2-junjie.cao@intel.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/aw99706.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/video/backlight/aw99706.c
+++ b/drivers/video/backlight/aw99706.c
@@ -130,23 +130,23 @@ static const struct aw99706_dt_prop aw99
AW99706_CFG0_REG, AW99706_DIM_MODE_MASK, 1,
},
{
- "awinic,sw-freq", aw99706_dt_property_lookup,
+ "awinic,sw-freq-hz", aw99706_dt_property_lookup,
aw99706_sw_freq_tbl, ARRAY_SIZE(aw99706_sw_freq_tbl),
AW99706_CFG1_REG, AW99706_SW_FREQ_MASK, 750000,
},
{
- "awinic,sw-ilmt", aw99706_dt_property_lookup,
+ "awinic,sw-ilmt-microamp", aw99706_dt_property_lookup,
aw99706_sw_ilmt_tbl, ARRAY_SIZE(aw99706_sw_ilmt_tbl),
AW99706_CFG1_REG, AW99706_SW_ILMT_MASK, 3000000,
},
{
- "awinic,iled-max", aw99706_dt_property_iled_max_convert,
+ "awinic,iled-max-microamp", aw99706_dt_property_iled_max_convert,
NULL, 0,
AW99706_CFG2_REG, AW99706_ILED_MAX_MASK, 20000,
},
{
- "awinic,uvlo-thres", aw99706_dt_property_lookup,
+ "awinic,uvlo-thres-microvolt", aw99706_dt_property_lookup,
aw99706_ulvo_thres_tbl, ARRAY_SIZE(aw99706_ulvo_thres_tbl),
AW99706_CFG2_REG, AW99706_UVLOSEL_MASK, 2200000,
},
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 311/713] backlight: aw99706: Honor the core blank state in update_status()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 310/713] backlight: aw99706: Fix DT property names to match binding Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 312/713] block: validate user space vectors during extraction Greg Kroah-Hartman
` (412 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junjie Cao,
Daniel Thompson (RISCstar), Lee Jones
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@linux.dev>
commit fbf8b5d251e8b4e1b01c591be313c63cb9e1526a upstream.
update_status() passes props.brightness straight to the hardware and
ignores the power/blank state tracked by the core. Writing 4 to the
bl_power sysfs attribute or blanking the framebuffer therefore leaves
the backlight lit.
Use backlight_get_brightness(), which returns 0 while the device is
blanked.
Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight")
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260804030255.1934470-4-junjie.cao@intel.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/aw99706.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/backlight/aw99706.c
+++ b/drivers/video/backlight/aw99706.c
@@ -335,7 +335,7 @@ static int aw99706_bl_update_status(stru
{
struct aw99706_device *aw = bl_get_data(bl);
- return aw99706_update_brightness(aw, bl->props.brightness);
+ return aw99706_update_brightness(aw, backlight_get_brightness(bl));
}
static const struct backlight_ops aw99706_bl_ops = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 312/713] block: validate user space vectors during extraction
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 311/713] backlight: aw99706: Honor the core blank state in update_status() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 313/713] block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Greg Kroah-Hartman
` (411 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Keith Busch, Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
commit 14b007e178811db72fbb1ebb3535160db6ec1e6a upstream.
The bio-based drivers don't necessarily check the alignment split, and
stacking block drivers don't always handle a misalignment detected after
submitting the bio. Validate user vectors against the device's
dma_alignment as the bio is built from the iov_iter, rejecting
misaligned early with -EINVAL.
Cc: stable@vger.kernel.org
Fixes: 5ff3f74e145a ("block: simplify direct io validity check")
Fixes: 7eac33186957 ("iomap: simplify direct io validity check")
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Link: https://patch.msgid.link/20260720201057.1862857-6-kbusch@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/bio.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++---
block/blk-map.c | 2 -
block/fops.c | 2 -
fs/iomap/direct-io.c | 1
include/linux/bio.h | 2 -
include/linux/uio.h | 10 ++++++++-
lib/iov_iter.c | 9 +++++++-
7 files changed, 74 insertions(+), 8 deletions(-)
--- a/block/bio.c
+++ b/block/bio.c
@@ -1221,10 +1221,45 @@ static int bio_iov_iter_align_down(struc
return 0;
}
+#ifdef CONFIG_DEBUG_KERNEL
+static inline bool bio_iov_bvec_aligned(const struct bio *bio,
+ unsigned mem_align_mask)
+{
+ struct bvec_iter iter;
+ struct bio_vec bv;
+
+ /*
+ * Correct callers never break the alignment requirements, so this
+ * exhaustive check is only paid for in debug builds.
+ */
+ for_each_mp_bvec(bv, bio->bi_io_vec, iter, bio->bi_iter)
+ if ((bv.bv_offset | bv.bv_len) & mem_align_mask)
+ return false;
+ return true;
+}
+#else
+static inline bool bio_iov_bvec_aligned(const struct bio *bio,
+ unsigned mem_align_mask)
+{
+ /*
+ * We forward the bio_vec as-is, so ITER_BVEC callers must provide
+ * segments already aligned to the device's DMA alignment. The only
+ * unchecked user-controllable offset that reaches here is an io_uring
+ * registered buffer where just the first segment can be unaligned
+ * (the rest is virtually contiguous), so checking only that one is
+ * sufficient to know if the entire vector is valid.
+ */
+ return !(mp_bvec_iter_offset(bio->bi_io_vec, bio->bi_iter) &
+ mem_align_mask);
+}
+#endif
+
/**
* bio_iov_iter_get_pages - add user or kernel pages to a bio
* @bio: bio to add pages to
* @iter: iov iterator describing the region to be added
+ * @mem_align_mask: the mask the source address and length must be aligned to,
+ * 0 for no requirement
* @len_align_mask: the mask to align the total size to, 0 for any length
*
* This takes either an iterator pointing to user memory, or one pointing to
@@ -1243,7 +1278,7 @@ static int bio_iov_iter_align_down(struc
* is returned only if 0 pages could be pinned.
*/
int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter,
- unsigned len_align_mask)
+ unsigned mem_align_mask, unsigned len_align_mask)
{
iov_iter_extraction_t flags = 0;
@@ -1252,6 +1287,10 @@ int bio_iov_iter_get_pages(struct bio *b
if (iov_iter_is_bvec(iter)) {
bio_iov_bvec_set(bio, iter);
+
+ if (!bio_iov_bvec_aligned(bio, mem_align_mask))
+ return -EINVAL;
+
iov_iter_advance(iter, bio->bi_iter.bi_size);
return 0;
}
@@ -1266,8 +1305,19 @@ int bio_iov_iter_get_pages(struct bio *b
ret = iov_iter_extract_bvecs(iter, bio->bi_io_vec,
BIO_MAX_SIZE - bio->bi_iter.bi_size,
- &bio->bi_vcnt, bio->bi_max_vecs, flags);
+ &bio->bi_vcnt, bio->bi_max_vecs,
+ mem_align_mask, flags);
if (ret <= 0) {
+ /*
+ * A misaligned vector fails the whole I/O. Release any
+ * pages pinned by earlier iterations before returning
+ * since this bio won't be submitted to release them.
+ */
+ if (ret == -EINVAL) {
+ bio_release_pages(bio, false);
+ bio_clear_flag(bio, BIO_PAGE_PINNED);
+ bio->bi_vcnt = 0;
+ }
if (!bio->bi_vcnt)
return ret;
break;
@@ -1380,7 +1430,7 @@ static int bio_iov_iter_bounce_read(stru
do {
ret = iov_iter_extract_bvecs(iter, bio->bi_io_vec + 1, len,
- &bio->bi_vcnt, bio->bi_max_vecs - 1, 0);
+ &bio->bi_vcnt, bio->bi_max_vecs - 1, 0, 0);
if (ret <= 0) {
if (!bio->bi_vcnt)
goto out_folio_put;
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -274,7 +274,7 @@ static int bio_map_user_iov(struct reque
* No alignment requirements on our part to support arbitrary
* passthrough commands.
*/
- ret = bio_iov_iter_get_pages(bio, iter, 0);
+ ret = bio_iov_iter_get_pages(bio, iter, 0, 0);
if (ret)
goto out_put;
ret = blk_rq_append_bio(rq, bio);
--- a/block/fops.c
+++ b/block/fops.c
@@ -46,7 +46,7 @@ static bool blkdev_dio_invalid(struct bl
static inline int blkdev_iov_iter_get_pages(struct bio *bio,
struct iov_iter *iter, struct block_device *bdev)
{
- return bio_iov_iter_get_pages(bio, iter,
+ return bio_iov_iter_get_pages(bio, iter, bdev_dma_alignment(bdev),
bdev_logical_block_size(bdev) - 1);
}
--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
@@ -358,6 +358,7 @@ static ssize_t iomap_dio_bio_iter_one(st
iomap_max_bio_size(&iter->iomap), alignment);
else
ret = bio_iov_iter_get_pages(bio, dio->submit.iter,
+ bdev_dma_alignment(bio->bi_bdev),
alignment - 1);
if (unlikely(ret))
goto out_put_bio;
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -477,7 +477,7 @@ int bdev_rw_virt(struct block_device *bd
size_t len, enum req_op op);
int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter,
- unsigned len_align_mask);
+ unsigned mem_align_mask, unsigned len_align_mask);
void bio_iov_bvec_set(struct bio *bio, const struct iov_iter *iter);
void __bio_release_pages(struct bio *bio, bool mark_dirty);
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -389,9 +389,17 @@ ssize_t iov_iter_extract_pages(struct io
size_t maxsize, unsigned int maxpages,
iov_iter_extraction_t extraction_flags,
size_t *offset0);
+/*
+ * Block-layer consumers (e.g. bio_iov_iter_get_pages()) require that the
+ * segments of an ITER_BVEC iterator are already aligned to the target device's
+ * DMA alignment, and forward them as-is. In-kernel users that build their own
+ * bvecs must not create sub-aligned segments; iov_iter_extract_bvecs() enforces
+ * the same for the segments it extracts via @mem_align_mask.
+ */
ssize_t iov_iter_extract_bvecs(struct iov_iter *iter, struct bio_vec *bv,
size_t max_size, unsigned short *nr_vecs,
- unsigned short max_vecs, iov_iter_extraction_t extraction_flags);
+ unsigned short max_vecs, unsigned mem_align_mask,
+ iov_iter_extraction_t extraction_flags);
/**
* iov_iter_extract_will_pin - Indicate how pages from the iterator will be retained
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1904,6 +1904,8 @@ static unsigned int get_contig_folio_len
* @max_size: maximum size to extract from @iter
* @nr_vecs: number of vectors in @bv (on in and output)
* @max_vecs: maximum vectors in @bv, including those filled before calling
+ * @mem_align_mask: reject with -EINVAL if the source address or
+ * length is not aligned to this mask
* @extraction_flags: flags to qualify request
*
* Like iov_iter_extract_pages(), but returns physically contiguous ranges
@@ -1915,14 +1917,19 @@ static unsigned int get_contig_folio_len
*/
ssize_t iov_iter_extract_bvecs(struct iov_iter *iter, struct bio_vec *bv,
size_t max_size, unsigned short *nr_vecs,
- unsigned short max_vecs, iov_iter_extraction_t extraction_flags)
+ unsigned short max_vecs, unsigned mem_align_mask,
+ iov_iter_extraction_t extraction_flags)
{
+ unsigned long start = (unsigned long)iter_iov_addr(iter);
unsigned short entries_left = max_vecs - *nr_vecs;
unsigned short nr_pages, i = 0;
size_t left, offset, len;
struct page **pages;
ssize_t size;
+ if ((start | iter_iov_len(iter)) & mem_align_mask)
+ return -EINVAL;
+
/*
* Move page array up in the allocated memory for the bio vecs as far as
* possible so that we can start filling biovecs from the beginning
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 313/713] block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 312/713] block: validate user space vectors during extraction Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 314/713] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Greg Kroah-Hartman
` (410 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lianqin Hu, Christoph Hellwig,
Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: 胡连勤 <hulianqin@vivo.com>
commit 7e9a46004b471eaf69b082c473d865316a4158e0 upstream.
Disks created via blk_mq_alloc_disk_for_queue() (e.g. SCSI SD disks)
do not have GD_OWNS_QUEUE set. Currently __blk_mark_disk_dead() only
sets QUEUE_FLAG_DYING when GD_OWNS_QUEUE is set, so for such disks
blk_queue_enter() and __bio_queue_enter() cannot detect the dying
state via blk_queue_dying() and remain blocked waiting for I/O that
will never complete after surprise removal.
blk_mark_disk_dead() is the explicit "surprise removal" API -- the
caller has already decided the disk is dead. Setting QUEUE_FLAG_DYING
unconditionally here is appropriate: any in-flight I/O from other
threads should get -ENODEV immediately from blk_queue_enter()
regardless of GD_OWNS_QUEUE ownership.
For disks that already have GD_OWNS_QUEUE set, __blk_mark_disk_dead()
will set the flag again which is harmless.
Fixes: 6f8191fdf41d ("block: simplify disk shutdown")
Cc: stable@vger.kernel.org
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/PUZPR06MB62247E82E66A3ED46CC3E6C7D2DC2@PUZPR06MB6224.apcprd06.prod.outlook.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/genhd.c | 1 +
1 file changed, 1 insertion(+)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -681,6 +681,7 @@ static bool __blk_mark_disk_dead(struct
*/
void blk_mark_disk_dead(struct gendisk *disk)
{
+ blk_queue_flag_set(QUEUE_FLAG_DYING, disk->queue);
__blk_mark_disk_dead(disk);
blk_report_disk_dead(disk, true);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 314/713] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 313/713] block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 315/713] Bluetooth: btusb: Add ASUS USB-BT600 " Greg Kroah-Hartman
` (409 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Zwerschke, Paul Menzel,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Zwerschke <cito@online.de>
commit 980084de4d9b25193398d89a1c0430ba3501b683 upstream.
Add the vendor/product ID (0x0b05, 0x1bef) to the usb_device_id table for
the Realtek RTL8761CU-based ASUS USB-BT540 adapter. It binds via the
generic Bluetooth class today, so BTUSB_REALTEK is never set and the
rtl8761cu firmware is not loaded, leaving the controller non-functional.
With the entry the driver loads rtl_bt/rtl8761cu_fw.bin (already shipped by
linux-firmware) and the adapter works (tested: A2DP and ASHA).
Similar to commit bc597f0cc44f
("Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV").
Device info from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 22 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0b05 ProdID=1bef Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Controller
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Zwerschke <cito@online.de>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -850,6 +850,10 @@ static const struct usb_device_id quirks
{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ /* Additional Realtek 8761CU Bluetooth devices */
+ { USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
/* Additional Realtek 8821AE Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 315/713] Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 314/713] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 316/713] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Greg Kroah-Hartman
` (408 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Zwerschke, Paul Menzel,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Zwerschke <cito@online.de>
commit 6f0624b4427e38c3bb63a951c536cf8adaee1238 upstream.
Add the vendor/product ID (0x0b05, 0x1d70) to the usb_device_id table for
the Realtek RTL8761CU-based ASUS USB-BT600 adapter. It binds via the
generic Bluetooth class today, so BTUSB_REALTEK is never set and the
rtl8761cu firmware is not loaded, leaving the controller non-functional.
With the entry the driver loads rtl_bt/rtl8761cu_fw.bin (already shipped by
linux-firmware) and the adapter works (tested: A2DP and ASHA).
Similar to commit bc597f0cc44f
("Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV").
Device info from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 23 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0b05 ProdID=1d70 Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Controller
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Zwerschke <cito@online.de>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -853,6 +853,8 @@ static const struct usb_device_id quirks
/* Additional Realtek 8761CU Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0b05, 0x1d70), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional Realtek 8821AE Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 316/713] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 315/713] Bluetooth: btusb: Add ASUS USB-BT600 " Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 317/713] Bluetooth: eir: Fix OOB read in eir_get_service_data() Greg Kroah-Hartman
` (407 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junjie Cao, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
commit ca0583c24661749508a0979189c254388a685559 upstream.
Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
times out with -110 about 30 s after firmware load, btusb resets the
device, and the adapter re-enumerates in an endless loop (382 firmware
reloads in one boot). 7.1.8, which predates the stable backport, runs
clean on this unit; 7.1.9 loops.
Move the quirk from btrtl's chip-wide switch to a btusb device-table
flag on the USB id the original fix was verified against. Other 8761B
dongles return to their earlier long-standing behaviour.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btrtl.c | 13 -------------
drivers/bluetooth/btusb.c | 8 ++++++++
2 files changed, 8 insertions(+), 13 deletions(-)
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hd
if (!btrtl_dev->ic_info)
return;
- switch (btrtl_dev->project_id) {
- case CHIP_ID_8761B:
- /* RTL8761B/BU reports HCI version 5.1 but does not support
- * the LE Extended Scan commands (Opcode 0x2042), causing
- * repeated -EBUSY failures when BlueZ attempts extended
- * scanning while a connection is active.
- */
- hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
- break;
- default:
- break;
- }
-
switch (btrtl_dev->ic_info->lmp_subver) {
case RTL_ROM_LMP_8703B:
/* 8723CS reports two pages for local ext features,
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)
#define BTUSB_ACTIONS_SEMI BIT(27)
#define BTUSB_BARROT BIT(28)
+#define BTUSB_BROKEN_EXT_SCAN BIT(29)
static const struct usb_device_id btusb_table[] = {
/* Generic Bluetooth USB device */
@@ -615,6 +616,10 @@ static const struct usb_device_id quirks
{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ /* Realtek 8761BU Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
+ BTUSB_BROKEN_EXT_SCAN },
+
/* Realtek Bluetooth devices */
{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
.driver_info = BTUSB_REALTEK },
@@ -4372,6 +4377,9 @@ static int btusb_probe(struct usb_interf
if (id->driver_info & BTUSB_INVALID_LE_STATES)
hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
+ if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
+ hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+
if (id->driver_info & BTUSB_DIGIANSWER) {
data->cmdreq_type = USB_TYPE_VENDOR;
hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 317/713] Bluetooth: eir: Fix OOB read in eir_get_service_data()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 316/713] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 318/713] bnx2x: fix double free in bnx2x_init_firmware() error path Greg Kroah-Hartman
` (406 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 4beb198bc59b242404a47c21990bc84165052c8a upstream.
eir_get_service_data() walks the advertising data for a Service Data
field with a matching UUID. On a mismatch it advances:
eir += dlen;
eir_len -= dlen;
eir_get_data() reports dlen as the field's data length, but the field
spans dlen + 2 bytes once its length and type bytes count, and more
when non-Service-Data fields were skipped to reach it. The pointer
lands correctly on the next field. eir_len does not, and the shortfall
compounds across fields until eir_get_data() reads the length and type
bytes of a "field" past the end of the buffer.
For an ISO broadcast sink that buffer is hcon->le_per_adv_data[], filled
from the periodic advertising reports of a remote broadcaster. A PA
payload packed with mismatching Service Data fields walks off the array
into the rest of struct hci_conn. A drifted field that matches the BAA
UUID puts those bytes in iso_pi(sk)->base, where user space reads them
back with getsockopt(BT_ISO_BASE).
Recompute eir_len from the end of the buffer each iteration.
Fixes: 8f9ae5b3ae80 ("Bluetooth: eir: Add helpers for managing service data")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/eir.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/bluetooth/eir.c
+++ b/net/bluetooth/eir.c
@@ -369,6 +369,7 @@ u8 eir_create_scan_rsp(struct hci_dev *h
void *eir_get_service_data(u8 *eir, size_t eir_len, u16 uuid, size_t *len)
{
+ const u8 *eir_end = eir + eir_len;
size_t dlen;
while ((eir = eir_get_data(eir, eir_len, EIR_SERVICE_DATA, &dlen))) {
@@ -381,7 +382,7 @@ void *eir_get_service_data(u8 *eir, size
}
eir += dlen;
- eir_len -= dlen;
+ eir_len = eir_end - eir;
}
return NULL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 318/713] bnx2x: fix double free in bnx2x_init_firmware() error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 317/713] Bluetooth: eir: Fix OOB read in eir_get_service_data() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 319/713] bnxt_en: Write doorbell when linearizing skb fails Greg Kroah-Hartman
` (405 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Simon Horman,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit d2796ffe38cb4155afe0eab23636295b096c27a5 upstream.
bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
bp->init_ops_offsets in its error path without setting them to NULL.
The cleanup function bnx2x_release_firmware() frees the same three
pointers unconditionally, so if init_firmware fails and
release_firmware is later called (e.g. from __bnx2x_remove or through
the function state machine), all three are freed a second time.
Set each pointer to NULL after kfree() in the error path so that the
subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260815122149.951215-1-yijiangshan@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13473,10 +13473,13 @@ static int bnx2x_init_firmware(struct bn
iro_alloc_err:
kfree(bp->init_ops_offsets);
+ bp->init_ops_offsets = NULL;
init_offsets_alloc_err:
kfree(bp->init_ops);
+ bp->init_ops = NULL;
init_ops_alloc_err:
kfree(bp->init_data);
+ bp->init_data = NULL;
request_firmware_exit:
release_firmware(bp->firmware);
bp->firmware = NULL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 319/713] bnxt_en: Write doorbell when linearizing skb fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 318/713] bnx2x: fix double free in bnx2x_init_firmware() error path Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 320/713] bpf, x86: Fix per-CPU address resolution into an extended register Greg Kroah-Hartman
` (404 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Damato, Michael Chan,
Andy Gospodarek, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <joe@dama.to>
commit 00eeab0c644a881a1dc86fbffb7e6047a6ce8ecd upstream.
When the driver is handed a burst of packets, the doorbell is deferred
until the end. If the last packet has a huge number of frags, but fails
to linearize, the doorbell will not be written adding latency on TX for
any packets in the ring and holding their DMA mappings until the next
TX. Note that the queue is not stopped, so this issue would delay
pending BDs until the next TX.
This issue was discovered by Sashiko and reading the code verifies that,
while unlikely, it is possible.
Fix this by jumping to tx_free, which replicates the same pre-existing
logic but also writes the doorbell.
Fixes: b91e82129400 ("bnxt_en: Linearize TX SKB if the fragments exceed the max")
Cc: stable@vger.kernel.org
Signed-off-by: Joe Damato <joe@dama.to>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Link: https://patch.msgid.link/20260826000234.2031564-1-joe@dama.to
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -501,11 +501,8 @@ static netdev_tx_t bnxt_start_xmit(struc
if (skb_shinfo(skb)->nr_frags > TX_MAX_FRAGS) {
netdev_warn_once(dev, "SKB has too many (%d) fragments, max supported is %d. SKB will be linearized.\n",
skb_shinfo(skb)->nr_frags, TX_MAX_FRAGS);
- if (skb_linearize(skb)) {
- dev_kfree_skb_any(skb);
- dev_core_stats_tx_dropped_inc(dev);
- return NETDEV_TX_OK;
- }
+ if (skb_linearize(skb))
+ goto tx_free;
}
#endif
if (skb_is_gso(skb) &&
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 320/713] bpf, x86: Fix per-CPU address resolution into an extended register
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 319/713] bnxt_en: Write doorbell when linearizing skb fails Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 321/713] bpf: Disable preemption in __bpf_get_stack Greg Kroah-Hartman
` (403 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vineet Gupta, Eduard Zingerman
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vineet.gupta@linux.dev>
commit 5bbbce02e500d47d8e259a45be5a7be9741d0533 upstream.
The destination of the per-CPU address MOV is encoded in ModRM.reg,
which is extended by REX.R, but the REX prefix is built with
add_1mod(), which sets REX.B. REX.B extends ModRM.rm and SIB.base, and
this instruction addresses memory as disp32 with no base, so the bit
has no effect at all and the high register bit is simply lost.
Every is_ereg() destination therefore resolves to the wrong register,
picking whichever one shares the low three bits:
R5 -> RAX R7 -> RBP R8 -> RSI R9 -> RDI
With BPF_REG_5, whose reg2hex is 0, the emitted
65 49 03 04 25 <off> add %gs:<off>,%rax
adds the per-CPU offset to RAX rather than R8. The destination keeps
the unadjusted address and RAX is clobbered, so the program goes on to
dereference a pointer that was never made per-CPU:
BUG: unable to handle page fault for address: 0000607e386a8894
RIP: bpf_prog_707837aafd2aa9ae_update_percpu_data+0x93/0xc9
Call Trace:
__bpf_prog_test_run_raw_tp+0x2dc/0x7d0
__flush_smp_call_function_queue+0x1e9/0xc80
Kernel panic - not syncing: Fatal exception in interrupt
R5 is the mildest of the four, aliasing a scratch register and faulting
at the store. R7 aliases RBP and would corrupt the frame pointer, R8
and R9 alias the argument registers.
Use add_2mod() so the register goes through REX.R, matching how
add_2reg() places it in ModRM.reg and how emit_priv_frame_ptr()
hardcodes 0x4c for the same instruction with R9. Encodings for the
non-extended registers are unchanged.
Problem showed up when trying to resurrect BPF_GCC CI (selftests built
with BPF_GCC).
This has gone unnoticed because clang reloads the address into R1
before each per-CPU access, so the destination is never an extended
register. GCC keeps several per-CPU addresses live at once, and
test_progs-bpf_gcc panics the kernel in global_percpu_data/init, where
the address of a .percpu variable ends up in R5.
Fixes: 7bdbf7446305 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs")
Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260814220254.3797467-2-vineet.gupta@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1887,7 +1887,7 @@ static int do_jit(struct bpf_verifier_en
EMIT_mov(dst_reg, src_reg);
#ifdef CONFIG_SMP
/* add <dst>, gs:[<off>] */
- EMIT2(0x65, add_1mod(0x48, dst_reg));
+ EMIT2(0x65, add_2mod(0x48, 0, dst_reg));
EMIT3(0x03, add_2reg(0x04, 0, dst_reg), 0x25);
EMIT((u32)(unsigned long)&this_cpu_off, 4);
#endif
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 321/713] bpf: Disable preemption in __bpf_get_stack
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 320/713] bpf, x86: Fix per-CPU address resolution into an extended register Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 322/713] buffer: avoid tail commit walk for uptodate folios Greg Kroah-Hartman
` (402 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Chen, STAR Labs SG,
Daniel Borkmann, Jiri Olsa, Andrii Nakryiko
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <borkmann@iogearbox.net>
commit b1a47b2708d4e95dbd23aee2ec83752190897b3f upstream.
get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and
releases its recursion slot via put_callchain_entry() before returning,
so nothing keeps the entry reserved while __bpf_get_stack() consumes
it below.
A preemptible BPF program (e.g. a non-sleepable raw tracepoint program
on a PREEMPT kernel, which runs under migrate_disable() but not
preempt_disable()) can be scheduled out between obtaining the entry
and the copy. Another task scheduled on the same CPU then reuses the
same per-CPU buffer and overwrites trace->nr with a larger value.
copy_len is then computed from the inflated trace->nr and can exceed
the caller's buffer, causing an out-of-bounds write in the memcpy()
and in the build_id path.
The rcu_read_lock() taken here alone does not prevent this. It is
only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does
not disable preemption; it merely keeps perf's callchain buffer array
alive (freed via call_rcu()) and does nothing to stop another task
from reusing the entry.
Disable preemption around obtaining the callchain entry and copying
it into the caller's buffer, so the entry cannot be reused underneath
us and trace->nr stays bounded by max_depth. Build ID resolution may
fault and is therefore deferred until after preemption is re-enabled;
by then the instruction pointers have already been copied into buf,
so it operates only on that private copy. Note, preempt_disable() also
subsumes the buffer-lifetime guarantee the rcu_read_lock() provided,
since a preempt-disabled section is an RCU read-side critical section
for the callchain buffers' call_rcu() reclaim.
Fixes: c195651e565a ("bpf: add bpf_get_stack helper")
Reported-by: Tao Chen <chen.dylane@linux.dev>
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <borkmann@iogearbox.net>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/
[ changed Fixes: commit ]
---
kernel/bpf/stackmap.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -718,6 +718,7 @@ static long __bpf_get_stack(struct pt_re
max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
+ preempt_disable();
if (may_fault)
rcu_read_lock(); /* need RCU for perf's callchain below */
@@ -734,6 +735,7 @@ static long __bpf_get_stack(struct pt_re
if (unlikely(!trace) || trace->nr < skip) {
if (may_fault)
rcu_read_unlock();
+ preempt_enable();
goto err_fault;
}
@@ -754,6 +756,7 @@ static long __bpf_get_stack(struct pt_re
/* trace/ips should not be dereferenced after this point */
if (may_fault)
rcu_read_unlock();
+ preempt_enable();
if (user_build_id)
stack_map_get_build_id_offset(buf, trace_nr, user, may_fault);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 322/713] buffer: avoid tail commit walk for uptodate folios
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 321/713] bpf: Disable preemption in __bpf_get_stack Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 323/713] bpf: Harden bloom filter sizing and indexing on 32-bit kernels Greg Kroah-Hartman
` (401 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle), Jan Kara,
Jia Zhu, Theodore Tso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Zhu <zhujia.zj@bytedance.com>
commit f10b9cc1eb20637351f4e33372bfb464f89de59b upstream.
block_commit_write() always walks every buffer_head attached to the
folio. That was cheap for order-0 folios, but large folios can contain
hundreds of buffer_heads. For a small buffered overwrite of an
already-uptodate large folio, the commit work is therefore proportional
to the folio size rather than the copied range.
This became visible with ext4 regular-file large folios, where cached
small overwrites reach block_commit_write() through block_write_end().
Before ext4 enabled large folios for regular files, this path was only
hit with order-0 folios for normal ext4 buffered writes, so the full walk
was bounded. The ext4 large-folio commit is therefore the regression
point for this generic helper cost.
The full walk is still needed when the folio is not uptodate, because
block_commit_write() uses per-buffer uptodate state to decide whether
the whole folio can be marked uptodate. Keep those folios on the old
full-buffer path.
For a folio that was already uptodate on entry, the commit no longer
needs tail buffers for folio-uptodate discovery. The copied range has
already been processed once block_start reaches @to, so stop there and
avoid the suffix walk.
Fixes: 7ac67301e82f0 ("ext4: enable large folio for regular file")
Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org # v6.16+
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jia Zhu <zhujia.zj@bytedance.com>
Link: https://patch.msgid.link/20260609035202.90669-2-zhujia.zj@bytedance.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/buffer.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2177,6 +2177,7 @@ void block_commit_write(struct folio *fo
{
size_t block_start, block_end;
bool partial = false;
+ bool uptodate = folio_test_uptodate(folio);
unsigned blocksize;
struct buffer_head *bh, *head;
@@ -2199,6 +2200,8 @@ void block_commit_write(struct folio *fo
clear_buffer_new(bh);
block_start = block_end;
+ if (uptodate && block_start >= to)
+ break;
bh = bh->b_this_page;
} while (bh != head);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 323/713] bpf: Harden bloom filter sizing and indexing on 32-bit kernels
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 322/713] buffer: avoid tail commit walk for uptodate folios Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 324/713] dm-io: clone the source bio instead of copying its biovec Greg Kroah-Hartman
` (400 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Andrii Nakryiko
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 11c1e836710dcba03e50454a4eedfdbaf8d3050e upstream.
bloom_map_alloc() has two 32-bit-specific problems when the computed
bitmap reaches the U32_MAX fallback case.
First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The
addition performed by DIV_ROUND_UP wraps, so the map allocates only the
fixed-size bloom filter object while keeping bitset_mask == U32_MAX.
Subsequent updates can then write past the allocated object.
Second, fixing only the allocation size is not sufficient. The bloom hash
is a u32, but set_bit() takes a signed long bit number and x86 test_bit()
eventually feeds the index to variable_test_bit(long, ...). On 32-bit
kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit
offsets. x86 bt/bts with a memory operand interpret those offsets relative
to the supplied base, so a map with bitset_mask == U32_MAX can read or
write before bloom->bitset even after allocating the full 512 MiB bitmap.
Keep the U32_MAX fallback, but split each hash into a word pointer and an
in-word bit number before calling test_bit() or set_bit(). The bitops
argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still
selects the intended word in the full bitmap.
Compute the bitset size from (u64)bitset_mask + 1 before passing the final
size to bpf_map_area_alloc(). This fixes the original under-allocation and
keeps the allocated storage consistent with the addressable bitset.
Exploitation note: local privilege escalation is possible on a 32-bit x86
kernel using the under-allocation bug from a binary with CAP_BPF.
Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260805060228.2703051-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Assisted-by: Codex:gpt-5
---
kernel/bpf/bloom_filter.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/kernel/bpf/bloom_filter.c
+++ b/kernel/bpf/bloom_filter.c
@@ -41,7 +41,7 @@ static long bloom_map_peek_elem(struct b
for (i = 0; i < bloom->nr_hash_funcs; i++) {
h = hash(bloom, value, map->value_size, i);
- if (!test_bit(h, bloom->bitset))
+ if (!test_bit(h % BITS_PER_LONG, bloom->bitset + BIT_WORD(h)))
return -ENOENT;
}
@@ -57,9 +57,13 @@ static long bloom_map_push_elem(struct b
if (flags != BPF_ANY)
return -EINVAL;
+ /*
+ * On 32-bit architectures, hashes larger than INT_MAX would be
+ * treated as negative by set_bit().
+ */
for (i = 0; i < bloom->nr_hash_funcs; i++) {
h = hash(bloom, value, map->value_size, i);
- set_bit(h, bloom->bitset);
+ set_bit(h % BITS_PER_LONG, bloom->bitset + BIT_WORD(h));
}
return 0;
@@ -94,9 +98,10 @@ static int bloom_map_alloc_check(union b
static struct bpf_map *bloom_map_alloc(union bpf_attr *attr)
{
- u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
+ u32 bitset_mask, nr_hash_funcs, nr_bits;
int numa_node = bpf_map_attr_numa_node(attr);
struct bpf_bloom_filter *bloom;
+ u64 bitset_bytes;
if (attr->key_size != 0 || attr->value_size == 0 ||
attr->max_entries == 0 ||
@@ -127,22 +132,16 @@ static struct bpf_map *bloom_map_alloc(u
if (check_mul_overflow(attr->max_entries, nr_hash_funcs, &nr_bits) ||
check_mul_overflow(nr_bits / 5, (u32)7, &nr_bits) ||
nr_bits > (1UL << 31)) {
- /* The bit array size is 2^32 bits but to avoid overflowing the
- * u32, we use U32_MAX, which will round up to the equivalent
- * number of bytes
- */
- bitset_bytes = BITS_TO_BYTES(U32_MAX);
bitset_mask = U32_MAX;
} else {
if (nr_bits <= BITS_PER_LONG)
nr_bits = BITS_PER_LONG;
else
nr_bits = roundup_pow_of_two(nr_bits);
- bitset_bytes = BITS_TO_BYTES(nr_bits);
bitset_mask = nr_bits - 1;
}
- bitset_bytes = roundup(bitset_bytes, sizeof(unsigned long));
+ bitset_bytes = BITS_TO_LONGS((u64)bitset_mask + 1) * sizeof(unsigned long);
bloom = bpf_map_area_alloc(sizeof(*bloom) + bitset_bytes, numa_node);
if (!bloom)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 324/713] dm-io: clone the source bio instead of copying its biovec
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 323/713] bpf: Harden bloom filter sizing and indexing on 32-bit kernels Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 325/713] dm-io: report non-retryable errors separatedly Greg Kroah-Hartman
` (399 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dr. David Alan Gilbert,
Vjaceslavs Klimovs, Keith Busch, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
commit 62dc37a819a5a5de5cba989ad9e96ee214b9253e upstream.
For DM_IO_BIO requests, do_region() built each destination bio by walking
the source bio's biovec and re-adding the pages one at a time, tracking
the remaining transfer in sectors. The vector lengths are byte granular
and need not be sector aligned (e.g. a misaligned O_DIRECT buffer split
across pages), so the sector-based accounting could lose a sub-sector
fragment: to_sector() truncated the remainder and the outer loop spun
forever submitting empty bios, hanging the I/O.
There is no need to rebuild the biovec at all. The destination reads into
(or writes from) exactly the same pages as the source bio, so the bio can
simply clone the source's biovec with bio_alloc_clone() and remap it to
the target device. The clone inherits the source's iterator and alignment,
and the block layer splits it to the target's limits on submission, so the
whole region maps to a single cloned bio with no manual page copying or
sector accounting.
This removes the per-page copy path (and its open-coded bvec dpages
helpers) for bio-backed I/O and fixes the hang on misaligned direct I/O to
a dm-mirror device. Page-list, vma and kmem sources keep the existing copy
path.
Fixes: 7eac33186957 ("iomap: simplify direct io validity check")
Fixes: 5ff3f74e145a ("block: simplify direct io validity check")
Cc: stable@vger.kernel.org
Reported-by: Dr. David Alan Gilbert <linux@treblig.org>
Reported-by: Vjaceslavs Klimovs <vklimovs@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-io.c | 67 ++++++++++++++++++-----------------------------------
1 file changed, 24 insertions(+), 43 deletions(-)
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -170,12 +170,11 @@ struct dpages {
struct page **p, unsigned long *len, unsigned int *offset);
void (*next_page)(struct dpages *dp);
- union {
- unsigned int context_u;
- struct bvec_iter context_bi;
- };
+ unsigned int context_u;
void *context_ptr;
+ struct bio *orig_bio;
+
void *vma_invalidate_address;
unsigned long vma_invalidate_size;
};
@@ -211,44 +210,6 @@ static void list_dp_init(struct dpages *
}
/*
- * Functions for getting the pages from a bvec.
- */
-static void bio_get_page(struct dpages *dp, struct page **p,
- unsigned long *len, unsigned int *offset)
-{
- struct bio_vec bvec = bvec_iter_bvec((struct bio_vec *)dp->context_ptr,
- dp->context_bi);
-
- *p = bvec.bv_page;
- *len = bvec.bv_len;
- *offset = bvec.bv_offset;
-
- /* avoid figuring it out again in bio_next_page() */
- dp->context_bi.bi_sector = (sector_t)bvec.bv_len;
-}
-
-static void bio_next_page(struct dpages *dp)
-{
- unsigned int len = (unsigned int)dp->context_bi.bi_sector;
-
- bvec_iter_advance((struct bio_vec *)dp->context_ptr,
- &dp->context_bi, len);
-}
-
-static void bio_dp_init(struct dpages *dp, struct bio *bio)
-{
- dp->get_page = bio_get_page;
- dp->next_page = bio_next_page;
-
- /*
- * We just use bvec iterator to retrieve pages, so it is ok to
- * access the bvec table directly here
- */
- dp->context_ptr = bio->bi_io_vec;
- dp->context_bi = bio->bi_iter;
-}
-
-/*
* Functions for getting the pages from a VMA.
*/
static void vm_get_page(struct dpages *dp,
@@ -332,6 +293,21 @@ static void do_region(const blk_opf_t op
return;
}
+ if (dp->orig_bio) {
+ bio = bio_alloc_clone(where->bdev, dp->orig_bio, GFP_NOIO,
+ &io->client->bios);
+ bio->bi_iter.bi_sector = where->sector;
+ bio->bi_iter.bi_size = where->count << SECTOR_SHIFT;
+ bio->bi_opf = opf;
+ bio->bi_end_io = endio;
+ bio->bi_ioprio = ioprio;
+ store_io_and_region_in_bio(bio, io, region);
+
+ atomic_inc(&io->count);
+ submit_bio(bio);
+ return;
+ }
+
/*
* where->count may be zero if op holds a flush and we need to
* send a zero-sized flush.
@@ -468,6 +444,7 @@ static int dp_init(struct dm_io_request
dp->vma_invalidate_address = NULL;
dp->vma_invalidate_size = 0;
+ dp->orig_bio = NULL;
switch (io_req->mem.type) {
case DM_IO_PAGE_LIST:
@@ -475,7 +452,11 @@ static int dp_init(struct dm_io_request
break;
case DM_IO_BIO:
- bio_dp_init(dp, io_req->mem.ptr.bio);
+ /*
+ * The destination bios clone this bio's biovec directly, so
+ * there are no per-page accessors to set up here.
+ */
+ dp->orig_bio = io_req->mem.ptr.bio;
break;
case DM_IO_VMA:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 325/713] dm-io: report non-retryable errors separatedly
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 324/713] dm-io: clone the source bio instead of copying its biovec Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 326/713] dm-era: fix shadowed superblock leak on take-snap failure Greg Kroah-Hartman
` (398 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 47a5e62f39875f371bded6e34ffb9cf15ccd813d upstream.
The error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg
failure on dm-raid1. This patch changes the interface to dm-io, so that
it reports two error bitmaps - error_bits and unsup_bits. The unsup_bit
bitmap tracks BLK_STS_NOTSUPP or BLK_STS_INVAL errors, the error_bits
bitmap tracks all the other errors.
dm-raid1 is changed so that it won't fail a leg if it receives an error
in the unsup_bits bitmap.
This patch (with 62dc37a819a5) fixes misbehavior if the user uses
unaligned bio vectors on dm-raid1.
Fixes: 7eac33186957 ("iomap: simplify direct io validity check")
Fixes: 5ff3f74e145a ("block: simplify direct io validity check")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 10 +++++-----
drivers/md/dm-integrity.c | 32 +++++++++++++++++++-------------
drivers/md/dm-io.c | 29 +++++++++++++++++++++--------
drivers/md/dm-kcopyd.c | 10 +++++-----
drivers/md/dm-log.c | 4 ++--
drivers/md/dm-raid1.c | 26 +++++++++++++++++---------
drivers/md/dm-snap-persistent.c | 4 ++--
drivers/md/dm-verity-target.c | 2 +-
drivers/md/dm-writecache.c | 14 ++++++++------
include/linux/dm-io.h | 6 +++---
10 files changed, 83 insertions(+), 54 deletions(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1287,11 +1287,11 @@ static void free_buffer(struct dm_buffer
* dm-io completion routine. It just calls b->bio.bi_end_io, pretending
* that the request was handled directly with bio interface.
*/
-static void dmio_complete(unsigned long error, void *context)
+static void dmio_complete(unsigned long error, unsigned long unsup, void *context)
{
struct dm_buffer *b = context;
- b->end_io(b, unlikely(error != 0) ? BLK_STS_IOERR : 0);
+ b->end_io(b, unlikely(error != 0) ? BLK_STS_IOERR : unlikely(unsup != 0) ? BLK_STS_NOTSUPP : 0);
}
static void use_dmio(struct dm_buffer *b, enum req_op op, sector_t sector,
@@ -1319,7 +1319,7 @@ static void use_dmio(struct dm_buffer *b
io_req.mem.ptr.vma = (char *)b->data + offset;
}
- r = dm_io(&io_req, 1, ®ion, NULL, ioprio);
+ r = dm_io(&io_req, 1, ®ion, NULL, NULL, ioprio);
if (unlikely(r))
b->end_io(b, errno_to_blk_status(r));
}
@@ -2220,7 +2220,7 @@ int dm_bufio_issue_flush(struct dm_bufio
if (WARN_ON_ONCE(dm_bufio_in_request()))
return -EINVAL;
- return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT);
+ return dm_io(&io_req, 1, &io_reg, NULL, NULL, IOPRIO_DEFAULT);
}
EXPORT_SYMBOL_GPL(dm_bufio_issue_flush);
@@ -2246,7 +2246,7 @@ int dm_bufio_issue_discard(struct dm_buf
if (WARN_ON_ONCE(dm_bufio_in_request()))
return -EINVAL; /* discards are optional */
- return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT);
+ return dm_io(&io_req, 1, &io_reg, NULL, NULL, IOPRIO_DEFAULT);
}
EXPORT_SYMBOL_GPL(dm_bufio_issue_discard);
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -562,7 +562,7 @@ static int sync_rw_sb(struct dm_integrit
}
}
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r))
return r;
@@ -1035,12 +1035,14 @@ static void encrypt_journal(struct dm_in
return crypt_journal(ic, encrypt, section, n_sections, comp);
}
-static void complete_journal_io(unsigned long error, void *context)
+static void complete_journal_io(unsigned long error, unsigned long unsup, void *context)
{
struct journal_completion *comp = context;
if (unlikely(error != 0))
dm_integrity_io_error(comp->ic, "writing journal", -EIO);
+ else if (unlikely(unsup != 0))
+ dm_integrity_io_error(comp->ic, "writing journal", -EOPNOTSUPP);
complete_journal_op(comp);
}
@@ -1055,7 +1057,7 @@ static void rw_journal_sectors(struct dm
if (unlikely(dm_integrity_failed(ic))) {
if (comp)
- complete_journal_io(-1UL, comp);
+ complete_journal_io(-1UL, -1UL, comp);
return;
}
@@ -1080,13 +1082,13 @@ static void rw_journal_sectors(struct dm
io_loc.sector = ic->start + SB_SECTORS + sector;
io_loc.count = n_sectors;
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r)) {
dm_integrity_io_error(ic, (opf & REQ_OP_MASK) == REQ_OP_READ ?
"reading journal" : "writing journal", r);
if (comp) {
WARN_ONCE(1, "asynchronous dm_io failed: %d", r);
- complete_journal_io(-1UL, comp);
+ complete_journal_io(-1UL, -1UL, comp);
}
}
}
@@ -1177,7 +1179,7 @@ static void copy_from_journal(struct dm_
BUG_ON((target | n_sectors | offset) & (unsigned int)(ic->sectors_per_block - 1));
if (unlikely(dm_integrity_failed(ic))) {
- fn(-1UL, data);
+ fn(-1UL, -1UL, data);
return;
}
@@ -1197,10 +1199,10 @@ static void copy_from_journal(struct dm_
io_loc.sector = target;
io_loc.count = n_sectors;
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r)) {
WARN_ONCE(1, "asynchronous dm_io failed: %d", r);
- fn(-1UL, data);
+ fn(-1UL, -1UL, data);
}
}
@@ -1493,12 +1495,14 @@ struct flush_request {
struct completion comp;
};
-static void flush_notify(unsigned long error, void *fr_)
+static void flush_notify(unsigned long error, unsigned long unsup, void *fr_)
{
struct flush_request *fr = fr_;
if (unlikely(error != 0))
dm_integrity_io_error(fr->ic, "flushing disk cache", -EIO);
+ else if (unlikely(unsup != 0))
+ dm_integrity_io_error(fr->ic, "flushing disk cache", -EOPNOTSUPP);
complete(&fr->comp);
}
@@ -1521,7 +1525,7 @@ static void dm_integrity_flush_buffers(s
fr.io_reg.count = 0;
fr.ic = ic;
init_completion(&fr.comp);
- r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL, NULL, IOPRIO_DEFAULT);
BUG_ON(r);
}
@@ -1837,7 +1841,7 @@ static noinline void integrity_recheck(s
buffer_offset = (sector - io_loc.sector) << SECTOR_SHIFT;
io_loc.count = round_up(io_loc.count, alignment);
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r)) {
dio->bi_status = errno_to_blk_status(r);
goto free_ret;
@@ -2890,7 +2894,7 @@ release_flush_bios:
}
}
-static void complete_copy_from_journal(unsigned long error, void *context)
+static void complete_copy_from_journal(unsigned long error, unsigned long unsup, void *context)
{
struct journal_io *io = context;
struct journal_completion *comp = io->comp;
@@ -2900,6 +2904,8 @@ static void complete_copy_from_journal(u
mempool_free(io, &ic->journal_io_mempool);
if (unlikely(error != 0))
dm_integrity_io_error(ic, "copying from journal", -EIO);
+ else if (unlikely(unsup != 0))
+ dm_integrity_io_error(ic, "copying from journal", -EOPNOTSUPP);
complete_journal_op(comp);
}
@@ -3215,7 +3221,7 @@ next_chunk:
io_loc.sector = get_data_sector(ic, area, offset);
io_loc.count = n_sectors;
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r)) {
dm_integrity_io_error(ic, "reading data", r);
goto err;
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -33,6 +33,7 @@ struct dm_io_client {
*/
struct io {
unsigned long error_bits;
+ unsigned long unsup_bits;
atomic_t count;
struct dm_io_client *client;
io_notify_fn callback;
@@ -119,6 +120,7 @@ static void retrieve_io_and_region_from_
static void complete_io(struct io *io)
{
unsigned long error_bits = io->error_bits;
+ unsigned long unsup_bits = io->unsup_bits;
io_notify_fn fn = io->callback;
void *context = io->context;
@@ -127,13 +129,17 @@ static void complete_io(struct io *io)
io->vma_invalidate_size);
mempool_free(io, &io->client->pool);
- fn(error_bits, context);
+ fn(error_bits, unsup_bits, context);
}
static void dec_count(struct io *io, unsigned int region, blk_status_t error)
{
- if (error)
- set_bit(region, &io->error_bits);
+ if (unlikely(error)) {
+ if (error == BLK_STS_NOTSUPP || error == BLK_STS_INVAL)
+ set_bit(region, &io->unsup_bits);
+ else
+ set_bit(region, &io->error_bits);
+ }
if (atomic_dec_and_test(&io->count))
complete_io(io);
@@ -394,6 +400,7 @@ static void async_io(struct dm_io_client
io = mempool_alloc(&client->pool, GFP_NOIO);
io->error_bits = 0;
+ io->unsup_bits = 0;
atomic_set(&io->count, 1); /* see dispatch_io() */
io->client = client;
io->callback = fn;
@@ -407,20 +414,23 @@ static void async_io(struct dm_io_client
struct sync_io {
unsigned long error_bits;
+ unsigned long unsup_bits;
struct completion wait;
};
-static void sync_io_complete(unsigned long error, void *context)
+static void sync_io_complete(unsigned long error, unsigned long unsup, void *context)
{
struct sync_io *sio = context;
sio->error_bits = error;
+ sio->unsup_bits = unsup;
complete(&sio->wait);
}
static int sync_io(struct dm_io_client *client, unsigned int num_regions,
struct dm_io_region *where, blk_opf_t opf, struct dpages *dp,
- unsigned long *error_bits, unsigned short ioprio)
+ unsigned long *error_bits, unsigned long *unsup_bits,
+ unsigned short ioprio)
{
struct sync_io sio;
@@ -433,8 +443,10 @@ static int sync_io(struct dm_io_client *
if (error_bits)
*error_bits = sio.error_bits;
+ if (unsup_bits)
+ *unsup_bits = sio.unsup_bits;
- return sio.error_bits ? -EIO : 0;
+ return sio.error_bits ? -EIO : sio.unsup_bits ? -EOPNOTSUPP : 0;
}
static int dp_init(struct dm_io_request *io_req, struct dpages *dp,
@@ -481,7 +493,7 @@ static int dp_init(struct dm_io_request
int dm_io(struct dm_io_request *io_req, unsigned int num_regions,
struct dm_io_region *where, unsigned long *sync_error_bits,
- unsigned short ioprio)
+ unsigned long *sync_unsup_bits, unsigned short ioprio)
{
int r;
struct dpages dp;
@@ -497,7 +509,8 @@ int dm_io(struct dm_io_request *io_req,
if (!io_req->notify.fn)
return sync_io(io_req->client, num_regions, where,
- io_req->bi_opf, &dp, sync_error_bits, ioprio);
+ io_req->bi_opf, &dp, sync_error_bits,
+ sync_unsup_bits, ioprio);
async_io(io_req->client, num_regions, where, io_req->bi_opf, &dp,
io_req->notify.fn, io_req->notify.context, ioprio);
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -517,16 +517,16 @@ static int run_complete_job(struct kcopy
return 0;
}
-static void complete_io(unsigned long error, void *context)
+static void complete_io(unsigned long error, unsigned long unsup, void *context)
{
struct kcopyd_job *job = context;
struct dm_kcopyd_client *kc = job->kc;
io_job_finish(kc->throttle);
- if (error) {
+ if (unlikely((error | unsup) != 0)) {
if (op_is_write(job->op))
- job->write_err |= error;
+ job->write_err |= error | unsup;
else
job->read_err = 1;
@@ -578,9 +578,9 @@ static int run_io_job(struct kcopyd_job
io_job_start(job->kc->throttle);
if (job->op == REQ_OP_READ)
- r = dm_io(&io_req, 1, &job->source, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &job->source, NULL, NULL, IOPRIO_DEFAULT);
else
- r = dm_io(&io_req, job->num_dests, job->dests, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, job->num_dests, job->dests, NULL, NULL, IOPRIO_DEFAULT);
return r;
}
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -300,7 +300,7 @@ static int rw_header(struct log_c *lc, e
{
lc->io_req.bi_opf = op;
- return dm_io(&lc->io_req, 1, &lc->header_location, NULL, IOPRIO_DEFAULT);
+ return dm_io(&lc->io_req, 1, &lc->header_location, NULL, NULL, IOPRIO_DEFAULT);
}
static int flush_header(struct log_c *lc)
@@ -313,7 +313,7 @@ static int flush_header(struct log_c *lc
lc->io_req.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
- return dm_io(&lc->io_req, 1, &null_location, NULL, IOPRIO_DEFAULT);
+ return dm_io(&lc->io_req, 1, &null_location, NULL, NULL, IOPRIO_DEFAULT);
}
static int read_header(struct log_c *log)
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -258,7 +258,7 @@ out:
static int mirror_flush(struct dm_target *ti)
{
struct mirror_set *ms = ti->private;
- unsigned long error_bits;
+ unsigned long error_bits, unsup_bits;
unsigned int i;
struct dm_io_region io[MAX_NR_MIRRORS];
@@ -277,8 +277,8 @@ static int mirror_flush(struct dm_target
}
error_bits = -1;
- dm_io(&io_req, ms->nr_mirrors, io, &error_bits, IOPRIO_DEFAULT);
- if (unlikely(error_bits != 0)) {
+ dm_io(&io_req, ms->nr_mirrors, io, &error_bits, &unsup_bits, IOPRIO_DEFAULT);
+ if (unlikely((error_bits | unsup_bits) != 0)) {
for (i = 0; i < ms->nr_mirrors; i++)
if (test_bit(i, &error_bits))
fail_mirror(ms->mirror + i,
@@ -511,7 +511,7 @@ static void hold_bio(struct mirror_set *
* Reads
*---------------------------------------------------------------
*/
-static void read_callback(unsigned long error, void *context)
+static void read_callback(unsigned long error, unsigned long unsup, void *context)
{
struct bio *bio = context;
struct mirror *m;
@@ -520,6 +520,8 @@ static void read_callback(unsigned long
bio_set_m(bio, NULL);
if (likely(!error)) {
+ if (unlikely(unsup != 0))
+ bio->bi_status = BLK_STS_INVAL;
bio_endio(bio);
return;
}
@@ -553,7 +555,7 @@ static void read_async_bio(struct mirror
map_region(&io, m, bio);
bio_set_m(bio, m);
- BUG_ON(dm_io(&io_req, 1, &io, NULL, IOPRIO_DEFAULT));
+ BUG_ON(dm_io(&io_req, 1, &io, NULL, NULL, IOPRIO_DEFAULT));
}
static inline int region_in_sync(struct mirror_set *ms, region_t region,
@@ -600,7 +602,7 @@ static void do_reads(struct mirror_set *
* NOSYNC: increment pending, just write to the default mirror
*---------------------------------------------------------------------
*/
-static void write_callback(unsigned long error, void *context)
+static void write_callback(unsigned long error, unsigned long unsup, void *context)
{
unsigned int i;
struct bio *bio = context;
@@ -617,7 +619,7 @@ static void write_callback(unsigned long
* This way we handle both writes to SYNC and NOSYNC
* regions with the same code.
*/
- if (likely(!error)) {
+ if (likely(!(error | unsup))) {
bio_endio(bio);
return;
}
@@ -632,6 +634,12 @@ static void write_callback(unsigned long
return;
}
+ if (!error && unsup) {
+ bio->bi_status = BLK_STS_INVAL;
+ bio_endio(bio);
+ return;
+ }
+
for (i = 0; i < ms->nr_mirrors; i++)
if (test_bit(i, &error))
fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
@@ -680,7 +688,7 @@ static void do_write(struct mirror_set *
*/
bio_set_m(bio, get_default_mirror(ms));
- BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL, IOPRIO_DEFAULT));
+ BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL, NULL, IOPRIO_DEFAULT));
}
static void do_writes(struct mirror_set *ms, struct bio_list *writes)
@@ -1262,7 +1270,7 @@ static int mirror_end_io(struct dm_targe
return DM_ENDIO_DONE;
}
- if (*error == BLK_STS_NOTSUPP)
+ if (*error == BLK_STS_NOTSUPP || *error == BLK_STS_INVAL)
goto out;
if (bio->bi_opf & REQ_RAHEAD)
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -223,7 +223,7 @@ static void do_metadata(struct work_stru
{
struct mdata_req *req = container_of(work, struct mdata_req, work);
- req->result = dm_io(req->io_req, 1, req->where, NULL, IOPRIO_DEFAULT);
+ req->result = dm_io(req->io_req, 1, req->where, NULL, NULL, IOPRIO_DEFAULT);
}
/*
@@ -247,7 +247,7 @@ static int chunk_io(struct pstore *ps, v
struct mdata_req req;
if (!metadata)
- return dm_io(&io_req, 1, &where, NULL, IOPRIO_DEFAULT);
+ return dm_io(&io_req, 1, &where, NULL, NULL, IOPRIO_DEFAULT);
req.where = &where;
req.io_req = &io_req;
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -395,7 +395,7 @@ static noinline int verity_recheck(struc
io_loc.bdev = v->data_dev->bdev;
io_loc.sector = cur_block << (v->data_dev_block_bits - SECTOR_SHIFT);
io_loc.count = 1 << (v->data_dev_block_bits - SECTOR_SHIFT);
- r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&io_req, 1, &io_loc, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r))
goto free_ret;
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -474,12 +474,14 @@ struct io_notify {
atomic_t count;
};
-static void writecache_notify_io(unsigned long error, void *context)
+static void writecache_notify_io(unsigned long error, unsigned long unsup, void *context)
{
struct io_notify *endio = context;
if (unlikely(error != 0))
writecache_error(endio->wc, -EIO, "error writing metadata");
+ else if (unlikely(unsup != 0))
+ writecache_error(endio->wc, -EOPNOTSUPP, "error writing metadata");
BUG_ON(atomic_read(&endio->count) <= 0);
if (atomic_dec_and_test(&endio->count))
complete(&endio->c);
@@ -530,11 +532,11 @@ static void ssd_commit_flushed(struct dm
req.notify.context = &endio;
/* writing via async dm-io (implied by notify.fn above) won't return an error */
- (void) dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT);
+ (void) dm_io(&req, 1, ®ion, NULL, NULL, IOPRIO_DEFAULT);
i = j;
}
- writecache_notify_io(0, &endio);
+ writecache_notify_io(0, 0, &endio);
wait_for_completion_io(&endio.c);
if (wait_for_ios)
@@ -567,7 +569,7 @@ static void ssd_commit_superblock(struct
req.notify.fn = NULL;
req.notify.context = NULL;
- r = dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&req, 1, ®ion, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r))
writecache_error(wc, r, "error writing superblock");
}
@@ -595,7 +597,7 @@ static void writecache_disk_flush(struct
req.client = wc->dm_io;
req.notify.fn = NULL;
- r = dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT);
+ r = dm_io(&req, 1, ®ion, NULL, NULL, IOPRIO_DEFAULT);
if (unlikely(r))
writecache_error(wc, r, "error flushing metadata: %d", r);
}
@@ -989,7 +991,7 @@ static int writecache_read_metadata(stru
req.client = wc->dm_io;
req.notify.fn = NULL;
- return dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT);
+ return dm_io(&req, 1, ®ion, NULL, NULL, IOPRIO_DEFAULT);
}
static void writecache_resume(struct dm_target *ti)
--- a/include/linux/dm-io.h
+++ b/include/linux/dm-io.h
@@ -27,7 +27,7 @@ struct page_list {
struct page *page;
};
-typedef void (*io_notify_fn)(unsigned int long error, void *context);
+typedef void (*io_notify_fn)(unsigned long int error, unsigned long int unsup, void *context);
enum dm_io_mem_type {
DM_IO_PAGE_LIST,/* Page list */
@@ -80,8 +80,8 @@ void dm_io_client_destroy(struct dm_io_c
* error occurred doing io to the corresponding region.
*/
int dm_io(struct dm_io_request *io_req, unsigned int num_regions,
- struct dm_io_region *region, unsigned int long *sync_error_bits,
- unsigned short ioprio);
+ struct dm_io_region *region, unsigned long int *sync_error_bits,
+ unsigned long int *sync_unsup_bits, unsigned short ioprio);
#endif /* __KERNEL__ */
#endif /* _LINUX_DM_IO_H */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 326/713] dm-era: fix shadowed superblock leak on take-snap failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 325/713] dm-io: report non-retryable errors separatedly Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 327/713] dm raid1: reserve space for NUL-terminator in build_constructor_string() Greg Kroah-Hartman
` (397 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, liyouhong, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: liyouhong <liyouhong@kylinos.cn>
commit 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 upstream.
metadata_take_snap() bumps the live superblock refcount and then
dm_tm_shadow_block() allocates a new block for the metadata snapshot.
If the subsequent dm_sm_inc_block() of writeset_tree_root or
era_array_root fails, the function only unlocks the clone and
returns. The newly allocated shadow block is never returned to the
metadata space map, so each failed take-snap permanently leaks one
metadata block.
Free the clone with dm_sm_dec_block() on those error paths, matching
the final step of metadata_drop_snap().
Fixes: eec40579d848 ("dm: add era target")
Cc: stable@vger.kernel.org
Signed-off-by: liyouhong <liyouhong@kylinos.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -1034,6 +1034,7 @@ static int metadata_checkpoint(struct er
static int metadata_take_snap(struct era_metadata *md)
{
int r, inc;
+ dm_block_t location;
struct dm_block *clone;
if (md->metadata_snap != SUPERBLOCK_LOCATION) {
@@ -1071,7 +1072,9 @@ static int metadata_take_snap(struct era
r = dm_sm_inc_block(md->sm, md->writeset_tree_root);
if (r) {
DMERR("%s: couldn't inc writeset tree root", __func__);
+ location = dm_block_location(clone);
dm_tm_unlock(md->tm, clone);
+ dm_sm_dec_block(md->sm, location);
return r;
}
@@ -1079,7 +1082,9 @@ static int metadata_take_snap(struct era
if (r) {
DMERR("%s: couldn't inc era tree root", __func__);
dm_sm_dec_block(md->sm, md->writeset_tree_root);
+ location = dm_block_location(clone);
dm_tm_unlock(md->tm, clone);
+ dm_sm_dec_block(md->sm, location);
return r;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 327/713] dm raid1: reserve space for NUL-terminator in build_constructor_string()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 326/713] dm-era: fix shadowed superblock leak on take-snap failure Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 328/713] dm array: validate array block headers on read Greg Kroah-Hartman
` (396 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Krutskih, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Krutskih <devsec@tpz.ru>
commit 73c37fe54cd056d07461b142ab0b8b81e1ef6ad8 upstream.
Reserve space for the termination NUL after the maximum 20 decimal
digits of a long long value to avoid buffer overflow in sprintf().
Fixes: f5db4af466e2 ("dm raid1: add userspace log")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Krutskih <devsec@tpz.ru>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-log-userspace-base.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -139,6 +139,7 @@ static int build_constructor_string(stru
str_size += strlen(argv[i]) + 1; /* +1 for space between args */
str_size += 20; /* Max number of chars in a printed u64 number */
+ str_size++; /* For NUL-terminator */
str = kzalloc(str_size, GFP_KERNEL);
if (!str) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 328/713] dm array: validate array block headers on read
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 327/713] dm raid1: reserve space for NUL-terminator in build_constructor_string() Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 329/713] dm array: reject an array block whose value size is not the callers Greg Kroah-Hartman
` (395 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming-Hung Tsai, Bryam Vargas,
Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 2965787723084835b18dfe993cd450ebf5bd4540 upstream.
array_block_check() validates blocknr and csum and nothing else, while
node_check(), next to it, has bounded the structural fields since both
were written. dm_array_cursor_next() takes its loop bound from the
on-disk nr_entries and element_at() is unguarded pointer arithmetic, so
a count larger than the block holds keeps the cursor in one block while
the index grows past it and the read walks off the dm-bufio buffer --
dm_cache_load_mappings() drives it once per cache block at activation.
Check the header against itself: reject a zero value_size, require
max_entries to equal calc_max_entries() for that value_size and block
size, and require nr_entries to fit. Equality rather than an upper bound,
since a count below the real capacity trips BUG_ON() in fill_ablock() and
trim_ablock(). Metadata dm-array writes satisfies all three.
Fixes: 6513c29f44f2 ("dm persistent data: add transactional array")
Suggested-by: Ming-Hung Tsai <mtsai@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-array.c | 37 ++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -38,6 +38,14 @@ struct array_block {
*/
#define CSUM_XOR 595846735
+/*
+ * Each array block can hold this many values.
+ */
+static uint32_t calc_max_entries(size_t value_size, size_t size_of_block)
+{
+ return (size_of_block - sizeof(struct array_block)) / value_size;
+}
+
static void array_block_prepare_for_write(const struct dm_block_validator *v,
struct dm_block *b,
size_t size_of_block)
@@ -55,6 +63,7 @@ static int array_block_check(const struc
size_t size_of_block)
{
struct array_block *bh_le = dm_block_data(b);
+ uint32_t nr_entries, max_entries, value_size;
__le32 csum_disk;
if (dm_block_location(b) != le64_to_cpu(bh_le->blocknr)) {
@@ -74,6 +83,26 @@ static int array_block_check(const struc
return -EILSEQ;
}
+ nr_entries = le32_to_cpu(bh_le->nr_entries);
+ max_entries = le32_to_cpu(bh_le->max_entries);
+ value_size = le32_to_cpu(bh_le->value_size);
+
+ if (!value_size) {
+ DMERR_LIMIT("%s failed: value_size is zero", __func__);
+ return -EILSEQ;
+ }
+
+ if (max_entries != calc_max_entries(value_size, size_of_block)) {
+ DMERR_LIMIT("%s failed: max_entries %u invalid for value_size %u",
+ __func__, max_entries, value_size);
+ return -EILSEQ;
+ }
+
+ if (nr_entries > max_entries) {
+ DMERR_LIMIT("%s failed: too many entries", __func__);
+ return -EILSEQ;
+ }
+
return 0;
}
@@ -139,14 +168,6 @@ static void dec_ablock_entries(struct dm
}
/*
- * Each array block can hold this many values.
- */
-static uint32_t calc_max_entries(size_t value_size, size_t size_of_block)
-{
- return (size_of_block - sizeof(struct array_block)) / value_size;
-}
-
-/*
* Allocate a new array block. The caller will need to unlock block.
*/
static int alloc_ablock(struct dm_array_info *info, size_t size_of_block,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 329/713] dm array: reject an array block whose value size is not the callers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 328/713] dm array: validate array block headers on read Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 330/713] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Greg Kroah-Hartman
` (394 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming-Hung Tsai, Bryam Vargas,
Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 4538a287bdf5d0f9a379c678e5262b9f5783f547 upstream.
array_block_check() can only compare the header against itself, so a block
with value_size 4 and max_entries 1018 is internally consistent and passes.
dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the
roots for both live in the superblock. Point the mappings root at a hint
block and __load_mappings() walks it through an info whose value size is 8,
so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160
of a 4096-byte block.
get_ablock() and __shadow_ablock() are the two places that hold the block
and the caller at once. Reject there when the two value sizes disagree.
Arrays only ever read their own blocks, so this fires on crafted metadata
only.
Fixes: 6513c29f44f2 ("dm persistent data: add transactional array")
Suggested-by: Ming-Hung Tsai <mtsai@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-array.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -246,6 +246,14 @@ static int get_ablock(struct dm_array_in
return r;
*ab = dm_block_data(*block);
+ if (le32_to_cpu((*ab)->value_size) != info->value_type.size) {
+ DMERR_LIMIT("%s failed: value_size %u != wanted %u", __func__,
+ le32_to_cpu((*ab)->value_size),
+ info->value_type.size);
+ dm_tm_unlock(info->btree_info.tm, *block);
+ return -EILSEQ;
+ }
+
return 0;
}
@@ -308,6 +316,14 @@ static int __shadow_ablock(struct dm_arr
return r;
*ab = dm_block_data(*block);
+ if (le32_to_cpu((*ab)->value_size) != info->value_type.size) {
+ DMERR_LIMIT("%s failed: value_size %u != wanted %u", __func__,
+ le32_to_cpu((*ab)->value_size),
+ info->value_type.size);
+ dm_tm_unlock(info->btree_info.tm, *block);
+ return -EILSEQ;
+ }
+
if (inc)
inc_ablock_entries(info, *ab);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 330/713] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 329/713] dm array: reject an array block whose value size is not the callers Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 331/713] cpufreq: apple-soc: Fix OPP table cleanup Greg Kroah-Hartman
` (393 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, James Clark,
Suzuki K Poulose
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
commit 41fb4e925528aefa4b7a5f76c7f81db99c0d0f38 upstream.
The cntr_val_show() function was intended to print the values of all
counters using a loop. However, due to a buffer overwrite issue with
sprintf(), it effectively only displayed the value of the last counter.
The companion function, cntr_val_store(), allows users to modify a
specific counter selected by 'cntr_idx'. To maintain consistency
between read and write operations and to align with the ETM4x driver
behavior, modify cntr_val_show() to report only the value of the
currently selected counter.
This change removes the loop and the "counter %d:" prefix, printing
only the hexadecimal value. It also adopts sysfs_emit() for standard
sysfs output formatting.
Fixes: a939fc5a71ad ("coresight-etm: add CoreSight ETM/PTM driver")
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251202082613.3265761-1-visitorckw@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
--- a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
@@ -717,26 +717,19 @@ static DEVICE_ATTR_RW(cntr_rld_event);
static ssize_t cntr_val_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
- int i, ret = 0;
u32 val;
struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
struct etm_config *config = &drvdata->config;
if (!coresight_get_mode(drvdata->csdev)) {
spin_lock(&drvdata->spinlock);
- for (i = 0; i < drvdata->nr_cntr; i++)
- ret += sprintf(buf, "counter %d: %x\n",
- i, config->cntr_val[i]);
+ val = config->cntr_val[config->cntr_idx];
spin_unlock(&drvdata->spinlock);
- return ret;
+ } else {
+ val = etm_readl(drvdata, ETMCNTVRn(config->cntr_idx));
}
- for (i = 0; i < drvdata->nr_cntr; i++) {
- val = etm_readl(drvdata, ETMCNTVRn(i));
- ret += sprintf(buf, "counter %d: %x\n", i, val);
- }
-
- return ret;
+ return sysfs_emit(buf, "%#x\n", val);
}
static ssize_t cntr_val_store(struct device *dev,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 331/713] cpufreq: apple-soc: Fix OPP table cleanup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 330/713] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Greg Kroah-Hartman
@ 2026-09-04 4:54 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 332/713] cpufreq: schedutil: Fix rate limit overflow Greg Kroah-Hartman
` (392 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Viresh Kumar
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit d87cb889dc7ab1f2deecadf2a5e9023184bd7900 upstream.
apple_soc_cpufreq_init() adds OPP tables from firmware, but
some failure paths do not remove them. The driver also uses
dev_pm_opp_remove_all_dynamic(), which is not the right cleanup
helper for OPP tables loaded from firmware.
Use the cpumask OPP helper after the policy CPU mask has been
populated. Pair it with the matching cpumask remove helper on
failure paths and in apple_soc_cpufreq_exit(). This also removes
the separate dev_pm_opp_set_sharing_cpus() call, as the cpumask
helper loads the DT OPP tables for all CPUs in the policy.
Fixes: 6286bbb40576 ("cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/apple-soc-cpufreq.c | 36 ++++++++++++++----------------------
1 file changed, 14 insertions(+), 22 deletions(-)
--- a/drivers/cpufreq/apple-soc-cpufreq.c
+++ b/drivers/cpufreq/apple-soc-cpufreq.c
@@ -249,21 +249,19 @@ static int apple_soc_cpufreq_init(struct
return -ENODEV;
}
- ret = dev_pm_opp_of_add_table(cpu_dev);
- if (ret < 0) {
- dev_err(cpu_dev, "%s: failed to add OPP table: %d\n", __func__, ret);
- return ret;
- }
+ priv = kzalloc_obj(*priv);
+ if (!priv)
+ return -ENOMEM;
ret = apple_soc_cpufreq_find_cluster(policy, ®_base, &info);
if (ret) {
dev_err(cpu_dev, "%s: failed to get cluster info: %d\n", __func__, ret);
- return ret;
+ goto out_free_priv;
}
- ret = dev_pm_opp_set_sharing_cpus(cpu_dev, policy->cpus);
- if (ret) {
- dev_err(cpu_dev, "%s: failed to mark OPPs as shared: %d\n", __func__, ret);
+ ret = dev_pm_opp_of_cpumask_add_table(policy->cpus);
+ if (ret < 0) {
+ dev_err(cpu_dev, "%s: failed to add OPP table: %d\n", __func__, ret);
goto out_iounmap;
}
@@ -271,19 +269,13 @@ static int apple_soc_cpufreq_init(struct
if (ret <= 0) {
dev_dbg(cpu_dev, "OPP table is not ready, deferring probe\n");
ret = -EPROBE_DEFER;
- goto out_free_opp;
- }
-
- priv = kzalloc_obj(*priv);
- if (!priv) {
- ret = -ENOMEM;
- goto out_free_opp;
+ goto out_free_table;
}
ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
if (ret) {
dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
- goto out_free_priv;
+ goto out_free_table;
}
/* Get OPP levels (p-state indexes) and stash them in driver_data */
@@ -318,12 +310,12 @@ static int apple_soc_cpufreq_init(struct
out_free_cpufreq_table:
dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
-out_free_priv:
- kfree(priv);
-out_free_opp:
- dev_pm_opp_remove_all_dynamic(cpu_dev);
+out_free_table:
+ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
out_iounmap:
iounmap(reg_base);
+out_free_priv:
+ kfree(priv);
return ret;
}
@@ -332,7 +324,7 @@ static void apple_soc_cpufreq_exit(struc
struct apple_cpu_priv *priv = policy->driver_data;
dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
- dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
iounmap(priv->reg_base);
kfree(priv);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 332/713] cpufreq: schedutil: Fix rate limit overflow
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-09-04 4:54 ` [PATCH 7.2 331/713] cpufreq: apple-soc: Fix OPP table cleanup Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 333/713] cxl/features: bound fwctl command payload to the input buffer Greg Kroah-Hartman
` (391 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Zhongqiu Han,
Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 3bff8f8e95fdc6ad19c8a1a8f87029094747e4bf upstream.
rate_limit_us is an unsigned int, while NSEC_PER_USEC is defined as
1000L. On 32-bit systems, the multiplication is therefore performed
using 32-bit unsigned arithmetic before the result is assigned to
freq_update_delay_ns.
For example, writing 4294968 to rate_limit_us wraps the delay from
4294968000 ns to 704 ns. This makes schedutil update far more often
than configured.
Add sugov_update_rate_limit_us() to widen rate_limit_us to s64 before
converting it to nanoseconds. Use the helper when updating the tunable
through sysfs and when starting the governor, so both paths perform the
conversion without overflow.
Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260806142304.1761454-1-sh_def@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/cpufreq_schedutil.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -61,6 +61,17 @@ static DEFINE_PER_CPU(struct sugov_cpu,
/************************ Governor internals ***********************/
+static void sugov_update_rate_limit_us(struct sugov_policy *sg_policy)
+{
+ /*
+ * Cast rate_limit_us before multiplication to force 64-bit arithmetic.
+ * Otherwise, on 32-bit platforms, both operands are converted to
+ * 32-bit unsigned long and the multiplication may overflow.
+ */
+ sg_policy->freq_update_delay_ns =
+ (s64)sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
+}
+
static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
{
s64 delta_ns;
@@ -606,7 +617,7 @@ rate_limit_us_store(struct gov_attr_set
tunables->rate_limit_us = rate_limit_us;
list_for_each_entry(sg_policy, &attr_set->policy_list, tunables_hook)
- sg_policy->freq_update_delay_ns = rate_limit_us * NSEC_PER_USEC;
+ sugov_update_rate_limit_us(sg_policy);
return count;
}
@@ -848,7 +859,7 @@ static int sugov_start(struct cpufreq_po
void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
unsigned int cpu;
- sg_policy->freq_update_delay_ns = sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
+ sugov_update_rate_limit_us(sg_policy);
sg_policy->last_freq_update_time = 0;
sg_policy->next_freq = 0;
sg_policy->work_in_progress = false;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 333/713] cxl/features: bound fwctl command payload to the input buffer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 332/713] cpufreq: schedutil: Fix rate limit overflow Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 334/713] cxl/mce: Make the MCE notifier per-region Greg Kroah-Hartman
` (390 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan,
Jason Gunthorpe, Dave Jiang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
commit f687394af983df5660b6afae7e0d06969f3af206 upstream.
fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len)
and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc()
ignores in_len and never checks the user-controlled op_size against it.
cxlctl_set_feature() bounds op_size only from below
(op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr)
bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len
and a large op_size the first memcpy() already reads past the
kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox
payload and sent to the device, and a large enough op_size can walk into
unmapped memory and oops the kernel. The Get paths pin op_size to a fixed
size but likewise read the input struct without checking in_len.
Reject, at the single dispatch point, any request whose fixed header plus
op_size does not fit in the copied-in buffer. The lower-bound test guards
the subtraction and ensures op_size was copied in before it is read.
Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/core/features.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/cxl/core/features.c
+++ b/drivers/cxl/core/features.c
@@ -649,7 +649,13 @@ static void *cxlctl_fw_rpc(struct fwctl_
struct cxl_memdev *cxlmd = fwctl_to_memdev(fwctl_dev);
struct cxl_features_state *cxlfs = to_cxlfs(cxlmd->cxlds);
const struct fwctl_rpc_cxl *rpc_in = in;
- u16 opcode = rpc_in->opcode;
+ u16 opcode;
+
+ if (in_len < sizeof(rpc_in->hdr) ||
+ rpc_in->op_size > in_len - sizeof(rpc_in->hdr))
+ return ERR_PTR(-EINVAL);
+
+ opcode = rpc_in->opcode;
if (!cxlctl_validate_hw_command(cxlfs, rpc_in, scope, opcode))
return ERR_PTR(-EINVAL);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 334/713] cxl/mce: Make the MCE notifier per-region
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 333/713] cxl/features: bound fwctl command payload to the input buffer Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 335/713] cxl/pmem: Format the nvdimm serial number as unsigned decimal Greg Kroah-Hartman
` (389 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Flavien Solt, Dan Williams,
Alison Schofield, Ben Cheatham, Dave Jiang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
commit 775d0f4558f4cec0ee0c8966595d1add1791f36e upstream.
Flavien Solt reported lifetime issues with the CXL MCE notifier, which
can lead to NULL dereferences and use-after-free in the MCE handler.
The notifier was registered per memory device and stored in 'struct
cxl_memdev_state', even though it only needs the region state (the
region's SPA range and its extended linear cache size).
Instead of keeping the memory device and endpoint alive, the correct fix
is to move the notifier into 'struct cxl_region' and register it from
cxl_region_probe() as it should be a per-region notifier. Setup the
registration to only happen for regions that have an extended linear
cache as that is the only current usage.
Remove cxl_port_get_spa_cache_alias() as it is now dead code.
[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
Reported-by: Flavien Solt <flavien@nus.edu.sg>
Suggested-by: Dan Williams <djbw@kernel.org>
Fixes: 516e5bd0b6bf ("cxl: Add mce notifier to emit aliased address for extended linear cache")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Link: https://patch.msgid.link/20260616224912.2567474-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/core/mbox.c | 8 --------
drivers/cxl/core/mce.c | 27 +++++++++++++--------------
drivers/cxl/core/region.c | 43 +++++++++++++++----------------------------
drivers/cxl/cxl.h | 8 ++------
drivers/cxl/cxlmem.h | 2 --
5 files changed, 30 insertions(+), 58 deletions(-)
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -11,7 +11,6 @@
#include "core.h"
#include "trace.h"
-#include "mce.h"
static bool cxl_raw_allow_all;
@@ -1526,7 +1525,6 @@ struct cxl_memdev_state *cxl_memdev_stat
u16 dvsec)
{
struct cxl_memdev_state *mds;
- int rc;
mds = devm_cxl_dev_state_create(dev, CXL_DEVTYPE_CLASSMEM, serial,
dvsec, struct cxl_memdev_state, cxlds,
@@ -1538,12 +1536,6 @@ struct cxl_memdev_state *cxl_memdev_stat
mutex_init(&mds->event.log_lock);
- rc = devm_cxl_register_mce_notifier(dev, &mds->mce_notifier);
- if (rc == -EOPNOTSUPP)
- dev_warn(dev, "CXL MCE unsupported\n");
- else if (rc)
- return ERR_PTR(rc);
-
return mds;
}
EXPORT_SYMBOL_NS_GPL(cxl_memdev_state_create, "CXL");
--- a/drivers/cxl/core/mce.c
+++ b/drivers/cxl/core/mce.c
@@ -4,16 +4,16 @@
#include <linux/notifier.h>
#include <linux/set_memory.h>
#include <asm/mce.h>
-#include <cxlmem.h>
+#include <cxl.h>
+#include "core.h"
#include "mce.h"
static int cxl_handle_mce(struct notifier_block *nb, unsigned long val,
void *data)
{
- struct cxl_memdev_state *mds = container_of(nb, struct cxl_memdev_state,
- mce_notifier);
- struct cxl_memdev *cxlmd = mds->cxlds.cxlmd;
- struct cxl_port *endpoint = cxlmd->endpoint;
+ struct cxl_region *cxlr = container_of(nb, struct cxl_region,
+ mce_notifier);
+ struct cxl_region_params *p = &cxlr->params;
struct mce *mce = data;
u64 spa, spa_alias;
unsigned long pfn;
@@ -21,26 +21,25 @@ static int cxl_handle_mce(struct notifie
if (!mce || !mce_usable_address(mce))
return NOTIFY_DONE;
- if (!endpoint)
- return NOTIFY_DONE;
-
spa = mce->addr & MCI_ADDR_PHYSADDR;
- pfn = spa >> PAGE_SHIFT;
- if (!pfn_valid(pfn))
+ if (!cxl_resource_contains_addr(p->res, spa))
return NOTIFY_DONE;
- spa_alias = cxl_port_get_spa_cache_alias(endpoint, spa);
- if (spa_alias == ~0ULL)
- return NOTIFY_DONE;
+ if (spa >= p->res->start + p->cache_size)
+ spa_alias = spa - p->cache_size;
+ else
+ spa_alias = spa + p->cache_size;
pfn = spa_alias >> PAGE_SHIFT;
+ if (!pfn_valid(pfn))
+ return NOTIFY_DONE;
/*
* Take down the aliased memory page. The original memory page flagged
* by the MCE will be taken cared of by the standard MCE handler.
*/
- dev_emerg(mds->cxlds.dev, "Offlining aliased SPA address0: %#llx\n",
+ dev_emerg(&cxlr->dev, "Offlining aliased SPA address0: %#llx\n",
spa_alias);
if (!memory_failure(pfn, 0))
set_mce_nospec(pfn);
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -15,6 +15,7 @@
#include <cxlmem.h>
#include <cxl.h>
#include "core.h"
+#include "mce.h"
/**
* DOC: cxl core region
@@ -3859,34 +3860,6 @@ int cxl_add_to_region(struct cxl_endpoin
}
EXPORT_SYMBOL_NS_GPL(cxl_add_to_region, "CXL");
-u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint, u64 spa)
-{
- struct cxl_region_ref *iter;
- unsigned long index;
-
- if (!endpoint)
- return ~0ULL;
-
- guard(rwsem_write)(&cxl_rwsem.region);
-
- xa_for_each(&endpoint->regions, index, iter) {
- struct cxl_region_params *p = &iter->region->params;
-
- if (cxl_resource_contains_addr(p->res, spa)) {
- if (!p->cache_size)
- return ~0ULL;
-
- if (spa >= p->res->start + p->cache_size)
- return spa - p->cache_size;
-
- return spa + p->cache_size;
- }
- }
-
- return ~0ULL;
-}
-EXPORT_SYMBOL_NS_GPL(cxl_port_get_spa_cache_alias, "CXL");
-
static int is_system_ram(struct resource *res, void *arg)
{
struct cxl_region *cxlr = arg;
@@ -4217,6 +4190,20 @@ static int cxl_region_probe(struct devic
if (rc)
return rc;
+ /*
+ * Regions fronted by an extended linear cache need the MCE notifier to
+ * offline the aliased page on a memory error.
+ */
+ if (p->cache_size) {
+ rc = devm_cxl_register_mce_notifier(&cxlr->dev,
+ &cxlr->mce_notifier);
+ if (rc == -EOPNOTSUPP)
+ dev_warn(&cxlr->dev,
+ "CONFIG_CXL_MCE disabled, MCE notifier not registered\n");
+ else if (rc)
+ return rc;
+ }
+
rc = cxl_region_setup_poison(cxlr);
if (rc)
return rc;
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -478,6 +478,7 @@ struct cxl_region_params {
* @coord: QoS access coordinates for the region
* @node_notifier: notifier for setting the access coordinates to node
* @adist_notifier: notifier for calculating the abstract distance of node
+ * @mce_notifier: notifier for MCE
*/
struct cxl_region {
struct device dev;
@@ -493,6 +494,7 @@ struct cxl_region {
struct access_coordinate coord[ACCESS_COORDINATE_MAX];
struct notifier_block node_notifier;
struct notifier_block adist_notifier;
+ struct notifier_block mce_notifier;
};
struct cxl_nvdimm_bridge {
@@ -870,7 +872,6 @@ bool is_cxl_pmem_region(struct device *d
struct cxl_pmem_region *to_cxl_pmem_region(struct device *dev);
int cxl_add_to_region(struct cxl_endpoint_decoder *cxled);
struct cxl_dax_region *to_cxl_dax_region(struct device *dev);
-u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint, u64 spa);
bool cxl_region_contains_resource(const struct resource *res);
#else
static inline bool is_cxl_pmem_region(struct device *dev)
@@ -889,11 +890,6 @@ static inline struct cxl_dax_region *to_
{
return NULL;
}
-static inline u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint,
- u64 spa)
-{
- return 0;
-}
static inline bool cxl_region_contains_resource(const struct resource *res)
{
return false;
--- a/drivers/cxl/cxlmem.h
+++ b/drivers/cxl/cxlmem.h
@@ -431,7 +431,6 @@ static inline struct cxl_dev_state *mbox
* @poison: poison driver state info
* @security: security driver state info
* @fw: firmware upload / activation state
- * @mce_notifier: MCE notifier
*
* See CXL 3.0 8.2.9.8.2 Capacity Configuration and Label Storage for
* details on capacity parameters.
@@ -451,7 +450,6 @@ struct cxl_memdev_state {
struct cxl_poison_state poison;
struct cxl_security_state security;
struct cxl_fw_state fw;
- struct notifier_block mce_notifier;
};
static inline struct cxl_memdev_state *
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 335/713] cxl/pmem: Format the nvdimm serial number as unsigned decimal
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 334/713] cxl/mce: Make the MCE notifier per-region Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 336/713] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Greg Kroah-Hartman
` (388 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Williams, Alison Schofield,
Dave Jiang
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <alison.schofield@intel.com>
commit 8a80d3d65cd06ee35b913d8517fb2f2319f8e70c upstream.
The CXL NVDIMM security passphrase key description and the nvdimm 'id'
sysfs attribute are both derived from the CXL device serial number,
but the serial number is not formatted consistently.
The key description is formatted in hexadecimal while the 'id'
attribute is formatted in decimal. As a result, ndctl stores the key
using a decimal description while the kernel later looks it up using
a hexadecimal description. For serial numbers of 10 and above, the
descriptions no longer match, preventing automatic unlock after
reboot.
The decimal formatting has a second problem: both the key description
and the 'id' attribute use the signed %lld format for a u64 PCIe
Device Serial Number. Devices whose vendor OUI sets bit 63, such as
Montage CXL devices, appear with negative decimal serial numbers.
Format the security key description and 'id' attribute as unsigned
decimal, %llu, and document that the 'id' attribute is an unsigned
decimal value.
The key lookup mismatch was exposed by CXL unit test cxl-security.sh
when cxl_test mock serial numbers were extended to 10 and above.
A work around is described for ndctl load-key users here:
https://github.com/pmem/ndctl/issues/299
Cc: stable@vger.kernel.org
Fixes: b5807c80b5bc ("cxl: add dimm_id support for __nvdimm_create()")
Acked-by: Dan Williams <djbw@kernel.org>
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/2c673a5ba0a8fa93ad160578e193bd556091fa95.1784924949.git.alison.schofield@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 ++-
drivers/cxl/core/pmem.c | 10 ++++++----
drivers/cxl/cxl.h | 3 ++-
drivers/cxl/pmem.c | 2 +-
4 files changed, 11 insertions(+), 7 deletions(-)
--- a/Documentation/ABI/testing/sysfs-bus-nvdimm
+++ b/Documentation/ABI/testing/sysfs-bus-nvdimm
@@ -48,7 +48,8 @@ What: /sys/bus/nd/devices/nmemX/cxl/id
Date: November 2022
KernelVersion: 6.2
Contact: Dave Jiang <dave.jiang@intel.com>
-Description: (RO) Show the id (serial) of the device. This is CXL specific.
+Description: (RO) Show the id (serial) of the device, formatted as an
+ unsigned 64-bit decimal value. This is CXL specific.
What: /sys/bus/nd/devices/nmemX/cxl/provider
Date: November 2022
--- a/drivers/cxl/core/pmem.c
+++ b/drivers/cxl/core/pmem.c
@@ -219,12 +219,14 @@ static struct cxl_nvdimm *cxl_nvdimm_all
dev->bus = &cxl_bus_type;
dev->type = &cxl_nvdimm_type;
/*
- * A "%llx" string is 17-bytes vs dimm_id that is max
- * NVDIMM_KEY_DESC_LEN
+ * dev_id is the nvdimm dimm_id used for security key lookup.
+ * It must match id_show(), which emits the CXL serial as an
+ * unsigned decimal. A u64 decimal string is at most 20 digits
+ * plus NUL.
*/
- BUILD_BUG_ON(sizeof(cxl_nvd->dev_id) < 17 ||
+ BUILD_BUG_ON(sizeof(cxl_nvd->dev_id) < 21 ||
sizeof(cxl_nvd->dev_id) > NVDIMM_KEY_DESC_LEN);
- sprintf(cxl_nvd->dev_id, "%llx", cxlmd->cxlds->serial);
+ sprintf(cxl_nvd->dev_id, "%llu", cxlmd->cxlds->serial);
return cxl_nvd;
}
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -505,7 +505,8 @@ struct cxl_nvdimm_bridge {
struct nvdimm_bus_descriptor nd_desc;
};
-#define CXL_DEV_ID_LEN 19
+/* Holds a u64 serial as a decimal string: up to 20 digits + NUL */
+#define CXL_DEV_ID_LEN 21
enum {
CXL_NVD_F_INVALIDATED = 0,
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -52,7 +52,7 @@ static ssize_t id_show(struct device *de
struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
struct cxl_dev_state *cxlds = cxl_nvd->cxlmd->cxlds;
- return sysfs_emit(buf, "%lld\n", cxlds->serial);
+ return sysfs_emit(buf, "%llu\n", cxlds->serial);
}
static DEVICE_ATTR_RO(id);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 336/713] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 335/713] cxl/pmem: Format the nvdimm serial number as unsigned decimal Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 337/713] Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Greg Kroah-Hartman
` (387 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Terry Bowman, Jonathan Cameron,
Dave Jiang, Richard Cheng, Alison Schofield
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Bowman <terry.bowman@amd.com>
commit 9d399526128bae184b153deab42b49f5f3eea2ed upstream.
cxl_rch_get_aer_severity() classifies RCH Downstream Port uncorrectable
errors as fatal or non-fatal by ANDing uncorrectable status with
PCI_ERR_ROOT_FATAL_RCV. This is wrong because PCI_ERR_ROOT_FATAL_RCV is a
Root Error Status register bit (bit 6), not a severity bit. ANDing it
against uncorrectable status tests a reserved bit and produces incorrect
severity classification.
Fix by ANDing the unmasked uncor_status against uncor_severity. Per
PCIe Base Spec r6.0 Section 7.8.4.4, each bit in the Uncorrectable
Error Severity register indicates whether the corresponding error is
fatal (1) or non-fatal (0).
Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging")
Cc: stable@vger.kernel.org
Signed-off-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260803221810.3685703-3-terry.bowman@amd.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/core/ras_rch.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/cxl/core/ras_rch.c
+++ b/drivers/cxl/core/ras_rch.c
@@ -94,11 +94,11 @@ static bool cxl_rch_get_aer_info(void __
static bool cxl_rch_get_aer_severity(struct aer_capability_regs *aer_regs,
int *severity)
{
- if (aer_regs->uncor_status & ~aer_regs->uncor_mask) {
- if (aer_regs->uncor_status & PCI_ERR_ROOT_FATAL_RCV)
- *severity = AER_FATAL;
- else
- *severity = AER_NONFATAL;
+ u32 uncor_status = aer_regs->uncor_status & ~aer_regs->uncor_mask;
+
+ if (uncor_status) {
+ *severity = (uncor_status & aer_regs->uncor_severity) ?
+ AER_FATAL : AER_NONFATAL;
return true;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 337/713] Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 336/713] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 338/713] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
` (386 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Sven Peter,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
commit aec6a8d80e3da0ab5c9303a0281fd06d077f8716 upstream.
Commit ed2a2ef16a6b ("Bluetooth: Add quirk to ignore reserved PHY bits in
LE Extended Adv Report") added a quirk to handle creative use of the
reserved bits in the PHY fields for 4388 controllers in Apple silicon.
I observed the same issue with the BCM4378 Bluetooth controller (14e4:5f69,
rev 05) on an Apple MacBook Pro (13-inch, M2, 2022):
> HCI Event: LE Meta Event (0x3e) plen 51
LE Extended Advertising Report (0x0d)
Num reports: 1
Entry 0
Event type: 0x2513
Props: 0x0013
Connectable
Scannable
Use legacy advertising PDUs
Data status: Complete
Reserved (0x2500)
Legacy PDU Type: Reserved (0x2513)
Address type: Random (0x01)
Address: EA:C1:82:F0:24:C6 (Static)
Primary PHY: Reserved
Secondary PHY: No packets
SID: no ADI field (0xff)
TX power: 127 dBm
RSSI: -57 dBm (0xc7)
Periodic advertising interval: 0.00 msec (0x0000)
Direct address type: Public (0x00)
Direct address: 00:00:00:00:00:00 (OUI 00-00-00)
Data length: 25
This results in the firmware rejecting connection attempts with
"Unsupported Feature or Parameter Value" (0x11).
Fix the issue by using the same quirk for BCM4378 devices too.
I tested this locally and confirmed that the issue is resolved.
This was observed when attempting to connect a Kinesis Advantage 360
keyboard to the MacBook.
Assisted-by: Claude:claude-fable-5
Fixes: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Sven Peter <sven@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_bcm4377.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/hci_bcm4377.c
+++ b/drivers/bluetooth/hci_bcm4377.c
@@ -2490,6 +2490,7 @@ static const struct bcm4377_hw bcm4377_h
.has_bar0_core2_window2 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .broken_le_ext_adv_report_phy = true,
.send_calibration = bcm4378_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 338/713] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 337/713] Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 339/713] Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Greg Kroah-Hartman
` (385 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit dc6b7c771a963e20aedf4a21ffa22543b9837ba8 upstream.
bcm_request_irq() calls pm_runtime_use_autosuspend(), but bcm_close()
does not call the matching pm_runtime_dont_use_autosuspend() when
tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: e88ab30d3669 ("Bluetooth: hci_bcm: Add suspend/resume runtime PM functions")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_bcm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -547,6 +547,7 @@ static int bcm_close(struct hci_uart *hu
if (IS_ENABLED(CONFIG_PM) && bdev->irq_acquired) {
devm_free_irq(bdev->dev, bdev->irq, bdev);
device_init_wakeup(bdev->dev, false);
+ pm_runtime_dont_use_autosuspend(bdev->dev);
pm_runtime_disable(bdev->dev);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 339/713] Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 338/713] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 340/713] Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Greg Kroah-Hartman
` (384 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gongwei Li, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gongwei Li <ligongwei@kylinos.cn>
commit a9355799343e10014f2acfd4b6844d2335ecafea upstream.
When reading the local version information for vendor detection
fails, the error is only printed and 0 is returned, which masks the
setup failure from the HCI core.
Return PTR_ERR(skb) instead.
Fixes: fb2ce8d11f039 ("Bluetooth: hci_uart: Add support for vendor detection flag")
Fixes: 82f5169bf3d3b ("Bluetooth: hci_uart: add serdev driver support library")
Cc: stable@vger.kernel.org
Signed-off-by: Gongwei Li <ligongwei@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_ldisc.c | 2 +-
drivers/bluetooth/hci_serdev.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -451,7 +451,7 @@ static int hci_uart_setup(struct hci_dev
if (IS_ERR(skb)) {
BT_ERR("%s: Reading local version information failed (%ld)",
hdev->name, PTR_ERR(skb));
- return 0;
+ return PTR_ERR(skb);
}
if (skb->len != sizeof(*ver)) {
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -221,7 +221,7 @@ static int hci_uart_setup(struct hci_dev
if (IS_ERR(skb)) {
bt_dev_err(hdev, "Reading local version info failed (%ld)",
PTR_ERR(skb));
- return 0;
+ return PTR_ERR(skb);
}
if (skb->len != sizeof(*ver))
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 340/713] Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 339/713] Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 341/713] Bluetooth: RFCOMM: serialize security confirmation handling Greg Kroah-Hartman
` (383 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hang Nan, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Nan <2122295973@qq.com>
commit 560bef609fa5992745929e8d7d458b9d88dd2830 upstream.
iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:
parent = iso_get_sock(hdev, ...);
if (!parent)
return;
lock_sock(parent);
sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
...
iso_chan_add(conn, sk, parent);
...
release_sock(parent);
sock_put(parent);
If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed. The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free). The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().
Fix it the same way the connected (non-BIS) path was fixed in commit
0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"):
after taking the socket lock, re-check that the parent is still a
listening, alive socket, and bail out otherwise.
Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type")
Cc: stable@vger.kernel.org
Signed-off-by: Hang Nan <2122295973@qq.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/iso.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2277,6 +2277,14 @@ static void iso_conn_ready(struct iso_co
lock_sock(parent);
+ /* The listener may have been closed concurrently. */
+ if (parent->sk_state != BT_LISTEN ||
+ sock_flag(parent, SOCK_ZAPPED)) {
+ release_sock(parent);
+ sock_put(parent);
+ return;
+ }
+
sk = iso_sock_alloc(sock_net(parent), NULL,
BTPROTO_ISO, GFP_ATOMIC, 0);
if (!sk) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 341/713] Bluetooth: RFCOMM: serialize security confirmation handling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 340/713] Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 342/713] Bluetooth: hci_conn: re-enable advertising only for peripheral role Greg Kroah-Hartman
` (382 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit 759c185d0bbdb131357408f50b8735e04ed3caff upstream.
rfcomm_security_cfm() looks up a session on session_list and then walks
its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown
uses rfcomm_mutex, krfcommd can close and free the same session and DLCs
concurrently:
hci_rx_work krfcommd
----------- ---------
rfcomm_session_get()
rfcomm_lock()
rfcomm_session_close()
rfcomm_dlc_unlink()
rfcomm_session_del()
kfree(s)
rfcomm_unlock()
walk s->dlcs
The callback can then read a freed session list head and touch freed DLCs
while updating their flags or timers.
Serialize the session lookup and DLC traversal in rfcomm_security_cfm()
with rfcomm_mutex. This matches the existing RFCOMM session lifetime
rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()
from tearing the objects down while the callback is using them.
KASAN reported:
BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440
Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89
Workqueue: hci0 hci_rx_work
Call Trace:
rfcomm_security_cfm+0x41c/0x440
hci_encrypt_cfm+0x139/0x590
hci_encrypt_change_evt+0x37b/0xc40
hci_event_packet+0x71b/0xb20
hci_rx_work+0x293/0x730
Allocated by task 69:
rfcomm_session_add+0x9e/0x2f0
rfcomm_run+0x44b/0x41e0
Freed by task 69:
kfree+0x131/0x3c0
rfcomm_session_del+0x188/0x220
rfcomm_run+0x1985/0x41e0
Fixes: 08c30aca9e698faddebd34f81e1196295f9dc063 ("Bluetooth: Remove RFCOMM session refcnt")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/rfcomm/core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2213,9 +2213,13 @@ static void rfcomm_security_cfm(struct h
BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
+ rfcomm_lock();
+
s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
- if (!s)
+ if (!s) {
+ rfcomm_unlock();
return;
+ }
list_for_each_entry_safe(d, n, &s->dlcs, list) {
if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
@@ -2247,6 +2251,8 @@ static void rfcomm_security_cfm(struct h
set_bit(RFCOMM_AUTH_REJECT, &d->flags);
}
+ rfcomm_unlock();
+
rfcomm_schedule();
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 342/713] Bluetooth: hci_conn: re-enable advertising only for peripheral role
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 341/713] Bluetooth: RFCOMM: serialize security confirmation handling Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 343/713] Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Greg Kroah-Hartman
` (381 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valentin Kindschi,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Kindschi <valentin.kindschi@fiveco.ch>
commit ed5fb41d3b6b6e665e7f97fd54bd1f9531c7477f upstream.
hci_le_conn_failed() unconditionally calls hci_enable_advertising(),
although its own comment states advertising should be re-enabled only
when the failed attempt was made as a peripheral.
hci_le_conn_failed() is reached from hci_conn_failed() for every failed
LE connection, including outgoing central connections. For a central
attempt this enable is redundant: hci_le_create_conn_sync() already
restores advertising via hci_resume_advertising_sync() in its done:
block. Because hci_enable_advertising() only queues the work on
cmd_sync_work, it runs *after* that resume has already succeeded and
set HCI_LE_ADV.
The resulting HCI sequence, captured on a BCM43455 (no LE Extended
Advertising, so legacy advertising is used):
LE Create Connection Status Success
... 13.8 s, peer never answers ...
LE Set Advertising Parameters (0x2006) Success <- done: resume,
LE Set Advertising Enable (0x200a) Success HCI_LE_ADV set
LE Create Connection Cancel (0x200e) Success
LE Connection Complete Unknown Conn Id
LE Set Advertising Parameters (0x2006) Command Disallowed (0x0c)
The last command is the queued enable from hci_le_conn_failed() running
as a second hci_enable_advertising_sync() pass. It clears HCI_LE_ADV
(hci_sync.c, "Clear the HCI_LE_ADV bit temporarily"), then sends
LE Set Advertising Parameters while the controller is still advertising,
which the controller correctly rejects with Command Disallowed.
The disable-first call at the top of hci_enable_advertising_sync()
cannot prevent this: hci_disable_advertising_sync() returns early
without sending anything when HCI_LE_ADV is clear, so it is a no-op
exactly when the flag is wrong.
hci_enable_advertising_sync() then returns without sending LE Set
Advertising Enable, so HCI_LE_ADV is never set again. The legacy
software rotation loop re-arms hci_schedule_adv_instance_sync() every
HCI_DEFAULT_ADV_DURATION (2 s), and its "already advertising" shortcut
tests HCI_LE_ADV, which can no longer become true. The command is
therefore retried every 2 s indefinitely:
Bluetooth: hci0: Opcode 0x2006 failed: -16
Observed on a gateway as 5326 occurrences over 3 hours, ending only when
bluetoothd was restarted. Connection attempts that succeed do not call
hci_le_conn_failed() and never trigger this.
Add the role test the comment already describes. Both other
hci_enable_advertising() call sites reached from a failed/closed LE
connection (hci_cs_disconnect() and hci_disconn_complete_evt()) already
guard on conn->role == HCI_ROLE_SLAVE; this one was missed.
Reproducing needs legacy advertising (ext_adv_capable() false, so the
software rotation loop is used), simultaneous peripheral advertising and
outgoing central connects, and a central connect that times out rather
than failing fast.
The Fixes tag points at the commit that introduced the advertising
restart into this path for the directed-advertising (peripheral) case;
the role test that the later commit 0b1db38ca26b ("Bluetooth: Fix check
for direct advertising") added to the sibling paths was never applied
here.
Fixes: 3c857757ef6e ("Bluetooth: Add directed advertising support through connect()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5 btmon
Signed-off-by: Valentin Kindschi <valentin.kindschi@fiveco.ch>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_conn.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1381,7 +1381,8 @@ static void hci_le_conn_failed(struct hc
/* Enable advertising in case this was a failed connection
* attempt as a peripheral.
*/
- hci_enable_advertising(hdev);
+ if (conn->role == HCI_ROLE_SLAVE)
+ hci_enable_advertising(hdev);
}
/* This function requires the caller holds hdev->lock */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 343/713] Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 342/713] Bluetooth: hci_conn: re-enable advertising only for peripheral role Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 344/713] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Greg Kroah-Hartman
` (380 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xin Chen, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Chen <xin.chen2@oss.qualcomm.com>
commit f5afdff569a09d1cb8cf19826199d024725576cb upstream.
BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log
shows the HCI Read Local Version command was sent and the firmware
replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),
but the waiter in __hci_cmd_sync_sk() never woke up and timed out
after 10 s:
bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk
bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add
bluetooth hci0: skb len 4 // hci_cmd_sync_alloc
bluetooth hci0: length 1 // hci_req_sync_run
Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work
Bluetooth: hci0 type 1 len 4 // hci_send_frame
Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete
<-- req_skb NULL: req_complete_skb not set,
hci_cmd_sync_complete() never called,
req_status stays HCI_REQ_PEND -->
<-- 10 s later: wait_event_interruptible_timeout expires -->
bluetooth hci0: end: err -110 // __hci_cmd_sync_sk
The root cause is that hci_send_cmd_sync() clones the sent command
into hdev->req_skb so that hci_req_cmd_complete() can locate the
registered completion callback. Under memory pressure this
skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply
is received and processed, but hci_req_cmd_complete() finds NULL
req_skb, so hci_cmd_sync_complete() is never called, req_status
stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.
req_skb is only used to read bt_cb(skb)->hci callbacks and opcode --
it is never modified. Replace skb_clone() with skb_get(), which
simply increments the reference count of hdev->sent_cmd without
allocating new memory and therefore cannot fail.
This issue was first observed as a use-after-free in ttyport_close()
when ttyport_open() failed, which was investigated in an earlier
patch series [1]. That investigation led to the discovery of the
true root cause described above.
[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/
Fixes: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback")
Cc: stable@vger.kernel.org
Signed-off-by: Xin Chen <xin.chen2@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4091,7 +4091,7 @@ static int hci_send_cmd_sync(struct hci_
if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND &&
!hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
kfree_skb(hdev->req_skb);
- hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
+ hdev->req_skb = skb_get(hdev->sent_cmd);
}
return err;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 344/713] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 343/713] Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 345/713] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
` (379 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valentin Kindschi,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Kindschi <valentin.kindschi@fiveco.ch>
commit 941929abe5feaed672b9a52e330e547d333240c6 upstream.
le_conn_complete_evt() clears HCI_LE_ADV before looking at the event
status, on the premise stated in its comment that all controllers stop
advertising when a connection is created.
That premise only holds when a connection was actually created. On a
non-zero status none was, and the controller is still advertising: after
the host issues LE Create Connection Cancel the event arrives with
Unknown Connection Identifier (0x02), and a connection timeout behaves
the same way. Clearing the flag there leaves the host believing
advertising is off while the controller has it on.
It is also wrong for extended advertising, where several sets can be
advertising at once. hci_cc_le_set_ext_adv_enable() is careful about
this - on disabling one set it walks hdev->adv_instances and only clears
HCI_LE_ADV once no instance is still enabled. The unconditional clear
here discards that bookkeeping, so one set connecting drops the flag
while the others keep advertising.
The direction of the error matters. A flag left set is self-correcting:
hci_disable_advertising_sync() sends LE Set Advertising Enable(0) and
the command complete puts the state back. A flag left clear is not,
because that same function returns early without sending anything while
the flag is clear:
- LE Set Advertising Parameters is then sent to a controller that is
still advertising, and is correctly rejected with Command Disallowed
(0x0c);
- hci_enable_advertising_sync() returns at that point, before the
LE Set Advertising Enable that would set HCI_LE_ADV again.
On a controller without LE Extended Advertising that is reachable from
here: hci_schedule_adv_instance_sync() re-arms adv_instance_expire every
HCI_DEFAULT_ADV_DURATION (2 s) and its "already advertising" shortcut
tests HCI_LE_ADV, which can no longer become true, so the parameter
write is retried for as long as advertising is configured:
Bluetooth: hci0: Opcode 0x2006 failed: -16
Only clear the flag when a connection was established.
Note this is not on its own sufficient to stop that retry loop - the
redundant enable queued by hci_le_conn_failed() clears HCI_LE_ADV itself
and recreates the same mismatch, which patch 1 addresses. This patch
fixes the event handler reporting a state the controller is not in.
Verified on the affected device (BCM43455, legacy advertising only) with
this patch and patch 1 applied. A 221 s btmon capture with an out-of-range
peer at -90 dBm contains two outgoing connection attempts that the host
cancelled, each producing exactly the event this patch changes:
< LE Set Advertising Parameters 0x2006 Success
< LE Set Advertising Enable 0x200a Success
< LE Create Connection Cancel 0x200e Success
> LE Connection Complete Unknown Connection Identifier (0x02), central
Nothing follows either one; the next command is an unrelated scan restart
70 ms later. Over the whole capture: 7 LE Set Advertising Parameters sent,
all Success; 10 LE Set Advertising Enable, all Success; no Command
Disallowed of any opcode, and no 2 s cadence anywhere. Two central
connections to other peers completed normally afterwards, with feature
exchange and a connection parameter update, so advertising was still live
across the cancelled attempts.
The extended advertising case above is a code argument, not a measurement:
this controller has no LE Extended Advertising, so that path is not
exercised by the capture.
Fixes: fbd96c151cdc ("Bluetooth: Fix clearing HCI_LE_ADV for LE connections")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5 btmon
Signed-off-by: Valentin Kindschi <valentin.kindschi@fiveco.ch>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5724,10 +5724,11 @@ static void le_conn_complete_evt(struct
hci_dev_lock(hdev);
hci_store_wake_reason(hdev, bdaddr, bdaddr_type);
- /* All controllers implicitly stop advertising in the event of a
- * connection, so ensure that the state bit is cleared.
+ /* Advertising stops when a connection is created. On a failed
+ * connection it keeps running, so leave the state bit alone.
*/
- hci_dev_clear_flag(hdev, HCI_LE_ADV);
+ if (!status)
+ hci_dev_clear_flag(hdev, HCI_LE_ADV);
/* Check for existing connection:
*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 345/713] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 344/713] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 346/713] Bluetooth: hci_intel: " Greg Kroah-Hartman
` (378 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 853a92b97ca547a7ddd9790ff90651b2fd943498 upstream.
h5_btrtl_open() calls pm_runtime_use_autosuspend(), but
h5_btrtl_close() does not call the matching
pm_runtime_dont_use_autosuspend() when tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: d9dd833cf6d2 ("Bluetooth: hci_h5: Add runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_h5.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -1023,8 +1023,10 @@ static void h5_btrtl_open(struct h5 *h5)
static void h5_btrtl_close(struct h5 *h5)
{
- if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags))
+ if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags)) {
+ pm_runtime_dont_use_autosuspend(&h5->hu->serdev->dev);
pm_runtime_disable(&h5->hu->serdev->dev);
+ }
gpiod_set_value_cansleep(h5->device_wake_gpio, 0);
gpiod_set_value_cansleep(h5->enable_gpio, 0);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 346/713] Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 345/713] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 347/713] Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Greg Kroah-Hartman
` (377 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit c7e9a8cb6918656884a0757c92465075c7555ffa upstream.
intel_set_power() calls pm_runtime_use_autosuspend() when powering on
the device, but the power-off path does not call the matching
pm_runtime_dont_use_autosuspend() before disabling runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped and usage_count remains
unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: 74cdad37cd24 ("Bluetooth: hci_intel: Add runtime PM support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -345,6 +345,7 @@ static int intel_set_power(struct hci_ua
devm_free_irq(&idev->pdev->dev, idev->irq, idev);
device_wakeup_disable(&idev->pdev->dev);
+ pm_runtime_dont_use_autosuspend(&idev->pdev->dev);
pm_runtime_disable(&idev->pdev->dev);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 347/713] Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 346/713] Bluetooth: hci_intel: " Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 348/713] kasan: fix cache shrink race with CPU hotplug Greg Kroah-Hartman
` (376 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Abdelkader, Hans de Goede,
Luiz Augusto von Dentz
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Abdelkader <iabdelka@qti.qualcomm.com>
commit cb19774faa57c51efa189d8b8606aeabccebc53b upstream.
A synchronous HCI command that never receives a response leaves
HCI_CMD_PENDING set: hci_req_cmd_complete() is the only place that clears
it, and it only runs when a response matching the last command sent
arrives.
hci_send_cmd_sync() populates hdev->req_skb only when the flag transitions
from clear to set, while hci_dev_open_sync() and hci_dev_close_sync() drop
req_skb without clearing the flag. After a timeout followed by either, the
two disagree: the flag claims a request is outstanding while req_skb is
NULL. Subsequent synchronous commands are then sent with no req_skb, so
hci_event_packet() has nothing to match an arriving event against, and the
caller times out even though the controller answered.
Commands answered by Command Complete recover on their own, since
hci_req_cmd_complete() clears the flag as a side effect. Drivers using
__hci_cmd_sync_ev() with a custom event do not, because a vendor event
never reaches that path. On a WCN3988 (hci_qca over UART) this makes a
controller firmware hang unrecoverable: the driver injects a hardware
error and re-runs qca_setup(), qca_read_soc_version() waits for
HCI_EV_VENDOR, the reply arrives within 4 ms and is discarded, and every
retry fails the same way. The adapter is left down until the driver is
unbound and rebound, or power is removed.
Clear the flag wherever the last request is dropped, restoring the
invariant that req_skb is non-NULL exactly when HCI_CMD_PENDING is set.
Verified on hardware by forcing a command timeout: without this change
setup fails on every attempt, with it setup succeeds on the first.
Fixes: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Abdelkader <iabdelka@qti.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_sync.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5374,6 +5374,7 @@ int hci_dev_open_sync(struct hci_dev *hd
if (hdev->req_skb) {
kfree_skb(hdev->req_skb);
hdev->req_skb = NULL;
+ hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
}
clear_bit(HCI_RUNNING, &hdev->flags);
@@ -5558,6 +5559,7 @@ int hci_dev_close_sync(struct hci_dev *h
if (hdev->req_skb) {
kfree_skb(hdev->req_skb);
hdev->req_skb = NULL;
+ hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
}
clear_bit(HCI_RUNNING, &hdev->flags);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 348/713] kasan: fix cache shrink race with CPU hotplug
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 347/713] Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 349/713] kho: fix size calculation in kho_preserved_memory_reserve() Greg Kroah-Hartman
` (375 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Su, Andrey Ryabinin,
Alexander Potapenko, Andrey Konovalov, Dmitry Vyukov,
Vincenzo Frascino, Zhang, Qiang1, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 8790303cbaac52a11dfed4aab261f8ea60682525 upstream.
kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on
all online CPUs. Each callback moves objects belonging to the cache from
cpu_quarantine to the CPU's shrink_qlist, where they can later be freed
from task context.
kmem_cache_destroy() invokes the quarantine removal path while holding
cpus_read_lock(), but kmem_cache_shrink() does not. The latter can
therefore race with CPU offlining as follows:
kmem_cache_shrink() CPU hotplug
------------------- -----------
on_each_cpu()
CPU1 moves objects to
CPU1's shrink_qlist
on_each_cpu() returns
CPU1 goes offline
kasan_cpu_offline()
drains cpu_quarantine
leaves shrink_qlist untouched
for_each_online_cpu()
skips CPU1
The objects left on CPU1's shrink_qlist are not returned to the slab
allocator. This may prevent kmem_cache_shrink() from releasing slabs that
would otherwise become empty. If CPU1 remains offline, a later
kmem_cache_destroy() also skips the list and can report that the cache
still contains objects.
An intermittent occurrence was observed with a virtio-9p filesystem. The
mount and umount commands both returned 0, but the kernel logged the
following during the userspace-triggered teardown:
[ 2994.380134][ T111] BUG 9p-fcall-cache-1 (Tainted: G B ): Objects remaining on __kmem_cache_shutdown()
[ 2994.381140][ T111] Object 0xff11000004361118 @offset=4376
[ 2994.381607][ T111] Allocated in p9_fcall_init+0x201/0x400 age=19564 cpu=1 pid=104
[ 2994.382591][ T111] p9_fcall_init+0x201/0x400
[ 2994.382810][ T111] p9_tag_alloc+0x12f/0x700
[ 2994.382982][ T111] p9_client_prepare_req+0x102/0x3e0
[ 2994.383165][ T111] p9_client_rpc+0x1ab/0xa50
[ 2994.383334][ T111] p9_client_getattr_dotl+0xb0/0x1a0
[ 2994.383515][ T111] v9fs_vfs_getattr_dotl+0x115/0x360
[ 2994.383719][ T111] vfs_getattr_nosec+0x22c/0x3a0
[ 2994.383910][ T111] vfs_statx+0xd7/0x170
[ 2994.384062][ T111] vfs_fstatat+0x45/0x80
[ 2994.384215][ T111] __do_sys_newfstatat+0x84/0xe0
[ 2994.384386][ T111] do_syscall_64+0x115/0x6a0
[ 2994.384566][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2994.399720][ T111] WARNING: mm/slub.c:1244 at __kmem_cache_shutdown+0x363/0x500, CPU#0: busybox/111
[ 2994.405655][ T111] Call Trace:
[ 2994.406325][ T111] kmem_cache_destroy+0x73/0x1b0
[ 2994.406630][ T111] p9_client_destroy+0x271/0x3c0
[ 2994.407210][ T111] v9fs_session_close+0x3c/0x260
[ 2994.407409][ T111] v9fs_kill_super+0x48/0x90
[ 2994.407584][ T111] deactivate_locked_super+0xa3/0x160
[ 2994.407778][ T111] cleanup_mnt+0x1dd/0x3e0
Thus, a successful umount left objects in the 9p fcall cache and prevented
the cache from being destroyed cleanly.
Per-CPU shrink_qlist storage exists for every possible CPU, and each list
is protected by its own raw spinlock. Iterate over possible CPUs so that
a list populated before its CPU went offline is drained as well.
for_each_possible_cpu() can do more work than for_each_online_cpu(), but
this change only affects CONFIG_KASAN_GENERIC kernels. The extra work is
limited to cache shrink and cache destruction paths and does not affect
the normal allocation/free fast path. It adds one raw-spinlock-protected
scan of each possible CPU's shrink list. These lists are normally empty;
a non-empty list is traversed to remove objects belonging to the cache
being shrunk or destroyed.
Link: https://lore.kernel.org/20260808031459.3032812-1-sh_def@163.com
Fixes: 07d067e4f2ce ("kasan: fix sleeping function called from invalid context on RT kernel")
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: "Zhang, Qiang1" <qiang1.zhang@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kasan/quarantine.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -355,7 +355,12 @@ void kasan_quarantine_remove_cache(struc
*/
on_each_cpu(per_cpu_remove_cache, cache, 1);
- for_each_online_cpu(cpu) {
+ /*
+ * A CPU can go offline after on_each_cpu() returns, leaving cache
+ * objects on that CPU's shrink list. Scan all possible CPUs to
+ * drain those lists.
+ */
+ for_each_possible_cpu(cpu) {
sq = per_cpu_ptr(&shrink_qlist, cpu);
raw_spin_lock_irqsave(&sq->lock, flags);
qlist_move_cache(&sq->qlist, &to_free, cache);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 349/713] kho: fix size calculation in kho_preserved_memory_reserve()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 348/713] kasan: fix cache shrink race with CPU hotplug Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 350/713] jbd2: bound shrinker scans by examined checkpoint buffers Greg Kroah-Hartman
` (374 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pratyush Yadav (Google),
Mike Rapoport (Microsoft)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav (Google) <pratyush@kernel.org>
commit 3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded upstream.
kho_preserved_memory_reserve() calculates the size of a preservation by
doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it
can only be shifted by 31. That is, it will only work for preservations
up to 2 GiB. Larger preservations will trigger undefined behaviour.
While preservations larger than 2 GiB can't be obtained via folios
currently, they can be obtained via kho_preserve_pages().
For example, memblock reserve_mem uses kho_preserve_pages().
Reservations larger than 2 GiB are valid and will trigger this bug if
properly aligned.
Fix it by using 1UL for shifting.
Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Link: https://patch.msgid.link/20260727150240.889555-1-pratyush@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/liveupdate/kexec_handover.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -501,7 +501,7 @@ static int __init kho_preserved_memory_r
struct page *page;
u64 sz;
- sz = 1 << (order + PAGE_SHIFT);
+ sz = 1UL << (order + PAGE_SHIFT);
page = kho_get_preserved_page(phys, order);
/* Reserve the memory preserved in KHO in memblock */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 350/713] jbd2: bound shrinker scans by examined checkpoint buffers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 349/713] kho: fix size calculation in kho_preserved_memory_reserve() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 351/713] jbd2: check need_resched() when skipping busy " Greg Kroah-Hartman
` (373 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Zhang Yi, Jan Kara,
Theodore Tso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit 15cb16496446b94e67f7abcb049b8e2c75cd3d02 upstream.
The jbd2 shrinker currently accounts only checkpoint buffers that it
successfully releases against nr_to_scan. Busy buffers therefore do not
consume the scan budget.
If a checkpoint transaction contains mostly busy buffers, the shrinker
can scan its entire checkpoint list while holding journal->j_list_lock.
Large checkpoint lists can result in excessive lock hold times and leave
other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.
Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for
every buffer examined, including busy buffers. Pass NULL from checkpoint
cleanup paths so their existing full-list behavior is preserved.
This restores the scan-budget semantics that existed before
journal_shrink_one_cp_list() was changed to always scan a complete
checkpoint list.
Fixes: b98dba273a0e ("jbd2: remove journal_clean_one_cp_list()")
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260713102229.1598812-3-max.kellermann@ionos.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/checkpoint.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -358,15 +358,16 @@ int jbd2_cleanup_journal_tail(journal_t
/*
* journal_shrink_one_cp_list
*
- * Find all the written-back checkpoint buffers in the given list
- * and try to release them. If the whole transaction is released, set
- * the 'released' parameter. Return the number of released checkpointed
- * buffers.
+ * Find written-back checkpoint buffers in the given list and try to release
+ * them. If 'nr_to_scan' is set, scan at most that many buffers. If the whole
+ * transaction is released, set the 'released' parameter. Return the number of
+ * released checkpointed buffers.
*
* Called with j_list_lock held.
*/
static unsigned long journal_shrink_one_cp_list(struct journal_head *jh,
enum jbd2_shrink_type type,
+ unsigned long *nr_to_scan,
bool *released)
{
struct journal_head *last_jh;
@@ -375,13 +376,15 @@ static unsigned long journal_shrink_one_
int ret;
*released = false;
- if (!jh)
+ if (!jh || (nr_to_scan && !*nr_to_scan))
return 0;
last_jh = jh->b_cpprev;
do {
jh = next_jh;
next_jh = jh->b_cpnext;
+ if (nr_to_scan)
+ (*nr_to_scan)--;
if (type == JBD2_SHRINK_DESTROY) {
ret = __jbd2_journal_remove_checkpoint(jh);
@@ -402,7 +405,7 @@ static unsigned long journal_shrink_one_
if (need_resched())
break;
- } while (jh != last_jh);
+ } while (jh != last_jh && (!nr_to_scan || *nr_to_scan));
return nr_freed;
}
@@ -424,7 +427,6 @@ unsigned long jbd2_journal_shrink_checkp
tid_t first_tid = 0, last_tid = 0, next_tid = 0;
tid_t tid = 0;
unsigned long nr_freed = 0;
- unsigned long freed;
bool first_set = false;
again:
@@ -457,10 +459,9 @@ again:
next_transaction = transaction->t_cpnext;
tid = transaction->t_tid;
- freed = journal_shrink_one_cp_list(transaction->t_checkpoint_list,
- JBD2_SHRINK_BUSY_SKIP, &released);
- nr_freed += freed;
- (*nr_to_scan) -= min(*nr_to_scan, freed);
+ nr_freed += journal_shrink_one_cp_list(transaction->t_checkpoint_list,
+ JBD2_SHRINK_BUSY_SKIP,
+ nr_to_scan, &released);
if (*nr_to_scan == 0)
break;
if (need_resched() || spin_needbreak(&journal->j_list_lock))
@@ -516,7 +517,7 @@ void __jbd2_journal_clean_checkpoint_lis
transaction = next_transaction;
next_transaction = transaction->t_cpnext;
journal_shrink_one_cp_list(transaction->t_checkpoint_list,
- type, &released);
+ type, NULL, &released);
/*
* This function only frees up some memory if possible so we
* dont have an obligation to finish processing. Bail out if
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 351/713] jbd2: check need_resched() when skipping busy checkpoint buffers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 350/713] jbd2: bound shrinker scans by examined checkpoint buffers Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 352/713] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Greg Kroah-Hartman
` (372 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Zhang Yi, Jan Kara,
Theodore Tso
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit f213e12ff5c9590b1034ae8da0e6d09665c772d0 upstream.
journal_shrink_one_cp_list() skips busy checkpoint buffers when called
with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also
skips the need_resched() check at the end of the loop body.
Consequently, when a checkpoint list contains mostly busy buffers, the
shrinker can walk the entire list while holding journal->j_list_lock,
even when a reschedule has been requested. Large checkpoint lists under
memory pressure can therefore cause long lock hold times and leave other
CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls.
Route the busy-buffer path through the need_resched() check so that the
shrinker can release j_list_lock and reschedule promptly, restoring
parity with the clean-buffer path, which already checks need_resched().
This does not change which checkpoint buffers are eligible for removal.
Fixes: b98dba273a0e ("jbd2: remove journal_clean_one_cp_list()")
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260713102229.1598812-2-max.kellermann@ionos.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/checkpoint.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -392,7 +392,7 @@ static unsigned long journal_shrink_one_
ret = jbd2_journal_try_remove_checkpoint(jh);
if (ret < 0) {
if (type == JBD2_SHRINK_BUSY_SKIP)
- continue;
+ goto next;
break;
}
}
@@ -403,6 +403,7 @@ static unsigned long journal_shrink_one_
break;
}
+next:
if (need_resched())
break;
} while (jh != last_jh && (!nr_to_scan || *nr_to_scan));
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 352/713] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 351/713] jbd2: check need_resched() when skipping busy " Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 353/713] ip: orphan prefetched skbs before multicast forwarding Greg Kroah-Hartman
` (371 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anton Danilov,
Fernando Fernandez Mancera, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Danilov <littlesmilingcloud@gmail.com>
commit 6776efe4a52f289a3fc18f8adf19b035a7d8e1bb upstream.
In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb
when ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and
mplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv()
and tunnelmpls4_rcv() read the zero return as "the packet has been
consumed" and do not free it either. The skb is leaked.
The other tunnel drivers all dispose of the packet at this point:
ip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return
PACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0.
Jump to the existing drop label instead. It frees the skb and still
returns 0, so the packet keeps being reported as consumed, which is what
we want here: the outer header has already been pulled, and neither the
remaining handlers nor an ICMP unreachable have any use for it.
Triggering this needs an ipip or mplsip tunnel in collect_md mode and an
atomic allocation failure, which is why it has gone unnoticed.
Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260819104338.432631-2-littlesmilingcloud@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ipip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -248,7 +248,7 @@ static int ipip_tunnel_rcv(struct sk_buf
tun_dst = ip_tun_rx_dst(skb, flags, 0, 0);
if (!tun_dst)
- return 0;
+ goto drop;
ip_tunnel_md_udp_encap(skb, &tun_dst->u.tun_info);
}
skb_reset_mac_header(skb);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 353/713] ip: orphan prefetched skbs before multicast forwarding
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 352/713] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 354/713] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Greg Kroah-Hartman
` (370 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Zhiling Zou, Ido Schimmel,
Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit e36ce6e78fe3fc3c071a26750783b7ba081ce10d upstream.
IPv4 and IPv6 input preserve an skb->sk association installed by
bpf_sk_assign() so that local delivery can use the selected socket under
RCU. Both address families can also prefetch a socket in UDP early demux.
In both paths (BPF and UDP early demux) a reference is not guaranteed to
be held on the socket.
When a multicast packet is not locally deliverable, IPv6 hands the
original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the
original skb when local delivery is not needed. Either path can put the
skb on an unresolved multicast route queue or forward it after the
receive-side RCU section ends.
After the prefetched socket is destroyed, a later skb free invokes
sock_pfree() and dereferences the stale skb->sk. Orphan the skb before
each non-local multicast forwarding path. Local delivery retains the
original skb; the existing skb_clone() calls provide multicast forwarding
with a socket-free clone.
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Fixes: 08842c43d016 ("udp: no longer touch sk->sk_refcnt in early demux")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/0c52eb3d7532aaf8bccf37e0f7c922143c639735.1786552223.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ipmr.c | 3 +++
net/ipv6/ip6_input.c | 1 +
2 files changed, 4 insertions(+)
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2213,6 +2213,9 @@ int ip_mr_input(struct sk_buff *skb)
if (IPCB(skb)->flags & IPSKB_FORWARDED)
goto dont_forward;
+ if (!local)
+ skb_orphan(skb);
+
mrt = ipmr_rt_fib_lookup(net, skb);
if (IS_ERR(mrt)) {
kfree_skb(skb);
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -622,6 +622,7 @@ int ip6_mc_input(struct sk_buff *skb)
if (deliver) {
skb2 = skb_clone(skb, GFP_ATOMIC);
} else {
+ skb_orphan(skb);
skb2 = skb;
skb = NULL;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 354/713] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 353/713] ip: orphan prefetched skbs before multicast forwarding Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 355/713] ip6_gre: fix hardware header length for NBMA tunnels Greg Kroah-Hartman
` (369 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Ido Schimmel, Zhiling Zou,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 87f21b59ddc618eff9670c174842964ad65fdade upstream.
ip6_tnl_xmit() may need to expand headroom before it can push the
outer IPv6 and optional encap headers. It currently does that with
skb_realloc_headroom(), copies skb->sk ownership, consumes the original
skb, and then continues processing with the replacement skb kept only in
its local variable.
That is safe only if the helper cannot fail afterwards. But this helper
still has post-reallocation error exits. collect_md tunnels reject
non-NONE encap after the replacement, and ip6_tnl_encap() can also fail
later. In those cases the helper returns an error to its callers while
the caller still only has the original skb pointer.
Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on
error, so they can end up freeing an skb that ip6_tnl_xmit() already
consumed.
Use skb_cow_head() instead. It provides the required headroom and
writability without privately replacing the caller-owned skb, so later
error returns cannot leave callers with a stale pointer.
The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING
and already call skb_cow_head() before entering ip6_tnl_xmit(). They do
not rely on the removed skb_shared() reallocation. This also makes the
IPv6 tunnel path consistent with ip_tunnel_xmit().
Fixes: 058214a4d1df ("ip6_tun: Add infrastructure for doing encapsulation")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Link: https://patch.msgid.link/30807a062ccc5c9c8a5ec2c5eb805ef279c50bdd.1786452593.git.zhilinz@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_tunnel.c | 15 ++-------------
1 file changed, 2 insertions(+), 13 deletions(-)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1236,19 +1236,8 @@ route_lookup:
*/
max_headroom += LL_RESERVED_SPACE(tdev);
- if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
- (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
- struct sk_buff *new_skb;
-
- new_skb = skb_realloc_headroom(skb, max_headroom);
- if (!new_skb)
- goto tx_err_dst_release;
-
- if (skb->sk)
- skb_set_owner_w(new_skb, skb->sk);
- consume_skb(skb);
- skb = new_skb;
- }
+ if (skb_cow_head(skb, max_headroom))
+ goto tx_err_dst_release;
if (t->parms.collect_md) {
if (t->encap.type != TUNNEL_ENCAP_NONE)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 355/713] ip6_gre: fix hardware header length for NBMA tunnels
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 354/713] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 356/713] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Greg Kroah-Hartman
` (368 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Zhiling Zou,
Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 505b6d296c486ef7d1274f279d4c43a172f63224 upstream.
ip6gre_tnl_link_config_route() accumulates the lower device's hardware
header length into dev->hard_header_len whenever header_ops is set. This
is incorrect for both users of header_ops.
ip6gretap and ip6erspan have a fixed Ethernet hardware header length.
For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,
the optional FOU or GUE header, and the outer IPv6 header. The lower
device header is headroom needed later, not part of the tunnel device's
hardware header.
Keep the lower device header in needed_headroom. Set hard_header_len to
the tunnel header length only for ARPHRD_IP6GRE devices with header_ops,
and leave the fixed Ethernet header length unchanged for tap and erspan
devices.
Fixes: 832ba596494b ("net: ip6_gre: set dev->hard_header_len when using header_ops")
Cc: stable@vger.kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/64b46542bbe1701f07702aaa50273e2a87903db5.1786542637.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_gre.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1137,13 +1137,8 @@ static void ip6gre_tnl_link_config_route
return;
if (rt->dst.dev) {
- unsigned short dst_len = rt->dst.dev->hard_header_len +
- t_hlen;
-
- if (t->dev->header_ops)
- dev->hard_header_len = dst_len;
- else
- dev->needed_headroom = dst_len;
+ dev->needed_headroom = rt->dst.dev->hard_header_len +
+ t_hlen;
if (set_mtu) {
int mtu = rt->dst.dev->mtu - t_hlen;
@@ -1171,8 +1166,8 @@ static int ip6gre_calc_hlen(struct ip6_t
t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
- if (tunnel->dev->header_ops)
- tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
+ if (tunnel->dev->header_ops && tunnel->dev->type == ARPHRD_IP6GRE)
+ tunnel->dev->hard_header_len = t_hlen;
else
tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 356/713] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 355/713] ip6_gre: fix hardware header length for NBMA tunnels Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 357/713] ipv6: use RCU iterator to dump route exceptions Greg Kroah-Hartman
` (367 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Mayer, Xiang Mei,
Simon Horman, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Mayer <andrea.mayer@uniroma2.it>
commit f826df95332c07380206dbd54178b6eefb311aba upstream.
ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL
check when reading idev->cnf.rpl_seg_enabled.
When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears
dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev
check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with
dev->ip6_ptr already NULL.
Reproduced by flooding the receiving interface with ping6 traffic while
flapping its MTU between 1500 and 1200:
BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070
Read of size 4 at addr 00000000000006b4 by task ping6/394
CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)
Call Trace:
<IRQ>
kasan_report+0xc6/0x100
ipv6_rpl_srh_rcv+0xb3/0x1070
ip6_protocol_deliver_rcu+0x759/0x9a0
ip6_input_finish+0xa8/0x1b0
ip6_input+0xe1/0x490
ipv6_rcv+0x33d/0x460
__netif_receive_skb_one_core+0xd6/0x130
process_backlog+0x2cc/0xa00
__napi_poll.constprop.0+0x56/0x270
net_rx_action+0x327/0x730
handle_softirqs+0x11e/0x630
do_softirq+0xb3/0xf0
</IRQ>
Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from
ipv6_rthdr_rcv(), which already has an idev lookup.
Fix the NULL dereference on the RPL path by checking idev in
ipv6_rthdr_rcv(), before it calls either function. The callees take idev as
an argument and no longer call __in6_dev_get(), so the packet is now
dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Tested-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260817132644.2223-1-andrea.mayer@uniroma2.it
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/exthdrs.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -368,23 +368,16 @@ static void seg6_update_csum(struct sk_b
(__be32 *)addr);
}
-static int ipv6_srh_rcv(struct sk_buff *skb)
+static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
{
struct inet6_skb_parm *opt = IP6CB(skb);
struct net *net = dev_net(skb->dev);
struct ipv6_sr_hdr *hdr;
- struct inet6_dev *idev;
struct in6_addr *addr;
int accept_seg6;
hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
- idev = __in6_dev_get(skb->dev);
- if (!idev) {
- kfree_skb(skb);
- return -1;
- }
-
accept_seg6 = min(READ_ONCE(net->ipv6.devconf_all->seg6_enabled),
READ_ONCE(idev->cnf.seg6_enabled));
@@ -485,12 +478,11 @@ looped_back:
return -1;
}
-static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
+static int ipv6_rpl_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
{
struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr;
struct inet6_skb_parm *opt = IP6CB(skb);
struct net *net = dev_net(skb->dev);
- struct inet6_dev *idev;
struct ipv6hdr *oldhdr;
unsigned int chdr_len;
unsigned char *buf;
@@ -499,8 +491,6 @@ static int ipv6_rpl_srh_rcv(struct sk_bu
u64 n = 0;
u32 r;
- idev = __in6_dev_get(skb->dev);
-
accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
READ_ONCE(idev->cnf.rpl_seg_enabled));
if (!accept_rpl_seg) {
@@ -689,10 +679,14 @@ static int ipv6_rthdr_rcv(struct sk_buff
switch (hdr->type) {
case IPV6_SRCRT_TYPE_4:
/* segment routing */
- return ipv6_srh_rcv(skb);
+ if (!idev)
+ goto disabled;
+ return ipv6_srh_rcv(skb, idev);
case IPV6_SRCRT_TYPE_3:
/* rpl segment routing */
- return ipv6_rpl_srh_rcv(skb);
+ if (!idev)
+ goto disabled;
+ return ipv6_rpl_srh_rcv(skb, idev);
default:
break;
}
@@ -837,6 +831,10 @@ unknown_rh:
icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
(&hdr->type) - skb_network_header(skb));
return -1;
+
+disabled:
+ kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
+ return -1;
}
static const struct inet6_protocol rthdr_protocol = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 357/713] ipv6: use RCU iterator to dump route exceptions
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 356/713] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 358/713] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
` (366 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuyang Huang, Stefano Brivio,
Ido Schimmel, David S. Miller, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuyang Huang <sigefriedhyy@gmail.com>
commit 47cdab0d51aaa9bd85f8e4904585bd5bd4df4488 upstream.
rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().
KCSAN reports this race (irrelevant details omitted):
==================================================================
BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions
write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
rt6_insert_exception+0x3bb/0x760
__ip6_rt_update_pmtu+0x4fe/0x750
ip6_sk_update_pmtu+0x19a/0x3b0
udpv6_err+0x3ff/0x800
icmpv6_notify+0x1e1/0x440
icmpv6_rcv+0x8c0/0xab0
ip6_protocol_deliver_rcu+0x616/0x840
ip6_input_finish+0xb9/0x160
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
rt6_nh_dump_exceptions+0xb3/0x260
rt6_dump_route+0x53e/0x5f0
fib6_dump_node+0x6d/0xf0
fib6_walk_continue+0x290/0x2d0
fib6_dump_table+0x28d/0x360
inet6_dump_fib+0x37d/0x620
rtnl_dumpit+0x7b/0xd0
netlink_dump+0x3ae/0x7e0
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
4 locks held by dumper/549:
...
#1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
#2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
#3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0
value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100
Reported by Kernel Concurrency Sanitizer on:
CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
7.2.0-rc7-virtme #38 PREEMPT(lazy)
...
Use hlist_for_each_entry_rcu() to safely iterate over the exception list.
Fixes: 1e47b4837f3b ("ipv6: Dump route exceptions if requested")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260815084651.69477-1-sigefriedhyy@gmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -6029,7 +6029,7 @@ static int rt6_nh_dump_exceptions(struct
return 0;
for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
- hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+ hlist_for_each_entry_rcu(rt6_ex, &bucket->chain, hlist) {
if (w->skip) {
w->skip--;
continue;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 358/713] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 357/713] ipv6: use RCU iterator to dump route exceptions Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 359/713] libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Greg Kroah-Hartman
` (365 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Brauner,
Mickaël Salaün, Günther Noack
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <gnoack@google.com>
commit 672fa082d48b21e1fb62cdb184fee41513e53421 upstream.
Whiteout objects are used in the upper layer of an OverlayFS to
indicate that the file with this name does not exist in the unified
view, even if it is present in one of the lower layer file systems.
For the userspace implementations of OverlayFS (fuse-overlayfs),
whiteout objects can be created from userspace as well:
* mknod(2) with S_IFCHR and makedev(0, 0)
* renameat2(2) with RENAME_WHITEOUT,
creating the whiteout in the old place of the moved file.
This commit guards whiteout creation in both of these cases with
LANDLOCK_ACCESS_FS_MAKE_REG. Whiteout objects are *not* considered
character devices and are not bound to a driver.
LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as a
whiteout object: creating one is the only S_IFCHR creation that the VFS
exempts from CAP_MKNOD, so it is as unprivileged as creating a regular
file, while LANDLOCK_ACCESS_FS_MAKE_CHAR and
LANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation of devices that
expose a kernel interface [1].
For the mknod(2) case, introduce a Landlock erratum. The creation of
whiteout objects through mknod(2) was previously guarded using
LANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded using
LANDLOCK_ACCESS_FS_MAKE_REG.
For the renameat2(2) case, fix a bug: Before this commit, renameat2(2)
with RENAME_WHITEOUT would create a directory entry even when all
LANDLOCK_ACCESS_FS_MAKE_* rights were denied.
This does not affect normal renames within layered OverlayFS mounts:
When doing a regular rename() on a mounted fuse-overlayfs, it is the
fuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT,
and only the Landlock domain of that daemon is checked there.
Suggested-by: Christian Brauner <brauner@kernel.org>
Suggested-by: Mickaël Salaün <mic@digikod.net>
Cc: stable@vger.kernel.org
Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
Depends-on: 49c9e09d9610 ("landlock: Fix handling of disconnected directories")
Depends-on: fe72ce6710cb ("landlock: Add errata documentation section")
Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260720.chow9ohYie5b@digikod.net [1]
Link: https://patch.msgid.link/20260813093157.1436894-3-gnoack@google.com
[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching right, and
add link(2) to the user doc]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/landlock.h | 1
security/landlock/errata/abi-1.h | 23 +++++++++++++++++++++
security/landlock/fs.c | 41 ++++++++++++++++++++++++++++++---------
3 files changed, 56 insertions(+), 9 deletions(-)
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -351,6 +351,7 @@ struct landlock_net_port_attr {
* device.
* - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory.
* - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file.
+ * This also guards the creation of whiteout objects as used in OverlayFS.
* - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain
* socket.
* - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe.
--- a/security/landlock/errata/abi-1.h
+++ b/security/landlock/errata/abi-1.h
@@ -22,3 +22,26 @@
* from their original mount points.
*/
LANDLOCK_ERRATUM(3)
+
+/**
+ * DOC: erratum_4
+ *
+ * Erratum 4: Creation of whiteout objects
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This fix changes the access rights required for the creation of whiteout
+ * objects through :manpage:`mknod(2)`, :manpage:`renameat2(2)`, or
+ * :manpage:`link(2)`. Creating whiteout objects is now guarded by
+ * ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ *
+ * Whiteout objects are used in OverlayFS to mark the absence of a file in an
+ * upper file system. Despite being created with ``S_IFCHR``, whiteout objects
+ * do not count as character devices.
+ *
+ * Impact:
+ *
+ * Sandboxed programs that create OverlayFS whiteouts (such as fuse-overlayfs)
+ * now require ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of
+ * ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ */
+LANDLOCK_ERRATUM(4)
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -20,6 +20,7 @@
#include <linux/falloc.h>
#include <linux/fs.h>
#include <linux/init.h>
+#include <linux/kdev_t.h>
#include <linux/kernel.h>
#include <linux/limits.h>
#include <linux/list.h>
@@ -983,7 +984,8 @@ static int current_check_access_path(con
return -EACCES;
}
-static __attribute_const__ access_mask_t get_mode_access(const umode_t mode)
+static __attribute_const__ access_mask_t get_mode_access(const umode_t mode,
+ const dev_t dev)
{
switch (mode & S_IFMT) {
case S_IFLNK:
@@ -991,6 +993,9 @@ static __attribute_const__ access_mask_t
case S_IFDIR:
return LANDLOCK_ACCESS_FS_MAKE_DIR;
case S_IFCHR:
+ /* Whiteout objects are guarded with MAKE_REG. */
+ if (dev == WHITEOUT_DEV)
+ return LANDLOCK_ACCESS_FS_MAKE_REG;
return LANDLOCK_ACCESS_FS_MAKE_CHAR;
case S_IFBLK:
return LANDLOCK_ACCESS_FS_MAKE_BLOCK;
@@ -1007,6 +1012,13 @@ static __attribute_const__ access_mask_t
}
}
+static access_mask_t get_dentry_access(const struct dentry *const dentry)
+{
+ const struct inode *const inode = d_backing_inode(dentry);
+
+ return get_mode_access(inode->i_mode, inode->i_rdev);
+}
+
static access_mask_t maybe_remove(const struct dentry *const dentry)
{
if (d_is_negative(dentry))
@@ -1093,6 +1105,7 @@ static bool collect_domain_accesses(cons
* @new_dentry: Destination file or directory.
* @removable: Sets to true if it is a rename operation.
* @exchange: Sets to true if it is a rename operation with RENAME_EXCHANGE.
+ * @whiteout: Sets to true if it is a rename operation with RENAME_WHITEOUT.
*
* Because of its unprivileged constraints, Landlock relies on file hierarchies
* (and not only inodes) to tie access rights to files. Being able to link or
@@ -1140,7 +1153,8 @@ static bool collect_domain_accesses(cons
static int current_check_refer_path(struct dentry *const old_dentry,
const struct path *const new_dir,
struct dentry *const new_dentry,
- const bool removable, const bool exchange)
+ const bool removable, const bool exchange,
+ const bool whiteout)
{
const struct landlock_cred_security *const subject =
landlock_get_applicable_subject(current_cred(), any_fs, NULL);
@@ -1159,18 +1173,25 @@ static int current_check_refer_path(stru
if (exchange) {
if (unlikely(d_is_negative(new_dentry)))
return -ENOENT;
- access_request_parent1 =
- get_mode_access(d_backing_inode(new_dentry)->i_mode);
+ access_request_parent1 = get_dentry_access(new_dentry);
} else {
access_request_parent1 = 0;
}
- access_request_parent2 =
- get_mode_access(d_backing_inode(old_dentry)->i_mode);
+ access_request_parent2 = get_dentry_access(old_dentry);
if (removable) {
access_request_parent1 |= maybe_remove(old_dentry);
access_request_parent2 |= maybe_remove(new_dentry);
}
+ /*
+ * In case of renameat2(2) with RENAME_WHITEOUT, a whiteout object is
+ * created in the source location, so we require an additional access
+ * right there.
+ */
+ if (whiteout)
+ access_request_parent1 |=
+ get_mode_access(S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
+
/* The mount points are the same for old and new paths, cf. EXDEV. */
if (old_dentry->d_parent == new_dir->dentry) {
/*
@@ -1520,7 +1541,7 @@ static int hook_path_link(struct dentry
struct dentry *const new_dentry)
{
return current_check_refer_path(old_dentry, new_dir, new_dentry, false,
- false);
+ false, false);
}
static int hook_path_rename(const struct path *const old_dir,
@@ -1531,7 +1552,8 @@ static int hook_path_rename(const struct
{
/* old_dir refers to old_dentry->d_parent and new_dir->mnt */
return current_check_refer_path(old_dentry, new_dir, new_dentry, true,
- !!(flags & RENAME_EXCHANGE));
+ !!(flags & RENAME_EXCHANGE),
+ !!(flags & RENAME_WHITEOUT));
}
static int hook_path_mkdir(const struct path *const dir,
@@ -1544,7 +1566,8 @@ static int hook_path_mknod(const struct
struct dentry *const dentry, const umode_t mode,
const unsigned int dev)
{
- return current_check_access_path(dir, get_mode_access(mode));
+ return current_check_access_path(
+ dir, get_mode_access(mode, new_decode_dev(dev)));
}
static int hook_path_symlink(const struct path *const dir,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 359/713] libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 358/713] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 360/713] mailbox: qcom-ipcc: fix duplicate channel allocation across holes Greg Kroah-Hartman
` (364 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alison Schofield, Bryam Vargas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 037770686126155eafc44501312989e2837b9659 upstream.
The on-media namespace index field nslot is a u32 read from the DIMM
label storage area. __nd_label_validate() bounds it against the config
area size, but sizeof_namespace_label() returns unsigned, so the product
nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before
the comparison. A crafted nslot passes the bound and is then used as the
loop trip count in nd_label_data_init(), whose memset() walks off the end
of the config_size buffer: an out-of-bounds write.
The field is not trusted -- it comes from the medium, or from userspace
via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound
check is exact; conforming labels are unaffected.
The check was safe when introduced by commit 4a826c83db4e ("libnvdimm:
namespace indices: read and validate"): it multiplied by sizeof(struct
nd_namespace_label), a size_t, so on a 64-bit build the product did not
wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label
definitions") narrowed it to 32 bits when the label size became a runtime
value read via sizeof_namespace_label().
Fixes: 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions")
Cc: stable@vger.kernel.org
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260624-b4-disp-d8279485-v3-1-cdb6cab28b41@proton.me
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -202,7 +202,7 @@ static int __nd_label_validate(struct nv
}
nslot = __le32_to_cpu(nsindex[i]->nslot);
- if (nslot * sizeof_namespace_label(ndd)
+ if ((u64)nslot * sizeof_namespace_label(ndd)
+ 2 * sizeof_namespace_index(ndd)
> ndd->nsarea.config_size) {
dev_dbg(dev, "nsindex%d nslot: %u invalid, config_size: %#x\n",
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 360/713] mailbox: qcom-ipcc: fix duplicate channel allocation across holes
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 359/713] libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 361/713] md/raid10: fix still_degraded being inverted in raid10_sync_request() Greg Kroah-Hartman
` (363 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anup Vishwakarma, Jassi Brar
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
commit 66c7bcad72430a02c860521031350b84b31ad9a8 upstream.
The IPCC of_xlate() both scans for a free mailbox channel and checks
for duplicate references to the same underlying IPCC channel. When a
channel has been shutdown it might have left a hole in the channel
list, which would terminate the search without considering duplicates
later in the list.
Continue the traversal of the channel list to detect and reject
duplicates, while keeping track of the first free channel.
Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mailbox/qcom-ipcc.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -167,7 +167,7 @@ static struct mbox_chan *qcom_ipcc_mbox_
{
struct qcom_ipcc *ipcc = to_qcom_ipcc(mbox);
struct qcom_ipcc_chan_info *mchan;
- struct mbox_chan *chan;
+ struct mbox_chan *chan, *free_chan = NULL;
struct device *dev;
int chan_id;
@@ -180,16 +180,21 @@ static struct mbox_chan *qcom_ipcc_mbox_
chan = &ipcc->chans[chan_id];
mchan = chan->con_priv;
- if (!mchan)
- break;
- else if (mchan->client_id == ph->args[0] &&
- mchan->signal_id == ph->args[1])
+ if (!mchan) {
+ /* Keep scanning past holes to reject duplicate channel requests. */
+ if (!free_chan)
+ free_chan = chan;
+ } else if (mchan->client_id == ph->args[0] &&
+ mchan->signal_id == ph->args[1]) {
return ERR_PTR(-EBUSY);
+ }
}
- if (chan_id >= mbox->num_chans)
+ if (!free_chan)
return ERR_PTR(-EBUSY);
+ chan = free_chan;
+
mchan = devm_kzalloc(dev, sizeof(*mchan), GFP_KERNEL);
if (!mchan)
return ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 361/713] md/raid10: fix still_degraded being inverted in raid10_sync_request()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 360/713] mailbox: qcom-ipcc: fix duplicate channel allocation across holes Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 362/713] md: do overflow check for sb->bblog_shift in super_1_load() Greg Kroah-Hartman
` (362 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunye Zhao, Mykola Marzhan,
Paul Menzel, Yu Kuai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunye Zhao <yunye.zhao@linux.alibaba.com>
commit 47f1441b281decde6954a2fa82b4131637d685ac upstream.
Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into
bitmap_operations") converted still_degraded from int to bool, but
inverted the assignment in the loop that checks whether the array will
still be degraded after the current device is recovered:
"still_degraded = 1" became "still_degraded = false".
As a result, recovering a device while another mirror is still missing
calls md_bitmap_start_sync() with degraded == false, which clears bitmap
bits that the still-missing device needs. When that device is re-added,
its bitmap-based recovery finds the bits already cleared and skips every
region written while the array was degraded, so it is marked In_sync
while holding stale data: silent corruption.
Reproducer (raid10 near=2, 4 disks, internal bitmap):
- fail and remove one disk of each mirror pair
- write to the degraded array
- re-add both disks and let recovery finish
- "check" reports mismatch_cnt=262272 after 256 MiB of degraded
writes and file contents differ; the second disk's "recovery"
completes in milliseconds because everything is skipped
The same conversion in raid1 got it right (still_degraded = true).
Restore the correct value.
Fixes: fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations")
Cc: stable@vger.kernel.org
Signed-off-by: Yunye Zhao <yunye.zhao@linux.alibaba.com>
Reviewed-by: Mykola Marzhan <mykola@meshstor.io>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260723135535.101995-2-yunye.zhao@linux.alibaba.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3365,7 +3365,7 @@ static sector_t raid10_sync_request(stru
struct md_rdev *rdev = conf->mirrors[j].rdev;
if (rdev == NULL || test_bit(Faulty, &rdev->flags)) {
- still_degraded = false;
+ still_degraded = true;
break;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 362/713] md: do overflow check for sb->bblog_shift in super_1_load()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 361/713] md/raid10: fix still_degraded being inverted in raid10_sync_request() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 363/713] module: validate string table section types Greg Kroah-Hartman
` (361 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ramesh Adhikari, Coly Li, Yu Kuai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coly Li <colyli@fygo.io>
commit 35d522bd32462afcf1981dab6da8a9256c26c1e0 upstream.
In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-
disk superblock. It is used for badblocks API badblocks_set() by the
following sequence,
1930 rdev->badblocks.shift = sb->bblog_shift;
1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
1932 u64 bb = le64_to_cpu(*bbp);
1933 int count = bb & (0x3ff);
1934 u64 sector = bb >> 10;
1935 sector <<= sb->bblog_shift;
1936 count <<= sb->bblog_shift;
1937 if (bb + 1 == 0)
1938 break;
1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))
1940 return -EINVAL;
1941 }
bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for
an invalid bb->bblog_shit, it is possible to make sector be overflowed
by the following calculation,
1935 sector <<= sb->bblog_shift;
Then in turn when call badblocks_set() at line 1939 with the invalid
rdev->badblocks.shift set at line 1930, may result an overflow inside
_badblocks_clear() in block/badblocks.c.
Although there are many places to call badblocks APIs, the non-zero
shift value is only used in super_1_load(), other places always use 0 as
the shift value. Therefore it is unnecessary to do a general shift value
overflow check inside badblock API, and just check here as the caller.
This may avoid unnecessary check, make the badblocks API code more simple
and elegant.
Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Fixes: 1726c7746783 ("badblocks: improve badblocks_set() for multiple ranges handling")
Cc: stable@vger.kernel.org
Cc: Ramesh Adhikari <adhikari.resume@gmail.com>
Signed-off-by: Coly Li <colyli@fygo.io>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260720111400.2120834-1-colyli@fygo.io
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1920,6 +1920,13 @@ static int super_1_load(struct md_rdev *
rdev->bb_page, REQ_OP_READ, true))
return -EIO;
bbp = (__le64 *)page_address(rdev->bb_page);
+
+ /* check for badblocks api. */
+ if (sb->bblog_shift >= BITS_PER_TYPE(sector_t)) {
+ pr_err("md: %pg: bogus bblog_shift %u for badblocks.\n",
+ rdev->bdev, sb->bblog_shift);
+ return -EINVAL;
+ }
rdev->badblocks.shift = sb->bblog_shift;
for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
u64 bb = le64_to_cpu(*bbp);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 363/713] module: validate string table section types
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 362/713] md: do overflow check for sb->bblog_shift in super_1_load() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 364/713] mpls: reload header after pskb_may_pull() Greg Kroah-Hartman
` (360 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thiébaud Weksteen, Aaron Tomlin,
Petr Pavlu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thiébaud Weksteen <tweek@google.com>
commit 9a5ff45689329835f874cefe5174e577d141d423 upstream.
In elf_validity_cache_sechdrs, section sizes and offsets are validated,
unless the section type is SHT_NULL or SHT_NOBITS.
Later, elf_validity_cache_secstrings and elf_validity_cache_index_str
access the section name table (.shstrtab) and symbol string table
(.strtab) headers without first ensuring that their types are
SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has
not been validated and may reference out-of-bounds memory when
dereferenced in elf_validity_cache_secstrings or
elf_validity_cache_strtab.
Validate that both string section headers are of type SHT_STRTAB before
caching them.
Cc: stable@vger.kernel.org
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module/main.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -2011,6 +2011,7 @@ static int elf_validity_cache_sechdrs(st
* Specifically checks:
*
* * Section name table index is inbounds of section headers
+ * * Section name table type is SHT_STRTAB
* * Section name table is not empty
* * Section name table is NUL terminated
* * All section name offsets are inbounds of the section
@@ -2038,6 +2039,11 @@ static int elf_validity_cache_secstrings
strhdr = &info->sechdrs[info->hdr->e_shstrndx];
+ if (strhdr->sh_type != SHT_STRTAB) {
+ pr_err("Invalid ELF section name table type: %u\n", strhdr->sh_type);
+ return -ENOEXEC;
+ }
+
/*
* The section name table must be NUL-terminated, as required
* by the spec. This makes strcmp and pr_* calls that access
@@ -2204,7 +2210,7 @@ static int elf_validity_cache_index_sym(
* Must have &load_info->index.sym populated.
*
* Looks at the symbol table's associated string table, makes sure it is
- * in-bounds, and caches it.
+ * in-bounds and of type SHT_STRTAB, and caches it.
*
* Return: %0 if valid, %-ENOEXEC on failure.
*/
@@ -2218,6 +2224,12 @@ static int elf_validity_cache_index_str(
return -ENOEXEC;
}
+ if (info->sechdrs[str_idx].sh_type != SHT_STRTAB) {
+ pr_err("Invalid ELF symbol string table type: %u\n",
+ info->sechdrs[str_idx].sh_type);
+ return -ENOEXEC;
+ }
+
info->index.str = str_idx;
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 364/713] mpls: reload header after pskb_may_pull()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 363/713] module: validate string table section types Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 365/713] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Greg Kroah-Hartman
` (359 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qing Ming, Simon Horman, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Ming <a0yami@mailbox.org>
commit 29e63b8d9fc150cc191b1c6eb7e16e1247e1b650 upstream.
mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop
when an MPLS route has multiple nexthops. While walking the MPLS label
stack, the hash routine caches hdr for the current label. After finding
the bottom-of-stack label, it calls pskb_may_pull() before reading the
inner IP header.
If an skb is constructed with the inner IP header in nonlinear data and
insufficient tailroom in the linear head, pskb_may_pull() calls
pskb_expand_head() to replace the skb head and free the old one. This
leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr
again when it performs a second pull for the larger header.
The issue was found through static analysis. A reproducer sending a legal
Geneve packet through a bareudp/MPLS multipath setup triggered the same
KASAN report in 2 of 2 unpatched runs:
BUG: KASAN: slab-use-after-free in mpls_select_multipath
Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23
Call Trace:
mpls_select_multipath
mpls_forward
__netif_receive_skb_list_core
netif_receive_skb_list_internal
napi_complete_done
gro_cell_poll
__napi_poll
net_rx_action
Freed by task 23:
kfree
pskb_expand_head
__pskb_pull_tail
mpls_select_multipath
Reload hdr from the current skb head after each successful pull before
deriving the inner IPv4 or IPv6 header pointer.
Fixes: 9f427a0e474a ("net: mpls: Fix multipath selection for LSR use case")
Cc: stable@vger.kernel.org
Signed-off-by: Qing Ming <a0yami@mailbox.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260814095404.7205-1-a0yami@mailbox.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mpls/af_mpls.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -221,6 +221,7 @@ static u32 mpls_multipath_hash(struct mp
if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) {
const struct iphdr *v4hdr;
+ hdr = mpls_hdr(skb) + label_index;
v4hdr = (const struct iphdr *)(hdr + 1);
if (v4hdr->version == 4) {
hash = jhash_3words(ntohl(v4hdr->saddr),
@@ -231,6 +232,7 @@ static u32 mpls_multipath_hash(struct mp
sizeof(struct ipv6hdr))) {
const struct ipv6hdr *v6hdr;
+ hdr = mpls_hdr(skb) + label_index;
v6hdr = (const struct ipv6hdr *)(hdr + 1);
hash = __ipv6_addr_jhash(&v6hdr->saddr, hash);
hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 365/713] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 364/713] mpls: reload header after pskb_may_pull() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 366/713] module/kallsyms: fix nextval for data symbol lookup Greg Kroah-Hartman
` (358 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harshit Varu, Matthieu Baerts (NGI0),
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Varu <harshitvaru666@gmail.com>
commit b878dfdd12d7a5b8722a78d35e313506140ca3d9 upstream.
mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
backup, join_id, token and msk from the saved cookie entry when rebuilding
the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
does not restore local_id, even though the SYN path saved it.
subflow_ulp_clone() then reads that uninitialized field and stores it as
the joined subflow's address-ID. Because the request-sock slab is
SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
byte of a previously freed request socket, which an off-path peer can
influence by sending concurrent MP_JOIN SYNs. This corrupts the path
manager's id-based subflow bookkeeping for the connection.
Restore subflow_req->local_id from the cookie entry, as done for the other
fields.
Fixes: 9466a1ccebbe ("mptcp: enable JOIN requests even if cookies are in use")
Cc: stable@vger.kernel.org
Signed-off-by: Harshit Varu <harshitvaru666@gmail.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260815115205.197151-1-harshitvaru666@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/syncookies.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/mptcp/syncookies.c
+++ b/net/mptcp/syncookies.c
@@ -118,6 +118,7 @@ bool mptcp_token_join_cookie_init_state(
subflow_req->local_nonce = e->local_nonce;
subflow_req->backup = e->backup;
subflow_req->remote_id = e->join_id;
+ subflow_req->local_id = e->local_id;
subflow_req->token = e->token;
subflow_req->msk = msk;
spin_unlock_bh(&join_entry_locks[i]);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 366/713] module/kallsyms: fix nextval for data symbol lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 365/713] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 367/713] nouveau/gem: reserve the bo in the info ioctl around the vma lookup Greg Kroah-Hartman
` (357 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stanislaw Gruszka, Petr Pavlu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <stf_xl@wp.pl>
commit 0e9f090a4e9bfae5a190ccf89eab3bf14f6b0f96 upstream.
The symbol lookup code assumes the queried address resides in either
MOD_TEXT or MOD_INIT_TEXT. This breaks for addresses in other module
memory regions (e.g. rodata or data), resulting in incorrect upper
bounds and wrong symbol size.
Select the module memory region the address belongs to instead of
hardcoding text sections. Also initialize the lower bound to the start
of that region, as searching from address 0 is unnecessary.
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module/kallsyms.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
--- a/kernel/module/kallsyms.c
+++ b/kernel/module/kallsyms.c
@@ -258,17 +258,25 @@ static const char *find_kallsyms_symbol(
unsigned int i, best = 0;
unsigned long nextval, bestval;
struct mod_kallsyms *kallsyms = rcu_dereference(mod->kallsyms);
- struct module_memory *mod_mem;
+ struct module_memory *mod_mem = NULL;
- /* At worse, next value is at end of module */
- if (within_module_init(addr, mod))
- mod_mem = &mod->mem[MOD_INIT_TEXT];
- else
- mod_mem = &mod->mem[MOD_TEXT];
+ for_each_mod_mem_type(type) {
+#ifndef CONFIG_KALLSYMS_ALL
+ if (!mod_mem_type_is_text(type))
+ continue;
+#endif
+ if (within_module_mem_type(addr, mod, type)) {
+ mod_mem = &mod->mem[type];
+ break;
+ }
+ }
- nextval = (unsigned long)mod_mem->base + mod_mem->size;
+ if (!mod_mem)
+ return NULL;
- bestval = kallsyms_symbol_value(&kallsyms->symtab[best]);
+ /* Initialize bounds within memory region the address belongs to. */
+ nextval = (unsigned long)mod_mem->base + mod_mem->size;
+ bestval = (unsigned long)mod_mem->base - 1;
/*
* Scan for closest preceding symbol, and next symbol. (ELF
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 367/713] nouveau/gem: reserve the bo in the info ioctl around the vma lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 366/713] module/kallsyms: fix nextval for data symbol lookup Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 368/713] params: fix charp corruption on allocation failure Greg Kroah-Hartman
` (356 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dave Airlie, Danilo Krummrich
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <airlied@redhat.com>
commit 5e17160d41d92823f3379c1982e1369680c5ce4d upstream.
In the non-uvmm path, there could be a race between the info lookup
finding the vma, and the gem close path closing the vma leading
to a use-after-free.
Spotted with the help of Opus 4.6.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fixes: e758a3111914 ("drm/nouveau: fixup gem_info ioctl to return client-specific bo virtual")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612020658.3176270-1-airlied@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_gem.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -313,11 +313,20 @@ nouveau_gem_info(struct drm_file *file_p
rep->offset = nvbo->offset;
if (vmm->vmm.object.oclass >= NVIF_CLASS_VMM_NV50 &&
!nouveau_cli_uvmm(cli)) {
+ int ret;
+
+ ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL);
+ if (ret)
+ return ret;
+
vma = nouveau_vma_find(nvbo, vmm);
- if (!vma)
+ if (!vma) {
+ ttm_bo_unreserve(&nvbo->bo);
return -EINVAL;
+ }
rep->offset = vma->addr;
+ ttm_bo_unreserve(&nvbo->bo);
} else
rep->offset = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 368/713] params: fix charp corruption on allocation failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 367/713] nouveau/gem: reserve the bo in the info ioctl around the vma lookup Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 369/713] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Greg Kroah-Hartman
` (355 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiacheng Yu, Petr Pavlu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiacheng Yu <yujiacheng3@huawei.com>
commit 3dfaae04243cde460d82dfc2a7dd0bb6664d20ae upstream.
param_set_charp() stores charp parameters in allocated memory after slab is
available, and releases the previous value when the parameter is updated.
The previous value is released before the replacement allocation succeeds.
If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter
left as NULL.
Failing zswap's compressor update before zswap is initialized can later
trigger:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:strcmp+0x10/0x30
Call Trace:
zswap_setup+0x3b1/0x490
zswap_enabled_param_set+0x5b/0xa0
param_attr_store+0x93/0xe0
module_attr_store+0x1c/0x30
kernfs_fop_write_iter+0x116/0x1f0
Allocate and copy the replacement first, then replace the parameter value
only after allocation succeeds.
Fixes: e180a6b7759a ("param: fix charp parameters set via sysfs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/params.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -261,6 +261,7 @@ EXPORT_SYMBOL_GPL(param_set_uint_minmax)
int param_set_charp(const char *val, const struct kernel_param *kp)
{
+ char *tmp;
size_t len, maxlen = 1024;
len = strnlen(val, maxlen + 1);
@@ -269,19 +270,20 @@ int param_set_charp(const char *val, con
return -ENOSPC;
}
- maybe_kfree_parameter(*(char **)kp->arg);
-
/*
* This is a hack. We can't kmalloc() in early boot, and we
* don't need to; this mangled commandline is preserved.
*/
if (slab_is_available()) {
- *(char **)kp->arg = kmalloc_parameter(len + 1);
- if (!*(char **)kp->arg)
+ tmp = kmalloc_parameter(len + 1);
+ if (!tmp)
return -ENOMEM;
- strcpy(*(char **)kp->arg, val);
+ memcpy(tmp, val, len + 1);
} else
- *(const char **)kp->arg = val;
+ tmp = (char *)val;
+
+ maybe_kfree_parameter(*(char **)kp->arg);
+ *(char **)kp->arg = tmp;
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 369/713] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 368/713] params: fix charp corruption on allocation failure Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 370/713] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Greg Kroah-Hartman
` (354 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Xu Yang, Felix Gu,
Vinod Koul
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
commit 87a1805b1c346b092c34f96f3806f207792910e1 upstream.
If probe fails after imx95_usb_phy_get_tca() succeeds, the typec
switch leaks because the only cleanup path was in .remove(), which
never runs on probe failure.
Use devm_add_action_or_reset() so the switch is cleaned up on both
probe failure and driver removal. The imx95_usb_phy_put_tca() is no
longer needed, it will be removed in .remove() too.
Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +++++++--------------
1 file changed, 7 insertions(+), 14 deletions(-)
--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
@@ -173,9 +173,9 @@ static struct typec_switch_dev *tca_blk_
return sw;
}
-static void tca_blk_put_typec_switch(struct typec_switch_dev *sw)
+static void tca_blk_put_typec_switch(void *data)
{
- typec_switch_unregister(sw);
+ typec_switch_unregister(data);
}
static void tca_blk_orientation_set(struct tca_blk *tca,
@@ -248,6 +248,7 @@ static struct tca_blk *imx95_usb_phy_get
struct device *dev = &pdev->dev;
struct resource *res;
struct tca_blk *tca;
+ int ret;
res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
if (!res)
@@ -266,17 +267,11 @@ static struct tca_blk *imx95_usb_phy_get
tca->orientation = TYPEC_ORIENTATION_NORMAL;
tca->sw = tca_blk_get_typec_switch(pdev, imx_phy);
- return tca;
-}
-
-static void imx95_usb_phy_put_tca(struct imx8mq_usb_phy *imx_phy)
-{
- struct tca_blk *tca = imx_phy->tca;
-
- if (!tca)
- return;
+ ret = devm_add_action_or_reset(&pdev->dev, tca_blk_put_typec_switch, tca->sw);
+ if (ret)
+ return ERR_PTR(ret);
- tca_blk_put_typec_switch(tca->sw);
+ return tca;
}
static u32 phy_tx_vref_tune_from_property(u32 percent)
@@ -741,9 +736,7 @@ static int imx8mq_usb_phy_probe(struct p
static void imx8mq_usb_phy_remove(struct platform_device *pdev)
{
- struct imx8mq_usb_phy *imx_phy = platform_get_drvdata(pdev);
- imx95_usb_phy_put_tca(imx_phy);
}
static struct platform_driver imx8mq_usb_phy_driver = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 370/713] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 369/713] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 371/713] SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Greg Kroah-Hartman
` (353 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 3f491306dcb673ff5e78e1044ba450c58978774e upstream.
xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by
walking the tail, pages, and head iovecs. Each per-section step
uses min_t() so it never removes more bytes than that section
holds, but the final accounting at the fix_len label subtracts the
total bytes actually consumed from buf->len without any clamp:
fix_len:
buf->len -= (len - trim);
When the caller has set buf->len to a value smaller than the sum
of the iov_lens, (len - trim) can exceed buf->len and the unsigned
subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches
xdr_buf_trim() in exactly that state:
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
buf->len is a small wire-derived value while the iov_lens are at
page scale, so the per-section loops legitimately consume far more
bytes than buf->len records. The wrapped buf->len then propagates
as the authoritative stream bound into every downstream XDR
decoder.
Fix by clamping the decrement so buf->len bottoms out at zero:
buf->len -= min_t(unsigned int, buf->len, len - trim);
On the normal path where the iov_lens sum to buf->len, (len - trim)
is always <= buf->len and the result is identical to before. No
callers change behavior outside the underflow case.
Fixes: 4c190e2f913f ("sunrpc: trim off trailing checksum before returning decrypted or integrity authenticated buffer")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-4-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -2049,7 +2049,7 @@ void xdr_buf_trim(struct xdr_buf *buf, u
trim -= cur;
}
fix_len:
- buf->len -= (len - trim);
+ buf->len -= min_t(unsigned int, buf->len, len - trim);
}
EXPORT_SYMBOL_GPL(xdr_buf_trim);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 371/713] SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 370/713] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 372/713] SUNRPC: svcauth_gss: enforce krb5 token minimum length Greg Kroah-Hartman
` (352 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 11539e8fcce0b0af062ae5fecf7b3676c2f7aeed upstream.
svcauth_gss_decode_credbody() writes the caller's
rpc_gss_wire_cred field by field and assigns gc_ctx.len only on
the success tail. The caller storage is svcdata->clcred, which
lives in the per-svc_rqst gss_svc_data and is reused across
requests. Early decode failures leave partially decoded state
mixed with residue from the prior request.
The trailing body_len tightness check is the sharpest case:
xdr_stream_decode_opaque_inline() has already written gc_ctx.data
with a borrowed inline pointer into the current request's XDR
pages, but gc_ctx.len retains its prior value. Once the request
pages are released the pooled clcred carries a dangling pointer
paired with a stale length.
Zero the caller's rpc_gss_wire_cred at function entry so that
every early-return path leaves a deterministic all-zero cred.
On the trailing tightness-check path, gc_ctx.len is now zero
instead of stale, which neuters length-driven consumers such as
gss_svc_searchbyctx() that would otherwise walk the dangling
data pointer.
Fixes: b0bc53470d1a ("SUNRPC: Convert the svcauth_gss_accept() pre-amble to use xdr_stream")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-5-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1573,6 +1573,9 @@ svcauth_gss_decode_credbody(struct xdr_s
u32 body_len;
__be32 *p;
+ /* Early-return paths leave deterministic state, not stale residue. */
+ memset(gc, 0, sizeof(*gc));
+
p = xdr_inline_decode(xdr, XDR_UNIT);
if (!p)
return false;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 372/713] SUNRPC: svcauth_gss: enforce krb5 token minimum length
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 371/713] SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 373/713] sunrpc: route to a populated pool in svc_pool_for_cpu() Greg Kroah-Hartman
` (351 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit a919c5c88769cf8fb3ec071e6078d830bf512489 upstream.
svcauth_gss_unwrap_priv() validates only an upper bound on the
wire-supplied opaque length before handing the buffer to
gss_unwrap():
if (len > xdr_stream_remaining(xdr))
goto unwrap_failed;
offset = xdr_stream_pos(xdr);
...
maj_stat = gss_unwrap(ctx, offset, offset + len, buf);
The wire value `len` flows unchanged as the upper bound into the
krb5 unwrap path, so a len in [0, 16] passes this check and is
handed to gss_unwrap(). For a krb5 v2 context that lands in
gss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token
header fields at ptr+4 and ptr+6 and then calls rotate_left()
before any integrity check. With a sub-header length the header
reads run past the token, and _rotate_left()'s `shift %= buf->len`
path can divide by zero when buf->len has been driven to zero by
the truncated token. A header-only token (len == 16) is equally
invalid: with a non-zero RRC field and the opaque blob ending at
the XDR buffer boundary, rotate_left() builds a zero-length
subbuffer, reaching the same division.
Reject the token at the server entry point before it reaches the
krb5 unwrap core. A valid sealed RFC 4121 token must contain
the 16-byte header plus at least some encrypted payload.
Fix by adding a minimum-length check immediately after the
existing upper-bound check:
if (len <= GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;
Fixes: 7c9fdcfb1b64 ("[PATCH] knfsd: svcrpc: gss: server-side implementation of rpcsec_gss privacy")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-2-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -949,6 +949,8 @@ svcauth_gss_unwrap_priv(struct svc_rqst
}
if (len > xdr_stream_remaining(xdr))
goto unwrap_failed;
+ if (len <= GSS_KRB5_TOK_HDR_LEN)
+ goto unwrap_failed;
offset = xdr_stream_pos(xdr);
saved_len = buf->len;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 373/713] sunrpc: route to a populated pool in svc_pool_for_cpu()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 372/713] SUNRPC: svcauth_gss: enforce krb5 token minimum length Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 374/713] SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Greg Kroah-Hartman
` (350 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f6310491c4cdb88af73aa551ec9df1f10a90c709 upstream.
svc_set_num_threads() spreads the requested threads evenly across the
service's pools (base = nrservs / sv_nrpools). When a service runs
fewer threads than it has pools -- e.g. an nfsd configured with fewer
threads than the host has NUMA nodes while running in "pernode" or
"percpu" mode -- the trailing pools are left with no threads at all.
svc_xprt_enqueue() selects a pool from the CPU servicing the transport,
queues the transport on that pool's sp_xprts, and only wakes a thread
from the same pool. Each thread services exclusively its own pool, so a
transport that lands on a threadless pool is enqueued on sp_xprts and
never picked up: the connection hangs indefinitely.
Have svc_pool_for_cpu() skip pools that currently have no threads,
falling back to the next populated pool. This trades NUMA locality for
a guarantee that the work is actually serviced. sp_nrthreads is only
updated under the service mutex; the lockless read here is a best-effort
routing hint, so annotate it with data_race().
Fixes: bfd241600a3b ("[PATCH] knfsd: make rpc threads pools numa aware")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260706-sunrpc-pool-mode-v5-1-6c4ee7cd89aa@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -402,6 +402,7 @@ struct svc_pool *svc_pool_for_cpu(struct
struct svc_pool_map *m = &svc_pool_map;
int cpu = raw_smp_processor_id();
unsigned int pidx = 0;
+ unsigned int i;
if (serv->sv_nrpools <= 1)
return serv->sv_pools;
@@ -414,8 +415,34 @@ struct svc_pool *svc_pool_for_cpu(struct
pidx = m->to_pool[cpu_to_node(cpu)];
break;
}
+ pidx %= serv->sv_nrpools;
- return &serv->sv_pools[pidx % serv->sv_nrpools];
+ /*
+ * It's possible to have a pool with no threads. Userland can just set
+ * things up this way directly. Also, when threads are autodistributed
+ * they are spread evenly across the pools, but when there are fewer
+ * threads than pools some pools can end up with none.
+ *
+ * A transport enqueued on a threadless pool would never be picked up,
+ * since each thread only services its own pool. Fall back to the next
+ * populated pool, trading NUMA locality for a guarantee that the
+ * transport is serviced.
+ */
+ for (i = 0; i < serv->sv_nrpools; i++) {
+ struct svc_pool *pool = &serv->sv_pools[pidx];
+
+ /* This is set under the service mutex and rarely ever
+ * changes. A data race here is harmless.
+ */
+ if (data_race(pool->sp_nrthreads))
+ return pool;
+
+ if (++pidx >= serv->sv_nrpools)
+ pidx = 0;
+ }
+
+ /* No pool has any threads; nothing can service the transport. */
+ return &serv->sv_pools[pidx];
}
static int svc_rpcb_setup(struct svc_serv *serv, struct net *net)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 374/713] SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 373/713] sunrpc: route to a populated pool in svc_pool_for_cpu() Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 375/713] SUNRPC: always drain cache_cleaner before destroying a cache_detail Greg Kroah-Hartman
` (349 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ameer Hamza, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ameer Hamza <ameer.hamza@truenas.com>
commit 0574da29ae12be7714df217c4ce7ff6ba9b0c23b upstream.
Commit d57e43b72bf2 ("SUNRPC: Update svcxdr_init_decode() to call
xdr_set_scratch_folio()") changed svc_pool_map_get_node() to return
numa_mem_id() instead of NUMA_NO_NODE, because __folio_alloc_node()
cannot accept NUMA_NO_NODE. That return value is not equivalent: it
is evaluated in the context of the task creating the nfsd threads,
once per thread created, and it is passed to kthread_create_on_node()
and to the per-thread allocations in svc_prepare_thread().
Since commit d1a89197589c ("kthread: Default affine kthread to its
preferred NUMA node"), the node argument of kthread_create_on_node()
no longer only places the task structure and stack: a kthread created
with a real node id normally affines itself to that node's CPUs when
it is first woken to run its thread function. All nfsd threads are
typically started together, by one task writing to
/proc/fs/nfsd/threads, so under the default pool_mode=global each
nfsd thread is now affined to the local-memory node of the CPU its
creating iteration happened to run on - typically the same node for
every thread. The CPUs of the other nodes are then unable to run
nfsd at all, and the threads' allocations - svc_rqst structures,
page pointer arrays, newly allocated task stacks, and the per-RPC
pages allocated at run time - all prefer that one node.
Restore the NUMA_NO_NODE behaviour that global mode has had since
commit 11fd165c68b7 ("sunrpc: use better NUMA affinities"), and
handle NUMA_NO_NODE at the one call site that cannot take it by
resolving it to numa_mem_id() there, exactly as alloc_pages_node()
did for the scratch page before the conversion. The mapped percpu
and pernode branches are unchanged. Unpooled services such as lockd
and the NFS client callback service also take this fallback when no
percpu or pernode map is active, restoring their thread placement in
that case.
A bisect of a 2x NFS READ throughput regression between v6.17 and
v6.18 converged on d57e43b72bf2. On the affected 4-node server every
nfsd thread comes up with its CPU affinity restricted to the CPUs of
a single node; with this change the threads are runnable on all CPUs
again and the observed regression is resolved.
Fixes: d57e43b72bf2 ("SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio()")
Cc: stable@vger.kernel.org
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260722182012.2063936-1-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -352,7 +352,7 @@ static int svc_pool_map_get_node(unsigne
if (m->mode == SVC_POOL_PERNODE)
return m->pool_to[pidx];
}
- return numa_mem_id();
+ return NUMA_NO_NODE;
}
/*
* Set the given thread's cpus_allowed mask so that it
@@ -738,7 +738,9 @@ svc_prepare_thread(struct svc_serv *serv
rqstp->rq_server = serv;
rqstp->rq_pool = pool;
- rqstp->rq_scratch_folio = __folio_alloc_node(GFP_KERNEL, 0, node);
+ rqstp->rq_scratch_folio = __folio_alloc_node(GFP_KERNEL, 0,
+ node == NUMA_NO_NODE ?
+ numa_mem_id() : node);
if (!rqstp->rq_scratch_folio)
goto out_enomem;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 375/713] SUNRPC: always drain cache_cleaner before destroying a cache_detail
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 374/713] SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 376/713] SUNRPC: Check svc pool percpu counter allocation Greg Kroah-Hartman
` (348 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f42d0fda0c67695db6bc704b04b7c10240805377 upstream.
sunrpc_destroy_cache_detail() only cancels the global cache_cleaner
delayed_work when cache_list is empty. During per-netns teardown
cache_list is never empty because init_net's caches remain registered,
so the cancel never fires. After unlink, the caller proceeds to
cache_destroy_net() which kfrees the cache_detail while cache_clean()
may still hold a dangling pointer to it. The result is a
use-after-free: cache_dequeue() takes cd->queue_lock on freed memory,
and cache_put() dereferences cd->cache_put as a function pointer from
freed slab.
Drop the list_empty guard so that cancel_delayed_work_sync() always
runs, ensuring any in-flight cache_clean() completes before the
cache_detail is freed. Re-arm the cleaner afterwards if other caches
are still registered.
Fixes: 820f9442e711 ("SUNRPC: split cache creation and PipeFS registration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-cache_cleaner_vs_destroy_no_sync-v1-1-a707a6fcfd32@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/cache.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -430,10 +430,9 @@ void sunrpc_destroy_cache_detail(struct
list_del_init(&cd->others);
spin_unlock(&cd->hash_lock);
spin_unlock(&cache_list_lock);
- if (list_empty(&cache_list)) {
- /* module must be being unloaded so its safe to kill the worker */
- cancel_delayed_work_sync(&cache_cleaner);
- }
+ cancel_delayed_work_sync(&cache_cleaner);
+ if (!list_empty(&cache_list))
+ queue_delayed_work(system_power_efficient_wq, &cache_cleaner, 0);
}
EXPORT_SYMBOL_GPL(sunrpc_destroy_cache_detail);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 376/713] SUNRPC: Check svc pool percpu counter allocation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 375/713] SUNRPC: always drain cache_cleaner before destroying a cache_detail Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 377/713] SUNRPC: close backchannel before destroying callback service Greg Kroah-Hartman
` (347 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 43e11e164704dde975c9edb370de1a06bec67270 upstream.
__svc_create() initializes three per-pool percpu_counter stats and
ignores every return value. On SMP, percpu_counter_init() fails when
__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed
counter with fbc->counters == NULL and its embedded raw_spinlock_t,
list_head, and count never initialized. __svc_create() returns the
half-constructed svc_serv to nfsd, lockd, or the NFS callback service
anyway.
Once that service is live, the hot-path increments in
svc_xprt_enqueue(), svc_handle_xprt(), and
svc_pool_wake_idle_thread() reach a counter whose backing pointer is
NULL. The pointer is a per-cpu offset, so the access does not fault:
it resolves to offset zero of the current CPU's per-cpu area and
silently corrupts whatever variable lives there. A
/proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and
returns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on
the never-initialized lock.
Creating the broken service requires a percpu allocation failure during
RPC server startup, so it is reachable only by a local administrator
under memory pressure or fault injection; a remote peer cannot induce
the bad state on its own.
Check each percpu_counter_init() return value in __svc_create() and
fail when an allocation fails, unwinding the counters already set up
in the current pool and in every pool initialized before it. A
discrete percpu_counter_destroy() per counter at teardown frees each
per-cpu allocation exactly once.
Fixes: ccf08bed6e7a ("SUNRPC: Replace pool stats with per-CPU variables")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-tier2-local-v2-2-5a0fd532db57@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 45 +++++++++++++++++++++++++++++++++++++++------
1 file changed, 39 insertions(+), 6 deletions(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -503,6 +503,35 @@ __svc_init_bc(struct svc_serv *serv)
}
#endif
+static int svc_pool_init_counters(struct svc_pool *pool)
+{
+ int err;
+
+ err = percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
+ if (err)
+ return err;
+ err = percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
+ if (err)
+ goto err_sockets;
+ err = percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
+ if (err)
+ goto err_threads;
+ return 0;
+
+err_threads:
+ percpu_counter_destroy(&pool->sp_sockets_queued);
+err_sockets:
+ percpu_counter_destroy(&pool->sp_messages_arrived);
+ return err;
+}
+
+static void svc_pool_destroy_counters(struct svc_pool *pool)
+{
+ percpu_counter_destroy(&pool->sp_messages_arrived);
+ percpu_counter_destroy(&pool->sp_sockets_queued);
+ percpu_counter_destroy(&pool->sp_threads_woken);
+}
+
/*
* Create an RPC service
*/
@@ -567,12 +596,18 @@ __svc_create(struct svc_program *prog, i
INIT_LIST_HEAD(&pool->sp_all_threads);
init_llist_head(&pool->sp_idle_threads);
- percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
- percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
- percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
+ if (svc_pool_init_counters(pool))
+ goto out_err;
}
return serv;
+
+out_err:
+ while (i--)
+ svc_pool_destroy_counters(&serv->sv_pools[i]);
+ kfree(serv->sv_pools);
+ kfree(serv);
+ return NULL;
}
/**
@@ -651,9 +686,7 @@ svc_destroy(struct svc_serv **servp)
for (i = 0; i < serv->sv_nrpools; i++) {
struct svc_pool *pool = &serv->sv_pools[i];
- percpu_counter_destroy(&pool->sp_messages_arrived);
- percpu_counter_destroy(&pool->sp_sockets_queued);
- percpu_counter_destroy(&pool->sp_threads_woken);
+ svc_pool_destroy_counters(pool);
}
kfree(serv->sv_pools);
kfree(serv);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 377/713] SUNRPC: close backchannel before destroying callback service
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 376/713] SUNRPC: Check svc pool percpu counter allocation Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 378/713] sunrpc: defer rq_argp and rq_resp free until after RCU grace period Greg Kroah-Hartman
` (346 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 3674f780f47d2906b5a0f7199b66973067bdfeca upstream.
A backchannel receive can complete a request while the NFS callback
service is being torn down. xprt_complete_bc_request() removes the
request from bc_pa_list, drops bc_alloc_count, marks the request in use,
and then asks xprt_enqueue_bc_request() to hand it to the callback
service.
If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request()
currently returns without enqueueing or freeing the committed request.
The xprt_get() taken on entry is leaked as well. If the producer wins
the race before bc_serv is cleared, it can also enqueue onto sv_cb_list
after nfs_callback_down() has stopped the callback threads, leaving the
request linked to a svc_serv that is about to be freed.
Close the producer side before callback threads are stopped. Add
xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call
it on callback shutdown and callback-start failure before stopping the
service threads. Requests that lose the NULL transition in
xprt_enqueue_bc_request() are released through the normal backchannel
free path after balancing bc_slot_count. Finally, drain any remaining
sv_cb_list requests after the callback threads have stopped and before
svc_destroy() frees the service.
Fixes: 441244d4273a ("SUNRPC: cleanup common code in backchannel request")
Fixes: 9e9fdd0ad0fb ("NFSv4.1: protect destroying and nullifying bc_serv structure")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-6-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback.c | 4 +++-
include/linux/sunrpc/bc_xprt.h | 5 +++++
net/sunrpc/backchannel_rqst.c | 38 +++++++++++++++++++++++++++-------
3 files changed, 39 insertions(+), 8 deletions(-)
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index ff4e9fd38e83..bc282b744f34 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -231,8 +231,9 @@ int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt)
cb_info->users++;
err_net:
if (!cb_info->users) {
+ xprt_svc_shutdown_bc(xprt);
svc_set_num_threads(cb_info->serv, 0, 0);
- svc_destroy(&cb_info->serv);
+ xprt_svc_destroy_nullify_bc(xprt, &cb_info->serv);
}
err_create:
mutex_unlock(&nfs_callback_mutex);
@@ -254,6 +255,7 @@ void nfs_callback_down(int minorversion, struct net *net, struct rpc_xprt *xprt)
mutex_lock(&nfs_callback_mutex);
serv = cb_info->serv;
+ xprt_svc_shutdown_bc(xprt);
nfs_callback_down_net(minorversion, serv, net);
cb_info->users--;
if (cb_info->users == 0) {
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index 98939cb664cf..59d0cc889beb 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -32,6 +32,7 @@ int xprt_setup_bc(struct rpc_xprt *xprt, unsigned int min_reqs);
void xprt_destroy_bc(struct rpc_xprt *xprt, unsigned int max_reqs);
void xprt_free_bc_rqst(struct rpc_rqst *req);
unsigned int xprt_bc_max_slots(struct rpc_xprt *xprt);
+void xprt_svc_shutdown_bc(struct rpc_xprt *xprt);
void xprt_svc_destroy_nullify_bc(struct rpc_xprt *xprt, struct svc_serv **serv);
/*
@@ -71,6 +72,10 @@ static inline void xprt_free_bc_request(struct rpc_rqst *req)
{
}
+static inline void xprt_svc_shutdown_bc(struct rpc_xprt *xprt)
+{
+}
+
static inline void xprt_svc_destroy_nullify_bc(struct rpc_xprt *xprt, struct svc_serv **serv)
{
svc_destroy(serv);
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 0ffa4d01a938..1482b06e0f38 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -25,20 +25,39 @@ unsigned int xprt_bc_max_slots(struct rpc_xprt *xprt)
}
/*
- * Helper function to nullify backchannel server pointer in transport.
- * We need to synchronize setting the pointer to NULL (done so after
- * the backchannel server is shutdown) with the usage of that pointer
- * by the backchannel request processing routines
- * xprt_complete_bc_request() and rpcrdma_bc_receive_call().
+ * Close the backchannel producer side, drain any requests still
+ * queued on sv_cb_list, then destroy the callback service.
*/
void xprt_svc_destroy_nullify_bc(struct rpc_xprt *xprt, struct svc_serv **serv)
{
- spin_lock(&xprt->bc_pa_lock);
+ struct svc_serv *bc_serv = *serv;
+ struct rpc_rqst *req;
+
+ xprt_svc_shutdown_bc(xprt);
+ while ((req = lwq_dequeue(&bc_serv->sv_cb_list, struct rpc_rqst,
+ rq_bc_list)) != NULL) {
+ atomic_dec(&req->rq_xprt->bc_slot_count);
+ xprt_free_bc_request(req);
+ }
svc_destroy(serv);
+}
+EXPORT_SYMBOL_GPL(xprt_svc_destroy_nullify_bc);
+
+/*
+ * Clear the backchannel server pointer in the transport. The NULL
+ * store is serialized under bc_pa_lock against readers of
+ * xprt->bc_serv in xprt_complete_bc_request() and
+ * rpcrdma_bc_receive_call(). Clearing it before the callback service
+ * is stopped prevents a producer from enqueueing onto a service that
+ * is being torn down.
+ */
+void xprt_svc_shutdown_bc(struct rpc_xprt *xprt)
+{
+ spin_lock(&xprt->bc_pa_lock);
xprt->bc_serv = NULL;
spin_unlock(&xprt->bc_pa_lock);
}
-EXPORT_SYMBOL_GPL(xprt_svc_destroy_nullify_bc);
+EXPORT_SYMBOL_GPL(xprt_svc_shutdown_bc);
/*
* Helper routines that track the number of preallocation elements
@@ -393,7 +412,12 @@ void xprt_enqueue_bc_request(struct rpc_rqst *req)
if (bc_serv) {
lwq_enqueue(&req->rq_bc_list, &bc_serv->sv_cb_list);
svc_pool_wake_idle_thread(&bc_serv->sv_pools[0]);
+ spin_unlock(&xprt->bc_pa_lock);
+ return;
}
spin_unlock(&xprt->bc_pa_lock);
+
+ atomic_dec(&xprt->bc_slot_count);
+ xprt_free_bc_request(req);
}
EXPORT_SYMBOL_GPL(xprt_enqueue_bc_request);
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 378/713] sunrpc: defer rq_argp and rq_resp free until after RCU grace period
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 377/713] SUNRPC: close backchannel before destroying callback service Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 379/713] SUNRPC: fix gssx_dec_option_array error path bugs Greg Kroah-Hartman
` (345 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit c479bde671cbe2f9e152834a8b0eb7c3c295bbaf upstream.
svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously
via kfree(), but defers the rqstp struct free via kfree_rcu(). After
svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is
a window where RCU readers that started before list_del_rcu() can still
traverse the thread list and find the rqstp. These readers (e.g.
nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has
already been freed — a use-after-free.
Fix this by moving the kfree of rq_argp and rq_resp into an explicit
call_rcu() callback alongside the struct free. Resources not accessed
by RCU readers (bvec, buffer pages, scratch folio, auth_data) remain
synchronously freed.
Fixes: 812443865c5f ("sunrpc: add a rcu_head to svc_rqst and use kfree_rcu to free it")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-4-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -743,6 +743,15 @@ svc_release_buffer(struct svc_rqst *rqst
}
}
+static void svc_rqst_free_rcu(struct rcu_head *head)
+{
+ struct svc_rqst *rqstp = container_of(head, struct svc_rqst, rq_rcu_head);
+
+ kfree(rqstp->rq_resp);
+ kfree(rqstp->rq_argp);
+ kfree(rqstp);
+}
+
static void
svc_rqst_free(struct svc_rqst *rqstp)
{
@@ -751,10 +760,8 @@ svc_rqst_free(struct svc_rqst *rqstp)
svc_release_buffer(rqstp);
if (rqstp->rq_scratch_folio)
folio_put(rqstp->rq_scratch_folio);
- kfree(rqstp->rq_resp);
- kfree(rqstp->rq_argp);
kfree(rqstp->rq_auth_data);
- kfree_rcu(rqstp, rq_rcu_head);
+ call_rcu(&rqstp->rq_rcu_head, svc_rqst_free_rcu);
}
static struct svc_rqst *
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 379/713] SUNRPC: fix gssx_dec_option_array error path bugs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 378/713] sunrpc: defer rq_argp and rq_resp free until after RCU grace period Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 380/713] sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Greg Kroah-Hartman
` (344 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 5e9a94539b1ec17a89177d952badfd0d844d694a upstream.
Four coupled defects in the gssx XDR option-array decoder make the
error paths unsafe: a NULL deref in the caller, a refcount leak on
the decoded group_info, and a latent use-after-free that the leak
fix would otherwise expose.
gssx_dec_option_array() sets oa->count = 1 before allocating
oa->data. If that allocation fails, -ENOMEM is returned with
oa->count == 1 and oa->data == NULL. All other error paths jump
to free_oa: which frees oa->data and NULLs it but also leaves
oa->count == 1. The caller trusts the count:
gssp_accept_sec_context_upcall()
gssx_dec_accept_sec_context()
gssx_dec_option_array() /* fails, count=1 data=NULL */
data = res.options.data[0].value /* NULL deref */
Independently, free_creds: releases the partially decoded svc_cred
with a bare kfree(creds). gssx_dec_linux_creds() installs a
groups_alloc() result into creds->cr_group_info; that object is
kvmalloc-backed and refcounted, and only put_group_info() reaches
kvfree(). A plain kfree(creds) drops the wrapper and leaks the
group_info allocation.
The natural fix for the leak is to call free_svc_cred(creds) before
kfree(creds), but free_svc_cred() invokes put_group_info() on
creds->cr_group_info unconditionally when non-NULL. The existing
out_free_groups: path in gssx_dec_linux_creds() already called
groups_free() on that pointer without clearing it, so once
free_svc_cred() is wired in, the subsequent put_group_info() would
touch freed memory.
Fix all four together:
- Move the oa->count = 1 assignment below the oa->data allocation
so it is never set when oa->data is NULL.
- Reset oa->count to 0 at free_oa: so count and data stay
coherent and the caller sees an empty option array.
- Call free_svc_cred(creds) before kfree(creds) at free_creds:
so the refcounted cr_group_info is released. free_svc_cred()
either NULL-guards each field explicitly (cr_group_info has
an if() check) or delegates to a helper that is NULL-safe
itself (kfree for the string fields, gss_mech_put() which
guards with if(gm) at gss_mech_switch.c:342), so it is safe
to call on a partially decoded svc_cred where only
cr_uid/cr_gid/cr_group_info have been written and everything
else is zero from kzalloc.
- In gssx_dec_linux_creds()'s out_free_groups: path, release
cr_group_info with put_group_info() rather than groups_free()
so the teardown matches free_svc_cred()'s refcount-aware path,
and clear the pointer so a later free_svc_cred() on the same
creds does not release it a second time.
Fixes: 3cfcfc102a5e ("SUNRPC: fix some memleaks in gssx_dec_option_array")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-2-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_rpc_xdr.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -222,7 +222,8 @@ static int gssx_dec_linux_creds(struct x
return 0;
out_free_groups:
- groups_free(creds->cr_group_info);
+ put_group_info(creds->cr_group_info);
+ creds->cr_group_info = NULL;
return err;
}
@@ -242,12 +243,12 @@ static int gssx_dec_option_array(struct
return 0;
/* we recognize only 1 currently: CREDS_VALUE */
- oa->count = 1;
-
oa->data = kmalloc_obj(struct gssx_option);
if (!oa->data)
return -ENOMEM;
+ oa->count = 1;
+
creds = kzalloc_obj(struct svc_cred);
if (!creds) {
err = -ENOMEM;
@@ -294,8 +295,10 @@ static int gssx_dec_option_array(struct
return 0;
free_creds:
+ free_svc_cred(creds);
kfree(creds);
free_oa:
+ oa->count = 0;
kfree(oa->data);
oa->data = NULL;
return err;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 380/713] sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 379/713] SUNRPC: fix gssx_dec_option_array error path bugs Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 381/713] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Greg Kroah-Hartman
` (343 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Xin Liu, Ren Wei,
Luxiao Xu, Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <rakukuip@gmail.com>
commit 932a8cf6abb2b2f8677b79153a823108d8861fe2 upstream.
Normal client creation goes through rpc_setup_pipedir(), which records
clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event()
calls rpc_setup_pipedir_sb() directly and never refreshes that field.
The umount path also removes the directory without clearing
clnt->pipefs_sb.
After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()
compares the current superblock against a stale pipefs_sb pointer and
skips cleanup, leaving pipefs dentries whose inode private data still
points at a freed rpc_clnt, leading to a potential use-after-free during
subsequent rpc_info_open() or rpc_show_info() calls.
Fix this by properly updating clnt->pipefs_sb upon mount events and
clearing it during unmount or failure paths.
Fixes: bfca5fb4e97c ("SUNRPC: Fix RPC client cleaned up the freed pipefs dentries")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/clnt.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -96,7 +96,10 @@ static void rpc_unregister_client(struct
static void __rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
{
- rpc_remove_client_dir(clnt);
+ if (clnt->pipefs_sb) {
+ rpc_remove_client_dir(clnt);
+ clnt->pipefs_sb = NULL;
+ }
}
static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
@@ -177,19 +180,28 @@ static int rpc_clnt_skip_event(struct rp
}
static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
- struct super_block *sb)
+ struct super_block *sb)
{
+ int err = 0;
+
switch (event) {
case RPC_PIPEFS_MOUNT:
- return rpc_setup_pipedir_sb(sb, clnt);
+ clnt->pipefs_sb = sb;
+ err = rpc_setup_pipedir_sb(sb, clnt);
+ if (err)
+ clnt->pipefs_sb = NULL;
+ break;
case RPC_PIPEFS_UMOUNT:
- __rpc_clnt_remove_pipedir(clnt);
+ if (clnt->pipefs_sb == sb) {
+ __rpc_clnt_remove_pipedir(clnt);
+ clnt->pipefs_sb = NULL;
+ }
break;
default:
printk(KERN_ERR "%s: unknown event: %ld\n", __func__, event);
return -ENOTSUPP;
}
- return 0;
+ return err;
}
static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 381/713] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 380/713] sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 382/713] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Greg Kroah-Hartman
` (342 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit f8870b9b75afb77986bc65940a231d54068ff2b1 upstream.
svcauth_gss_release() reads gc_proc and switches on gc_svc before
consulting rq_auth_stat. On the SVC_DENIED path after a failed
svcauth_gss_accept(), those fields may hold stale values from a
prior request or uninitialized slab residue: svcauth_gss_accept()
allocates gss_svc_data with non-zeroing kmalloc and clears only
gsd_databody_offset and rsci per request, not clcred.
Because RPC_GSS_PROC_DATA is zero, a zeroed or stale-zero gc_proc
passes the existing guard and falls through into the gc_svc switch,
which can dispatch to svcauth_gss_wrap_integ() or
svcauth_gss_wrap_priv(). Both wrap helpers call
svcauth_gss_prepare_to_wrap() before any rsci->mechctx dereference,
and that helper already returns early when rq_auth_stat is not
rpc_auth_ok, so the downstream NULL dereference is blocked. The
dispatch itself remains structurally wrong: it reads scalars that
the caller has no contract to have initialized after a failed
authentication.
Mirror the existing rq_auth_stat gate in
svcauth_gss_prepare_to_wrap() one frame up, so
svcauth_gss_release() skips the clcred dispatch entirely when
authentication has not succeeded. The cleanup tail that releases
rq_client, rq_gssclient, cr_group_info, and rsci still runs.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-4-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1947,6 +1947,8 @@ svcauth_gss_release(struct svc_rqst *rqs
if (!gsd)
goto out;
+ if (rqstp->rq_auth_stat != rpc_auth_ok)
+ goto out;
gc = &gsd->clcred;
if (gc->gc_proc != RPC_GSS_PROC_DATA)
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 382/713] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 381/713] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 383/713] SUNRPC: harden gss_unwrap_resp_priv length checks Greg Kroah-Hartman
` (341 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 6959297aaa9572783d620a226d73c3fb94494888 upstream.
gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and
ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN
(16) bytes long, and its rotate_left() helper passes buf->len - base
to xdr_buf_subsegment() without verifying that base <= buf->len. When
a caller hands in a sub-16-byte token, or a token whose declared len
leaves base past the end of the buffer, three distinct failures follow:
gss_krb5_unwrap_v2(offset, len, buf)
ptr = buf->head[0].iov_base + offset
ec = *(ptr + 4) /* OOB read on short head */
rrc = *(ptr + 6) /* OOB read on short head */
rotate_left(offset + 16, buf, rrc)
xdr_buf_subsegment(buf, &subbuf,
base, buf->len - base) /* u32 wrap when base > len */
_rotate_left(&subbuf, shift)
shift %= buf->len /* divide-by-zero when base == len */
After decryption, the cleanup arithmetic has the same shape:
movelen = min_t(unsigned int, buf->head[0].iov_len, len);
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
buf->head[0].iov_len);
The BUG_ON re-adds the value just subtracted, so it reduces to
min(A, B) > A and is permanently false; it cannot catch the unsigned
underflow of movelen, which then drives a ~UINT_MAX-byte memmove().
Add four defense-in-depth guards inside the unwrap core so it is safe
regardless of what its callers validate:
- reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before
touching ptr+4/ptr+6;
- bail from rotate_left() when buf->len <= base, covering both the
underflow and zero-length cases;
- return early from _rotate_left() when buf->len is zero, so the
shift %= buf->len modulo cannot fault;
- replace the dead BUG_ON with a live check that returns
GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
Fixes: de9c17eb4a91 ("gss_krb5: add support for new token formats in rfc4121")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-5-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_krb5_wrap.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -73,6 +73,8 @@ static void _rotate_left(struct xdr_buf
int shifted = 0;
int this_shift;
+ if (!buf->len)
+ return;
shift %= buf->len;
while (shifted < shift) {
this_shift = min(shift - shifted, LOCAL_BUF_LEN);
@@ -85,6 +87,8 @@ static void rotate_left(u32 base, struct
{
struct xdr_buf subbuf;
+ if (buf->len <= base)
+ return;
xdr_buf_subsegment(buf, &subbuf, base, buf->len - base);
_rotate_left(&subbuf, shift);
}
@@ -154,6 +158,9 @@ gss_krb5_unwrap_v2(struct krb5_ctx *kctx
dprintk("RPC: %s\n", __func__);
+ if (len - offset <= GSS_KRB5_TOK_HDR_LEN)
+ return GSS_S_DEFECTIVE_TOKEN;
+
ptr = buf->head[0].iov_base + offset;
if (be16_to_cpu(*((__be16 *)ptr)) != KG2_TOK_WRAP)
@@ -220,9 +227,9 @@ gss_krb5_unwrap_v2(struct krb5_ctx *kctx
* head buffer space rather than that actually occupied.
*/
movelen = min_t(unsigned int, buf->head[0].iov_len, len);
+ if (movelen < offset + GSS_KRB5_TOK_HDR_LEN + headskip)
+ return GSS_S_DEFECTIVE_TOKEN;
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
- BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
- buf->head[0].iov_len);
memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 383/713] SUNRPC: harden gss_unwrap_resp_priv length checks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 382/713] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 384/713] sunrpc: init gssp_lock before publishing proc entry Greg Kroah-Hartman
` (340 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 87831b92112c81db251d46756d65daa4f91af6a2 upstream.
gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with
offset = (u8 *)(p) - (u8 *)head->iov_base;
if (offset + opaque_len > rcv_buf->len)
goto unwrap_failed;
maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
offset + opaque_len, rcv_buf);
Both operands are u32 and the sum is computed in u32. A reply with
opaque_len near 0xffffffff makes offset + opaque_len wrap to a small
value that is below rcv_buf->len, so the bound check passes and
gss_unwrap() is called with end < begin. The check also lacks a
lower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is
accepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt
header reads at ptr+4 and ptr+6 then run past the token.
A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive
the client into out-of-bounds reads in gss_krb5_unwrap_v2() and the
rotate_left() loop that follows.
Fix by replacing the single combined check with three guards that
are safe in u32 arithmetic and that enforce the RFC 4121 minimum
outer token length:
if (offset > rcv_buf->len)
goto unwrap_failed;
if (opaque_len > rcv_buf->len - offset)
goto unwrap_failed;
if (opaque_len < GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;
The first guard makes the subtraction in the second guard
unconditionally safe; offset is derived from a successful
xdr_inline_decode() in the head kvec, so in practice it already
satisfies the bound. The floor mirrors the server-side check added
in commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token
minimum length").
Fixes: 2d2da60c63b6 ("RPCSEC_GSS: client-side privacy support")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-3-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/auth_gss.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -2072,7 +2072,11 @@ gss_unwrap_resp_priv(struct rpc_task *ta
goto unwrap_failed;
opaque_len = be32_to_cpup(p++);
offset = (u8 *)(p) - (u8 *)head->iov_base;
- if (offset + opaque_len > rcv_buf->len)
+ if (offset > rcv_buf->len)
+ goto unwrap_failed;
+ if (opaque_len > rcv_buf->len - offset)
+ goto unwrap_failed;
+ if (opaque_len <= GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;
maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 384/713] sunrpc: init gssp_lock before publishing proc entry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 383/713] SUNRPC: harden gss_unwrap_resp_priv length checks Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 385/713] SUNRPC: reject duplicate CREDS_VALUE options Greg Kroah-Hartman
` (339 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 5ce1ed6159731a41fdd0b03eedbed4e147036a5a upstream.
create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy
via proc_create_data() before init_gssp_clnt() runs mutex_init() on
sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is
immediately reachable from userspace, so a write that lands in the
window drives set_gssp_clnt() into mutex_lock() on a zero-initialized
struct mutex.
create_use_gss_proxy_proc_entry(net)
proc_create_data("use-gss-proxy", ...) /* dentry live */
init_gssp_clnt(sn)
mutex_init(&sn->gssp_lock) /* too late */
write_gssp()
set_gssp_clnt(net)
mutex_lock(&sn->gssp_lock) /* uninitialized */
gssp_rpc_create(...)
sn->gssp_clnt = clnt
mutex_unlock(&sn->gssp_lock)
The window spans only the two statements between proc_create_data()
returning and init_gssp_clnt(), so a writer reaches it only if the
registering thread is preempted there while another task is already
opening the freshly published file. register_pernet_subsys() runs in
preemptible context under pernet_ops_rwsem, so that preemption is
possible, and the window widens on auth_rpcgss module load, when the
proc entry is created for every live net namespace whose tasks are
already running. A writer that wins the race locks a zero-filled
struct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a
"lock used without init" splat; on a production kernel the fast path
acquires the lock via CMPXCHG(owner, 0, current). In the latter case
a second writer that arrives before init_gssp_clnt() re-zeroes owner
can enter set_gssp_clnt() concurrently, shut down the first writer's
clnt while it is still in use, and leak the loser's clnt.
Fix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime
matches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from
the kzalloc that backs net_generic storage, so the lazy helper is no
longer needed; drop init_gssp_clnt(), its prototype, and the call from
create_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time
dependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on
every netns before any auth_gss pernet init can publish the proc
entry.
Fixes: 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-tier2-local-v2-1-5a0fd532db57@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 ------
net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 -
net/sunrpc/auth_gss/svcauth_gss.c | 1 -
net/sunrpc/sunrpc_syms.c | 1 +
4 files changed, 1 insertion(+), 8 deletions(-)
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -121,12 +121,6 @@ out:
return result;
}
-void init_gssp_clnt(struct sunrpc_net *sn)
-{
- mutex_init(&sn->gssp_lock);
- sn->gssp_clnt = NULL;
-}
-
int set_gssp_clnt(struct net *net)
{
struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.h
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.h
@@ -29,7 +29,6 @@ int gssp_accept_sec_context_upcall(struc
struct gssp_upcall_data *data);
void gssp_free_upcall_data(struct gssp_upcall_data *data);
-void init_gssp_clnt(struct sunrpc_net *);
int set_gssp_clnt(struct net *);
void clear_gssp_clnt(struct sunrpc_net *);
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1468,7 +1468,6 @@ static int create_use_gss_proxy_proc_ent
&use_gss_proxy_proc_ops, net);
if (!*p)
return -ENOMEM;
- init_gssp_clnt(sn);
return 0;
}
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -57,6 +57,7 @@ static __net_init int sunrpc_init_net(st
INIT_LIST_HEAD(&sn->all_clients);
spin_lock_init(&sn->rpc_client_lock);
spin_lock_init(&sn->rpcb_clnt_lock);
+ mutex_init(&sn->gssp_lock);
return 0;
err_pipefs:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 385/713] SUNRPC: reject duplicate CREDS_VALUE options
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 384/713] sunrpc: init gssp_lock before publishing proc entry Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 386/713] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Greg Kroah-Hartman
` (338 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 2e4ce62385c1b8a887c5370af058ac7b52a8eaf9 upstream.
gssx_dec_option_array() walks the wire-supplied option array and, for
every entry whose name matches CREDS_VALUE, calls
gssx_dec_linux_creds() on the same struct svc_cred. That helper
unconditionally installs a fresh groups_alloc() result into
creds->cr_group_info without releasing whatever pointer was already
there:
for (i = 0; i < count; i++) {
... decode name ...
if (length == sizeof(CREDS_VALUE) &&
memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
err = gssx_dec_linux_creds(xdr, creds);
...
}
}
A reply that carries two CREDS_VALUE entries therefore overwrites
cr_group_info on the second iteration and orphans the group_info
allocated by the first call. The earlier free_creds path only
releases the last cr_group_info via free_svc_cred(), so the first
allocation's refcount stays at one and its kvmalloc-backed storage
is leaked. No in-tree caller of gssp_accept_sec_context_upcall()
expects more than one CREDS_VALUE per reply.
Fix by tracking whether a CREDS_VALUE option has already been
decoded and returning -EINVAL on any subsequent match, so the
free_creds path releases the single group_info that was installed.
Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-3-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -231,6 +231,7 @@ static int gssx_dec_option_array(struct
struct gssx_option_array *oa)
{
struct svc_cred *creds;
+ bool creds_decoded = false;
u32 count, i;
__be32 *p;
int err;
@@ -281,9 +282,14 @@ static int gssx_dec_option_array(struct
if (length == sizeof(CREDS_VALUE) &&
memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
/* We have creds here. parse them */
+ if (creds_decoded) {
+ err = -EINVAL;
+ goto free_creds;
+ }
err = gssx_dec_linux_creds(xdr, creds);
if (err)
goto free_creds;
+ creds_decoded = true;
oa->data[0].value.len = 1; /* presence */
} else {
/* consume uninteresting buffer */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 386/713] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 385/713] SUNRPC: reject duplicate CREDS_VALUE options Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 387/713] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 Greg Kroah-Hartman
` (337 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit ad484748eec0a66eac0f13ab53b3fbedb7333c91 upstream.
gss_krb5_unwrap_v2() sets buf->len to a logical
length, which can be much smaller than head[0].iov_len
(the allocated receive-page capacity). It then calls
xdr_buf_trim() with a trim length derived from the 16-bit
"extra count" (ec) field in the Kerberos v2 token header.
The ec field is authenticated by the post-decrypt memcmp()
against the encrypted header copy, so a randomly-mutated
value is rejected. However, any peer holding a valid GSS
context can legitimately encrypt a token whose ec exceeds
the plaintext length. Per RFC 4121, such a token is
structurally malformed.
Although xdr_buf_trim() now clamps the buf->len subtraction
to avoid unsigned underflow, the buffer is still left in a
semantically invalid state (zero length, inconsistent iov
lengths) when ec is oversized.
Reject these tokens before calling xdr_buf_trim(), giving
callers a well-defined GSS_S_DEFECTIVE_TOKEN error and
keeping the xdr_buf internally consistent. The wrapped blob
begins at a nonzero offset -- both callers pass len as
offset + opaque_len -- so buf->len still counts the offset
bytes that precede the blob. Compare the trim length
against the remaining wrapped segment, buf->len - offset,
rather than the whole buffer; comparing against buf->len
alone leaves an offset-wide window in which an oversized ec
passes the test and xdr_buf_trim() cuts into the bytes ahead
of the blob.
Fixes: cf4c024b9083 ("sunrpc: trim off EC bytes in GSSAPI v2 unwrap")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-1-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_krb5_wrap.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -235,6 +235,8 @@ gss_krb5_unwrap_v2(struct krb5_ctx *kctx
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
/* Trim off the trailing "extra count" and checksum blob */
+ if (ec + GSS_KRB5_TOK_HDR_LEN + tailskip > buf->len - offset)
+ return GSS_S_DEFECTIVE_TOKEN;
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
*align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 387/713] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 386/713] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 388/713] SUNRPC: wait for in-flight client TLS handshake callback Greg Kroah-Hartman
` (336 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit b94f6719dcd9f7a609bc5f459f85795900e77d25 upstream.
gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags
byte at ptr[2], and padding at ptr[3..7], then passes
ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().
None of these accesses check read_token->len first.
The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus
ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers
accept shorter tokens from the wire:
- gss_unwrap_resp_integ() enforces only an upper bound
(offset + len <= rcv_buf->len) before allocating
mic.data = kmalloc(len) and passing it to gss_verify_mic().
A malicious NFS server can therefore supply a short checksum
opaque, producing a small slab allocation that the Kerberos MIC
verifier reads past.
- gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)
before passing the wire-supplied length to
gss_validate_seqno_mic(), which constructs a mic xdr_netobj
and calls gss_verify_mic().
- svcauth_gss_verify_header() enforces only
checksum.len >= XDR_UNIT (4 bytes) before dispatching to
gss_verify_mic().
- svcauth_gss_unwrap_integ() checks only that the checksum fits
in gsd->gsd_scratch.
Add a length guard at the top of gss_krb5_verify_mic_v2(), before any
ptr[] access or scatterlist construction. Well-formed MIC tokens from
gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +
cksum_len bytes, so valid traffic is unaffected.
Reported-by: Chris Mason <clm@meta.com>
Fixes: de9c17eb4a91 ("gss_krb5: add support for new token formats in rfc4121")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260523165237.510204-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_krb5_unseal.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -89,6 +89,9 @@ gss_krb5_verify_mic_v2(struct krb5_ctx *
dprintk("RPC: %s\n", __func__);
+ if (read_token->len < GSS_KRB5_TOK_HDR_LEN + cksum_len)
+ return GSS_S_DEFECTIVE_TOKEN;
+
memcpy(&be16_ptr, (char *) ptr, 2);
if (be16_to_cpu(be16_ptr) != KG2_TOK_MIC)
return GSS_S_DEFECTIVE_TOKEN;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 388/713] SUNRPC: wait for in-flight client TLS handshake callback
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 387/713] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 389/713] svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Greg Kroah-Hartman
` (335 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Chuck Lever,
Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit a89dd597458848b463d284b15e42a8078beeb046 upstream.
xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the
lower transport before submitting the handshake request. On timeout or
signal, the synchronous waiter drops that reference after calling
tls_handshake_cancel().
handshake_req_cancel() returns false when handshake_complete() has
already marked the request complete. In that case the completion callback
can still be running, so dropping the callback-owned reference in the
waiter can free the lower transport before xs_tls_handshake_done() stores
xprt_err or drops its own reference.
If cancellation loses to completion, wait until xs_tls_handshake_done()
signals handshake_done and let the callback release its reference. This
mirrors the server-side handshake lifetime handling and keeps the timeout
or signal return value unchanged.
Fixes: 75eb6af7acdf ("SUNRPC: Add a TCP-with-TLS RPC transport class")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtsock.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2648,7 +2648,17 @@ static int xs_tls_handshake_sync(struct
rc = wait_for_completion_interruptible_timeout(&lower_transport->handshake_done,
XS_TLS_HANDSHAKE_TO);
if (rc <= 0) {
- tls_handshake_cancel(sk);
+ if (!tls_handshake_cancel(sk)) {
+ /*
+ * Cancellation lost to handshake_complete(): the
+ * callback still owns its xprt reference and is in
+ * flight. Wait for it to finish before returning.
+ */
+ wait_for_completion(&lower_transport->handshake_done);
+ if (rc == 0)
+ rc = -ETIMEDOUT;
+ goto out;
+ }
if (rc == 0)
rc = -ETIMEDOUT;
goto out_put_xprt;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 389/713] svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 388/713] SUNRPC: wait for in-flight client TLS handshake callback Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 390/713] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails Greg Kroah-Hartman
` (334 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 4488e912973773d64368828acf3b8e39d93650ae upstream.
svc_rdma_free() caches rdma->sc_cm_id->device before teardown,
then calls rdma_destroy_id(sc_cm_id) which frees the cm_id.
rpcrdma_rn_unregister() follows, but between those two calls
the transport's sc_rn entry is still installed in the device's
rd_xa. A concurrent ib_unregister_device walk can dispatch
svc_rdma_xprt_done() against the now-freed sc_cm_id.
Move rpcrdma_rn_unregister() before rdma_destroy_id() so the
transport's notification entry is removed from the xarray before
the cm_id it references is destroyed.
Also guard the sc_cm_id dereference with a NULL check: the
following patches introduce paths that reach svc_rdma_free()
with sc_cm_id == NULL (listener create failure, ADDR_CHANGE
replacement failure).
Fixes: c4de97f7c454 ("svcrdma: Handle device removal outside of the CM event handler")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-2-1b09bd87b6cd@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -634,10 +634,15 @@ static void svc_rdma_free(struct svc_xpr
{
struct svcxprt_rdma *rdma =
container_of(xprt, struct svcxprt_rdma, sc_xprt);
- struct ib_device *device = rdma->sc_cm_id->device;
+ struct ib_device *device;
might_sleep();
+ if (!rdma->sc_cm_id)
+ goto out_free;
+
+ device = rdma->sc_cm_id->device;
+
/* This blocks until the Completion Queues are empty */
if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
ib_drain_qp(rdma->sc_qp);
@@ -662,11 +667,13 @@ static void svc_rdma_free(struct svc_xpr
if (rdma->sc_pd && !IS_ERR(rdma->sc_pd))
ib_dealloc_pd(rdma->sc_pd);
+ if (!test_bit(XPT_LISTENER, &rdma->sc_xprt.xpt_flags))
+ rpcrdma_rn_unregister(device, &rdma->sc_rn);
+
/* Destroy the CM ID */
rdma_destroy_id(rdma->sc_cm_id);
- if (!test_bit(XPT_LISTENER, &rdma->sc_xprt.xpt_flags))
- rpcrdma_rn_unregister(device, &rdma->sc_rn);
+out_free:
kfree(rdma);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 390/713] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 389/713] svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 391/713] svcrdma: Fix offset arithmetic in read_chunk_range Greg Kroah-Hartman
` (333 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 01500306e1d50de7ca7a2cdcdfa28ac0523eb747 upstream.
When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,
it creates a replacement listener cm_id and returns 1, telling
the CM core to destroy the old one. If the replacement allocation
fails, sc_cm_id still points at the old cm_id that the CM core is
about to destroy. Any subsequent dereference of sc_cm_id --
such as svc_rdma_detach()'s rdma_disconnect() call -- is a
use-after-free.
NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s
rdma_disconnect() call against NULL so that the listener can
be torn down safely when the server shuts down.
Fixes: d1b586e75ec6 ("svcrdma: Handle ADDR_CHANGE CM event properly")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-5-1b09bd87b6cd@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -325,6 +325,7 @@ static int svc_rdma_listen_handler(struc
if (IS_ERR(listen_id)) {
pr_err("Listener dead, address change failed for device %s\n",
cma_id->device->name);
+ cma_xprt->sc_cm_id = NULL;
} else
cma_xprt->sc_cm_id = listen_id;
return 1;
@@ -614,7 +615,8 @@ static void svc_rdma_detach(struct svc_x
struct svcxprt_rdma *rdma =
container_of(xprt, struct svcxprt_rdma, sc_xprt);
- rdma_disconnect(rdma->sc_cm_id);
+ if (rdma->sc_cm_id)
+ rdma_disconnect(rdma->sc_cm_id);
/*
* Most close paths go through svc_rdma_xprt_deferred_close(),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 391/713] svcrdma: Fix offset arithmetic in read_chunk_range
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 390/713] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails Greg Kroah-Hartman
@ 2026-09-04 4:55 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 392/713] svcrdma: Fix pcl_for_each_segment for empty chunks Greg Kroah-Hartman
` (332 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e upstream.
svc_rdma_read_chunk_range() walks a Read chunk's segment list to
build a sub-range starting at byte offset and spanning length bytes
for a Position-Zero or Call chunk. Two arithmetic defects in the
per-segment loop produce wrong DMA lengths and a u32 underflow:
pcl_for_each_segment(segment, chunk) {
if (offset > segment->rs_length) {
offset -= segment->rs_length;
continue;
}
dummy.rs_handle = segment->rs_handle;
dummy.rs_length = min_t(u32, length,
segment->rs_length) - offset;
dummy.rs_offset = segment->rs_offset + offset;
First, the skip predicate uses '>' instead of '>='. When offset
equals the segment's full rs_length, the segment is fully consumed
and should be skipped, but the loop falls through into the body.
The resulting dummy.rs_length is min_t(u32, length, rs_length) -
rs_length, which underflows to a near-UINT_MAX u32 when length is
smaller than rs_length, or is zero otherwise.
Second, the length formula subtracts offset from the min_t() result
rather than from segment->rs_length before the cap. For offset > 0
the segment's residual is rs_length - offset, not rs_length, so the
cap must be applied to the residual. With the current bracketing,
whenever length is smaller than rs_length - offset the per-segment
length becomes length - offset instead of length, silently dropping
offset bytes from the rebuilt chunk. Combined with the boundary
case above it also enables the u32 underflow path, which propagates
a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB
kmalloc_array_node() in svc_rdma_get_rw_ctxt().
Additionally, svc_rdma_read_call_chunk() can invoke this function
with length == 0 when the last Read chunk ends exactly at the end
of the Call chunk. With the corrected >= predicate, every segment
is skipped and the function returns the initial -EINVAL, rejecting
a valid request. Return success immediately when length is zero.
Also break out of the loop once length is fully consumed to avoid
passing zero-length segments to svc_rdma_build_read_segment().
Fix by using '>=' so a fully-consumed segment is skipped, by
moving '- offset' inside min_t() so the cap is applied to the
segment's residual length, by returning success for zero-length
requests, and by stopping iteration when the requested range has
been consumed.
Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-rpc-kernel-bugs-v1-2-e251306ccca9@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_rw.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -996,17 +996,20 @@ static int svc_rdma_read_chunk_range(str
const struct svc_rdma_segment *segment;
int ret;
+ if (!length)
+ return 0;
+
ret = -EINVAL;
pcl_for_each_segment(segment, chunk) {
struct svc_rdma_segment dummy;
- if (offset > segment->rs_length) {
+ if (offset >= segment->rs_length) {
offset -= segment->rs_length;
continue;
}
dummy.rs_handle = segment->rs_handle;
- dummy.rs_length = min_t(u32, length, segment->rs_length) - offset;
+ dummy.rs_length = min_t(u32, length, segment->rs_length - offset);
dummy.rs_offset = segment->rs_offset + offset;
ret = svc_rdma_build_read_segment(rqstp, head, &dummy);
@@ -1015,6 +1018,8 @@ static int svc_rdma_read_chunk_range(str
head->rc_readbytes += dummy.rs_length;
length -= dummy.rs_length;
+ if (!length)
+ break;
offset = 0;
}
return ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 392/713] svcrdma: Fix pcl_for_each_segment for empty chunks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-09-04 4:55 ` [PATCH 7.2 391/713] svcrdma: Fix offset arithmetic in read_chunk_range Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 393/713] svcrdma: Fix unmatched rn_unregister on failed accept Greg Kroah-Hartman
` (331 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit b7713a784c59515d0aba558c8f5df6a0164dd3a9 upstream.
When a parsed chunk list contains a chunk whose ch_segcount is zero,
pcl_for_each_segment computes its inclusive upper bound as
&chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the
subtraction wraps to 0xFFFFFFFF and the bound lands far past the
ch_segments flex array. The loop body then walks unrelated memory at
sizeof(struct svc_rdma_segment) stride until it faults.
A zero-segcount chunk is reachable from the wire:
xdr_check_write_chunk() only rejects segcount values greater than
rc_maxpages, and pcl_alloc_write() links a freshly allocated chunk
onto rc_write_pcl/rc_reply_pcl before its segment-fill loop runs,
so a Write or Reply chunk advertising zero segments leaves
ch_segcount == 0 on the list. When the transport has negotiated
Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four
PCLs with pcl_for_each_segment and dereferences segment->rs_handle
on each iteration, turning the underflow into an out-of-bounds read
and a general protection fault.
xdr_check_write_list / xdr_check_reply_chunk
pcl_alloc_write()
chunk = pcl_alloc_chunk(...) /* ch_segcount = 0 */
list_add_tail(&chunk->ch_list, &pcl->cl_chunks)
/* fill loop iterates zero times for wire segcount 0 */
svc_rdma_get_inv_rkey()
pcl_for_each_chunk(rc_write_pcl)
pcl_for_each_segment(segment, chunk)
pos <= &ch_segments[0u - 1u] /* 0xFFFFFFFF */
segment->rs_handle /* OOB read -> GPF */
Fix by switching the macro to a half-open upper bound that uses
ch_segcount directly. For ch_segcount == 0 the loop start equals the
loop end and the body is skipped; for ch_segcount > 0 the iteration
range is unchanged. All six existing call sites in
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c and
net/sunrpc/xprtrdma/svc_rdma_rw.c remain correct under the new bound,
so no caller changes are needed.
Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-rpc-kernel-bugs-v1-4-e251306ccca9@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/sunrpc/svc_rdma_pcl.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/sunrpc/svc_rdma_pcl.h
+++ b/include/linux/sunrpc/svc_rdma_pcl.h
@@ -97,7 +97,7 @@ pcl_next_chunk(const struct svc_rdma_pcl
*/
#define pcl_for_each_segment(pos, chunk) \
for (pos = &(chunk)->ch_segments[0]; \
- pos <= &(chunk)->ch_segments[(chunk)->ch_segcount - 1]; \
+ pos < &(chunk)->ch_segments[(chunk)->ch_segcount]; \
pos++)
/**
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 393/713] svcrdma: Fix unmatched rn_unregister on failed accept
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 392/713] svcrdma: Fix pcl_for_each_segment for empty chunks Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 394/713] svcrdma: Reject connection when transport allocation fails Greg Kroah-Hartman
` (330 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 26190394c64c9429481fc88a4738f70bb92fb352 upstream.
When svc_rdma_accept() takes the errout path before
rpcrdma_rn_register() has succeeded, the existing cleanup block
calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally.
svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and
sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another
caller's slot 0 and performs an unmatched kref_put() on the
rpcrdma_device's rd_kref.
The same errout also brackets the cleanup with svc_xprt_get()/
svc_xprt_put() around the kref_init() birth reference. The kref
goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the
net/ns_tracker it pinned) is leaked on every failed accept.
rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc()
and kref_get() have both succeeded, so rn_done == NULL is a natural
"never registered" sentinel. Guard rpcrdma_rn_unregister() with an
early return when rn_done is NULL, and clear rn_done before the
matching xa_erase() so a repeated unregister is also a no-op.
With that guard in place, the accept errout drops the kref_init()
birth reference via svc_xprt_put(), which dispatches svc_rdma_free().
Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing
IS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new
rn_done sentinel; sc_cm_id is non-NULL on every errout path because
svc_rdma_accept() dereferences it above the first goto errout.
svc_xprt_free() drops the module reference associated with the freed
transport, and svc_handle_xprt() drops its pre-acquired reference
when ->xpo_accept() returns NULL. Take a replacement module reference
before svc_xprt_put() so the two module_put()s remain balanced.
The rn_done guard also covers svc_rdma_free()'s non-listener call
to rpcrdma_rn_unregister() for transports whose register attempt
failed or never ran.
Fixes: 8ac6fcae5dc0 ("svcrdma: Unregister the device if svc_rdma_accept() fails")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-1-1b09bd87b6cd@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/ib_client.c | 24 +++++++++++++++++++++++-
net/sunrpc/xprtrdma/svc_rdma_transport.c | 28 +++++++++++++++++++++-------
2 files changed, 44 insertions(+), 8 deletions(-)
--- a/net/sunrpc/xprtrdma/ib_client.c
+++ b/net/sunrpc/xprtrdma/ib_client.c
@@ -51,7 +51,11 @@ static struct rpcrdma_device *rpcrdma_ge
* to be invoked when the device is removed, unless this notification
* is unregistered first.
*
- * On failure, a negative errno is returned.
+ * On failure, a negative errno is returned. rn->rn_done is left
+ * NULL on every failure path (it is assigned only after xa_alloc
+ * and kref_get have both succeeded), so the @rn may safely be
+ * passed to rpcrdma_rn_unregister() without a separate
+ * registered/unregistered flag in the caller.
*/
int rpcrdma_rn_register(struct ib_device *device,
struct rpcrdma_notification *rn,
@@ -83,6 +87,10 @@ static void rpcrdma_rn_release(struct kr
* rpcrdma_rn_unregister - stop device removal notifications
* @device: monitored device
* @rn: notification object that no longer wishes to be notified
+ *
+ * It is safe to call this on an @rn whose registration never
+ * completed or failed; rn_done == NULL is treated as
+ * never-registered and the call is a no-op.
*/
void rpcrdma_rn_unregister(struct ib_device *device,
struct rpcrdma_notification *rn)
@@ -92,6 +100,20 @@ void rpcrdma_rn_unregister(struct ib_dev
if (!rd)
return;
+ /*
+ * rn_done is the registration sentinel: rpcrdma_rn_register
+ * assigns it last, after xa_alloc and kref_get have both
+ * succeeded. A NULL rn_done means this notification was
+ * never registered (or its registration failed) or has
+ * already been unregistered, and the call is a no-op.
+ * Without this guard, rn_index == 0 from a kzalloc'd
+ * parent would erase another caller's slot 0 and underflow
+ * rd_kref.
+ */
+ if (!rn->rn_done)
+ return;
+ rn->rn_done = NULL;
+
trace_rpcrdma_client_unregister(device, rn);
xa_erase(&rd->rd_xa, rn->rn_index);
kref_put(&rd->rd_kref, rpcrdma_rn_release);
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -43,6 +43,7 @@
*/
#include <linux/interrupt.h>
+#include <linux/module.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
@@ -599,13 +600,26 @@ static struct svc_xprt *svc_rdma_accept(
return &newxprt->sc_xprt;
errout:
- /* Take a reference in case the DTO handler runs */
- svc_xprt_get(&newxprt->sc_xprt);
- if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp))
- ib_destroy_qp(newxprt->sc_qp);
- rdma_destroy_id(newxprt->sc_cm_id);
- rpcrdma_rn_unregister(dev, &newxprt->sc_rn);
- /* This call to put will destroy the transport */
+ /*
+ * Drop the kref_init birth reference. svc_xprt_free will
+ * dispatch xpo_free = svc_rdma_free, which tears down sc_qp,
+ * sc_sq_cq, sc_rq_cq, and sc_pd under existing IS_ERR/NULL
+ * guards, and sc_rn under the rn_done sentinel guard inside
+ * rpcrdma_rn_unregister.
+ *
+ * sc_cm_id is destroyed unconditionally by svc_rdma_free; that
+ * is safe here because sc_cm_id is non-NULL by caller invariant
+ * on every path that reaches this errout: handle_connect_req
+ * installs newxprt->sc_cm_id before queueing the new xprt for
+ * accept, and svc_rdma_accept has already dereferenced it above
+ * the first goto errout.
+ *
+ * svc_handle_xprt() drops its pre-acquired module reference when
+ * ->xpo_accept() returns NULL. Take a replacement reference before
+ * freeing @newxprt, because svc_xprt_free() drops the module
+ * reference associated with @newxprt.
+ */
+ __module_get(newxprt->sc_xprt.xpt_class->xcl_owner);
svc_xprt_put(&newxprt->sc_xprt);
return NULL;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 394/713] svcrdma: Reject connection when transport allocation fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 393/713] svcrdma: Fix unmatched rn_unregister on failed accept Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 395/713] svcrdma: Reject inline replies that overflow the pull-up buffer Greg Kroah-Hartman
` (329 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 0944462247dcb7de7622cdaaadf5f05c52707dab upstream.
handle_connect_req() returns without action when
svc_rdma_create_xprt() fails to allocate the new transport.
The CM core returns 0 for CONNECT_REQUEST events, so it does
not destroy the new rdma_cm_id. Each allocation failure under
memory pressure leaks one rdma_cm_id, and a remote peer driving
connection attempts can amplify this.
Reject the connection by returning a non-zero status from the
CM event handler, which tells the CM core to destroy the
orphaned cm_id.
Fixes: 377f9b2f4529 ("rdma: SVCRDMA Core Transport Services")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-4-1b09bd87b6cd@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -246,12 +246,16 @@ svc_rdma_parse_connect_private(struct sv
* structure for the listening endpoint.
*
* This function creates a new xprt for the new connection and enqueues it on
- * the accept queue for the listent xprt. When the listen thread is kicked, it
+ * the accept queue for the listen xprt. When the listen thread is kicked, it
* will call the recvfrom method on the listen xprt which will accept the new
* connection.
+ *
+ * Return values:
+ * %0: Do not destroy @new_cma_id
+ * %1: Destroy @new_cma_id (allocation failure)
*/
-static void handle_connect_req(struct rdma_cm_id *new_cma_id,
- struct rdma_conn_param *param)
+static int handle_connect_req(struct rdma_cm_id *new_cma_id,
+ struct rdma_conn_param *param)
{
struct svcxprt_rdma *listen_xprt = new_cma_id->context;
struct svcxprt_rdma *newxprt;
@@ -261,7 +265,7 @@ static void handle_connect_req(struct rd
listen_xprt->sc_xprt.xpt_net,
ibdev_to_node(new_cma_id->device));
if (!newxprt)
- return;
+ return 1;
newxprt->sc_cm_id = new_cma_id;
new_cma_id->context = newxprt;
svc_rdma_parse_connect_private(newxprt, param);
@@ -295,6 +299,7 @@ static void handle_connect_req(struct rd
set_bit(XPT_CONN, &listen_xprt->sc_xprt.xpt_flags);
svc_xprt_enqueue(&listen_xprt->sc_xprt);
+ return 0;
}
/**
@@ -318,8 +323,7 @@ static int svc_rdma_listen_handler(struc
switch (event->event) {
case RDMA_CM_EVENT_CONNECT_REQUEST:
- handle_connect_req(cma_id, &event->param.conn);
- break;
+ return handle_connect_req(cma_id, &event->param.conn);
case RDMA_CM_EVENT_ADDR_CHANGE:
listen_id = svc_rdma_create_listen_id(cma_rdma->xpt_net,
sap, cma_xprt);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 395/713] svcrdma: Reject inline replies that overflow the pull-up buffer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 394/713] svcrdma: Reject connection when transport allocation fails Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 396/713] svcrdma: Reject oversized Read segments at decode time Greg Kroah-Hartman
` (328 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 0fbe20dfe74b783d255bf389a6ea77aa25dc7860 upstream.
An RPC-over-RDMA client can request a reply, such as an NFS READ
payload, without providing a Write list or a Reply chunk to carry
it. When such a reply needs more scatter/gather entries than the
device's Send Queue supports, svc_rdma_pull_up_needed() selects
pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole
reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size
bytes, while the reply on this path is bounded only by the client's
request, so svc_rdma_xb_linearize() copies past the end of the
buffer and corrupts adjacent slab memory. The oversized length is
then stored in sc_sges[0].length and posted, so the device also
reads beyond the mapped region.
The SGE-exhaustion branch is the only pull-up path that can exceed
the buffer: the threshold branch pulls up only replies smaller
than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE
budget are sent directly without linearization. Make
svc_rdma_pull_up_needed() report -E2BIG when the reply it would
pull up cannot fit sc_max_req_size, and fail the request with
ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping
the connection.
The helper no longer answers a simple yes/no question: it now
reports pull-up, no pull-up, or -E2BIG for a reply too large to
linearize. Rename svc_rdma_pull_up_needed() to
svc_rdma_check_pull_up() so its name no longer implies a boolean
predicate.
Fixes: e248aa7be86e ("svcrdma: Remove max_sge check at connect time")
Cc: stable@vger.kernel.org
Reported-by: Chris Mason <clm@meta.com>
Assisted-by: kres:claude-opus-4-7
Link: https://patch.msgid.link/20260623014728.826032-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++++++++++++++++++++++-----------
1 file changed, 32 insertions(+), 15 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -825,20 +825,21 @@ static int svc_rdma_xb_count_sges(const
}
/**
- * svc_rdma_pull_up_needed - Determine whether to use pull-up
+ * svc_rdma_check_pull_up - Determine whether to use pull-up
* @rdma: controlling transport
* @sctxt: send_ctxt for the Send WR
* @write_pcl: Write chunk list provided by client
* @xdr: xdr_buf containing RPC message to transmit
*
* Returns:
- * %true if pull-up must be used
- * %false otherwise
+ * %1 if pull-up must be used
+ * %0 if pull-up is not needed
+ * %-E2BIG if the reply is too large to be pulled up
*/
-static bool svc_rdma_pull_up_needed(const struct svcxprt_rdma *rdma,
- const struct svc_rdma_send_ctxt *sctxt,
- const struct svc_rdma_pcl *write_pcl,
- const struct xdr_buf *xdr)
+static int svc_rdma_check_pull_up(const struct svcxprt_rdma *rdma,
+ const struct svc_rdma_send_ctxt *sctxt,
+ const struct svc_rdma_pcl *write_pcl,
+ const struct xdr_buf *xdr)
{
/* Resources needed for the transport header */
struct svc_rdma_pullup_data args = {
@@ -850,11 +851,22 @@ static bool svc_rdma_pull_up_needed(cons
ret = pcl_process_nonpayloads(write_pcl, xdr,
svc_rdma_xb_count_sges, &args);
if (ret < 0)
- return false;
+ return 0;
if (args.pd_length < RPCRDMA_PULLUP_THRESH)
- return true;
- return args.pd_num_sges >= rdma->sc_max_send_sges;
+ return 1;
+ if (args.pd_num_sges < rdma->sc_max_send_sges)
+ return 0;
+
+ /*
+ * The reply has too many SGEs to Send inline, so it has to be
+ * linearized into sc_xprt_buf. That buffer holds only
+ * sc_max_req_size bytes, so a larger reply cannot be pulled up.
+ * RFC 8166 Section 4.5.3 requires responding with ERR_CHUNK.
+ */
+ if (args.pd_length > rdma->sc_max_req_size)
+ return -E2BIG;
+ return 1;
}
/**
@@ -910,7 +922,7 @@ static int svc_rdma_xb_linearize(const s
* Assemble the elements of @xdr into the transport header buffer.
*
* Assumptions:
- * pull_up_needed has determined that @xdr will fit in the buffer.
+ * check_pull_up has determined that @xdr will fit in the buffer.
*
* Returns:
* %0 if pull-up was successful
@@ -945,6 +957,7 @@ static int svc_rdma_pull_up_reply_msg(co
*
* Returns:
* %0 if DMA mapping was successful.
+ * %-E2BIG if the reply is too large to be pulled up
* %-EMSGSIZE if a buffer manipulation problem occurred
* %-EIO if DMA mapping failed
*
@@ -960,6 +973,7 @@ int svc_rdma_map_reply_msg(struct svcxpr
.md_rdma = rdma,
.md_ctxt = sctxt,
};
+ int ret;
/* Set up the (persistently-mapped) transport header SGE. */
sctxt->sc_send_wr.num_sge = 1;
@@ -974,7 +988,10 @@ int svc_rdma_map_reply_msg(struct svcxpr
/* For pull-up, svc_rdma_send() will sync the transport header.
* No additional DMA mapping is necessary.
*/
- if (svc_rdma_pull_up_needed(rdma, sctxt, write_pcl, xdr))
+ ret = svc_rdma_check_pull_up(rdma, sctxt, write_pcl, xdr);
+ if (ret < 0)
+ return ret;
+ if (ret)
return svc_rdma_pull_up_reply_msg(rdma, sctxt, write_pcl, xdr);
return pcl_process_nonpayloads(write_pcl, xdr,
@@ -1162,7 +1179,7 @@ int svc_rdma_sendto(struct svc_rqst *rqs
&rctxt->rc_reply_pcl, sctxt,
&rqstp->rq_res);
if (ret < 0)
- goto reply_chunk;
+ goto send_err;
rc_size = ret;
}
@@ -1183,10 +1200,10 @@ int svc_rdma_sendto(struct svc_rqst *rqs
ret = svc_rdma_send_reply_msg(rdma, sctxt, rctxt, rqstp);
if (ret < 0)
- goto put_ctxt;
+ goto send_err;
return 0;
-reply_chunk:
+send_err:
if (ret != -E2BIG && ret != -EINVAL)
goto put_ctxt;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 396/713] svcrdma: Reject oversized Read segments at decode time
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 395/713] svcrdma: Reject inline replies that overflow the pull-up buffer Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 397/713] svcrdma: Reject Read lists that exceed the page budget Greg Kroah-Hartman
` (327 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit af6f0e06bed818ee7fc8b869915964410020a1c5 upstream.
The RPC/RDMA Read list decoder stores wire-supplied segment
lengths without validation. xdr_count_read_segments() checks
4-byte alignment for non-zero position values but does not
cap the segment length.
An oversized rs_length reaches svc_rdma_build_read_segment(),
which derives nr_bvec from it and can drive a large dynamic
bvec allocation before verifying that enough rq_pages remain.
If the post-allocation page-overrun guard fires, the freshly
acquired rw context is not returned, leaking the resource.
Reject any segment whose length exceeds the receive context's
page budget during Read list decoding, consistent with how
xdr_check_write_chunk() bounds Write segment counts against
rc_maxpages. Also return the rw context on the existing
post-allocation overrun path in svc_rdma_build_read_segment(),
keeping that defensive guard balanced.
Fixes: 5ee62b4a9113 ("svcrdma: use bvec-based RDMA read/write API")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-rpc-kernel-bugs-v1-3-e251306ccca9@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 ++
net/sunrpc/xprtrdma/svc_rdma_rw.c | 5 +++--
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index fe9bf0371b6e..15c1d8ae5301 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -458,6 +458,8 @@ static bool xdr_count_read_segments(struct svc_rdma_recv_ctxt *rctxt, __be32 *p)
xdr_decode_read_segment(p, &position, &handle,
&length, &offset);
+ if (length > rctxt->rc_maxpages << PAGE_SHIFT)
+ return false;
if (position) {
if (position & 3)
return false;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index b4cb4f991235..9aaaade99e6e 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -795,7 +795,7 @@ static int svc_rdma_build_read_segment(struct svc_rqst *rqstp,
len -= seg_len;
if (len && ((head->rc_curpage + 1) > rqstp->rq_maxpages))
- goto out_overrun;
+ goto out_put;
}
ret = svc_rdma_rw_ctx_init(rdma, ctxt, segment->rs_offset,
@@ -809,7 +809,8 @@ static int svc_rdma_build_read_segment(struct svc_rqst *rqstp,
cc->cc_sqecount += ret;
return 0;
-out_overrun:
+out_put:
+ svc_rdma_put_rw_ctxt(rdma, ctxt);
trace_svcrdma_page_overrun_err(&cc->cc_cid, head->rc_curpage);
return -EINVAL;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 397/713] svcrdma: Reject Read lists that exceed the page budget
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 396/713] svcrdma: Reject oversized Read segments at decode time Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 398/713] svcrdma: Reject Write/Reply chunks with segcount 0 Greg Kroah-Hartman
` (326 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 0ca487abb3bdf581851664b5db21f364caf57682 upstream.
Individual Read segment lengths are validated at decode time, but
nothing prevents a requester from sending multiple segments whose
cumulative length exceeds the rq_pages array budget. When one
segment fills the page array exactly, the runtime guard in
svc_rdma_build_read_segment() is bypassed because len reaches zero.
A subsequent segment then accesses the NULL sentinel slot at
rq_pages[rq_maxpages], resulting in a NULL pointer dereference during
DMA mapping.
Accumulate pages across all Read segments and reject the message at
decode time when the total would overflow the page budget.
Fixes: 026d958b38c6 ("svcrdma: Add recvfrom helpers to svc_rdma_rw.c")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -440,11 +440,14 @@ static void svc_rdma_build_arg_xdr(struc
* to the first byte past the Read list. rc_read_pcl and
* rc_call_pcl cl_count fields are set to the number of
* Read segments in the list.
- * %false: Read list is corrupt. @rctxt's xdr_stream is left in an
- * unknown state.
+ * %false: Read list is corrupt or exceeds the page budget. @rctxt's
+ * xdr_stream is left in an unknown state.
*/
static bool xdr_count_read_segments(struct svc_rdma_recv_ctxt *rctxt, __be32 *p)
{
+ unsigned int maxlen = rctxt->rc_maxpages << PAGE_SHIFT;
+ unsigned int total_len = 0;
+
rctxt->rc_call_pcl.cl_count = 0;
rctxt->rc_read_pcl.cl_count = 0;
while (xdr_item_is_present(p)) {
@@ -458,7 +461,10 @@ static bool xdr_count_read_segments(stru
xdr_decode_read_segment(p, &position, &handle,
&length, &offset);
- if (length > rctxt->rc_maxpages << PAGE_SHIFT)
+ if (length > maxlen)
+ return false;
+ total_len += length;
+ if (PAGE_ALIGN(total_len) > maxlen)
return false;
if (position) {
if (position & 3)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 398/713] svcrdma: Reject Write/Reply chunks with segcount 0
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 397/713] svcrdma: Reject Read lists that exceed the page budget Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 399/713] svcrdma: Use svc_xprt_put to free listener on create failure Greg Kroah-Hartman
` (325 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 9808eb7656666acc7291bae9ab6b987bd16e47e0 upstream.
A peer can send a Write or Reply chunk whose segcount field is zero.
xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero
passes the range check, and xdr_inline_decode(stream, 0) returns the
current (non-NULL) cursor without advancing. The function returns
true and pcl_alloc_write() then links a struct svc_rdma_chunk with
ch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.
An earlier patch in this series made pcl_for_each_segment() safe for
ch_segcount == 0, so this no longer drives the memory walk it used
to. Rejecting the malformed frame at the decode boundary is still
worthwhile as defense in depth: it keeps degenerate zero-segment
chunks off the parsed chunk lists entirely, so any future consumer
that walks ch_segments directly cannot observe one, and it makes the
zero-floor easy to backport to trees where the macro change is more
intrusive. RFC 8166 has no meaning for a Write/Reply chunk that
describes no remote buffer, so no legitimate client is affected.
xdr_check_reply_chunk() funnels Reply chunks through
xdr_check_write_chunk() and inherits the same rejection.
pcl_alloc_write() also links each chunk onto the parsed chunk list
before filling its segment array. If a future change weakens the
segcount-0 rejection, an incomplete chunk is visible to consumers
during the fill loop. Reorder so that list_add_tail() follows the
segment fill loop, ensuring only fully-populated chunks appear on
the list.
Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-rpc-kernel-bugs-v1-5-e251306ccca9@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +-
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 ++++++---
2 files changed, 7 insertions(+), 4 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_pcl.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_pcl.c
@@ -213,7 +213,6 @@ bool pcl_alloc_write(struct svc_rdma_rec
chunk = pcl_alloc_chunk(segcount, 0);
if (!chunk)
return false;
- list_add_tail(&chunk->ch_list, &pcl->cl_chunks);
for (j = 0; j < segcount; j++) {
segment = &chunk->ch_segments[j];
@@ -225,6 +224,7 @@ bool pcl_alloc_write(struct svc_rdma_rec
chunk->ch_length += segment->rs_length;
chunk->ch_segcount++;
}
+ list_add_tail(&chunk->ch_list, &pcl->cl_chunks);
}
return true;
}
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -516,10 +516,13 @@ static bool xdr_check_write_chunk(struct
return false;
/* Before trusting the segcount value enough to use it in
- * a computation, perform a simple range check. This is an
- * arbitrary but sensible limit (ie, not architectural).
+ * a computation, perform a simple range check. A zero
+ * segcount describes no remote buffer and is rejected so
+ * downstream consumers never see a degenerate ch_segcount==0
+ * chunk. The upper bound is an arbitrary but sensible limit
+ * (ie, not architectural).
*/
- if (unlikely(segcount > rctxt->rc_maxpages))
+ if (segcount == 0 || unlikely(segcount > rctxt->rc_maxpages))
return false;
p = xdr_inline_decode(&rctxt->rc_stream,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 399/713] svcrdma: Use svc_xprt_put to free listener on create failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 398/713] svcrdma: Reject Write/Reply chunks with segcount 0 Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 400/713] svcrdma: Validate Read chunk positions before reconstruction Greg Kroah-Hartman
` (324 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit e346ef7bcb137f50c49f969330ab7dcf64ea1654 upstream.
svc_rdma_create() calls kfree(cma_xprt) when
svc_rdma_create_listen_id() fails. svc_xprt_init() has already
acquired a net namespace reference via get_net_track(); kfree
bypasses svc_xprt_free() which releases it.
Replace the kfree() with svc_xprt_put() so the kref_init birth
reference drops to zero and svc_xprt_free() dispatches
svc_rdma_free() to clean up properly. sc_cm_id is still NULL
at that point; the preceding patch added the necessary NULL
guard in svc_rdma_free().
svc_xprt_free() also drops the module reference via
module_put(), but the caller _svc_xprt_create() does the same
on xpo_create failure, double-putting the single
try_module_get() it acquired. Take a compensating
__module_get() before the svc_xprt_put() to keep the count
balanced, matching the convention in svc_rdma_accept()'s error
path.
Fixes: 4fb8518bdac8 ("sunrpc: Tag svc_xprt with net")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-3-1b09bd87b6cd@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -393,7 +393,13 @@ static struct svc_xprt *svc_rdma_create(
listen_id = svc_rdma_create_listen_id(net, sa, cma_xprt);
if (IS_ERR(listen_id)) {
- kfree(cma_xprt);
+ /* _svc_xprt_create() acquired one module reference and
+ * puts it on xpo_create failure. svc_xprt_free() puts
+ * a second one when the kref drops to zero. Take a
+ * compensating reference so both puts are balanced.
+ */
+ __module_get(cma_xprt->sc_xprt.xpt_class->xcl_owner);
+ svc_xprt_put(&cma_xprt->sc_xprt);
return ERR_CAST(listen_id);
}
cma_xprt->sc_cm_id = listen_id;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 400/713] svcrdma: Validate Read chunk positions before reconstruction
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 399/713] svcrdma: Use svc_xprt_put to free listener on create failure Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 401/713] udf: reject VAT indexes equal to the entry count Greg Kroah-Hartman
` (323 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b upstream.
The RPC/RDMA Read chunk position field is supplied by the remote
client and stored verbatim in the parsed chunk list.
xdr_count_read_segments() checks only 4-byte alignment; it never
compares the position against the received inline body length.
In the single-chunk path, svc_rdma_read_complete_one() splits the
head and tail kvecs at ch_position. A position past the inline
body underflows the tail length, exposing adjacent slab memory to
the upper XDR decoder.
In the multi-chunk path, svc_rdma_read_multiple_chunks() computes
gap lengths between chunks as unsigned subtractions from
ch_position. Overlapping Read chunks cause these subtractions to
underflow. A final position past the inline body likewise
underflows the trailing gap length. svc_rdma_copy_inline_range()
then copies past the receive buffer into request pages that are
returned to the client through the Reply channel.
Bound inline-range copies in svc_rdma_copy_inline_range() against
the decoded inline RPC body saved in rc_saved_arg. Reject a
single Read chunk positioned beyond that body, and reject
multi-chunk lists where accumulated read bytes exceed the next
chunk's position. Apply the same position and overlap checks in
the call-chunk interleaving path.
Fixes: d96962e6d0e2 ("svcrdma: Use the new parsed chunk list when pulling Read chunks")
Cc: stable@vger.kernel.org
Acked-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-rpc-kernel-bugs-v1-1-e251306ccca9@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtrdma/svc_rdma_rw.c | 38 ++++++++++++++++++++++++++++++--------
1 file changed, 30 insertions(+), 8 deletions(-)
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -848,7 +848,7 @@ static int svc_rdma_build_read_chunk(str
* svc_rdma_copy_inline_range - Copy part of the inline content into pages
* @rqstp: RPC transaction context
* @head: context for ongoing I/O
- * @offset: offset into the Receive buffer of region to copy
+ * @offset: offset into the inline content of region to copy
* @remaining: length of region to copy
*
* Take a page at a time from rqstp->rq_pages and copy the inline
@@ -865,9 +865,13 @@ static int svc_rdma_copy_inline_range(st
unsigned int offset,
unsigned int remaining)
{
- unsigned char *dst, *src = head->rc_recv_buf;
+ unsigned char *dst, *src = head->rc_saved_arg.head[0].iov_base;
+ unsigned int inline_len = head->rc_saved_arg.head[0].iov_len;
unsigned int page_no, numpages;
+ if (offset > inline_len || remaining > inline_len - offset)
+ return -EINVAL;
+
numpages = PAGE_ALIGN(head->rc_pageoff + remaining) >> PAGE_SHIFT;
for (page_no = 0; page_no < numpages; page_no++) {
unsigned int page_len;
@@ -918,9 +922,10 @@ svc_rdma_read_multiple_chunks(struct svc
{
const struct svc_rdma_pcl *pcl = &head->rc_read_pcl;
struct svc_rdma_chunk *chunk, *next;
- unsigned int start, length;
+ unsigned int inline_len, start, length;
int ret;
+ inline_len = head->rc_saved_arg.head[0].iov_len;
start = 0;
chunk = pcl_first_chunk(pcl);
length = chunk->ch_position;
@@ -938,6 +943,8 @@ svc_rdma_read_multiple_chunks(struct svc
break;
start += length;
+ if (head->rc_readbytes > next->ch_position)
+ return -EINVAL;
length = next->ch_position - head->rc_readbytes;
ret = svc_rdma_copy_inline_range(rqstp, head, start, length);
if (ret < 0)
@@ -945,7 +952,9 @@ svc_rdma_read_multiple_chunks(struct svc
}
start += length;
- length = head->rc_byte_len - start;
+ if (start > inline_len)
+ return -EINVAL;
+ length = inline_len - start;
return svc_rdma_copy_inline_range(rqstp, head, start, length);
}
@@ -970,8 +979,12 @@ svc_rdma_read_multiple_chunks(struct svc
static int svc_rdma_read_data_item(struct svc_rqst *rqstp,
struct svc_rdma_recv_ctxt *head)
{
- return svc_rdma_build_read_chunk(rqstp, head,
- pcl_first_chunk(&head->rc_read_pcl));
+ struct svc_rdma_chunk *chunk = pcl_first_chunk(&head->rc_read_pcl);
+
+ if (chunk->ch_position > head->rc_saved_arg.head[0].iov_len)
+ return -EINVAL;
+
+ return svc_rdma_build_read_chunk(rqstp, head, chunk);
}
/**
@@ -1045,14 +1058,17 @@ static int svc_rdma_read_call_chunk(stru
pcl_first_chunk(&head->rc_call_pcl);
const struct svc_rdma_pcl *pcl = &head->rc_read_pcl;
struct svc_rdma_chunk *chunk, *next;
- unsigned int start, length;
+ unsigned int call_len, start, length;
int ret;
if (pcl_is_empty(pcl))
return svc_rdma_build_read_chunk(rqstp, head, call_chunk);
+ call_len = call_chunk->ch_length;
start = 0;
chunk = pcl_first_chunk(pcl);
+ if (chunk->ch_position > call_len)
+ return -EINVAL;
length = chunk->ch_position;
ret = svc_rdma_read_chunk_range(rqstp, head, call_chunk,
start, length);
@@ -1069,6 +1085,10 @@ static int svc_rdma_read_call_chunk(stru
break;
start += length;
+ if (next->ch_position > call_len)
+ return -EINVAL;
+ if (head->rc_readbytes > next->ch_position)
+ return -EINVAL;
length = next->ch_position - head->rc_readbytes;
ret = svc_rdma_read_chunk_range(rqstp, head, call_chunk,
start, length);
@@ -1077,7 +1097,9 @@ static int svc_rdma_read_call_chunk(stru
}
start += length;
- length = call_chunk->ch_length - start;
+ if (start > call_len)
+ return -EINVAL;
+ length = call_len - start;
return svc_rdma_read_chunk_range(rqstp, head, call_chunk,
start, length);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 401/713] udf: reject VAT indexes equal to the entry count
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 400/713] svcrdma: Validate Read chunk positions before reconstruction Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 402/713] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets Greg Kroah-Hartman
` (322 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Lee, Jan Kara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lee <david.lee@trailofbits.com>
commit cac0cb07f29ccfb373fd4a36c81e908ef3ce608c upstream.
UDF 1.50 virtual partition mapping uses the VAT as an array of physical
block mappings. s_num_entries stores the number of entries in that array,
not the highest valid index. The valid VAT indexes are therefore below
s_num_entries.
udf_get_pblock_virt15() currently rejects only indexes greater than
s_num_entries. A crafted image can request index s_num_entries, pass the
bounds check, and make the kernel read one entry past the allocated VAT table.
Change the check to reject block >= s_num_entries, so the count is handled as
an exclusive upper bound.
A crafted UDF image reproduced this on origin/master commit
0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds
report in udf_get_pblock_virt15().
Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Link: https://patch.msgid.link/20260708101712.1706564-1-david.lee@trailofbits.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/partition.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/udf/partition.c
+++ b/fs/udf/partition.c
@@ -55,7 +55,7 @@ uint32_t udf_get_pblock_virt15(struct su
map = &sbi->s_partmaps[partition];
vdata = &map->s_type_specific.s_virtual;
- if (block > vdata->s_num_entries) {
+ if (block >= vdata->s_num_entries) {
udf_debug("Trying to access block beyond end of VAT (%u max %u)\n",
block, vdata->s_num_entries);
return 0xFFFFFFFF;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 402/713] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 401/713] udf: reject VAT indexes equal to the entry count Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 403/713] wifi: mt76: mt7925: cancel pending mlo_pm_work Greg Kroah-Hartman
` (321 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Doruk Tan Ozturk, Jeff Johnson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <doruk@0sec.ai>
commit 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613 upstream.
ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from
assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower
bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()
bounds the declared lengths from above (their sum must fit the received
event), but an assoc request/response shorter than its fixed offset still
underflows here: the u8 wraps to ~250, and cfg80211_connect_result() /
cfg80211_roamed() then treat that wrapped value as the IE length and copy
that many bytes out of the small assoc_info buffer to user space via
nl80211, disclosing adjacent slab memory.
Clamp both lengths to their offsets before subtracting.
Found by 0sec (https://0sec.ai) using automated source analysis; the
missing lower bound is evident from source. Compile-tested.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:claude-opus-4-8
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Link: https://patch.msgid.link/20260713213251.21161-1-doruk@0sec.ai
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -754,6 +754,11 @@ void ath6kl_cfg80211_connect_event(struc
u8 *assoc_resp_ie = assoc_info + beacon_ie_len + assoc_req_len +
assoc_resp_ie_offset;
+ if (assoc_req_len < assoc_req_ie_offset)
+ assoc_req_len = assoc_req_ie_offset;
+ if (assoc_resp_len < assoc_resp_ie_offset)
+ assoc_resp_len = assoc_resp_ie_offset;
+
assoc_req_len -= assoc_req_ie_offset;
assoc_resp_len -= assoc_resp_ie_offset;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 403/713] wifi: mt76: mt7925: cancel pending mlo_pm_work
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 402/713] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 404/713] staging: media: tegra-video: fix of_node_put() on VIP parse errors Greg Kroah-Hartman
` (320 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Guan, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
commit 2889e84282dda147f10b10d94cf0efd90a349c53 upstream.
If the device is reset, suspended or unregistered within that window,
the pending work can still run and access vif/bss data that may already
be freed, or send MCU commands while the firmware is not available.
Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown
and suspend paths:
- mt7925_mac_reset_work() (chip reset recovery)
- mt7925e_unregister_device() (PCIe unbind)
- mt7925_pci_suspend() (PCIe bus suspend)
- mt7925_suspend() (mac80211 suspend)
- mt7925u_suspend() (USB bus / runtime suspend)
This ensures the work is stopped before the device state becomes
invalid.
Assisted-by: kimi-cli:kimi-k2.7 code
Assisted-by: atomcode:glm-5.2 #Reported-by
Fixes: 276a568832577 ("wifi: mt76: mt7925: update the power-saving flow")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://patch.msgid.link/20260630090218.3202029-1-guanwentao@uniontech.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 ++
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 +
4 files changed, 5 insertions(+)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -1323,6 +1323,7 @@ void mt7925_mac_reset_work(struct work_s
cancel_delayed_work_sync(&dev->mphy.mac_work);
cancel_delayed_work_sync(&pm->ps_work);
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
cancel_work_sync(&pm->wake_work);
for (i = 0; i < 10; i++) {
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -1640,6 +1640,7 @@ static int mt7925_suspend(struct ieee802
cancel_delayed_work_sync(&phy->mt76->mac_work);
cancel_delayed_work_sync(&dev->pm.ps_work);
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
mt792x_mutex_acquire(dev);
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -48,6 +48,7 @@ static void mt7925e_unregister_device(st
mt76_for_each_q_rx(&dev->mt76, i)
napi_disable(&dev->mt76.napi[i]);
cancel_delayed_work_sync(&pm->ps_work);
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
cancel_work_sync(&pm->wake_work);
cancel_work_sync(&dev->reset_work);
@@ -517,6 +518,7 @@ static int mt7925_pci_suspend(struct dev
dev->hif_resumed = false;
flush_work(&dev->reset_work);
cancel_delayed_work_sync(&pm->ps_work);
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
cancel_work_sync(&pm->wake_work);
mt7925_roc_abort_sync(dev);
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -269,6 +269,7 @@ static int mt7925u_suspend(struct usb_in
pm->suspended = true;
dev->hif_resumed = false;
flush_work(&dev->reset_work);
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
mt76_connac_mcu_set_hif_suspend(&dev->mt76, true, false);
ret = wait_event_timeout(dev->wait,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 404/713] staging: media: tegra-video: fix of_node_put() on VIP parse errors
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 403/713] wifi: mt76: mt7925: cancel pending mlo_pm_work Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 405/713] staging: media: tegra-video: vi: fix probe failure on skipped last port Greg Kroah-Hartman
` (319 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang, Hans Verkuil
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 7393372f79db940acff206b43e2905685a0c57ad upstream.
tegra_vip_channel_of_parse() initializes np from dev->of_node without
taking a reference, but its error paths drop one through the
err_node_put label. This underflows the refcount of the VIP device's
OF node when endpoint parsing fails on a malformed device tree.
The only reference the function takes on np is the success-path
of_node_get() stored in vip->chan.of_node, and that one is already
released by the tegra_vip_init() error path and by tegra_vip_exit().
Return errors directly instead of jumping to the bogus cleanup label.
Fixes: e740d199cf0f ("staging: media: tegra-video: add support for Tegra20 parallel input")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/tegra-video/vip.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/drivers/staging/media/tegra-video/vip.c
+++ b/drivers/staging/media/tegra-video/vip.c
@@ -126,7 +126,7 @@ static int tegra_vip_channel_of_parse(st
if (!ep) {
err = -EINVAL;
dev_err_probe(dev, err, "%pOF: error getting endpoint node\n", np);
- goto err_node_put;
+ return err;
}
fwh = of_fwnode_handle(ep);
@@ -134,14 +134,14 @@ static int tegra_vip_channel_of_parse(st
of_node_put(ep);
if (err) {
dev_err_probe(dev, err, "%pOF: failed to parse v4l2 endpoint\n", np);
- goto err_node_put;
+ return err;
}
num_pads = of_graph_get_endpoint_count(np);
if (num_pads != TEGRA_VIP_PADS_NUM) {
err = -EINVAL;
dev_err_probe(dev, err, "%pOF: need 2 pads, got %d\n", np, num_pads);
- goto err_node_put;
+ return err;
}
vip->chan.of_node = of_node_get(np);
@@ -149,10 +149,6 @@ static int tegra_vip_channel_of_parse(st
vip->chan.pads[TEGRA_VIP_PAD_SOURCE].flags = MEDIA_PAD_FL_SOURCE;
return 0;
-
-err_node_put:
- of_node_put(np);
- return err;
}
static int tegra_vip_channel_init(struct tegra_vip *vip)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 405/713] staging: media: tegra-video: vi: fix probe failure on skipped last port
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 404/713] staging: media: tegra-video: fix of_node_put() on VIP parse errors Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 406/713] media: staging/ipu7: fix async notifier UAF on probe error path Greg Kroah-Hartman
` (318 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang, Hans Verkuil
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit ae15adeed9f7ec54989175fe3c9e0815186821bc upstream.
tegra_vi_channels_alloc() iterates over port nodes and skips those
whose reg property cannot be read or whose remote endpoint fails
v4l2_fwnode_endpoint_parse(), leaving the negative result of the
failed call in ret. If that happens on the last port node, the loop
ends with ret still negative and tegra_vi_init() fails the whole VI
probe.
The same defective port earlier in the ports node is skipped silently,
so probing succeeds or fails depending on the order of the port nodes.
The CSI equivalent, tegra_csi_channels_alloc(), returns 0
unconditionally after its loop and does not have this problem.
Use a separate variable for the per-port checks so that only fatal
errors end up in ret.
Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
Fixes: 2ac4035a78c9 ("media: tegra-video: Add support for x8 captures with gang ports")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/tegra-video/vi.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -1257,6 +1257,7 @@ static int tegra_vi_channels_alloc(struc
struct device_node *parent;
struct v4l2_fwnode_endpoint v4l2_ep = { .bus_type = 0 };
unsigned int lanes;
+ int err;
int ret = 0;
ports = of_get_child_by_name(node, "ports");
@@ -1267,8 +1268,8 @@ static int tegra_vi_channels_alloc(struc
if (!of_node_name_eq(port, "port"))
continue;
- ret = of_property_read_u32(port, "reg", &port_num);
- if (ret < 0)
+ err = of_property_read_u32(port, "reg", &port_num);
+ if (err < 0)
continue;
if (port_num > vi->soc->vi_max_channels) {
@@ -1289,10 +1290,10 @@ static int tegra_vi_channels_alloc(struc
ep = of_graph_get_endpoint_by_regs(parent, 0, 0);
of_node_put(parent);
- ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep),
+ err = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep),
&v4l2_ep);
of_node_put(ep);
- if (ret)
+ if (err)
continue;
lanes = v4l2_ep.bus.mipi_csi2.num_data_lanes;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 406/713] media: staging/ipu7: fix async notifier UAF on probe error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 405/713] staging: media: tegra-video: vi: fix probe failure on skipped last port Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 407/713] sched/core: Handle pick_task() releasing the rq lock Greg Kroah-Hartman
` (317 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Sakari Ailus
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit d7f48aa7d60c65d3e6d5312c27f17d5525a245fb upstream.
isys_register_devices() registers the V4L2 async notifier via
isys_notifier_init(). If a subsequent probe step such as
isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label
which only calls isys_unregister_devices(). That helper tears down the
video devices, subdevices, V4L2 device and media device, but never
unregisters or cleans up the async notifier.
As a result the notifier stays chained in the global notifier_list while
the enclosing struct ipu7_isys is freed by devres, leading to list
corruption and a use-after-free the next time the list is walked.
The remove path already does the right thing by calling
isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on
the probe error path so the notifier is unregistered and cleaned up
before the device is torn down.
Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/ipu7/ipu7-isys.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/media/ipu7/ipu7-isys.c
+++ b/drivers/staging/media/ipu7/ipu7-isys.c
@@ -773,6 +773,7 @@ static int isys_probe(struct auxiliary_d
return 0;
out_cleanup:
+ isys_notifier_cleanup(isys);
isys_unregister_devices(isys);
out_cleanup_fw:
ipu7_fw_isys_release(isys);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 407/713] sched/core: Handle pick_task() releasing the rq lock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 406/713] media: staging/ipu7: fix async notifier UAF on probe error path Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 408/713] sched/core: Make core-sched flips wait for in-flight selections Greg Kroah-Hartman
` (316 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo, Peter Zijlstra (Intel)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit c10b216a072ff5c57bc880a05f87eb519aecc529 upstream.
Core scheduling's pick_next_task() breaks when a ->pick_task()
implementation can release the rq lock. The selection state derived on entry
is only valid while the lock is held continuously. Once a pick can drop the
lock, an interleaving selection can invalidate all of it: the single-CPU
fast path can commit an uncookied pick although the core went cookied during
the release, and forceidle committed by the interleaving selection skews the
restarted pass's accounting.
Fix it by restarting the whole selection when a pick returns RETRY_TASK
after releasing the lock: a single restart point above the state derivation
replaces the per-loop restart labels, so a retry picks up state committed by
interleaving selections and accounts and resets forceidle like a fresh
selection would.
need_sync and fi_before latch across retries. Clock validity can't be
re-derived - there is no program-ordered way to tell whether the own and
core rq clocks are still updated after the lock was released, as other
lockers' pin cycles may or may not have invalidated them. When restarting,
clear core_clock_updated so that the sibling loop re-updates the core rq,
and update the own rq clock if invalidated.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6223,7 +6223,7 @@ pick_next_task(struct rq *rq, struct rq_
unsigned long cookie;
int i, cpu, occ = 0;
struct rq *rq_i;
- bool need_sync;
+ bool need_sync = false;
if (!sched_core_enabled(rq))
return __pick_next_task(rq, rf);
@@ -6266,7 +6266,9 @@ pick_next_task(struct rq *rq, struct rq_
prev_balance(rq, rf);
smt_mask = cpu_smt_mask(cpu);
- need_sync = !!rq->core->core_cookie;
+
+restart:
+ need_sync |= !!rq->core->core_cookie;
/* reset state */
rq->core->core_cookie = 0UL;
@@ -6301,10 +6303,15 @@ pick_next_task(struct rq *rq, struct rq_
* and there are no cookied tasks running on siblings.
*/
if (!need_sync) {
-restart_single:
next = pick_task(rq, rf);
- if (unlikely(next == RETRY_TASK))
- goto restart_single;
+ if (unlikely(next == RETRY_TASK)) {
+ /* rq lock may have been dropped, clocks invalidated */
+ core_clock_updated = false;
+ if (!(rq->clock_update_flags & RQCF_UPDATED))
+ update_rq_clock(rq);
+ goto restart;
+ }
+
if (!next->core_cookie) {
rq->core_pick = NULL;
rq->core_dl_server = NULL;
@@ -6324,7 +6331,6 @@ restart_single:
*
* Tie-break prio towards the current CPU
*/
-restart_multi:
max = NULL;
for_each_cpu_wrap(i, smt_mask, cpu) {
rq_i = cpu_rq(i);
@@ -6338,8 +6344,13 @@ restart_multi:
update_rq_clock(rq_i);
p = pick_task(rq_i, rf);
- if (unlikely(p == RETRY_TASK))
- goto restart_multi;
+ if (unlikely(p == RETRY_TASK)) {
+ /* rq lock may have been dropped, clocks invalidated */
+ core_clock_updated = false;
+ if (!(rq->clock_update_flags & RQCF_UPDATED))
+ update_rq_clock(rq);
+ goto restart;
+ }
rq_i->core_pick = p;
rq_i->core_dl_server = rq_i->dl_server;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 408/713] sched/core: Make core-sched flips wait for in-flight selections
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 407/713] sched/core: Handle pick_task() releasing the rq lock Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 409/713] sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return Greg Kroah-Hartman
` (315 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo, Peter Zijlstra (Intel)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit f3629c63a4af3e491381780bc6c123cb498c4c40 upstream.
Core scheduling's pick_next_task() operates on all sibling rqs under one
acquisition of the shared core-wide lock. A ->pick_task() that releases the
rq lock leaves every sibling __lock momentarily free, letting
__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under
it. The selection resumes on the split locks, touching sibling state it no
longer protects, and __schedule() finally releases a lock that was never
taken while leaking the one that was.
Count in-flight core-wide selections in the leader's rq->core_pick_in_flight
and make __sched_core_flip() wait for the count to drain. The count only
changes under the shared lock, which the flip holds while sampling, so no
other ordering is needed. The wait can repeat while selections overlap, but
the flip backs off between samples and flips are rare cookie-lifetime
events.
sched_core_cpu_deactivate() moves the count to the new leader - a stale copy
left behind would bias it forever if that CPU later returns as its own
leader.
Fixes: 539f65125d20 ("sched: Add core wide task selection and scheduling")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 22 ++++++++++++++++++++++
kernel/sched/sched.h | 1 +
2 files changed, 23 insertions(+)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -443,6 +443,17 @@ static void __sched_core_flip(bool enabl
sched_core_lock(cpu, &flags);
+ /*
+ * A core-wide selection may have the shared rq lock temporarily
+ * released by a lock-dropping ->pick_task(). Flipping would
+ * rebind rq_lockp() under it. Wait it out.
+ */
+ while (cpu_rq(cpu)->core->core_pick_in_flight) {
+ sched_core_unlock(cpu, &flags);
+ cpu_relax();
+ sched_core_lock(cpu, &flags);
+ }
+
for_each_cpu(t, smt_mask)
cpu_rq(t)->core_enabled = enabled;
@@ -6242,6 +6253,8 @@ pick_next_task(struct rq *rq, struct rq_
return __pick_next_task(rq, rf);
}
+ rq->core->core_pick_in_flight++;
+
/*
* If there were no {en,de}queues since we picked (IOW, the task
* pointers are all still valid), and we haven't scheduled the last
@@ -6456,6 +6469,7 @@ restart:
}
out_set_next:
+ rq->core->core_pick_in_flight--;
put_prev_set_next_task(rq, rq->donor, next);
if (rq->core->core_forceidle_count && next == rq->idle)
queue_core_balance(rq);
@@ -6651,6 +6665,13 @@ static void sched_core_cpu_deactivate(un
core_rq->core_forceidle_occupation = rq->core_forceidle_occupation;
/*
+ * A stale leftover would bias the count forever if this CPU later
+ * returns as its own leader. Move, don't copy.
+ */
+ core_rq->core_pick_in_flight = rq->core_pick_in_flight;
+ rq->core_pick_in_flight = 0;
+
+ /*
* Accounting edge for forced idle is handled in pick_next_task().
* Don't need another one here, since the hotplug thread shouldn't
* have a cookie.
@@ -9064,6 +9085,7 @@ void __init sched_init(void)
rq->core_forceidle_count = 0;
rq->core_forceidle_occupation = 0;
rq->core_forceidle_start = 0;
+ rq->core_pick_in_flight = 0;
rq->core_cookie = 0UL;
#endif
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1358,6 +1358,7 @@ struct rq {
unsigned int core_forceidle_seq;
unsigned int core_forceidle_occupation;
u64 core_forceidle_start;
+ unsigned int core_pick_in_flight;
#endif /* CONFIG_SCHED_CORE */
/* Scratch cpumask to be temporarily used under rq_lock */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 409/713] sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 408/713] sched/core: Make core-sched flips wait for in-flight selections Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 410/713] sched_ext: Fix this_rq() assumptions in dispatch kfuncs Greg Kroah-Hartman
` (314 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit ffaab58d217581cb75353168f8812a16e10463fc upstream.
SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover
from when balancing and picking were separate operations. An rq-level flag
only works while dispatches and picks pair up one to one, which core
scheduling breaks: selections interleave through dispatch's lock drops and a
pick can consume a stale flag, keeping a task that has since been dequeued.
Fixing core scheduling support requires the decision to travel with the
dispatch that made it. Make scx_dispatch_sched() and balance_one() return an
explicit verdict instead and drop the flag's plumbing from the tools autogen
enum headers.
Also factor the pick-side invocation, its follow-up queueing and the
post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No
functional changes intended.
v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers
as well (Andrea).
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 124 +++++++++++-------
kernel/sched/sched.h | 1 -
.../sched_ext/include/scx/enum_defs.autogen.h | 1 -
.../sched_ext/include/scx/enums.autogen.bpf.h | 3 -
tools/sched_ext/include/scx/enums.autogen.h | 1 -
5 files changed, 73 insertions(+), 57 deletions(-)
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 18183062f751..ffbe4f7edc99 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -2774,12 +2774,19 @@ static inline void maybe_queue_balance_callback(struct rq *rq)
rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING;
}
+/* what dispatch concluded, consumed by the pick that follows */
+enum scx_dsp_verdict {
+ SCX_DSP_NONE, /* nothing to run */
+ SCX_DSP_LOCAL, /* local DSQ has tasks */
+ SCX_DSP_PREV, /* keep running @prev */
+};
+
/*
* One user of this function is scx_bpf_dispatch() which can be called
* recursively as sub-sched dispatches nest. Always inline to reduce stack usage
* from the call frame.
*/
-static __always_inline bool
+static __always_inline enum scx_dsp_verdict
scx_dispatch_sched(struct scx_sched *sch, struct rq *rq,
struct task_struct *prev, bool nested)
{
@@ -2790,12 +2797,15 @@ scx_dispatch_sched(struct scx_sched *sch, struct rq *rq,
scx_task_on_sched(sch, prev);
if (consume_global_dsq(sch, rq))
- return true;
+ return SCX_DSP_LOCAL;
if (bypass_dsp_enabled(sch)) {
/* if @sch is bypassing, only the bypass DSQs are active */
- if (scx_bypassing(sch, cpu))
- return consume_dispatch_q(sch, rq, bypass_dsq(sch, cpu), 0);
+ if (scx_bypassing(sch, cpu)) {
+ if (consume_dispatch_q(sch, rq, bypass_dsq(sch, cpu), 0))
+ return SCX_DSP_LOCAL;
+ return SCX_DSP_NONE;
+ }
#ifdef CONFIG_EXT_SUB_SCHED
/*
@@ -2815,13 +2825,13 @@ scx_dispatch_sched(struct scx_sched *sch, struct rq *rq,
if (!(pcpu->bypass_host_seq++ % SCX_BYPASS_HOST_NTH) &&
consume_dispatch_q(sch, rq, bypass_dsq(sch, cpu), 0)) {
__scx_add_event(sch, SCX_EV_SUB_BYPASS_DISPATCH, 1);
- return true;
+ return SCX_DSP_LOCAL;
}
#endif /* CONFIG_EXT_SUB_SCHED */
}
if (unlikely(!SCX_HAS_OP(sch, dispatch)) || !scx_rq_online(rq))
- return false;
+ return SCX_DSP_NONE;
dspc->rq = rq;
@@ -2848,14 +2858,12 @@ scx_dispatch_sched(struct scx_sched *sch, struct rq *rq,
flush_dispatch_buf(sch, rq);
- if ((prev->scx.flags & SCX_TASK_QUEUED) && prev->scx.slice) {
- rq->scx.flags |= SCX_RQ_BAL_KEEP;
- return true;
- }
+ if ((prev->scx.flags & SCX_TASK_QUEUED) && prev->scx.slice)
+ return SCX_DSP_PREV;
if (rq->scx.local_dsq.nr)
- return true;
+ return SCX_DSP_LOCAL;
if (consume_global_dsq(sch, rq))
- return true;
+ return SCX_DSP_LOCAL;
/*
* ops.dispatch() can trap us in this loop by repeatedly
@@ -2877,20 +2885,20 @@ scx_dispatch_sched(struct scx_sched *sch, struct rq *rq,
* queued. Without this fallback, bypassed tasks could stall if the host
* scheduler's ops.dispatch() doesn't yield any tasks.
*/
- if (bypass_dsp_enabled(sch))
- return consume_dispatch_q(sch, rq, bypass_dsq(sch, cpu), 0);
+ if (bypass_dsp_enabled(sch) && consume_dispatch_q(sch, rq, bypass_dsq(sch, cpu), 0))
+ return SCX_DSP_LOCAL;
- return false;
+ return SCX_DSP_NONE;
}
-static int balance_one(struct rq *rq, struct task_struct *prev)
+static enum scx_dsp_verdict balance_one(struct rq *rq, struct task_struct *prev)
{
struct scx_sched *sch = scx_root;
+ enum scx_dsp_verdict verdict;
s32 cpu = cpu_of(rq);
lockdep_assert_rq_held(rq);
rq->scx.flags |= SCX_RQ_IN_BALANCE;
- rq->scx.flags &= ~SCX_RQ_BAL_KEEP;
if ((sch->ops.flags & SCX_OPS_HAS_CPU_PREEMPT) &&
unlikely(rq->scx.cpu_released)) {
@@ -2920,16 +2928,19 @@ static int balance_one(struct rq *rq, struct task_struct *prev)
*/
if ((prev->scx.flags & SCX_TASK_QUEUED) && prev->scx.slice &&
!scx_bypassing(sch, cpu)) {
- rq->scx.flags |= SCX_RQ_BAL_KEEP;
+ verdict = SCX_DSP_PREV;
goto has_tasks;
}
}
/* if there already are tasks to run, nothing to do */
- if (rq->scx.local_dsq.nr)
+ if (rq->scx.local_dsq.nr) {
+ verdict = SCX_DSP_LOCAL;
goto has_tasks;
+ }
- if (scx_dispatch_sched(sch, rq, prev, false))
+ verdict = scx_dispatch_sched(sch, rq, prev, false);
+ if (verdict != SCX_DSP_NONE)
goto has_tasks;
/*
@@ -2938,12 +2949,12 @@ static int balance_one(struct rq *rq, struct task_struct *prev)
*/
if ((prev->scx.flags & SCX_TASK_QUEUED) &&
(!(sch->ops.flags & SCX_OPS_ENQ_LAST) || scx_bypassing(sch, cpu))) {
- rq->scx.flags |= SCX_RQ_BAL_KEEP;
__scx_add_event(sch, SCX_EV_DISPATCH_KEEP_LAST, 1);
+ verdict = SCX_DSP_PREV;
goto has_tasks;
}
rq->scx.flags &= ~SCX_RQ_IN_BALANCE;
- return false;
+ return SCX_DSP_NONE;
has_tasks:
/*
@@ -2960,7 +2971,7 @@ static int balance_one(struct rq *rq, struct task_struct *prev)
schedule_reenq_local(rq, 0);
rq->scx.flags &= ~SCX_RQ_IN_BALANCE;
- return true;
+ return verdict;
}
static void set_next_task_scx(struct rq *rq, struct task_struct *p, bool first)
@@ -3179,27 +3190,23 @@ static struct task_struct *first_local_task(struct rq *rq)
struct task_struct, scx.dsq_list.node);
}
-static struct task_struct *
-do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
+/*
+ * Run dispatch and queue the follow-up work for a pick.
+ */
+static enum scx_dsp_verdict dispatch_pick(struct rq *rq, struct rq_flags *rf,
+ struct task_struct *prev)
{
- struct task_struct *prev = rq->curr;
- bool keep_prev;
- struct task_struct *p;
-
- /* see kick_sync_wait_bal_cb() */
- smp_store_release(&rq->scx.kick_sync, rq->scx.kick_sync + 1);
-
- rq_modified_begin(rq, &ext_sched_class);
+ enum scx_dsp_verdict verdict;
rq_unpin_lock(rq, rf);
- balance_one(rq, prev);
+ verdict = balance_one(rq, prev);
rq_repin_lock(rq, rf);
maybe_queue_balance_callback(rq);
/*
- * Defer to a balance callback which can drop rq lock and enable
- * IRQs. Waiting directly in the pick path would deadlock against
- * CPUs sending us IPIs (e.g. TLB flushes) while we wait for them.
+ * Defer to a balance callback which can drop rq lock and enable IRQs.
+ * Waiting directly in the pick path would deadlock against CPUs sending
+ * us IPIs (e.g. TLB flushes) while we wait for them.
*/
if (unlikely(rq->scx.kick_sync_pending)) {
rq->scx.kick_sync_pending = false;
@@ -3207,10 +3214,32 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
kick_sync_wait_bal_cb);
}
+ if (unlikely(verdict == SCX_DSP_PREV && prev->sched_class != &ext_sched_class)) {
+ WARN_ON_ONCE(scx_enable_state() == SCX_ENABLED);
+ verdict = SCX_DSP_LOCAL;
+ }
+
+ return verdict;
+}
+
+static struct task_struct *
+do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
+{
+ struct task_struct *prev = rq->curr;
+ enum scx_dsp_verdict verdict;
+ struct task_struct *p;
+
+ /* see kick_sync_wait_bal_cb() */
+ smp_store_release(&rq->scx.kick_sync, rq->scx.kick_sync + 1);
+
+ rq_modified_begin(rq, &ext_sched_class);
+
+ verdict = dispatch_pick(rq, rf, prev);
+
/*
- * If any higher-priority sched class enqueued a runnable task on
- * this rq during balance_one(), abort and return RETRY_TASK, so
- * that the scheduler loop can restart.
+ * If any higher-priority sched class enqueued a runnable task on this
+ * rq during balance_one(), abort and return RETRY_TASK, so that the
+ * scheduler loop can restart.
*
* If @force_scx is true, always try to pick a SCHED_EXT task,
* regardless of any higher-priority sched classes activity.
@@ -3218,19 +3247,12 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
if (!force_scx && rq_modified_above(rq, &ext_sched_class))
return RETRY_TASK;
- keep_prev = rq->scx.flags & SCX_RQ_BAL_KEEP;
- if (unlikely(keep_prev &&
- prev->sched_class != &ext_sched_class)) {
- WARN_ON_ONCE(scx_enable_state() == SCX_ENABLED);
- keep_prev = false;
- }
-
/*
* If balance_one() is telling us to keep running @prev, replenish slice
* if necessary and keep running @prev. Otherwise, pop the first one
* from the local DSQ.
*/
- if (keep_prev) {
+ if (verdict == SCX_DSP_PREV) {
p = prev;
if (!p->scx.slice)
refill_task_slice_dfl(scx_task_sched(p), p);
@@ -5573,7 +5595,7 @@ static void disable_bypass_dsp(struct scx_sched *sch)
*
* - ops.dispatch() is ignored.
*
- * - balance_one() does not set %SCX_RQ_BAL_KEEP on non-zero slice as slice
+ * - balance_one() does not report %SCX_DSP_PREV on non-zero slice as slice
* can't be trusted. Whenever a tick triggers, the running task is rotated to
* the tail of the queue with core_sched_at touched.
*
@@ -9201,8 +9223,8 @@ __bpf_kfunc bool scx_bpf_sub_dispatch(u64 cgroup_id, const struct bpf_prog_aux *
return false;
}
- return scx_dispatch_sched(child, this_rq, this_rq->scx.sub_dispatch_prev,
- true);
+ return scx_dispatch_sched(child, this_rq, this_rq->scx.sub_dispatch_prev, true) !=
+ SCX_DSP_NONE;
}
#endif /* CONFIG_EXT_SUB_SCHED */
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 450b6a04669f..14c2df6fd9af 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -784,7 +784,6 @@ enum scx_rq_flags {
*/
SCX_RQ_ONLINE = 1 << 0,
SCX_RQ_CAN_STOP_TICK = 1 << 1,
- SCX_RQ_BAL_KEEP = 1 << 3, /* balance decided to keep current */
SCX_RQ_CLK_VALID = 1 << 5, /* RQ clock is fresh and valid */
SCX_RQ_BAL_CB_PENDING = 1 << 6, /* must queue a cb after dispatching */
diff --git a/tools/sched_ext/include/scx/enum_defs.autogen.h b/tools/sched_ext/include/scx/enum_defs.autogen.h
index da4b459820fd..8e287c88ad90 100644
--- a/tools/sched_ext/include/scx/enum_defs.autogen.h
+++ b/tools/sched_ext/include/scx/enum_defs.autogen.h
@@ -143,7 +143,6 @@
#define HAVE___SCX_REENQ_TSR_MASK
#define HAVE_SCX_RQ_ONLINE
#define HAVE_SCX_RQ_CAN_STOP_TICK
-#define HAVE_SCX_RQ_BAL_KEEP
#define HAVE_SCX_RQ_CLK_VALID
#define HAVE_SCX_RQ_BAL_CB_PENDING
#define HAVE_SCX_RQ_IN_WAKEUP
diff --git a/tools/sched_ext/include/scx/enums.autogen.bpf.h b/tools/sched_ext/include/scx/enums.autogen.bpf.h
index dafccbb6b69d..d02abed94e8e 100644
--- a/tools/sched_ext/include/scx/enums.autogen.bpf.h
+++ b/tools/sched_ext/include/scx/enums.autogen.bpf.h
@@ -22,9 +22,6 @@ const volatile u64 __SCX_RQ_CAN_STOP_TICK __weak;
const volatile u64 __SCX_RQ_BAL_PENDING __weak;
#define SCX_RQ_BAL_PENDING __SCX_RQ_BAL_PENDING
-const volatile u64 __SCX_RQ_BAL_KEEP __weak;
-#define SCX_RQ_BAL_KEEP __SCX_RQ_BAL_KEEP
-
const volatile u64 __SCX_RQ_BYPASSING __weak;
#define SCX_RQ_BYPASSING __SCX_RQ_BYPASSING
diff --git a/tools/sched_ext/include/scx/enums.autogen.h b/tools/sched_ext/include/scx/enums.autogen.h
index bbd4901f4fce..c26934a3d8e9 100644
--- a/tools/sched_ext/include/scx/enums.autogen.h
+++ b/tools/sched_ext/include/scx/enums.autogen.h
@@ -11,7 +11,6 @@
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_ONLINE); \
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_CAN_STOP_TICK); \
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_BAL_PENDING); \
- SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_BAL_KEEP); \
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_BYPASSING); \
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_CLK_VALID); \
SCX_ENUM_SET(skel, scx_rq_flags, SCX_RQ_IN_WAKEUP); \
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 410/713] sched_ext: Fix this_rq() assumptions in dispatch kfuncs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 409/713] sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 411/713] sched_ext: Fix rq->core_pick corruption under core scheduling Greg Kroah-Hartman
` (313 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 3dd52416e44a70bc993adb96d2e0d71b9ea21359 upstream.
Under core scheduling, dispatch runs from within the core-wide pick and can
target a sibling rq, so ops.dispatch() may execute on a CPU different from
the dispatched rq's. Several kfunc paths assumed the two always coincide:
- scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s
rq flags and lock-danced accordingly. A dispatch for a sibling took the
unlocked-context branch and acquired the source rq lock on top of the
already held dispatched rq lock which could deadlock.
- scx_bpf_sub_dispatch() dispatched this_rq() with its stashed
sub_dispatch_prev, which is NULL when dispatching for a sibling.
- finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued()
resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched
rq's. The latter two are callable from other rq-locked operations too,
where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes
behavior also without core scheduling, e.g. for ops.enqueue() running a
remote wakeup on the waking CPU, and is intended: which CPU happens to
execute an operation is incidental, the op's rq is what it is operating
on, and the resolution now matches the insert side where SCX_DSQ_LOCAL
dispatches land on the task's rq.
Use the rq tracked by scx_locked_rq(), which is set to the dispatched rq
around ops invocations and NULL in unlocked contexts.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 58 +++++++++++++++++++++++++-----------------
1 file changed, 35 insertions(+), 23 deletions(-)
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index ffbe4f7edc99..84ec71d28b61 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -2737,7 +2737,7 @@ static void finish_dispatch(struct scx_sched *sch, struct rq *rq,
BUG_ON(!(p->scx.flags & SCX_TASK_QUEUED));
- dsq = find_dsq_for_dispatch(sch, this_rq(), dsq_id, task_cpu(p));
+ dsq = find_dsq_for_dispatch(sch, rq, dsq_id, task_cpu(p));
if (dsq->id == SCX_DSQ_LOCAL)
dispatch_to_local_dsq(sch, rq, dsq, p, enq_flags);
@@ -8887,9 +8887,8 @@ static bool scx_dsq_move(struct bpf_iter_scx_dsq_kern *kit,
{
struct scx_dispatch_q *src_dsq = kit->dsq, *dst_dsq;
struct scx_sched *sch;
- struct rq *this_rq, *src_rq, *locked_rq;
+ struct rq *p_rq, *src_rq, *locked_rq;
bool dispatched = false;
- bool in_balance;
unsigned long flags;
/*
@@ -8919,24 +8918,28 @@ static bool scx_dsq_move(struct bpf_iter_scx_dsq_kern *kit,
}
/*
- * Can be called from either ops.dispatch() locking this_rq() or any
- * context where no rq lock is held. If latter, lock @p's task_rq which
- * we'll likely need anyway.
+ * Can be called from either ops.dispatch() holding the dispatched rq's
+ * lock or any context where no rq lock is held. If latter, lock @p's
+ * task_rq which we'll likely need anyway.
*/
src_rq = task_rq(p);
local_irq_save(flags);
- this_rq = this_rq();
- in_balance = this_rq->scx.flags & SCX_RQ_IN_BALANCE;
- if (in_balance) {
- if (this_rq != src_rq)
- switch_rq_lock(this_rq, src_rq);
+ /*
+ * Under core scheduling, dispatch can run for a sibling rq, so the
+ * locked rq is not necessarily this CPU's.
+ */
+ locked_rq = scx_locked_rq();
+
+ if (locked_rq) {
+ if (locked_rq != src_rq)
+ switch_rq_lock(locked_rq, src_rq);
} else {
raw_spin_rq_lock(src_rq);
}
- locked_rq = src_rq;
+ p_rq = src_rq;
raw_spin_lock(&src_dsq->lock);
/* did someone else get to it while we dropped the locks? */
@@ -8946,7 +8949,7 @@ static bool scx_dsq_move(struct bpf_iter_scx_dsq_kern *kit,
}
/* @p is still on $src_dsq and stable, determine the destination */
- dst_dsq = find_dsq_for_dispatch(sch, this_rq, dsq_id, task_cpu(p));
+ dst_dsq = find_dsq_for_dispatch(sch, locked_rq ?: this_rq(), dsq_id, task_cpu(p));
/*
* Apply vtime and slice updates before moving so that the new time is
@@ -8959,14 +8962,14 @@ static bool scx_dsq_move(struct bpf_iter_scx_dsq_kern *kit,
p->scx.slice = kit->slice;
/* execute move */
- locked_rq = move_task_between_dsqs(sch, p, enq_flags, src_dsq, dst_dsq);
+ p_rq = move_task_between_dsqs(sch, p, enq_flags, src_dsq, dst_dsq);
dispatched = true;
out:
- if (in_balance) {
- if (this_rq != locked_rq)
- switch_rq_lock(locked_rq, this_rq);
+ if (locked_rq) {
+ if (locked_rq != p_rq)
+ switch_rq_lock(p_rq, locked_rq);
} else {
- raw_spin_rq_unlock_irqrestore(locked_rq, flags);
+ raw_spin_rq_unlock_irqrestore(p_rq, flags);
}
kit->cursor.flags &= ~(__SCX_DSQ_ITER_HAS_SLICE |
@@ -9204,7 +9207,7 @@ __bpf_kfunc bool scx_bpf_dsq_move_vtime(struct bpf_iter_scx_dsq *it__iter,
*/
__bpf_kfunc bool scx_bpf_sub_dispatch(u64 cgroup_id, const struct bpf_prog_aux *aux)
{
- struct rq *this_rq = this_rq();
+ struct rq *rq = scx_locked_rq();
struct scx_sched *parent, *child;
guard(rcu)();
@@ -9223,7 +9226,7 @@ __bpf_kfunc bool scx_bpf_sub_dispatch(u64 cgroup_id, const struct bpf_prog_aux *
return false;
}
- return scx_dispatch_sched(child, this_rq, this_rq->scx.sub_dispatch_prev, true) !=
+ return scx_dispatch_sched(child, rq, rq->scx.sub_dispatch_prev, true) !=
SCX_DSP_NONE;
}
#endif /* CONFIG_EXT_SUB_SCHED */
@@ -9518,6 +9521,10 @@ __bpf_kfunc s32 scx_bpf_kick_cid(s32 cid, u64 flags, const struct bpf_prog_aux *
*
* Return the number of tasks in the DSQ matching @dsq_id. If not found,
* -%ENOENT is returned.
+ *
+ * %SCX_DSQ_LOCAL resolves to the local DSQ of the rq the current scheduler
+ * operation is locked to - e.g. the rq being dispatched for in ops.dispatch() -
+ * or the calling CPU's when no rq is locked.
*/
__bpf_kfunc s32 scx_bpf_dsq_nr_queued(u64 dsq_id, const struct bpf_prog_aux *aux)
{
@@ -9534,7 +9541,7 @@ __bpf_kfunc s32 scx_bpf_dsq_nr_queued(u64 dsq_id, const struct bpf_prog_aux *aux
}
if (dsq_id == SCX_DSQ_LOCAL) {
- ret = READ_ONCE(this_rq()->scx.local_dsq.nr);
+ ret = READ_ONCE((scx_locked_rq() ?: this_rq())->scx.local_dsq.nr);
goto out;
} else if ((dsq_id & SCX_DSQ_LOCAL_ON) == SCX_DSQ_LOCAL_ON) {
s32 cpu = scx_cpu_ret(sch, dsq_id & SCX_DSQ_LOCAL_CPU_MASK);
@@ -9713,10 +9720,15 @@ __bpf_kfunc struct task_struct *scx_bpf_dsq_peek(u64 dsq_id,
* - User DSQs
*
* Re-enqueues are performed asynchronously. Can be called from anywhere.
+ *
+ * %SCX_DSQ_LOCAL resolves to the local DSQ of the rq the current scheduler
+ * operation is locked to - e.g. the rq being dispatched for in ops.dispatch() -
+ * or the calling CPU's when no rq is locked.
*/
__bpf_kfunc void scx_bpf_dsq_reenq(u64 dsq_id, u64 reenq_flags,
const struct bpf_prog_aux *aux)
{
+ struct rq *locked_rq = scx_locked_rq();
struct scx_sched *sch;
struct scx_dispatch_q *dsq;
@@ -9735,8 +9747,8 @@ __bpf_kfunc void scx_bpf_dsq_reenq(u64 dsq_id, u64 reenq_flags,
if (!(reenq_flags & __SCX_REENQ_FILTER_MASK))
reenq_flags |= SCX_REENQ_ANY;
- dsq = find_dsq_for_dispatch(sch, this_rq(), dsq_id, smp_processor_id());
- schedule_dsq_reenq(sch, dsq, reenq_flags, scx_locked_rq());
+ dsq = find_dsq_for_dispatch(sch, locked_rq ?: this_rq(), dsq_id, smp_processor_id());
+ schedule_dsq_reenq(sch, dsq, reenq_flags, locked_rq);
}
/**
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 411/713] sched_ext: Fix rq->core_pick corruption under core scheduling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 410/713] sched_ext: Fix this_rq() assumptions in dispatch kfuncs Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 412/713] sched_ext: Count rq lock releases in rq->scx.lock_drop_seq Greg Kroah-Hartman
` (312 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ElXreno, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit d954004205c1a1d3f59ce8482b559266c15600fa upstream.
Core scheduling's pick_next_task() picks what to run on every SMT sibling of
the core in a single pass under the shared core-wide rq lock. The selection
state is consistent only while the lock is held continuously, so
->pick_task() originally could not release it. However, since 4c95380701f5
("sched/ext: Fold balance_scx() into pick_task_scx()"), sched_ext runs
dispatch from inside the pick and dispatching can drop the rq lock. To
support this, pick_next_task() has been updated to restart the whole
selection when a pick returns RETRY_TASK after releasing the lock.
When selections on the same core interleave through the dropped lock, they
corrupt each other's state: one clears the other's rq->core_pick leading to
a NULL deref, or invalidates its keep-the-previous-task decision leaving a
dequeued task running, which deadlocks the next wakeup and matches the
reported hard hangs. A cookied ping-pong load on an SMT machine makes the
interleavings frequent and kills the kernel within seconds.
Fix it by making the pick return RETRY_TASK whenever dispatch released the
rq lock, so that a selection only ever commits picks made under a
continuously held lock. The previous patch's rq->scx.lock_drop_seq counts
the releases. A dispatch that touched nothing never releases the lock and
its verdict, including "nothing to run", stands: retries are bounded, each
following a dispatch that actually did something, and an idle CPU does not
loop.
If another dispatch is already in flight on the rq, skip dispatching and
pick from what is already queued locally - the in-flight dispatch has
released the lock, so its own selection will retry and re-pick this rq,
while returning RETRY_TASK here would only spin on the lock that dispatch
needs to finish.
Balance callbacks must run in the context that queued them, so they can only
be queued on the CPU's own rq. When dispatching for another rq, run the
deferred work directly instead - that rq may consume all its picks through
the core-sched fast path and never queue the callback itself.
The put_prev_task_scx() warning about a runnable task being left behind
assumed that dispatch ran as part of the very pick that is switching away.
That now only holds on the non-core path, so gate it and drop the
cookie-match test, which is always true without core scheduling, from its
condition.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Reported-by: ElXreno <elxreno@gmail.com>
Link: https://github.com/sched-ext/scx/issues/3715
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 86 ++++++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 78 insertions(+), 8 deletions(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -2779,6 +2779,7 @@ enum scx_dsp_verdict {
SCX_DSP_NONE, /* nothing to run */
SCX_DSP_LOCAL, /* local DSQ has tasks */
SCX_DSP_PREV, /* keep running @prev */
+ SCX_DSP_RETRY, /* pick helpers only: restart the pick */
};
/*
@@ -3124,12 +3125,12 @@ static void put_prev_task_scx(struct rq
* ops.enqueue() that @p is the only one available for this cpu,
* which should trigger an explicit follow-up scheduling event.
*
- * Core scheduling can force this CPU idle while @p stays
- * runnable. @p's cookie then won't match the core's, so skip
- * the warning in that case.
+ * Under core scheduling, a pick dispatches only when nothing is
+ * locally runnable and can legitimately go idle with @p still
+ * runnable (see do_pick_task_scx()).
*/
if (next && sched_class_above(&ext_sched_class, next->sched_class)) {
- WARN_ON_ONCE(sched_cpu_cookie_match(rq, p) &&
+ WARN_ON_ONCE(!sched_core_enabled(rq) &&
!(sch->ops.flags & SCX_OPS_ENQ_LAST));
do_enqueue_task(rq, p, SCX_ENQ_LAST, -1);
} else {
@@ -3222,6 +3223,70 @@ static enum scx_dsp_verdict dispatch_pic
return verdict;
}
+#ifdef CONFIG_SCHED_CORE
+/*
+ * Dispatch for a pick when core scheduling is enabled. The selection picks for
+ * all SMT siblings and the rq_i->core_pick state it builds must stay atomic
+ * throughout. If the dispatch released the rq lock, anything can have happened
+ * in between - return %SCX_DSP_RETRY to restart the selection against current
+ * state.
+ */
+static enum scx_dsp_verdict dispatch_core_pick(struct rq *rq, struct rq_flags *rf,
+ struct task_struct *prev)
+{
+ enum scx_dsp_verdict verdict;
+ u32 seq = rq->scx.lock_drop_seq;
+
+ /* another dispatch is in flight on @rq, let that handle it */
+ if (rq->scx.flags & SCX_RQ_IN_BALANCE)
+ return SCX_DSP_NONE;
+
+ rq_unpin_lock(rq, rf);
+
+ verdict = balance_one(rq, prev);
+
+ if (cpu_of(rq) == smp_processor_id()) {
+ maybe_queue_balance_callback(rq);
+
+ /* see dispatch_pick() */
+ if (unlikely(rq->scx.kick_sync_pending)) {
+ rq->scx.kick_sync_pending = false;
+ queue_balance_callback(rq, &rq->scx.kick_sync_bal_cb,
+ kick_sync_wait_bal_cb);
+ }
+ } else if (unlikely(rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
+ /*
+ * Balance callbacks must run in the context that queued them,
+ * so they can't be queued on another CPU's rq. Run the deferred
+ * work directly instead.
+ */
+ rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING;
+ run_deferred(rq);
+ }
+
+ rq_repin_lock(rq, rf);
+
+ /* if balance_one() released the rq lock, restart the selection */
+ if (rq->scx.lock_drop_seq != seq)
+ return SCX_DSP_RETRY;
+
+ /* see dispatch_pick() */
+ if (unlikely(verdict == SCX_DSP_PREV &&
+ prev->sched_class != &ext_sched_class)) {
+ WARN_ON_ONCE(scx_enable_state() == SCX_ENABLED);
+ verdict = SCX_DSP_LOCAL;
+ }
+
+ return verdict;
+}
+#else /* CONFIG_SCHED_CORE */
+static enum scx_dsp_verdict dispatch_core_pick(struct rq *rq, struct rq_flags *rf,
+ struct task_struct *prev)
+{
+ return SCX_DSP_NONE;
+}
+#endif /* CONFIG_SCHED_CORE */
+
static struct task_struct *
do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
{
@@ -3234,7 +3299,13 @@ do_pick_task_scx(struct rq *rq, struct r
rq_modified_begin(rq, &ext_sched_class);
- verdict = dispatch_pick(rq, rf, prev);
+ if (sched_core_enabled(rq))
+ verdict = dispatch_core_pick(rq, rf, prev);
+ else
+ verdict = dispatch_pick(rq, rf, prev);
+
+ if (verdict == SCX_DSP_RETRY)
+ return RETRY_TASK;
/*
* If any higher-priority sched class enqueued a runnable task on this
@@ -3248,9 +3319,8 @@ do_pick_task_scx(struct rq *rq, struct r
return RETRY_TASK;
/*
- * If balance_one() is telling us to keep running @prev, replenish slice
- * if necessary and keep running @prev. Otherwise, pop the first one
- * from the local DSQ.
+ * If we're keeping @prev, replenish slice if necessary and keep running
+ * @prev. Otherwise, pop the first one from the local DSQ.
*/
if (verdict == SCX_DSP_PREV) {
p = prev;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 412/713] sched_ext: Count rq lock releases in rq->scx.lock_drop_seq
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 411/713] sched_ext: Fix rq->core_pick corruption under core scheduling Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 413/713] sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection Greg Kroah-Hartman
` (311 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit f2da9587118d5da41a3f81a59642d5bb4782ddcc upstream.
Under core scheduling, pick_next_task() selects for all SMT siblings under
one continuous hold of the shared core-wide rq lock, and sched_ext's
dispatch can release that lock from inside the pick. In preparation for
making the core-sched pick detect the releases and retry, add
rq->scx.lock_drop_seq and bump it at every site that can release an rq lock
while a dispatch may be in flight. The counter is only maintained while core
scheduling is enabled. No functional changes.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 38 ++++++++++++++++++++++++++++++++++++--
kernel/sched/sched.h | 3 +++
2 files changed, 39 insertions(+), 2 deletions(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -479,12 +479,27 @@ static bool rq_is_open(struct rq *rq, u6
*/
DEFINE_PER_CPU(struct rq *, scx_locked_rq_state);
+/*
+ * Under core scheduling, a pick that releases the rq lock invalidates the
+ * core-wide selection it is part of. Count the releases so that the core-sched
+ * pick can tell whether one happened across dispatch.
+ */
+static void scx_rq_lock_drop(struct rq *rq)
+{
+ lockdep_assert_rq_held(rq);
+#ifdef CONFIG_SCHED_CORE
+ if (sched_core_enabled(rq))
+ rq->scx.lock_drop_seq++;
+#endif
+}
+
static void switch_rq_lock(struct rq *from, struct rq *to)
{
bool tracked = scx_locked_rq() == from;
if (tracked)
update_locked_rq(NULL);
+ scx_rq_lock_drop(from);
raw_spin_rq_unlock(from);
raw_spin_rq_lock(to);
if (tracked)
@@ -1133,6 +1148,7 @@ static void deferred_irq_workfn(struct i
raw_spin_rq_lock(rq);
run_deferred(rq);
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock(rq);
}
@@ -2430,12 +2446,14 @@ static bool consume_remote_task(struct r
struct task_struct *p, u64 enq_flags,
struct scx_dispatch_q *dsq, struct rq *src_rq)
{
+ scx_rq_lock_drop(this_rq);
raw_spin_rq_unlock(this_rq);
if (unlink_dsq_and_lock_src_rq(p, dsq, src_rq)) {
move_remote_task_to_local_dsq(p, enq_flags, src_rq, this_rq);
return true;
} else {
+ scx_rq_lock_drop(src_rq);
raw_spin_rq_unlock(src_rq);
raw_spin_rq_lock(this_rq);
return false;
@@ -3172,6 +3190,7 @@ retry:
continue;
}
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock_irq(rq);
while (READ_ONCE(cpu_rq(cpu)->scx.kick_sync) == ksyncs[cpu]) {
smp_store_release(&rq->scx.kick_sync, rq->scx.kick_sync + 1);
@@ -4350,8 +4369,10 @@ static void reenq_user(struct rq *rq, st
task_rq = task_rq(p);
if (locked_rq != task_rq) {
- if (locked_rq)
+ if (locked_rq) {
+ scx_rq_lock_drop(locked_rq);
raw_spin_rq_unlock(locked_rq);
+ }
if (unlikely(!raw_spin_rq_trylock(task_rq))) {
raw_spin_unlock(&dsq->lock);
raw_spin_rq_lock(task_rq);
@@ -4377,6 +4398,7 @@ static void reenq_user(struct rq *rq, st
p->scx.flags &= ~SCX_TASK_REENQ_REASON_MASK;
if (!(++nr_enqueued % SCX_TASK_ITER_BATCH)) {
+ scx_rq_lock_drop(locked_rq);
raw_spin_rq_unlock(locked_rq);
locked_rq = NULL;
cpu_relax();
@@ -4389,8 +4411,10 @@ static void reenq_user(struct rq *rq, st
raw_spin_unlock(&dsq->lock);
if (locked_rq != rq) {
- if (locked_rq)
+ if (locked_rq) {
+ scx_rq_lock_drop(locked_rq);
raw_spin_rq_unlock(locked_rq);
+ }
raw_spin_rq_lock(rq);
}
}
@@ -5442,6 +5466,7 @@ resume:
if (!(nr_balanced % SCX_BYPASS_LB_BATCH) && n) {
list_move_tail(&cursor.node, &n->scx.dsq_list.node);
raw_spin_unlock(&donor_dsq->lock);
+ scx_rq_lock_drop(donor_rq);
raw_spin_rq_unlock_irq(donor_rq);
cpu_relax();
raw_spin_rq_lock_irq(donor_rq);
@@ -5452,6 +5477,7 @@ resume:
list_del_init(&cursor.node);
raw_spin_unlock(&donor_dsq->lock);
+ scx_rq_lock_drop(donor_rq);
raw_spin_rq_unlock_irq(donor_rq);
return nr_balanced;
@@ -5742,6 +5768,7 @@ static void scx_bypass(struct scx_sched
* sees scx_bypassing() before moving tasks to SCX.
*/
if (!scx_enabled()) {
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock(rq);
continue;
}
@@ -5768,6 +5795,7 @@ static void scx_bypass(struct scx_sched
if (cpu_online(cpu) || cpu == smp_processor_id())
resched_curr(rq);
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock(rq);
}
@@ -8495,6 +8523,7 @@ static bool kick_one_cpu(s32 cpu, struct
cpumask_clear_cpu(cpu, this_scx->cpus_to_wait);
}
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock_irqrestore(rq, flags);
return should_wait;
@@ -8511,6 +8540,7 @@ static void kick_one_cpu_if_idle(s32 cpu
(cpu_online(cpu) || cpu == cpu_of(this_rq)))
resched_curr(rq);
+ scx_rq_lock_drop(rq);
raw_spin_rq_unlock_irqrestore(rq, flags);
}
@@ -8548,6 +8578,7 @@ static void kick_cpus_irq_workfn(struct
raw_spin_rq_lock(this_rq);
this_scx->kick_sync_pending = true;
resched_curr(this_rq);
+ scx_rq_lock_drop(this_rq);
raw_spin_rq_unlock(this_rq);
}
}
@@ -9039,6 +9070,7 @@ out:
if (locked_rq != p_rq)
switch_rq_lock(p_rq, locked_rq);
} else {
+ scx_rq_lock_drop(p_rq);
raw_spin_rq_unlock_irqrestore(p_rq, flags);
}
@@ -9518,9 +9550,11 @@ static void scx_kick_cpu(struct scx_sche
if (raw_spin_rq_trylock(target_rq)) {
if (can_skip_idle_kick(target_rq)) {
+ scx_rq_lock_drop(target_rq);
raw_spin_rq_unlock(target_rq);
goto out;
}
+ scx_rq_lock_drop(target_rq);
raw_spin_rq_unlock(target_rq);
}
cpumask_set_cpu(cpu, this_rq->scx.cpus_to_kick_if_idle);
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -803,6 +803,9 @@ struct scx_rq {
bool cpu_released;
u32 flags;
u32 nr_immed; /* ENQ_IMMED tasks on local_dsq */
+#ifdef CONFIG_SCHED_CORE
+ u32 lock_drop_seq; /* nr dispatch lock releases */
+#endif
u64 clock; /* current per-rq clock -- see scx_bpf_now() */
cpumask_var_t cpus_to_kick;
cpumask_var_t cpus_to_kick_if_idle;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 413/713] sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 412/713] sched_ext: Count rq lock releases in rq->scx.lock_drop_seq Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 414/713] sched_ext: Fix exit_task leak on fork failure during enable Greg Kroah-Hartman
` (310 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, fangqiurong, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: fangqiurong <fangqiurong@kylinos.cn>
commit 56bbc91219c0711f1580a8ba7cd60471b6e1684e upstream.
libbpf strips the last ___flavor suffix when resolving kfunc externs, so
the bare ___v2 declaration resolves to scx_bpf_dsq_move_to_local, whose
BTF proto lacks @enq_flags. The extern never matches, bpf_ksym_exists()
returns false on every kernel that has the ___v2 kfunc, and the macro
falls back to ___v1, silently dropping @enq_flags.
Add the trailing ___compat suffix used by the other versioned externs in
this file (scx_bpf_dsq_insert___v2, scx_bpf_reenqueue_local___v2).
Any caller passing non-zero @enq_flags through the compat macro silently
loses them.
Fixes: 860683763ebf ("sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local()")
Cc: stable@vger.kernel.org # v7.1+
Assisted-by: Z.ai:glm-5.2
Signed-off-by: fangqiurong <fangqiurong@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/sched_ext/include/scx/compat.bpf.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/sched_ext/include/scx/compat.bpf.h b/tools/sched_ext/include/scx/compat.bpf.h
index bddbf83831cb..5767647f8c49 100644
--- a/tools/sched_ext/include/scx/compat.bpf.h
+++ b/tools/sched_ext/include/scx/compat.bpf.h
@@ -31,7 +31,7 @@ struct cgroup *scx_bpf_task_cgroup___new(struct task_struct *p) __ksym __weak;
*
* v7.1: scx_bpf_dsq_move_to_local___v2() to add @enq_flags.
*/
-bool scx_bpf_dsq_move_to_local___v2(u64 dsq_id, u64 enq_flags) __ksym __weak;
+bool scx_bpf_dsq_move_to_local___v2___compat(u64 dsq_id, u64 enq_flags) __ksym __weak;
bool scx_bpf_dsq_move_to_local___v1(u64 dsq_id) __ksym __weak;
void scx_bpf_dsq_move_set_slice___new(struct bpf_iter_scx_dsq *it__iter, u64 slice) __ksym __weak;
void scx_bpf_dsq_move_set_vtime___new(struct bpf_iter_scx_dsq *it__iter, u64 vtime) __ksym __weak;
@@ -45,8 +45,8 @@ bool scx_bpf_dispatch_from_dsq___old(struct bpf_iter_scx_dsq *it__iter, struct t
bool scx_bpf_dispatch_vtime_from_dsq___old(struct bpf_iter_scx_dsq *it__iter, struct task_struct *p, u64 dsq_id, u64 enq_flags) __ksym __weak;
#define scx_bpf_dsq_move_to_local(dsq_id, enq_flags) \
- (bpf_ksym_exists(scx_bpf_dsq_move_to_local___v2) ? \
- scx_bpf_dsq_move_to_local___v2((dsq_id), (enq_flags)) : \
+ (bpf_ksym_exists(scx_bpf_dsq_move_to_local___v2___compat) ? \
+ scx_bpf_dsq_move_to_local___v2___compat((dsq_id), (enq_flags)) : \
(bpf_ksym_exists(scx_bpf_dsq_move_to_local___v1) ? \
scx_bpf_dsq_move_to_local___v1((dsq_id)) : \
scx_bpf_consume___old((dsq_id))))
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 414/713] sched_ext: Fix exit_task leak on fork failure during enable
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 413/713] sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 415/713] sched_ext: Fix inverted ops.core_sched_before() invocation Greg Kroah-Hartman
` (309 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, fangqiurong, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: fangqiurong <fangqiurong@kylinos.cn>
commit 03506edca637a8465dba9f635c50e9884fbcaf4e upstream.
scx_fork() initializes tasks when scx_init_task_enabled is set, but
scx_cancel_fork() only exits them when scx_enabled() is true. A fork
that fails in the enable window (between releasing scx_fork_rwsem and
setting __scx_enabled) runs ops.init_task() but never ops.exit_task().
Gate scx_cancel_fork() on scx_init_task_enabled.
Fixes: 4269c603cc26 ("sched_ext: Enable scx_ops_init_task() separately")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: fangqiurong <fangqiurong@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3988,7 +3988,7 @@ void scx_post_fork(struct task_struct *p
void scx_cancel_fork(struct task_struct *p)
{
- if (scx_enabled()) {
+ if (scx_init_task_enabled) {
struct rq *rq;
struct rq_flags rf;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 415/713] sched_ext: Fix inverted ops.core_sched_before() invocation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 414/713] sched_ext: Fix exit_task leak on fork failure during enable Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 416/713] sched_ext: Dont BUG_ON a destroyed DSQ in process_deferred_reenq_users Greg Kroah-Hartman
` (308 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit f7b6d128dd49a6eec09066ecfd29095f12588786 upstream.
scx_prio_less() implements prio_less() semantics - %true means that @a is
the lower priority and should run after @b. ops.core_sched_before() is
documented to return %true when @a should run before @b. scx_prio_less()
returns the op's value as-is, inverting the documented semantics at runtime.
Call the op with the arguments swapped.
scx_qmap followed the wiring instead of the documentation and returned %true
for the younger task, so the two inversions canceled out and it behaved as
intended. Flip its comparison to match. scx_qmap is likely the only current
user in or out of the kernel tree. Any scheduler written the same way needs
the same flip, while schedulers following the documentation are fixed by
this change.
Fixes: 7b0888b7cc19 ("sched_ext: Implement core-sched support")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 10 ++++++++--
tools/sched_ext/scx_qmap.bpf.c | 2 +-
2 files changed, 9 insertions(+), 3 deletions(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3416,6 +3416,8 @@ void ext_server_init(struct rq *rq)
*
* When ops.core_sched_before() is enabled, @p->scx.core_sched_at is used to
* implement FIFO ordering within each local DSQ. See pick_task_scx().
+ *
+ * Return: %true if @a should run after @b.
*/
bool scx_prio_less(const struct task_struct *a, const struct task_struct *b,
bool in_fi)
@@ -3424,6 +3426,10 @@ bool scx_prio_less(const struct task_str
struct scx_sched *sch_b = scx_task_sched(b);
/*
+ * scx_prio_less() returns whether @a should run after @b while
+ * ops.core_sched_before() returns whether its first argument should run
+ * before the second. Swap the arguments.
+ *
* The const qualifiers are dropped from task_struct pointers when
* calling ops.core_sched_before(). Accesses are controlled by the
* verifier.
@@ -3432,8 +3438,8 @@ bool scx_prio_less(const struct task_str
!scx_bypassing(sch_a, task_cpu(a)))
return SCX_CALL_OP_2TASKS_RET(sch_a, core_sched_before,
task_rq(a),
- (struct task_struct *)a,
- (struct task_struct *)b);
+ (struct task_struct *)b,
+ (struct task_struct *)a);
else
return time_after64(a->scx.core_sched_at, b->scx.core_sched_at);
}
--- a/tools/sched_ext/scx_qmap.bpf.c
+++ b/tools/sched_ext/scx_qmap.bpf.c
@@ -749,7 +749,7 @@ static s64 task_qdist(struct task_struct
bool BPF_STRUCT_OPS(qmap_core_sched_before,
struct task_struct *a, struct task_struct *b)
{
- return task_qdist(a) > task_qdist(b);
+ return task_qdist(a) < task_qdist(b);
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 416/713] sched_ext: Dont BUG_ON a destroyed DSQ in process_deferred_reenq_users
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 415/713] sched_ext: Fix inverted ops.core_sched_before() invocation Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 417/713] sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype Greg Kroah-Hartman
` (307 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Cui, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
commit 8d8dd8ae89eaa78b37fc85528e926029f5facbdf upstream.
scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from
run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru
runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and
hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip.
tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID
check and the BUG_ON would leave a window where destroy_dsq() can
invalidate the id between the two reads and still trigger the BUG_ON.
Fixes: 84b1a0ea0b7c ("sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs")
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4431,7 +4431,7 @@ static void process_deferred_reenq_users
while (true) {
struct scx_dispatch_q *dsq;
- u64 reenq_flags;
+ u64 dsq_id, reenq_flags;
scoped_guard (raw_spinlock, &rq->scx.deferred_reenq_lock) {
struct scx_deferred_reenq_user *dru =
@@ -4454,7 +4454,12 @@ static void process_deferred_reenq_users
/* see schedule_dsq_reenq() */
smp_mb();
- BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);
+ /* destroy_dsq() may have raced and invalidated @dsq, nothing to reenq */
+ dsq_id = READ_ONCE(dsq->id);
+ if (unlikely(dsq_id == SCX_DSQ_INVALID))
+ continue;
+
+ BUG_ON(dsq_id & SCX_DSQ_FLAG_BUILTIN);
reenq_user(rq, dsq, reenq_flags);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 417/713] sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 416/713] sched_ext: Dont BUG_ON a destroyed DSQ in process_deferred_reenq_users Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 418/713] sched_ext: Keep kick_sync waiting on the rqs own CPU Greg Kroah-Hartman
` (306 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 62f3d531e41a7e6e0dc8d37ea377c50488decb56 upstream.
scx_bpf_dsq_reenq() is registered with KF_IMPLICIT_ARGS and its kernel BTF
prototype omits the trailing bpf_prog_aux argument. The ___compat extern
declares the argument explicitly, so libbpf never matches the prototype and
the weak extern silently stays unresolved on every kernel. The wrapper
always takes the old fallback path, which disables generic reenq users like
scx_qmap's lowpri mechanism and fails non-local reenq with "kernel too old"
even on kernels that have the kfunc.
Drop the explicit aux argument. Also correct the stale v6.20 reference, the
kfunc was added in v7.1.
Fixes: 9c34c5074d1b ("sched_ext: Introduce scx_bpf_dsq_reenq() for remote local DSQ reenqueue")
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/sched_ext/include/scx/compat.bpf.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/tools/sched_ext/include/scx/compat.bpf.h
+++ b/tools/sched_ext/include/scx/compat.bpf.h
@@ -414,10 +414,10 @@ static inline void scx_bpf_reenqueue_loc
}
/*
- * v6.20: New scx_bpf_dsq_reenq() that allows re-enqueues on more DSQs. This
+ * v7.1: New scx_bpf_dsq_reenq() that allows re-enqueues on more DSQs. This
* will eventually deprecate scx_bpf_reenqueue_local().
*/
-void scx_bpf_dsq_reenq___compat(u64 dsq_id, u64 reenq_flags, const struct bpf_prog_aux *aux__prog) __ksym __weak;
+void scx_bpf_dsq_reenq___compat(u64 dsq_id, u64 reenq_flags) __ksym __weak;
static inline bool __COMPAT_has_generic_reenq(void)
{
@@ -427,7 +427,7 @@ static inline bool __COMPAT_has_generic_
static inline void scx_bpf_dsq_reenq(u64 dsq_id, u64 reenq_flags)
{
if (bpf_ksym_exists(scx_bpf_dsq_reenq___compat))
- scx_bpf_dsq_reenq___compat(dsq_id, reenq_flags, NULL);
+ scx_bpf_dsq_reenq___compat(dsq_id, reenq_flags);
else if (dsq_id == SCX_DSQ_LOCAL && reenq_flags == 0)
scx_bpf_reenqueue_local();
else
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 418/713] sched_ext: Keep kick_sync waiting on the rqs own CPU
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 417/713] sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 419/713] scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Greg Kroah-Hartman
` (305 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tejun Heo
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit e0253dd04beb03e79477c5ef4768b11135687206 upstream.
kick_sync_wait_bal_cb() assumes it runs on the rq's CPU from the
__schedule() tail: the snapshots it compares against live in that CPU's
percpu area and the busy-wait runs with the rq lock dropped and IRQs
enabled.
However, dispatch can now drop the rq lock while the callback sits queued,
and rq lock takers in that window (the sched class change paths, the scx
task iterator) flush pending balance callbacks on release, running the
callback on a foreign CPU. Such a run compares against unrelated snapshots
and can deadlock when the executing CPU is itself a wait target.
Bail on a foreign CPU and leave the wait state alone. The wait only observes
progress that the resched kicks already guarantee and the rq's next wait
picks up the stale cpus_to_sync bits.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext/ext.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3163,12 +3163,27 @@ switch_class:
static void kick_sync_wait_bal_cb(struct rq *rq)
{
- struct scx_kick_syncs __rcu *ks = __this_cpu_read(scx_kick_syncs);
- unsigned long *ksyncs = rcu_dereference_sched(ks)->syncs;
+ struct scx_kick_syncs __rcu *ks;
+ unsigned long *ksyncs;
bool waited;
s32 cpu;
/*
+ * This callback is queued and normally flushed within @rq's own
+ * scheduling pass. However, dispatch can drop the rq lock while it sits
+ * queued, and lock takers in that window (the sched class change paths,
+ * the scx task iterator) flush pending balance callbacks on release,
+ * running this one on a foreign CPU whose snapshots are unrelated. The
+ * kicked CPUs are already on their way to advance the kick_syncs being
+ * waited on. Don't get in the way.
+ */
+ if (unlikely(cpu_of(rq) != smp_processor_id()))
+ return;
+
+ ks = __this_cpu_read(scx_kick_syncs);
+ ksyncs = rcu_dereference_sched(ks)->syncs;
+
+ /*
* Drop rq lock and enable IRQs while waiting. IRQs must be enabled
* — a target CPU may be waiting for us to process an IPI (e.g. TLB
* flush) while we wait for its kick_sync to advance.
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 419/713] scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 418/713] sched_ext: Keep kick_sync waiting on the rqs own CPU Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 420/713] scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Greg Kroah-Hartman
` (304 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Vaganov, Bart Van Assche,
Martin K. Petersen (Oracle)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Vaganov <p.vaganov@ideco.ru>
commit 626147717bea776b61ed3631d2c26283760c4cc4 upstream.
During fuzz testing, the following issue was discovered:
BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310
__dma_map_sg_attrs+0x217/0x310
dma_map_sg_attrs+0x4a/0x70
ata_qc_issue+0x9f8/0x1420
__ata_scsi_queuecmd+0x1657/0x1740
ata_scsi_queuecmd+0x79a/0x920
scsi_queue_rq+0x4472/0x4f40
blk_mq_dispatch_rq_list+0x1cca/0x3ee0
__blk_mq_sched_dispatch_requests+0x458/0x630
blk_mq_sched_dispatch_requests+0x15b/0x340
__blk_mq_run_hw_queue+0xe5/0x250
__blk_mq_delay_run_hw_queue+0x138/0x780
blk_mq_run_hw_queue+0x4bb/0x7e0
blk_mq_sched_insert_request+0x2a7/0x4c0
blk_execute_rq+0x497/0x8a0
sg_io+0xbe0/0xe20
scsi_ioctl+0x2b36/0x3c60
sr_block_ioctl+0x319/0x440
blkdev_ioctl+0x80f/0xd70
__se_sys_ioctl+0x219/0x420
__x64_sys_ioctl+0x93/0xe0
x64_sys_call+0x1d6c/0x3ad0
do_syscall_64+0x4c/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Uninit was created at:
__alloc_pages+0x5c0/0xc80
alloc_pages+0xe0e/0x1050
blk_rq_map_user_iov+0x2b77/0x6100
blk_rq_map_user_io+0x2fa/0x4d0
sg_io+0xad6/0xe20
scsi_ioctl+0x2b36/0x3c60
sr_block_ioctl+0x319/0x440
blkdev_ioctl+0x80f/0xd70
__se_sys_ioctl+0x219/0x420
__x64_sys_ioctl+0x93/0xe0
x64_sys_call+0x1d6c/0x3ad0
do_syscall_64+0x4c/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Bytes 14-15 of 16 are uninitialized
Memory access of size 16 starts at ffff88800cbdb000
When processing the last unaligned element of the scatterlist, it is
supplemented with missing bytes in the amount of pad_len. These bytes
remain uninitialized, which leads to a problem.
Extend last_sg->length by pad_len first, then use sg_zero_buffer() to
zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally,
which correctly handles sg entries spanning multiple pages and padding
that crosses a page boundary.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 40b01b9bbdf5 ("block: update bio according to DMA alignment padding")
Cc: stable@vger.kernel.org
Signed-off-by: Petr Vaganov <p.vaganov@ideco.ru>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260628185229.37957-1-p.vaganov@ideco.ru
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_lib.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1187,8 +1187,10 @@ blk_status_t scsi_alloc_sgtables(struct
if (blk_rq_bytes(rq) & rq->q->limits.dma_pad_mask) {
unsigned int pad_len =
(rq->q->limits.dma_pad_mask & ~blk_rq_bytes(rq)) + 1;
+ unsigned int data_len = last_sg->length;
last_sg->length += pad_len;
+ sg_zero_buffer(last_sg, 1, pad_len, data_len);
cmd->extra_len += pad_len;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 420/713] scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 419/713] scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 421/713] rpmsg: glink: smem: order FIFO read after availability check Greg Kroah-Hartman
` (303 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linkai Gong, Karan Tilak Kumar,
Martin K. Petersen (Oracle)
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
commit 9639c6324524ea3f934908bd51f02430000954ab upstream.
fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor with
kzalloc_obj() (default GFP_KERNEL) while holding vlans_lock via
spin_lock_irqsave(). GFP_KERNEL may sleep, which is not allowed in this
atomic context and can trigger a sleeping-from-invalid-context warning
or deadlock.
Pass GFP_ATOMIC so the allocation is safe under the IRQ-safe spinlock.
Fixes: 098585aa8aca ("scsi: fnic: Add and integrate support for FIP")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Link: https://patch.msgid.link/20260731073820.16449-1-gonglinkai@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/fnic/fip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/fnic/fip.c
+++ b/drivers/scsi/fnic/fip.c
@@ -139,7 +139,7 @@ void fnic_fcoe_process_vlan_resp(struct
FNIC_FIP_DBG(KERN_INFO, fnic->host,
fnic->fnic_num,
"process_vlan_resp: FIP VLAN %d\n", vid);
- vlan = kzalloc_obj(*vlan);
+ vlan = kzalloc_obj(*vlan, GFP_ATOMIC);
if (!vlan) {
/* retry from timer */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 421/713] rpmsg: glink: smem: order FIFO read after availability check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 420/713] scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 422/713] Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Greg Kroah-Hartman
` (302 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chunkai Deng, Konrad Dybcio,
Bjorn Andersson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunkai Deng <chunkai.deng@oss.qualcomm.com>
commit 786439ad58763e04b91bc2ec5f590e463939f197 upstream.
glink_smem_rx_peek() reads the RX FIFO payload after the caller has
determined data is available via glink_smem_rx_avail(), which reads the
remote-updated head index. A control dependency between the head read
and the subsequent payload read does not order the two loads, so the
CPU may speculatively read the FIFO before observing the head update
and consume stale data the remote has not yet published.
Add rmb() in glink_smem_rx_peek() before the memcpy_fromio() so the
availability (head) read is ordered ahead of the FIFO payload read,
matching the consumer pattern in
Documentation/core-api/circular-buffers.rst.
Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chunkai Deng <chunkai.deng@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260618-rpmsg-glink-smem-mb-v1-1-68a026453a69@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rpmsg/qcom_glink_smem.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/rpmsg/qcom_glink_smem.c
+++ b/drivers/rpmsg/qcom_glink_smem.c
@@ -103,6 +103,13 @@ static void glink_smem_rx_peek(struct qc
if (tail >= pipe->native.length)
tail -= pipe->native.length;
+ /*
+ * Order the availability (head) read in glink_smem_rx_avail()
+ * against the FIFO payload read below, so APPS never consumes
+ * stale data the remote has not yet published.
+ */
+ rmb();
+
len = min_t(size_t, count, pipe->native.length - tail);
if (len)
memcpy_fromio(data, pipe->fifo + tail, len);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 422/713] Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 421/713] rpmsg: glink: smem: order FIFO read after availability check Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 423/713] arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap Greg Kroah-Hartman
` (301 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Stuebner, Peter Robinson,
Thorsten Leemhuis, Oren Klopfer
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oren Klopfer <oklopfer37@gmail.com>
commit 5f19535351bf28f28d702f452d11a1216ec2bd28 upstream.
This reverts commit 096bd8c679185f898cae9933c6a68650fa26ea4f.
Just as with the Pinebook Pro, there are multiple chipset variants for
the Pinephone Pro, and multiple firmware binaries for different
distributions. The change causes issues with some of these combinations,
and reverting it resolves the issues. See the Closes below for the full
report.
Similarly with the Pinebook Pro adjustment, the original commit only
indicates "further description" and not indicative of fixing any
existing issues, so reverting should not kick any back up.
Fixes: 096bd8c67918 ("arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro")
Cc: Heiko Stuebner <heiko@sntech.de>
Cc: Peter Robinson <pbrobinson@gmail.com>
Cc: Thorsten Leemhuis <regressions@leemhuis.info>
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/r/20260607225901.64019-1-oklopfer37@gmail.com/
Signed-off-by: Oren Klopfer <oklopfer37@gmail.com>
Link: https://patch.msgid.link/20260703201010.67311-1-oklopfer37@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 ------------------
1 file changed, 18 deletions(-)
--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
@@ -734,12 +734,6 @@
};
};
- wifi {
- wifi_host_wake_l: wifi-host-wake-l {
- rockchip,pins = <4 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>;
- };
- };
-
wireless-bluetooth {
bt_wake_pin: bt-wake-pin {
rockchip,pins = <2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -766,19 +760,7 @@
pinctrl-names = "default";
pinctrl-0 = <&sdio0_bus4 &sdio0_cmd &sdio0_clk>;
sd-uhs-sdr104;
- #address-cells = <1>;
- #size-cells = <0>;
status = "okay";
-
- brcmf: wifi@1 {
- compatible = "brcm,bcm4329-fmac";
- reg = <1>;
- interrupt-parent = <&gpio4>;
- interrupts = <RK_PD0 IRQ_TYPE_LEVEL_HIGH>;
- interrupt-names = "host-wake";
- pinctrl-names = "default";
- pinctrl-0 = <&wifi_host_wake_l>;
- };
};
&pwm0 {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 423/713] arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 422/713] Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 424/713] arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Greg Kroah-Hartman
` (300 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jianping Li, Konrad Dybcio,
Bjorn Andersson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianping Li <jianping.li@oss.qualcomm.com>
commit 9d7d847ff1c502802ac764120f9a1800b94ce497 upstream.
On KODIAK platforms boot can fail when the DT "adsp-rpc-remote-heap"
reserved-memory region overlaps with firmware allocations (UEFI/EFI
runtime). The kernel then reports failure to reserve the region and
subsequent EFI runtime activity may trigger aborts.
The remote heap node was described as a fixed "no-map" region, which
turns it into a hard carveout. Replace it with a "shared-dma-pool"
reserved memory region with reusable CMA-backed allocation, specifying
alignment and size.
This avoids hard carveouts and reduces the chance of conflicting with
firmware memory maps while keeping an explicit pool for ADSP remote
heap usage.
Fixes: 90a58ffa9c55 ("arm64: dts: qcom: kodiak: Add memory region for audiopd")
Cc: stable@kernel.org
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260429073443.2027-1-jianping.li@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/kodiak.dtsi | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/kodiak.dtsi b/arch/arm64/boot/dts/qcom/kodiak.dtsi
index ac048ec9aeb5..7e73348fe0d0 100644
--- a/arch/arm64/boot/dts/qcom/kodiak.dtsi
+++ b/arch/arm64/boot/dts/qcom/kodiak.dtsi
@@ -191,9 +191,12 @@ rmtfs_mem: rmtfs@9c900000 {
qcom,vmid = <QCOM_SCM_VMID_MSS_MSA>;
};
- adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap@9cb80000 {
- reg = <0x0 0x9cb80000 0x0 0x800000>;
- no-map;
+ adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
+ compatible = "shared-dma-pool";
+ alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
+ reusable;
+ alignment = <0x0 0x400000>;
+ size = <0x0 0x800000>;
};
};
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 424/713] arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 423/713] arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 425/713] arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Greg Kroah-Hartman
` (299 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
commit 8e73ae5c34e4fbbd25a8324e3c0eb1e845d7f01e upstream.
IRQ_TYPE_xxx flags are not correct in the context of GPIO flags.
These are simple defines so they could be used in DTS but they will not
have the same meaning: IRQ_TYPE_LEVEL_LOW = 8 = GPIO_TRANSITORY.
Correct the touchscreen irq-gpios to use proper flags, assuming the
author of the code wanted similar logical behavior:
IRQ_TYPE_LEVEL_LOW => GPIO_ACTIVE_LOW
Fixes: e46b455e67f8 ("arm64: dts: qcom: sm6115-pro1x: Add Goodix Touchscreen")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260413090527.53000-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts
+++ b/arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts
@@ -151,7 +151,7 @@
interrupts-extended = <&tlmm 80 IRQ_TYPE_LEVEL_LOW>;
- irq-gpios = <&tlmm 80 IRQ_TYPE_LEVEL_LOW>;
+ irq-gpios = <&tlmm 80 GPIO_ACTIVE_LOW>;
reset-gpios = <&tlmm 71 GPIO_ACTIVE_HIGH>;
AVDD28-supply = <&ts_vdd_supply>;
VDDIO-supply = <&ts_vddio_supply>;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 425/713] arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 424/713] arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 426/713] arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Greg Kroah-Hartman
` (298 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Scott, Konrad Dybcio,
Val Packett, Bjorn Andersson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Scott <mike.scott@oss.qualcomm.com>
commit 06c8fc3e132ce8659bc9f0877b5c6daaf41aadbd upstream.
The l12b and l15b supplies are used by components that are not (fully)
described (and some never will be) and must never be disabled.
Mark the regulators as always-on to prevent them from being disabled,
for example, when consumers probe defer or suspend.
Note that these supplies currently have no consumers described in
mainline for dell-thena beyond the audio codec (vdd-buck/vdd-rxtx/
vdd-io on wcd938x), which can release them when the codec goes idle.
The board-level gpio-fixed regulators that feed the Type-C retimer's
VDDIO and other rails are not described with a vin-supply link, so
the kernel cannot keep their parent LDOs alive on its own.
This mirrors the same change Johan Hovold applied to every other
X1E80100 board in a March 2025 series; commit 63169c07d740
("arm64: dts: qcom: x1e80100-dell-xps13-9345: mark l12b and l15b always-on")
is representative. The dell-thena board file was introduced four months
later and did not inherit that change; this patch closes the gap.
Fixes: e7733b42111c ("arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Scott <mike.scott@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Acked-by: Val Packett <val@packett.cool>
Link: https://lore.kernel.org/r/20260521010935.1333494-4-mike.scott@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
@@ -589,6 +589,7 @@
regulator-min-microvolt = <1200000>;
regulator-max-microvolt = <1200000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-always-on;
};
vreg_l13b_3p0: ldo13 {
@@ -610,6 +611,7 @@
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-always-on;
};
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 426/713] arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 425/713] arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 427/713] arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Greg Kroah-Hartman
` (297 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Quentin Schulz, Heiko Stuebner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <quentin.schulz@cherry.de>
commit 2a08921edcab6a462fa6ddb02c91b90b5ac92429 upstream.
According to the Jedec 5.1 specification, the device is held in reset
when RST_n is low, therefore the polarity of the line must be that, as
specified in the Device Tree binding (mmc/mmc-pwrseq-emmc.yaml).
Due to the wrong polarity, eMMC devices with RST_n_FUNCTION[162]
bitfield [1:0] set to 0x1 (the default is 0x0) will be held in reset
forever.
Cc: stable@vger.kernel.org
Fixes: 56198acdbf0d ("arm64: dts: rockchip: add px30-pp1516 base dtsi and board variants")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260612-pp1516-emmc-polarity-v1-1-4816c1c909f7@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi
+++ b/arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi
@@ -33,7 +33,7 @@
compatible = "mmc-pwrseq-emmc";
pinctrl-0 = <&emmc_reset>;
pinctrl-names = "default";
- reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_LOW>;
};
gpio-leds {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 427/713] arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 426/713] arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 428/713] arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Greg Kroah-Hartman
` (296 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Quentin Schulz, Heiko Stuebner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <quentin.schulz@cherry.de>
commit dfe078755706ed50651ebbe0442843ecd4ae8389 upstream.
According to the Jedec 5.1 specification, the device is held in reset
when RST_n is low, therefore the polarity of the line must be that, as
specified in the Device Tree binding (mmc/mmc-pwrseq-emmc.yaml).
Due to the wrong polarity, eMMC devices with RST_n_FUNCTION[162]
bitfield [1:0] set to 0x1 (the default is 0x0) will be held in reset
forever.
Cc: stable@vger.kernel.org
Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260626-ringneck-emmc-polarity-v1-1-90cefe57b316@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
@@ -26,7 +26,7 @@
compatible = "mmc-pwrseq-emmc";
pinctrl-0 = <&emmc_reset>;
pinctrl-names = "default";
- reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_LOW>;
};
leds {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 428/713] arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 427/713] arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 429/713] arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Greg Kroah-Hartman
` (295 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakob Unterwurzacher, Quentin Schulz,
Heiko Stuebner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
commit 85babf47515e2adf266dcc3be9804e31f752083e upstream.
Technically, the reset signal is active low - it's called RST_n after all.
But it is ignored completely unless RST_n_FUNCTION=1 (byte 162 in extcsd)
is set in the emmc. It is 0 per default.
For emmcs that have RST_n_FUNCTION=1 we failed like this:
[ 3.074480] mmc1: Failed to initialize a non-removable card
With this change they work normally.
Cc: stable@vger.kernel.org
Fixes: bb510ddc9d3e ("arm64: dts: rockchip: add px30-cobra base dtsi and board variants")
Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
Tested-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260609081728.30616-2-jakobunt@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/px30-cobra.dtsi
+++ b/arch/arm64/boot/dts/rockchip/px30-cobra.dtsi
@@ -35,7 +35,7 @@
compatible = "mmc-pwrseq-emmc";
pinctrl-0 = <&emmc_reset>;
pinctrl-names = "default";
- reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_LOW>;
};
gpio-leds {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 429/713] arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 428/713] arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 430/713] arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Greg Kroah-Hartman
` (294 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Heiko Stuebner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@nabladev.com>
commit 4f7259ebe1eba4778768a4f5a0bbbe439d10f3f3 upstream.
The ES8388 sound card on the rk3399-roc-pc-plus fails to probe because
i2s1 cannot claim its MCLK pin:
pinctrl: pin gpio4-0 already requested by ff880000.i2s; cannot claim for ff890000.i2s
pinctrl: error -EINVAL: pin-128 (ff890000.i2s)
pinctrl: error -EINVAL: could not request pin 128 (gpio4-0) from group i2s-8ch-mclk-pin
on device rockchip-pinctrl
GPIO4_A0 is routed as SCLK_I2S_8CH_OUT and is used by i2s1 as the
external MCLK for the ES8388 codec. The board dts already removes
GPIO4_A0 from the i2s0_8ch_bus pin group, but i2s0 still claims the
same pin through its bclk_off state.
Since the i2s driver requests both states, this blocks i2s1 pinctrl
setup and leaves the simple-audio-card deferred with a parse error.
Override i2s0_8ch_bus_bclk_off as well, matching the existing
i2s0_8ch_bus override, so GPIO4_A0 is left for i2s1/ES8388 audio.
Cc: stable@vger.kernel.org
Fixes: 6d9a7bd6a13c ("arm64: dts: rockchip: add support for Firefly ROC-RK3399-PC-PLUS")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts
@@ -136,6 +136,18 @@
<3 RK_PD7 1 &pcfg_pull_none>;
};
+&i2s0_8ch_bus_bclk_off {
+ rockchip,pins =
+ <3 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>,
+ <3 RK_PD1 1 &pcfg_pull_none>,
+ <3 RK_PD2 1 &pcfg_pull_none>,
+ <3 RK_PD3 1 &pcfg_pull_none>,
+ <3 RK_PD4 1 &pcfg_pull_none>,
+ <3 RK_PD5 1 &pcfg_pull_none>,
+ <3 RK_PD6 1 &pcfg_pull_none>,
+ <3 RK_PD7 1 &pcfg_pull_none>;
+};
+
&i2s1 {
pinctrl-names = "default";
pinctrl-0 = <&i2s_8ch_mclk_pin>, <&i2s1_2ch_bus>;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 430/713] arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 429/713] arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 431/713] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage Greg Kroah-Hartman
` (293 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Heiko Stuebner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@nabladev.com>
commit b4db45b3ec97a9d0d23446084f45e095b2ba2020 upstream.
The rk3588s-roc-pc ES8388 codec is connected to the i2s0_8ch audio
interface. Use the matching I2S0 MCLK output for the codec clock
instead of I2S1.
Using the I2S1 MCLK can leave the ALSA PCM running while the codec has
no usable master clock for the active audio path, resulting in silent
headphone output.
Also make the CPU DAI provide bitclock and frame clock. This matches
the active Rockchip I2S controller side and avoids relying on the codec
to drive the bus clocks.
Route the headphone output to LOUT2 and ROUT2, matching the old 5.10
BSP device tree. LOUT1 and ROUT1 are used for the speaker route there,
so using them for the headphone widget can leave the headphone jack
silent even while the ALSA path is active.
The old BSP also used hp-con-gpio on GPIO1_A4. Model that GPIO as a
simple audio amplifier so DAPM enables the headphone connection when the
headphone path is active.
Cc: stable@vger.kernel.org
Fixes: 7f9509791507 ("arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260703025648.180135-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts
@@ -23,16 +23,19 @@
compatible = "simple-audio-card";
pinctrl-names = "default";
pinctrl-0 = <&hp_detect>;
+ simple-audio-card,aux-devs = <&headphones_amp>;
simple-audio-card,name = "rockchip,es8388";
- simple-audio-card,bitclock-master = <&masterdai>;
+ simple-audio-card,bitclock-master = <&cpudai>;
simple-audio-card,format = "i2s";
- simple-audio-card,frame-master = <&masterdai>;
+ simple-audio-card,frame-master = <&cpudai>;
simple-audio-card,hp-det-gpios = <&gpio1 RK_PA6 GPIO_ACTIVE_LOW>;
simple-audio-card,mclk-fs = <256>;
simple-audio-card,pin-switches = "Headphones";
simple-audio-card,routing =
- "Headphones", "LOUT1",
- "Headphones", "ROUT1",
+ "Headphones", "Headphone Amp OUTL",
+ "Headphones", "Headphone Amp OUTR",
+ "Headphone Amp INL", "LOUT2",
+ "Headphone Amp INR", "ROUT2",
"LINPUT1", "Microphone Jack",
"RINPUT1", "Microphone Jack",
"LINPUT2", "Onboard Microphone",
@@ -47,11 +50,17 @@
system-clock-frequency = <12288000>;
};
- simple-audio-card,cpu {
+ cpudai: simple-audio-card,cpu {
sound-dai = <&i2s0_8ch>;
};
};
+ headphones_amp: audio-amplifier-headphones {
+ compatible = "simple-audio-amplifier";
+ enable-gpios = <&gpio1 RK_PA4 GPIO_ACTIVE_HIGH>;
+ sound-name-prefix = "Headphone Amp";
+ };
+
chosen {
stdout-path = "serial2:1500000n8";
};
@@ -327,12 +336,12 @@
es8388: audio-codec@11 {
compatible = "everest,es8388", "everest,es8328";
reg = <0x11>;
- clocks = <&cru I2S1_8CH_MCLKOUT>;
+ clocks = <&cru I2S0_8CH_MCLKOUT>;
AVDD-supply = <&vcc_3v3_s0>;
DVDD-supply = <&vcc_1v8_s0>;
HPVDD-supply = <&vcc_3v3_s0>;
PVDD-supply = <&vcc_3v3_s0>;
- assigned-clocks = <&cru I2S1_8CH_MCLKOUT>;
+ assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
assigned-clock-rates = <12288000>;
#sound-dai-cells = <0>;
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 431/713] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 430/713] arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 432/713] riscv: dts: spacemit: k1-milkv-jupiter: " Greg Kroah-Hartman
` (292 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Yixun Lan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit b496282ee4ad07311a13489e15b74fb7078d9a01 upstream.
On the Banana Pi BPI-F3 board, the buck1 and buck2 voltage regulators,
which supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.
Set the maximum regulator voltage to 1.050V instead.
Fixes: 09a412d39748 ("riscv: dts: spacemit: define regulator constraints")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260729150722.1598630-2-aurelien@aurel32.net
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
@@ -204,14 +204,14 @@
regulators {
buck1 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
buck2 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 432/713] riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 431/713] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 433/713] riscv: dts: spacemit: k1-musepi-pro: " Greg Kroah-Hartman
` (291 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Yixun Lan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit 56a77ddae794ca0516fc146f6e59bb8cdf4fd9d2 upstream.
On the Milk-V Jupiter board, the buck1 and buck2 voltage regulators,
which supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.
Set the maximum regulator voltage to 1.050V instead.
Fixes: 7d307daa12b1 ("riscv: dts: spacemit: Define the P1 PMIC regulators for Milk-V Jupiter")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260729150722.1598630-3-aurelien@aurel32.net
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
index b61f5995ec77..c76b91ecb914 100644
--- a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
@@ -211,14 +211,14 @@ pmic@41 {
regulators {
buck1 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
buck2 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 433/713] riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 432/713] riscv: dts: spacemit: k1-milkv-jupiter: " Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 434/713] riscv: dts: spacemit: k1-orangepi-r2s: " Greg Kroah-Hartman
` (290 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Yixun Lan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit f045253a03589b2616332560b4120e584342a987 upstream.
On the MusePi Pro board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.
Set the maximum regulator voltage to 1.050V instead.
Fixes: e2dac7c7a3a8 ("riscv: dts: spacemit: k1-musepi-pro: add PMIC and power infrastructure")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260729150722.1598630-5-aurelien@aurel32.net
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts b/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
index 3078ffb5cb87..246f8f2ab62b 100644
--- a/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
@@ -180,14 +180,14 @@ pmic@41 {
regulators {
buck1 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
buck2 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 434/713] riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 433/713] riscv: dts: spacemit: k1-musepi-pro: " Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 435/713] riscv: dts: spacemit: k1-orangepi-rv2: " Greg Kroah-Hartman
` (289 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Yixun Lan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit d66267c35032c46c18b675601d03c80239bcd913 upstream.
On the OrangePi R2S board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.
Set the maximum regulator voltage to 1.050V instead.
Fixes: 793cc54475b4 ("riscv: dts: spacemit: enable PMIC on OrangePi R2S")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260729150722.1598630-6-aurelien@aurel32.net
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
@@ -126,14 +126,14 @@
regulators {
buck1 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
buck2 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 435/713] riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 434/713] riscv: dts: spacemit: k1-orangepi-r2s: " Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 436/713] RISC-V: KVM: Fix PMU event info array size overflow Greg Kroah-Hartman
` (288 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Yixun Lan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit ae0c38f0a24f95c8759b6b0eaaa5a0d36a7c6af2 upstream.
On the OrangePi RV2 board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.
Set the maximum regulator voltage to 1.050V instead.
Fixes: c02c047b925c ("riscv: dts: spacemit: Define the P1 PMIC regulators for OrangePi RV2")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260729150722.1598630-4-aurelien@aurel32.net
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts b/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
index 7c49bce427f3..b907a1396b21 100644
--- a/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
@@ -164,14 +164,14 @@ pmic@41 {
regulators {
buck1 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
buck2 {
regulator-min-microvolt = <500000>;
- regulator-max-microvolt = <3450000>;
+ regulator-max-microvolt = <1050000>;
regulator-ramp-delay = <5000>;
regulator-always-on;
};
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 436/713] RISC-V: KVM: Fix PMU event info array size overflow
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 435/713] riscv: dts: spacemit: k1-orangepi-rv2: " Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 437/713] riscv: acpi: Handle LPI architectural context loss flags Greg Kroah-Hartman
` (287 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Naveed Khan, Guidong Han, Anup Patel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guidong Han <2045gemini@gmail.com>
commit 735bc20c24187ca419c9d5e63860a54b91be34bd upstream.
SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)
in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010
truncate to 16. KVM then allocates one entry but loops over the original
num_events, causing out-of-bounds reads and writes. A nested guest
triggered:
BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
Read of size 4 at addr ff600000074d46b0 by task init/1
Call Trace:
[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268
[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540
[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80
Allocated by task 1:
__kmalloc_noprof+0x19e/0x4b0
kvm_riscv_vcpu_pmu_event_info+0x72/0x142
kvm_sbi_ext_pmu_handler+0xca/0x268
kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
kvm_riscv_vcpu_exit+0x48c/0x540
kvm_arch_vcpu_ioctl_run+0x37e/0xc80
The buggy address is located 0 bytes to the right of
allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)
Store the shared-memory size in size_t and reject multiplication overflow.
Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged
to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.
Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index
to match num_events.
Reported-by: Naveed Khan <naveed@digiscrypt.com>
Closes: https://lore.kernel.org/kvm/178345245327.72065.13249716450708539854@digiscrypt.com/
Fixes: e309fd113b9f ("RISC-V: KVM: Implement get event info function")
Cc: stable@vger.kernel.org
Signed-off-by: Guidong Han <2045gemini@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260730092533.1369531-1-2045gemini@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kvm/vcpu_pmu.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -12,7 +12,9 @@
#include <linux/err.h>
#include <linux/kvm_host.h>
#include <linux/nospec.h>
+#include <linux/overflow.h>
#include <linux/perf/riscv_pmu.h>
+#include <linux/slab.h>
#include <asm/csr.h>
#include <asm/kvm_isa.h>
#include <asm/kvm_vcpu_sbi.h>
@@ -479,13 +481,14 @@ int kvm_riscv_vcpu_pmu_event_info(struct
unsigned long flags, struct kvm_vcpu_sbi_return *retdata)
{
struct riscv_pmu_event_info *einfo = NULL;
- int shmem_size = num_events * sizeof(*einfo);
+ size_t shmem_size;
gpa_t shmem;
u32 eidx, etype;
u64 econfig;
int ret;
- if (flags != 0 || (saddr_low & (SZ_16 - 1) || num_events == 0)) {
+ if (flags != 0 || (saddr_low & (SZ_16 - 1)) || num_events == 0 ||
+ check_mul_overflow(num_events, sizeof(*einfo), &shmem_size)) {
ret = SBI_ERR_INVALID_PARAM;
goto out;
}
@@ -500,7 +503,8 @@ int kvm_riscv_vcpu_pmu_event_info(struct
}
}
- einfo = kzalloc(shmem_size, GFP_KERNEL);
+ einfo = kvcalloc(num_events, sizeof(*einfo),
+ GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
if (!einfo) {
ret = SBI_ERR_FAILURE;
goto out;
@@ -512,7 +516,7 @@ int kvm_riscv_vcpu_pmu_event_info(struct
goto free_mem;
}
- for (int i = 0; i < num_events; i++) {
+ for (unsigned long i = 0; i < num_events; i++) {
eidx = einfo[i].event_idx;
etype = kvm_pmu_get_perf_event_type(eidx);
econfig = kvm_pmu_get_perf_event_config(eidx, einfo[i].event_data);
@@ -525,7 +529,7 @@ int kvm_riscv_vcpu_pmu_event_info(struct
ret = SBI_ERR_INVALID_ADDRESS;
free_mem:
- kfree(einfo);
+ kvfree(einfo);
out:
retdata->err_val = ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 437/713] riscv: acpi: Handle LPI architectural context loss flags
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 436/713] RISC-V: KVM: Fix PMU event info array size overflow Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 438/713] riscv: unaligned: stop using kthread for check_vector_unaligned_access() Greg Kroah-Hartman
` (286 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Yixun Lan, Sunil V L,
Huisong Li, Peixin Xie, Paul Walmsley
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peixin Xie <peixin.xie@linux.spacemit.com>
commit 7e4cb63d61a7e0bef20f0d00e831c7fac06e4a1c upstream.
Commit 4785aa802853 ("cpuidle, ACPI: Evaluate LPI arch_flags for
broadcast timer") replaced the generic nonzero check for LPI
architectural context loss flags with arch_get_idle_state_flags().
RISC-V does not implement the helper, so it falls back to the stub
that returns 0. Consequently, CPUIDLE_FLAG_TIMER_STOP is not set when
an LPI state loses the hart timer context, preventing cpuidle from
using a broadcast timer for that state.
Implement the RISC-V helper and map the hart timer context loss flag
to CPUIDLE_FLAG_TIMER_STOP.
Fixes: 4785aa802853 ("cpuidle, ACPI: Evaluate LPI arch_flags for broadcast timer")
Cc: stable@vger.kernel.org
Acked-by: Sudeep Holla <sudeep.holla@kernel.org>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Reviewed-by: Sunil V L <sunilvl@oss.qualcomm.com>
Reviewed-by: Huisong Li <lihuisong@huawei.com>
Signed-off-by: Peixin Xie <peixin.xie@linux.spacemit.com>
Link: https://patch.msgid.link/20260803-riscv-acpi-lpi-timer-v3-1-520fa13732f5@linux.spacemit.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/acpi.h | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/arch/riscv/include/asm/acpi.h
+++ b/arch/riscv/include/asm/acpi.h
@@ -12,6 +12,8 @@
#ifndef _ASM_ACPI_H
#define _ASM_ACPI_H
+#include <linux/cpuidle.h>
+
/* Basic configuration for ACPI */
#ifdef CONFIG_ACPI
@@ -67,6 +69,23 @@ int acpi_get_riscv_isa(struct acpi_table
void acpi_get_cbo_block_size(struct acpi_table_header *table, u32 *cbom_size,
u32 *cboz_size, u32 *cbop_size);
+
+/*
+ * RISC-V Functional Fixed Hardware Specification Version v1.0.1,
+ * Chapter 3.1.2, Table 4: Arch. Context Lost Flags
+ */
+#define RISCV_LPI_HART_TIMER_CTXT_LOST BIT(0)
+
+static inline unsigned int arch_get_idle_state_flags(u32 arch_flags)
+{
+ if (arch_flags & RISCV_LPI_HART_TIMER_CTXT_LOST)
+ return CPUIDLE_FLAG_TIMER_STOP;
+
+ return 0;
+}
+
+#define arch_get_idle_state_flags arch_get_idle_state_flags
+
#else
static inline void acpi_init_rintc_map(void) { }
static inline struct acpi_madt_rintc *acpi_cpu_get_madt_rintc(int cpu)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 438/713] riscv: unaligned: stop using kthread for check_vector_unaligned_access()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 437/713] riscv: acpi: Handle LPI architectural context loss flags Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 439/713] remoteproc: scp: Fix device reference leak on failed lookup Greg Kroah-Hartman
` (285 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anirudh Srinivasan, Nam Cao,
Jesse Taube, Paul Walmsley
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit 34c9cfcde29b938c416924ee6ec3519270bc2238 upstream.
A kthread is used to run check_vector_unaligned_access() to optimize boot
time, allowing the kernel to continue booting without waiting for the
unaligned vector speed probe to finish.
However, this asynchronous approach introduces several complications.
First, the kthread may not complete before a user reads vDSO data,
resulting in incorrect values. This was previously addressed by
commit 5d15d2ad36b0 ("riscv: hwprobe: Fix stale vDSO data for
late-initialized keys at boot"), which added complex synchronization
between the kthread and vDSO reads.
Second, it was discovered that the kthread may not finish before
vec_check_unaligned_access_speed_all_cpus() (marked with __init) is freed,
triggering a page fault.
These issues raise the question of whether the kthread is worth the added
complexity. A past boot time regression report was actually unrelated to
synchronous probing; it was caused by the probe running serially. Since
switching to a parallel probe, no further complaints have been made.
Furthermore, the unaligned scalar access speed probe takes the same amount
of time, runs synchronously, and has caused no issues.
Testing shows no noticeable boot time slowdown when running the vector
probe synchronously (0.464474s with kthread vs. 0.457991s without).
Remove the kthread usage and run the probe synchronously. This simplifies
the boot flow and allows for the revert of commit 5d15d2ad36b0 ("riscv:
hwprobe: Fix stale vDSO data for late-initialized keys at boot")
Reported-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Closes: https://lore.kernel.org/linux-riscv/20260612-vec_unaligned_drop_init-v1-1-df969210ae34@oss.tenstorrent.com/
Fixes: e7c9d66e313b ("RISC-V: Report vector unaligned access speed hwprobe")
Cc: stable@vger.kernel.org
Signed-off-by: Nam Cao <namcao@linutronix.de>
Acked-by: Jesse Taube <jtaubepe@redhat.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Link: https://patch.msgid.link/1c378963f27c5960e8a57c50b8b444d30954cb54.1781666867.git.namcao@linutronix.de
[pjw@kernel.org: updated to apply; adjusted Fixes: tag; fixed my own manual patch application error]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/unaligned_access_speed.c | 19 ++-----------------
1 file changed, 2 insertions(+), 17 deletions(-)
--- a/arch/riscv/kernel/unaligned_access_speed.c
+++ b/arch/riscv/kernel/unaligned_access_speed.c
@@ -6,7 +6,6 @@
#include <linux/cpu.h>
#include <linux/cpumask.h>
#include <linux/jump_label.h>
-#include <linux/kthread.h>
#include <linux/mm.h>
#include <linux/smp.h>
#include <linux/types.h>
@@ -288,18 +287,9 @@ free:
__free_pages(page, MISALIGNED_BUFFER_ORDER);
}
-/* Measure unaligned access speed on all CPUs present at boot in parallel. */
-static int vec_check_unaligned_access_speed_all_cpus(void *unused __always_unused)
-{
- schedule_on_each_cpu(check_vector_unaligned_access);
- riscv_hwprobe_complete_async_probe();
-
- return 0;
-}
#else /* CONFIG_RISCV_PROBE_VECTOR_UNALIGNED_ACCESS */
-static int vec_check_unaligned_access_speed_all_cpus(void *unused __always_unused)
+static void check_vector_unaligned_access(struct work_struct *work __always_unused)
{
- return 0;
}
#endif
@@ -387,12 +377,7 @@ static int __init check_unaligned_access
per_cpu(vector_misaligned_access, cpu) = unaligned_vector_speed_param;
} else if (!check_vector_unaligned_access_emulated_all_cpus() &&
IS_ENABLED(CONFIG_RISCV_PROBE_VECTOR_UNALIGNED_ACCESS)) {
- riscv_hwprobe_register_async_probe();
- if (IS_ERR(kthread_run(vec_check_unaligned_access_speed_all_cpus,
- NULL, "vec_check_unaligned_access_speed_all_cpus"))) {
- pr_warn("Failed to create vec_unalign_check kthread\n");
- riscv_hwprobe_complete_async_probe();
- }
+ schedule_on_each_cpu(check_vector_unaligned_access);
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 439/713] remoteproc: scp: Fix device reference leak on failed lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 438/713] riscv: unaligned: stop using kthread for check_vector_unaligned_access() Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 440/713] ptp: vmclock: prevent read-only mappings from becoming writable Greg Kroah-Hartman
` (284 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Erin Lo, Johan Hovold,
Mathieu Poirier
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 22f9efb3ae07f966a1901d929d16df1388cce65c upstream.
Make sure to drop the reference taken to the SCP device when attempting
to look up its driver data before the driver has been bound.
Note that holding a reference to a device does not prevent its driver
data from going away.
Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183")
Cc: stable@vger.kernel.org # 5.6
Cc: Erin Lo <erin.lo@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20260706065614.389412-1-johan@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/mtk_scp.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -36,6 +36,7 @@ struct mtk_scp *scp_get(struct platform_
struct device *dev = &pdev->dev;
struct device_node *scp_node;
struct platform_device *scp_pdev;
+ struct mtk_scp *scp;
scp_node = of_parse_phandle(dev->of_node, "mediatek,scp", 0);
if (!scp_node) {
@@ -51,7 +52,13 @@ struct mtk_scp *scp_get(struct platform_
return NULL;
}
- return platform_get_drvdata(scp_pdev);
+ scp = platform_get_drvdata(scp_pdev);
+ if (!scp) {
+ put_device(&scp_pdev->dev);
+ return NULL;
+ }
+
+ return scp;
}
EXPORT_SYMBOL_GPL(scp_get);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 440/713] ptp: vmclock: prevent read-only mappings from becoming writable
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 439/713] remoteproc: scp: Fix device reference leak on failed lookup Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 441/713] qede: Fix NULL pointer dereference in TPA fragment processing Greg Kroah-Hartman
` (283 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
commit a5edadbae57e2298a56cf7a4e774a027905a331f upstream.
vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the
page read-only and then upgrade it to writable with mprotect(), after
which the guest can corrupt the host-written timekeeping data (sequence
counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.
Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 does for its read-only objects and as fixed in drm/vc4
(CVE-2026-68445) and drm/panthor (CVE-2024-53071).
Cc: stable@vger.kernel.org
Fixes: 205032724226 ("ptp: Add support for the AMZNC10C 'vmclock' device")
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Link: https://patch.msgid.link/20260813174707.14809-1-suruurism@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ptp/ptp_vmclock.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/ptp/ptp_vmclock.c
+++ b/drivers/ptp/ptp_vmclock.c
@@ -378,6 +378,12 @@ static int vmclock_miscdev_mmap(struct f
*/
vm_flags_clear(vma, VM_MAYWRITE);
+ /*
+ * Restrict the read-only mapping so it cannot be upgraded to
+ * writable later with mprotect().
+ */
+ vm_flags_clear(vma, VM_MAYWRITE);
+
if (vma->vm_end - vma->vm_start != PAGE_SIZE || vma->vm_pgoff)
return -EINVAL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 441/713] qede: Fix NULL pointer dereference in TPA fragment processing
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 440/713] ptp: vmclock: prevent read-only mappings from becoming writable Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 442/713] RDMA/cxgb4: Cancel reg_work before freeing device on remove Greg Kroah-Hartman
` (282 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vaibhav Nagare, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Nagare <nagarevaibhav@gmail.com>
commit 06aa3d26327f24edd039ff249672fdf6f2ba5695 upstream.
Under memory pressure, the qede driver encounters NULL pointer
dereferences when processing TPA continuation fragments.
Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally
dropped the assignment of tpa_info->buffer.data in qede_tpa_start().
When memory pressure causes an SKB allocation failure in qede_tpa_start(),
the driver sets tpa_start_fail = true and attempts to recycle the physical
page later in qede_tpa_end() via qede_reuse_page(). However, because
buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
"ghost" BD (valid DMA mapping but NULL data pointer) back into the
active Rx ring.
The next time the hardware uses this ring slot, it passes a NULL page
to qede_fill_frag_skb(), causing a kernel panic.
Example crash from production system:
BUG: unable to handle kernel NULL pointer dereference at 0x8
RIP: qede_fill_frag_skb+0x96/0x430 [qede]
Call Trace:
qede_rx_int+0xb06/0x1de0
qede_poll+0x2f4/0x6c0
__napi_poll+0x2d/0x130
Fix the root cause by restoring the tpa_info->buffer.data assignment
in qede_tpa_start(), ensuring valid pages are correctly tracked and
recycled. Additionally, update the stale comment for
struct qede_agg_info::buffer to reflect its current usage.
Fixes: 8a8633978b84 ("qede: Add build_skb() support.")
Cc: stable@vger.kernel.org
Signed-off-by: Vaibhav Nagare <vnagare@redhat.com>
Link: https://patch.msgid.link/20260818073309.2266072-1-vnagare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qede/qede.h | 8 ++++----
drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 +
2 files changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/qlogic/qede/qede.h
+++ b/drivers/net/ethernet/qlogic/qede/qede.h
@@ -303,10 +303,10 @@ enum qede_agg_state {
};
struct qede_agg_info {
- /* rx_buf is a data buffer that can be placed / consumed from rx bd
- * chain. It has two purposes: We will preallocate the data buffer
- * for each aggregation when we open the interface and will place this
- * buffer on the rx-bd-ring when we receive TPA_START. We don't want
+ /* buffer is used to retain the Rx consumer descriptor when a TPA
+ * session starts. If the SKB allocation fails during TPA_START,
+ * we use this saved buffer to safely recycle the physical page
+ * back into the rx-bd-ring via qede_reuse_page(). We don't want
* to be in a state where allocation fails, as we can't reuse the
* consumer buffer in the rx-chain since FW may still be writing to it
* (since header needs to be modified for TPA).
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -850,6 +850,7 @@ static void qede_tpa_start(struct qede_d
pad, false);
tpa_info->buffer.page_offset = sw_rx_data_cons->page_offset;
tpa_info->buffer.mapping = sw_rx_data_cons->mapping;
+ tpa_info->buffer.data = sw_rx_data_cons->data;
if (unlikely(!tpa_info->skb)) {
DP_NOTICE(edev, "Failed to allocate SKB for gro\n");
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 442/713] RDMA/cxgb4: Cancel reg_work before freeing device on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 441/713] qede: Fix NULL pointer dereference in TPA fragment processing Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 443/713] RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budget Greg Kroah-Hartman
` (281 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit a7100601aa1a39f799a566acce10db20eaf4b7f2 upstream.
c4iw_uld_state_change() queues reg_work to register the RDMA device.
c4iw_remove() can free ctx->dev while this work is pending or running,
leaving c4iw_register_device() accessing the freed device.
Cancel reg_work before removing the device. The registration work can
tear down ctx->dev when registration fails, so do not unregister or
deallocate it again in that case.
This issue was found by an in-house static analysis tool.
Fixes: 1c8f1da5d851 ("iw_cxgb4: Fix possible circular dependency locking warning")
Link: https://patch.msgid.link/r/20260806130128.465460-1-fanwu01@zju.edu.cn
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/cxgb4/device.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -951,6 +951,12 @@ void c4iw_dealloc(struct uld_ctx *ctx)
static void c4iw_remove(struct uld_ctx *ctx)
{
pr_debug("c4iw_dev %p\n", ctx->dev);
+
+ /* c4iw_register_device() may still be using ctx->dev. */
+ cancel_work_sync(&ctx->reg_work);
+ if (!ctx->dev)
+ return;
+
debugfs_remove_recursive(ctx->dev->debugfs_root);
c4iw_unregister_device(ctx->dev);
c4iw_dealloc(ctx);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 443/713] RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budget
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 442/713] RDMA/cxgb4: Cancel reg_work before freeing device on remove Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 444/713] RDMA/ionic: Embed counter driver data in rdma_counter allocation Greg Kroah-Hartman
` (280 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brett Creeley, Abhijit Gangurde,
Leon Romanovsky
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Creeley <brett.creeley@amd.com>
commit 1d0f877d593438a494ca5b05cc8699150409005a upstream.
ionic_fill_lif_cfg() reads eq_count from firmware uncapped, but the
eth driver only reserves ionic->neqs_per_lif MSI-X vectors for RDMA
event queues. Since ionic_rdma probes via the auxiliary bus before
the netdev is brought up, it can exhaust the shared interrupt bitmap,
causing ionic_open() to fail with -ENOSPC when allocating rx/tx
interrupts.
Cap RDMA eq_count to neqs_per_lif, which is populated by
ionic_lif_size() at PCI probe before the RDMA aux device registers.
Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter")
Cc: stable@vger.kernel.org
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com>
Link: https://patch.msgid.link/20260805053254.4023262-1-abhijit.gangurde@amd.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/ionic/ionic_lif_cfg.c
+++ b/drivers/infiniband/hw/ionic/ionic_lif_cfg.c
@@ -70,7 +70,7 @@ void ionic_fill_lif_cfg(struct ionic_lif
* eq_count is tunable; see ionic_eq_count
*/
cfg->aq_count = le32_to_cpu(ident->rdma.aq_qtype.qid_count);
- cfg->eq_count = le32_to_cpu(ident->rdma.eq_qtype.qid_count);
+ cfg->eq_count = lif->ionic->neqs_per_lif;
cfg->cq_count = le32_to_cpu(ident->rdma.cq_qtype.qid_count);
cfg->qp_count = le32_to_cpu(ident->rdma.sq_qtype.qid_count);
cfg->dbid_count = le32_to_cpu(lif->ionic->ident.dev.ndbpgs_per_lif);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 444/713] RDMA/ionic: Embed counter driver data in rdma_counter allocation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 443/713] RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budget Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 445/713] RDMA/ucma: Lock the handler in ucma_set_ib_path() Greg Kroah-Hartman
` (279 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abhijit Gangurde, Leon Romanovsky
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhijit Gangurde <abhijit.gangurde@amd.com>
commit cf3ebd89e754015625fee90aa938f6bc79a2c974 upstream.
Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using
rdma_zalloc_drv_obj()") requires drivers implementing counter ops to
embed struct rdma_counter in a driver-specific struct, register its size
via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback.
The ionic driver was merged without this adaptation, causing a NULL
pointer dereference in alloc_and_bind() since rdma_zalloc_drv_obj()
allocates zero bytes when size_rdma_counter is unset.
Consolidate struct ionic_counter into a new struct ionic_rdma_counter
that embeds struct rdma_counter, replace the xarray with a lightweight
ida for ID allocation, and add the required counter_init and
INIT_RDMA_OBJ_SIZE declarations.
Fixes: ea4c399642b8 ("RDMA/ionic: Implement device stats ops")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com>
Link: https://patch.msgid.link/20260805053254.4023262-2-abhijit.gangurde@amd.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/ionic/ionic_hw_stats.c | 101 ++++++++++++---------------
drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 ++
2 files changed, 54 insertions(+), 58 deletions(-)
--- a/drivers/infiniband/hw/ionic/ionic_hw_stats.c
+++ b/drivers/infiniband/hw/ionic/ionic_hw_stats.c
@@ -235,35 +235,34 @@ err_dma:
static struct rdma_hw_stats *
ionic_counter_alloc_stats(struct rdma_counter *counter)
{
+ struct ionic_rdma_counter *cntr = to_ionic_rdma_counter(counter);
struct ionic_ibdev *dev = to_ionic_ibdev(counter->device);
- struct ionic_counter *cntr;
- int err;
+ struct rdma_hw_stats *stats;
+ int id;
- cntr = kzalloc_obj(*cntr);
- if (!cntr)
- return NULL;
-
- /* buffer for current values from the device */
cntr->vals = kzalloc(PAGE_SIZE, GFP_KERNEL);
if (!cntr->vals)
- goto err_vals;
-
- err = xa_alloc(&dev->counter_stats->xa_counters, &counter->id,
- cntr,
- XA_LIMIT(0, IONIC_MAX_QPID),
- GFP_KERNEL);
- if (err)
- goto err_xa;
-
- INIT_LIST_HEAD(&cntr->qp_list);
+ return NULL;
- return rdma_alloc_hw_stats_struct(dev->counter_stats->stats_hdrs,
- dev->counter_stats->queue_stats_count,
- RDMA_HW_STATS_DEFAULT_LIFESPAN);
-err_xa:
+ id = ida_alloc_max(&dev->counter_stats->counter_ida,
+ IONIC_MAX_QPID, GFP_KERNEL);
+ if (id < 0)
+ goto err_ida;
+
+ counter->id = id;
+
+ stats = rdma_alloc_hw_stats_struct(dev->counter_stats->stats_hdrs,
+ dev->counter_stats->queue_stats_count,
+ RDMA_HW_STATS_DEFAULT_LIFESPAN);
+ if (!stats)
+ goto err_hw_stats;
+
+ return stats;
+
+err_hw_stats:
+ ida_free(&dev->counter_stats->counter_ida, id);
+err_ida:
kfree(cntr->vals);
-err_vals:
- kfree(cntr);
return NULL;
}
@@ -271,14 +270,10 @@ err_vals:
static int ionic_counter_dealloc(struct rdma_counter *counter)
{
struct ionic_ibdev *dev = to_ionic_ibdev(counter->device);
- struct ionic_counter *cntr;
-
- cntr = xa_erase(&dev->counter_stats->xa_counters, counter->id);
- if (!cntr)
- return -EINVAL;
+ struct ionic_rdma_counter *cntr = to_ionic_rdma_counter(counter);
+ ida_free(&dev->counter_stats->counter_ida, counter->id);
kfree(cntr->vals);
- kfree(cntr);
return 0;
}
@@ -287,13 +282,8 @@ static int ionic_counter_bind_qp(struct
struct ib_qp *ibqp,
u32 port)
{
- struct ionic_ibdev *dev = to_ionic_ibdev(counter->device);
+ struct ionic_rdma_counter *cntr = to_ionic_rdma_counter(counter);
struct ionic_qp *qp = to_ionic_qp(ibqp);
- struct ionic_counter *cntr;
-
- cntr = xa_load(&dev->counter_stats->xa_counters, counter->id);
- if (!cntr)
- return -EINVAL;
list_add_tail(&qp->qp_list_counter, &cntr->qp_list);
ibqp->counter = counter;
@@ -313,29 +303,23 @@ static int ionic_counter_unbind_qp(struc
return 0;
}
-static int ionic_get_qp_stats(struct ib_device *ibdev,
- struct rdma_hw_stats *hw_stats,
- u32 counter_id)
-{
- struct ionic_ibdev *dev = to_ionic_ibdev(ibdev);
- struct ionic_counter_stats *cs;
- struct ionic_counter *cntr;
+static int ionic_counter_update_stats(struct rdma_counter *counter)
+{
+ struct ionic_rdma_counter *cntr = to_ionic_rdma_counter(counter);
+ struct ionic_ibdev *dev = to_ionic_ibdev(counter->device);
+ struct ionic_counter_stats *cs = dev->counter_stats;
dma_addr_t hw_stats_dma;
struct ionic_qp *qp;
int rc, stat_i = 0;
- cs = dev->counter_stats;
- cntr = xa_load(&cs->xa_counters, counter_id);
- if (!cntr)
- return -EINVAL;
-
hw_stats_dma = dma_map_single(dev->lif_cfg.hwdev, cntr->vals,
PAGE_SIZE, DMA_FROM_DEVICE);
rc = dma_mapping_error(dev->lif_cfg.hwdev, hw_stats_dma);
if (rc)
return rc;
- memset(hw_stats->value, 0, sizeof(u64) * hw_stats->num_counters);
+ memset(counter->stats->value, 0,
+ sizeof(u64) * counter->stats->num_counters);
list_for_each_entry(qp, &cntr->qp_list, qp_list_counter) {
rc = ionic_hw_stats_cmd(dev, hw_stats_dma, PAGE_SIZE,
@@ -345,7 +329,7 @@ static int ionic_get_qp_stats(struct ib_
goto err_cmd;
for (stat_i = 0; stat_i < cs->queue_stats_count; ++stat_i)
- hw_stats->value[stat_i] +=
+ counter->stats->value[stat_i] +=
ionic_v1_stat_val(&cs->hdr[stat_i],
cntr->vals,
PAGE_SIZE);
@@ -360,11 +344,6 @@ err_cmd:
return rc;
}
-static int ionic_counter_update_stats(struct rdma_counter *counter)
-{
- return ionic_get_qp_stats(counter->device, counter->stats, counter->id);
-}
-
static int ionic_alloc_counters(struct ionic_ibdev *dev)
{
struct ionic_counter_stats *cs = dev->counter_stats;
@@ -424,12 +403,22 @@ static const struct ib_device_ops ionic_
.get_hw_stats = ionic_get_hw_stats,
};
+static void ionic_counter_init(struct rdma_counter *counter)
+{
+ struct ionic_rdma_counter *cntr = to_ionic_rdma_counter(counter);
+
+ INIT_LIST_HEAD(&cntr->qp_list);
+}
+
static const struct ib_device_ops ionic_counter_stats_ops = {
.counter_alloc_stats = ionic_counter_alloc_stats,
.counter_dealloc = ionic_counter_dealloc,
.counter_bind_qp = ionic_counter_bind_qp,
.counter_unbind_qp = ionic_counter_unbind_qp,
.counter_update_stats = ionic_counter_update_stats,
+ .counter_init = ionic_counter_init,
+
+ INIT_RDMA_OBJ_SIZE(rdma_counter, ionic_rdma_counter, rdma_counter),
};
void ionic_stats_init(struct ionic_ibdev *dev)
@@ -458,7 +447,7 @@ void ionic_stats_init(struct ionic_ibdev
return;
}
- xa_init_flags(&dev->counter_stats->xa_counters, XA_FLAGS_ALLOC);
+ ida_init(&dev->counter_stats->counter_ida);
ib_set_device_ops(&dev->ibdev, &ionic_counter_stats_ops);
}
@@ -467,7 +456,7 @@ void ionic_stats_init(struct ionic_ibdev
void ionic_stats_cleanup(struct ionic_ibdev *dev)
{
if (dev->counter_stats) {
- xa_destroy(&dev->counter_stats->xa_counters);
+ ida_destroy(&dev->counter_stats->counter_ida);
kfree(dev->counter_stats->hdr);
kfree(dev->counter_stats->stats_hdrs);
kfree(dev->counter_stats);
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.h
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.h
@@ -331,14 +331,21 @@ struct ionic_counter_stats {
int queue_stats_count;
struct ionic_v1_stat *hdr;
struct rdma_stat_desc *stats_hdrs;
- struct xarray xa_counters;
+ struct ida counter_ida;
};
-struct ionic_counter {
+struct ionic_rdma_counter {
+ struct rdma_counter rdma_counter;
void *vals;
struct list_head qp_list;
};
+static inline struct ionic_rdma_counter *
+to_ionic_rdma_counter(struct rdma_counter *counter)
+{
+ return container_of(counter, struct ionic_rdma_counter, rdma_counter);
+}
+
static inline struct ionic_ibdev *to_ionic_ibdev(struct ib_device *ibdev)
{
return container_of(ibdev, struct ionic_ibdev, ibdev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 445/713] RDMA/ucma: Lock the handler in ucma_set_ib_path()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 444/713] RDMA/ionic: Embed counter driver data in rdma_counter allocation Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 446/713] RDMA/ucma: Lock the handler in ucma_write_cm_event() Greg Kroah-Hartman
` (278 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Norbert Szetei, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
commit ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820 upstream.
ucma_set_ib_path() calls ucma_event_handler() straight from the write()
path, without the handler lock that keeps ctx->file stable while a uevent
is queued. The handler re-reads ctx->file for every dereference:
mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */
A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION
caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's
event_list while only file A's mutex is held, racing every other user of
that list:
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0
Read of size 8 at addr ffff888153c6a418 by task poc_corr/486
Call Trace:
__list_add_valid_or_report+0x1aa/0x1c0
ucma_event_handler+0x1be/0xc00
ucma_set_ib_path+0x45e/0x710
ucma_set_option+0x32e/0x590
ucma_write+0x1f9/0x330
Allocated by task 505:
ucma_write_cm_event+0x1a1/0x660
Freed by task 505:
kfree+0x1da/0x4c0
ucma_get_event+0x5d5/0x7e0
The freed object is a ucma_event that another thread dequeued from file B's
list under file B's mutex. File A's mut is left held on top of that,
wedging its next writer in uninterruptible sleep.
This path needs a bound and address-resolved cm_id, so it requires an RDMA
device to be present.
Take the handler lock around the call.
Fixes: 09e328e47a69 ("RDMA/ucma: Fix the locking of ctx->file")
Link: https://patch.msgid.link/r/2823D190-92D5-4714-8769-4FB643C64FF3@doyensec.com
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1404,7 +1404,10 @@ static int ucma_set_ib_path(struct ucma_
memset(&event, 0, sizeof event);
event.event = RDMA_CM_EVENT_ROUTE_RESOLVED;
- return ucma_event_handler(ctx->cm_id, &event);
+ rdma_lock_handler(ctx->cm_id);
+ ret = ucma_event_handler(ctx->cm_id, &event);
+ rdma_unlock_handler(ctx->cm_id);
+ return ret;
}
static int ucma_set_option_ib(struct ucma_context *ctx, int optname,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 446/713] RDMA/ucma: Lock the handler in ucma_write_cm_event()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 445/713] RDMA/ucma: Lock the handler in ucma_set_ib_path() Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 447/713] RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Greg Kroah-Hartman
` (277 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Norbert Szetei, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
commit f4cc21c6a8e9d392871477f9fd98d68e5ad80272 upstream.
ctx->file may only be changed under the handler lock and the xa_lock, which
is what stops uevents being queued for a ctx while ucma_migrate_id() moves
it to another file. The CM core takes that lock before invoking
ucma_event_handler(), but the write() paths that queue uevents themselves
do not.
ucma_write_cm_event() re-reads ctx->file for each of its four dereferences,
so ucma_migrate_id() can swap it mid-sequence:
mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */
The window is the mutex_lock() itself: the writer sleeps in it while the
migration reassigns ctx->file. The list_add_tail() then runs on file B's
event_list holding only file A's mutex:
list_add corruption. prev->next should be next (ffff888101320f30),
but was ffff88814a08c418. (prev=ffff88814a075c18).
kernel BUG at lib/list_debug.c:32!
Call Trace:
ucma_write_cm_event+0x36e/0x5e0
and file A's mut is left held forever, wedging its next writer in D state.
The uevent is also stranded on a list ucma_cleanup_ctx_events() will not
walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no
RDMA device is involved, so an unprivileged user reaches all of this.
Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
pinned by the ucma_get_ctx() reference.
Fixes: a3c9d0fcd371 ("RDMA/ucma: Support write an event into a CM")
Link: https://patch.msgid.link/r/60544A67-EFD6-4D5D-974C-D983445F1070@doyensec.com
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1779,6 +1779,13 @@ static ssize_t ucma_write_cm_event(struc
goto out;
}
+ rdma_lock_handler(ctx->cm_id);
+ if (!ctx->uid) {
+ kfree(uevent);
+ ret = -EINVAL;
+ goto err_unlock;
+ }
+
uevent->ctx = ctx;
uevent->resp.uid = ctx->uid;
uevent->resp.id = ctx->id;
@@ -1792,6 +1799,8 @@ static ssize_t ucma_write_cm_event(struc
mutex_unlock(&ctx->file->mut);
wake_up_interruptible(&ctx->file->poll_wait);
+err_unlock:
+ rdma_unlock_handler(ctx->cm_id);
out:
ucma_put_ctx(ctx);
return ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 447/713] RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 446/713] RDMA/ucma: Lock the handler in ucma_write_cm_event() Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 448/713] RDMA/uverbs: Guard legacy bundles without method_elm Greg Kroah-Hartman
` (276 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
commit 011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf upstream.
The original commit missed that three drivers (mthca, irdma, siw) have UHW
data associated with reg_mr that cannot be passed through the ioctl. They
also assume that the udata cannot be NULL, so failing to pass a valid
udata can trigger a NULL udata crash in those drivers.
This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex()
does not accept a udata and those three drivers don't use it, however a
malicious userspace could trigger it.
Cc: stable@vger.kernel.org
Fixes: 5b2e45049dc0 ("IB/core: Add UVERBS_METHOD_REG_MR on the MR object")
Reported-by: Jacob Moroni <jmoroni@google.com>
Closes: https://lore.kernel.org/all/CAHYDg1TOGxRGZrS69d4Y--Shj_DZv0nJuM73iHUBwBM70g_t3Q@mail.gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_std_types_mr.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/core/uverbs_std_types_mr.c
+++ b/drivers/infiniband/core/uverbs_std_types_mr.c
@@ -364,7 +364,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_
dmah, attrs);
else
mr = pd->device->ops.reg_user_mr(pd, addr, length, iova,
- access_flags, dmah, NULL);
+ access_flags, dmah,
+ &attrs->driver_udata);
if (IS_ERR(mr))
return PTR_ERR(mr);
@@ -527,7 +528,8 @@ DECLARE_UVERBS_NAMED_METHOD(
UA_MANDATORY),
UVERBS_ATTR_PTR_OUT(UVERBS_ATTR_REG_MR_RESP_RKEY,
UVERBS_ATTR_TYPE(u32),
- UA_MANDATORY));
+ UA_MANDATORY),
+ UVERBS_ATTR_UHW());
DECLARE_UVERBS_NAMED_METHOD_DESTROY(
UVERBS_METHOD_MR_DESTROY,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 448/713] RDMA/uverbs: Guard legacy bundles without method_elm
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 447/713] RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 449/713] regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Greg Kroah-Hartman
` (275 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhang Pan, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhang Pan <242270054@hdu.edu.cn>
commit 60a42d510113f46de47e86a84bf5758597644487 upstream.
The legacy write() path dispatches through a uverbs_api_write_method, but
the uverbs_attr_bundle passed to provider code does not have an ioctl
method element. If malformed provider input causes the common uverbs
validation code to emit an error message, uverbs_get_handler_fn()
dereferences the uninitialized method_elm pointer.
Initialize method_elm explicitly for legacy bundles and make
uverbs_get_handler_fn() return NULL when no ioctl method is present. The
legacy dispatcher continues to use its local write method, while the ioctl
path continues to use the registered ioctl handler.
Cc: stable@vger.kernel.org
Fixes: 7122ff96068a ("RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()")
Link: https://patch.msgid.link/r/AOYAQgCQK3IXqJLr1TB5Qao9.1.1787036796115.Hmail.242270054@hdu.edu.cn
Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ib_core_uverbs.c | 3 +++
drivers/infiniband/core/uverbs_main.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/infiniband/core/ib_core_uverbs.c b/drivers/infiniband/core/ib_core_uverbs.c
index dbbc0875132a..41c84ffe8c09 100644
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -424,6 +424,9 @@ static uverbs_api_ioctl_handler_fn uverbs_get_handler_fn(struct ib_udata *udata)
lockdep_assert_held(&bundle->ufile->device->disassociate_srcu);
+ if (!bundle->method_elm)
+ return NULL;
+
return srcu_dereference(bundle->method_elm->handler,
&bundle->ufile->device->disassociate_srcu);
}
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 3ccf58e96aed..0d88b2ee68ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -556,6 +556,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
bundle.ufile = file;
bundle.context = NULL; /* only valid if bundle has uobject */
bundle.uobject = NULL;
+ bundle.method_elm = NULL;
if (!method_elm->is_ex) {
size_t in_len = hdr.in_words * 4 - sizeof(hdr);
size_t out_len = hdr.out_words * 4;
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 449/713] regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 448/713] RDMA/uverbs: Guard legacy bundles without method_elm Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 450/713] regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata Greg Kroah-Hartman
` (274 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Mark Brown
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c upstream.
In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a
reference on np, which is then assigned to pdev->dev.of_node. The
function immediately calls of_node_put(np), releasing the reference and
leaving pdev->dev.of_node as a dangling pointer.
Remove the of_node_put(np) call to let the device hold the reference.
Cc: stable@vger.kernel.org
Fixes: bc407334e9a6 ("regulator: as3722: add regulator driver for AMS AS3722")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260626160150.54291-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/as3722-regulator.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -600,7 +600,6 @@ static int as3722_get_regulator_dt_data(
ret = of_regulator_match(&pdev->dev, np, as3722_regulator_matches,
ARRAY_SIZE(as3722_regulator_matches));
- of_node_put(np);
if (ret < 0) {
dev_err(&pdev->dev, "Parsing of regulator node failed: %d\n",
ret);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 450/713] regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 449/713] regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 451/713] regulator: qcom-refgen: correct the regulator type to CURRENT Greg Kroah-Hartman
` (273 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Mark Brown
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 7c8cc25d8d86f9eb3979255935cfdc7d062ad746 upstream.
In max8998_pmic_dt_parse_pdata(), of_get_child_by_name() acquires a
reference on reg_np which is then stored in rdata->reg_node, transferring
ownership to the regulator data array. The subsequent of_node_put(reg_np)
at the end of the function releases the last matched regulator node's
reference, leaving rdata->reg_node as a dangling pointer for the last
entry.
Remove the spurious of_node_put(reg_np) call.
Cc: stable@vger.kernel.org
Fixes: 156f252857df ("drivers: regulator: add Maxim 8998 driver")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260626160326.54457-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/max8998.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -582,7 +582,6 @@ static int max8998_pmic_dt_parse_pdata(s
}
pdata->num_regulators = rdata - pdata->regulators;
- of_node_put(reg_np);
of_node_put(regulators_np);
pdata->buck_voltage_lock = of_property_read_bool(pmic_np, "max8998,pmic-buck-voltage-lock");
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 451/713] regulator: qcom-refgen: correct the regulator type to CURRENT
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 450/713] regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata Greg Kroah-Hartman
@ 2026-09-04 4:56 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 452/713] ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Greg Kroah-Hartman
` (272 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio,
Kathiravan Thirumoorthy, Mark Brown
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
commit 05dfeb2d0ccf87a7b92cd149a393b8423a26a04e upstream.
As per the REFGEN IP team, this block supplies the reference current to
the PHYs in the SoC. So, correct the regulator type to REGULATOR_CURRENT
to match with the HW behavior.
Fixes: 7cbfbe237960 ("regulator: Introduce Qualcomm REFGEN regulator driver")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://patch.msgid.link/20260617-ipq9650_refgen-v4-1-c505ea6c6661@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/qcom-refgen-regulator.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/regulator/qcom-refgen-regulator.c
+++ b/drivers/regulator/qcom-refgen-regulator.c
@@ -66,7 +66,7 @@ static const struct regulator_desc sdm84
.enable_time = 5,
.name = "refgen",
.owner = THIS_MODULE,
- .type = REGULATOR_VOLTAGE,
+ .type = REGULATOR_CURRENT,
.ops = &(const struct regulator_ops) {
.enable = qcom_sdm845_refgen_enable,
.disable = qcom_sdm845_refgen_disable,
@@ -82,7 +82,7 @@ static const struct regulator_desc sm825
.enable_time = 5,
.name = "refgen",
.owner = THIS_MODULE,
- .type = REGULATOR_VOLTAGE,
+ .type = REGULATOR_CURRENT,
.ops = &(const struct regulator_ops) {
.enable = regulator_enable_regmap,
.disable = regulator_disable_regmap,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 452/713] ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-09-04 4:56 ` [PATCH 7.2 451/713] regulator: qcom-refgen: correct the regulator type to CURRENT Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 453/713] ring-buffer: Free cpu_buffer::free_page with subbuf_order Greg Kroah-Hartman
` (271 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Vincent Donnefort,
Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
commit e743527c5bfdceda1095bc0a9e596e2aebb6a9c3 upstream.
ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,
it can allocate a reader page with an outdated order. This isn't a big
issue, the user can still re-allocate a new reader page and try again.
However, what is more problematic is if the value of subbuf_order
changes in the middle of ring_buffer_alloc_read_page(). In that case,
bpage->order might not match the actual allocated memory.
Use bpage->order for the allocation to prevent this race.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260813131152.3589632-6-vdonnefort@google.com
Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7018,7 +7018,7 @@ ring_buffer_alloc_read_page(struct trace
if (bpage->data) {
rb_init_data_page(bpage->data);
} else {
- bpage->data = alloc_cpu_data(cpu, cpu_buffer->buffer->subbuf_order);
+ bpage->data = alloc_cpu_data(cpu, bpage->order);
if (!bpage->data) {
kfree(bpage);
return ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 453/713] ring-buffer: Free cpu_buffer::free_page with subbuf_order
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 452/713] ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 454/713] ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Greg Kroah-Hartman
` (270 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Vincent Donnefort,
Masami Hiramatsu (Google), Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
commit 234b1a72e9706fe20c08c96f4374ec8e83b934cb upstream.
When sub-buffers use an order greater than 0, cpu_buffer->free_page is
allocated with subbuf_order. Use the correct order for
cpu_buffer->free_page.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260813131152.3589632-2-vdonnefort@google.com
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260806211306.3704194-1-vdonnefort%40google.com # patch 3
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2672,7 +2672,7 @@ static void rb_free_cpu_buffer(struct ri
free_buffer_page(bpage);
}
- free_page((unsigned long)cpu_buffer->free_page);
+ free_pages((unsigned long)cpu_buffer->free_page, cpu_buffer->buffer->subbuf_order);
kfree(cpu_buffer);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 454/713] ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 453/713] ring-buffer: Free cpu_buffer::free_page with subbuf_order Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 455/713] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Greg Kroah-Hartman
` (269 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Vincent Donnefort,
Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
commit 24974bd0da1b47fd56c975533ead50abf754e74d upstream.
Because, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page,
hold cpu_buffer->lock to prevent races with
ring_buffer_alloc_read_page() and ring_buffer_free_read_page().
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260813131152.3589632-3-vdonnefort@google.com
Fixes: 8e7b58c27b3c ("ring-buffer: Just update the subbuffers when changing their allocation order")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260810125633.3344684-1-vdonnefort%40google.com # patch 3
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7477,8 +7477,10 @@ int ring_buffer_subbuf_order_set(struct
cpu_buffer->nr_pages = cpu_buffer->nr_pages_to_update;
cpu_buffer->nr_pages_to_update = 0;
+ arch_spin_lock(&cpu_buffer->lock);
old_free_data_page = cpu_buffer->free_page;
cpu_buffer->free_page = NULL;
+ arch_spin_unlock(&cpu_buffer->lock);
rb_head_page_activate(cpu_buffer);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 455/713] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 454/713] ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 456/713] ring-buffer: Stop remote reader update when page swap fails Greg Kroah-Hartman
` (268 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Donnefort, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
commit 7a1fb95de5404134f8758c1295ce88986bdf117c upstream.
Discarding a cached reader page after a concurrent ring buffer resize
uses the new global subbuf_order for the free_pages() call. This
mismatched order may crashes the kernel or leaks memory because the cached
page was allocated under the old size.
Save the actual free_page order alongside the page address to ensure we
always refer to the correct value and do not rely on the potentially
stalled cpu_buffer->subbuf_order value. The simplest is to make
free_page a buffer_data_read_page which already covers exactly what we
need: a page address and a page order.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260813131152.3589632-4-vdonnefort@google.com
Fixes: 8e7b58c27b3c ("ring-buffer: Just update the subbuffers when changing their allocation order")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -518,7 +518,7 @@ struct ring_buffer_per_cpu {
raw_spinlock_t reader_lock; /* serialize readers */
arch_spinlock_t lock;
struct lock_class_key lock_key;
- struct buffer_data_page *free_page;
+ struct buffer_data_read_page free_page;
unsigned long nr_pages;
unsigned int current_context;
struct list_head *pages;
@@ -2672,7 +2672,7 @@ static void rb_free_cpu_buffer(struct ri
free_buffer_page(bpage);
}
- free_pages((unsigned long)cpu_buffer->free_page, cpu_buffer->buffer->subbuf_order);
+ free_pages((unsigned long)cpu_buffer->free_page.data, cpu_buffer->free_page.order);
kfree(cpu_buffer);
}
@@ -7007,9 +7007,9 @@ ring_buffer_alloc_read_page(struct trace
local_irq_save(flags);
arch_spin_lock(&cpu_buffer->lock);
- if (cpu_buffer->free_page) {
- bpage->data = cpu_buffer->free_page;
- cpu_buffer->free_page = NULL;
+ if (cpu_buffer->free_page.data) {
+ *bpage = cpu_buffer->free_page;
+ cpu_buffer->free_page.data = NULL;
}
arch_spin_unlock(&cpu_buffer->lock);
@@ -7061,8 +7061,8 @@ void ring_buffer_free_read_page(struct t
local_irq_save(flags);
arch_spin_lock(&cpu_buffer->lock);
- if (!cpu_buffer->free_page) {
- cpu_buffer->free_page = dpage;
+ if (!cpu_buffer->free_page.data) {
+ cpu_buffer->free_page = *data_page;
dpage = NULL;
}
@@ -7436,7 +7436,7 @@ int ring_buffer_subbuf_order_set(struct
}
for_each_buffer_cpu(buffer, cpu) {
- struct buffer_data_page *old_free_data_page;
+ struct buffer_data_read_page old_free_data_page;
struct list_head old_pages;
unsigned long flags;
@@ -7479,7 +7479,7 @@ int ring_buffer_subbuf_order_set(struct
arch_spin_lock(&cpu_buffer->lock);
old_free_data_page = cpu_buffer->free_page;
- cpu_buffer->free_page = NULL;
+ cpu_buffer->free_page.data = NULL;
arch_spin_unlock(&cpu_buffer->lock);
rb_head_page_activate(cpu_buffer);
@@ -7491,7 +7491,7 @@ int ring_buffer_subbuf_order_set(struct
list_del_init(&bpage->list);
free_buffer_page(bpage);
}
- free_pages((unsigned long)old_free_data_page, old_order);
+ free_pages((unsigned long)old_free_data_page.data, old_free_data_page.order);
rb_check_pages(cpu_buffer);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 456/713] ring-buffer: Stop remote reader update when page swap fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 455/713] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 457/713] PM: sleep: Unblock runtime PM when device prepare fails Greg Kroah-Hartman
` (267 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivan Immanuel Shaji, Steven Rostedt
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
commit 5eab74874d11160725c42ab676ba97a797a362eb upstream.
The remote swap_reader_page callback can return -EBUSY when the writer
moves the head before the remote catches it, particularly during an event
storm on a small buffer. __rb_get_reader_page_from_remote() currently
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.
Handle the callback failure as a recoverable error. Report it with
pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader
page as a failed attempt. This avoids splicing the same page as both the
previous and new reader without flooding the log under contention.
Cc: stable@vger.kernel.org
Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Link: https://patch.msgid.link/20260825-kernel-patch-1-v2-2-bb3461807a32@gmail.com
Assisted-by: LLM sparse
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5791,8 +5791,11 @@ __rb_get_reader_page_from_remote(struct
prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
- WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
- cpu_buffer->remote->priv));
+ if (cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
+ cpu_buffer->remote->priv)) {
+ pr_warn_ratelimited("Remote reader page swap failed\n");
+ return NULL;
+ }
/* nr_pages doesn't include the reader page */
if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
return NULL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 457/713] PM: sleep: Unblock runtime PM when device prepare fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 456/713] ring-buffer: Stop remote reader update when page swap fails Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 458/713] orangefs: fix double-free of trailer_buf on readdir copy failure Greg Kroah-Hartman
` (266 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shibo Zhu, Rafael J. Wysocki
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shibo Zhu <3499129952@qq.com>
commit cb258d651d747a7f7063d40f145418bee562ceaf upstream.
device_prepare() blocks runtime PM for a device with runtime PM disabled
before invoking its system-sleep ->prepare() callback. For a device that
has never enabled runtime PM, this changes dev->power.last_status from
RPM_INVALID to RPM_BLOCKED.
If the callback returns an error, dpm_prepare() does not move the device
to dpm_prepared_list. Consequently, the recovery path through
dpm_complete() never calls device_complete() for the failing device.
The error path drops the runtime PM usage reference, but does not clear
RPM_BLOCKED. A later legitimate pm_runtime_enable() then reports:
Attempt to enable runtime PM when it is blocked
before clearing the stale state.
Call pm_runtime_unblock() on the prepare error path before dropping the
runtime PM reference, matching the cleanup performed by device_complete().
The issue was reproduced with a platform test device whose ->prepare()
callback returns -EIO while runtime PM has never been enabled. Before
the fix, last_status remained RPM_BLOCKED after the failed suspend and
the first pm_runtime_enable() produced the warning above. With the fix,
last_status is restored to RPM_INVALID and the warning is absent.
Fixes: 3e5eee147b7b ("PM: Block enabling of runtime PM during system suspend")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Shibo Zhu <3499129952@qq.com>
Link: https://patch.msgid.link/tencent_C5AC0A02FC01F700E764F8C2E3ECE4F41009@qq.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -2234,6 +2234,7 @@ unlock:
if (ret < 0) {
suspend_report_result(dev, callback, ret);
+ pm_runtime_unblock(dev);
pm_runtime_put(dev);
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 458/713] orangefs: fix double-free of trailer_buf on readdir copy failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 457/713] PM: sleep: Unblock runtime PM when device prepare fails Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 459/713] orangefs: skip leading spaces before parsing client debug masks Greg Kroah-Hartman
` (265 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yifei Gao, Mike Marshall
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Gao <gyf161023@gmail.com>
commit f574296be7f46eb60beca851240b526df232f480 upstream.
On a readdir downcall, orangefs_devreq_write_iter() frees
op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails,
but does not clear the pointer before goto Efault. The waiter in
do_readdir() is then woken with a negative status and frees the same
pointer again on its r < 0 path, causing a deterministic double-free.
A client holding /dev/pvfs2-req triggers it by sending a readdir
downcall whose declared trailer_size exceeds the bytes it supplies.
Clear the pointer after freeing so the readdir-side vfree() becomes a
no-op.
Fixes: 382f4581e67f ("orangefs: rewrite readdir to fix several bugs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/orangefs/devorangefs-req.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/orangefs/devorangefs-req.c
+++ b/fs/orangefs/devorangefs-req.c
@@ -474,6 +474,7 @@ static ssize_t orangefs_devreq_write_ite
op->downcall.trailer_size, iter)) {
gossip_err("%s: failed to copy trailer.\n", __func__);
vfree(op->downcall.trailer_buf);
+ op->downcall.trailer_buf = NULL;
goto Efault;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 459/713] orangefs: skip leading spaces before parsing client debug masks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 458/713] orangefs: fix double-free of trailer_buf on readdir copy failure Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 460/713] ocfs2: always run deallocs on copy-on-write completion Greg Kroah-Hartman
` (264 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Zhiling Zou, Ren Wei,
Mike Marshall
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit d410cd5303ec59c7cf23dd61423752ce8e9ecb59 upstream.
orangefs_prepare_cdm_array() sizes each client debug keyword buffer
with strcspn(cds_head, " "), but then parses the keyword with %s. The
%s conversion skips leading whitespace, while strcspn() does not.
If a client debug entry starts with a space, the allocation can be sized
for an empty keyword while sscanf() copies the following non-empty token.
This can write past the end of the allocated keyword buffer.
Skip leading spaces before computing the keyword length so the allocation
matches the string parsed by sscanf().
Fixes: f7be4ee07fb7 ("Orangefs: kernel client part 4")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/orangefs/orangefs-debugfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/orangefs/orangefs-debugfs.c
+++ b/fs/orangefs/orangefs-debugfs.c
@@ -569,6 +569,7 @@ static int orangefs_prepare_cdm_array(ch
cds_delimiter = strchr(cds_head, '\n');
*cds_delimiter = '\0';
+ cds_head = skip_spaces(cds_head);
keyword_len = strcspn(cds_head, " ");
cdm_array[i].keyword = kzalloc(keyword_len + 1, GFP_KERNEL);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 460/713] ocfs2: always run deallocs on copy-on-write completion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 459/713] orangefs: skip leading spaces before parsing client debug masks Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 461/713] ocfs2: bound namelen in dlm_migrate_request_handler Greg Kroah-Hartman
` (263 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
commit 82ea9d4fc05fb7a387db547c6a7c0aa6a3719616 upstream.
Local fuzzing of 6.12.94 has found the following memory leak
caused by doing 'copy_file_range()' within the same filesystem:
unreferenced object 0xffff88812192c980 (size 32):
comm "syz.0.49", pid 12095, jiffies 4294964143
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................
c0 c5 92 21 81 88 ff ff 00 02 00 00 00 06 00 00 ...!............
backtrace (crc 7068d63f):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
ocfs2_find_per_slot_free_list fs/ocfs2/alloc.c:6618 [inline]
ocfs2_cache_block_dealloc+0x155/0x4b0 fs/ocfs2/alloc.c:6786
ocfs2_cache_extent_block_free fs/ocfs2/alloc.c:6819 [inline]
ocfs2_unlink_path+0x286/0x450 fs/ocfs2/alloc.c:2613
ocfs2_rotate_subtree_left fs/ocfs2/alloc.c:2779 [inline]
__ocfs2_rotate_tree_left+0x1f6f/0x2da0 fs/ocfs2/alloc.c:2985
ocfs2_rotate_tree_left+0x283/0xe00 fs/ocfs2/alloc.c:3237
ocfs2_try_to_merge_extent+0xf56/0x1a20 fs/ocfs2/alloc.c:3825
ocfs2_split_extent+0x15f4/0x2940 fs/ocfs2/alloc.c:5138
ocfs2_clear_ext_refcount+0x2f6/0x550 fs/ocfs2/refcounttree.c:3098
ocfs2_replace_clusters fs/ocfs2/refcounttree.c:3131 [inline]
ocfs2_make_clusters_writable fs/ocfs2/refcounttree.c:3255 [inline]
ocfs2_replace_cow+0x991/0x1660 fs/ocfs2/refcounttree.c:3349
ocfs2_refcount_cow_hunk fs/ocfs2/refcounttree.c:3427 [inline]
ocfs2_refcount_cow+0x5e1/0x9f0 fs/ocfs2/refcounttree.c:3470
ocfs2_prepare_inode_for_write fs/ocfs2/file.c:2340 [inline]
ocfs2_file_write_iter+0xbda/0x1880 fs/ocfs2/file.c:2451
iter_file_splice_write+0x890/0xf60 fs/splice.c:743
do_splice_from fs/splice.c:944 [inline]
direct_splice_actor+0x232/0x480 fs/splice.c:1167
splice_direct_to_actor+0x4b4/0xb60 fs/splice.c:1111
do_splice_direct_actor fs/splice.c:1210 [inline]
do_splice_direct+0x10f/0x1c0 fs/splice.c:1236
do_sendfile+0x430/0xbf0 fs/read_write.c:1388
unreferenced object 0xffff88812192c5c0 (size 32):
comm "syz.0.49", pid 12095, jiffies 4294964143
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
29 70 00 00 00 00 00 00 19 00 00 00 00 00 00 00 )p..............
backtrace (crc afec850f):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
ocfs2_cache_block_dealloc+0x25c/0x4b0 fs/ocfs2/alloc.c:6793
ocfs2_cache_extent_block_free fs/ocfs2/alloc.c:6819 [inline]
ocfs2_unlink_path+0x286/0x450 fs/ocfs2/alloc.c:2613
ocfs2_rotate_subtree_left fs/ocfs2/alloc.c:2779 [inline]
__ocfs2_rotate_tree_left+0x1f6f/0x2da0 fs/ocfs2/alloc.c:2985
ocfs2_rotate_tree_left+0x283/0xe00 fs/ocfs2/alloc.c:3237
ocfs2_try_to_merge_extent+0xf56/0x1a20 fs/ocfs2/alloc.c:3825
ocfs2_split_extent+0x15f4/0x2940 fs/ocfs2/alloc.c:5138
ocfs2_clear_ext_refcount+0x2f6/0x550 fs/ocfs2/refcounttree.c:3098
ocfs2_replace_clusters fs/ocfs2/refcounttree.c:3131 [inline]
ocfs2_make_clusters_writable fs/ocfs2/refcounttree.c:3255 [inline]
ocfs2_replace_cow+0x991/0x1660 fs/ocfs2/refcounttree.c:3349
ocfs2_refcount_cow_hunk fs/ocfs2/refcounttree.c:3427 [inline]
ocfs2_refcount_cow+0x5e1/0x9f0 fs/ocfs2/refcounttree.c:3470
ocfs2_prepare_inode_for_write fs/ocfs2/file.c:2340 [inline]
ocfs2_file_write_iter+0xbda/0x1880 fs/ocfs2/file.c:2451
iter_file_splice_write+0x890/0xf60 fs/splice.c:743
do_splice_from fs/splice.c:944 [inline]
direct_splice_actor+0x232/0x480 fs/splice.c:1167
splice_direct_to_actor+0x4b4/0xb60 fs/splice.c:1111
do_splice_direct_actor fs/splice.c:1210 [inline]
do_splice_direct+0x10f/0x1c0 fs/splice.c:1236
do_sendfile+0x430/0xbf0 fs/read_write.c:1388
This happens when 'ocfs2_cache_block_dealloc()' called from
'ocfs2_cache_extent_block_free()' uses the suballocator to
schedule extent removal, so 'ocfs2_run_deallocs()' should
be run unconditionally to complete the removal with
'ocfs2_free_cached_blocks()'. An extra semi-automated static
analysis [1] suspects that the same scenario looks possible in
'ocfs2_attach_refcount_tree()' and 'ocfs2_reflink_remap_blocks()'
as well, but, since 'ocfs2_run_deallocs()' is a safe no-op for
an empty dealloc context, 'ocfs2_create_reflink_node()' and
'ocfs2_reflink_xattrs()' may be adjusted in the same way too,
thus keeping the code pattern consistent.
Link: https://lore.kernel.org/20260721102840.387663-1-dmantipov@yandex.ru
Link: https://lore.kernel.org/ocfs2-devel/f1d7e266-4b44-41b9-98c0-5b3868a8d9c3@yandex.ru [1]
Fixes: 6f70fa519976 ("ocfs2: Add CoW support.")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/refcounttree.c | 20 ++++++++------------
fs/ocfs2/xattr.c | 5 ++---
2 files changed, 10 insertions(+), 15 deletions(-)
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3360,10 +3360,9 @@ static int ocfs2_replace_cow(struct ocfs
cow_start += num_clusters;
}
- if (ocfs2_dealloc_has_cluster(&context->dealloc)) {
+ if (ocfs2_dealloc_has_cluster(&context->dealloc))
ocfs2_schedule_truncate_log_flush(osb, 1);
- ocfs2_run_deallocs(osb, &context->dealloc);
- }
+ ocfs2_run_deallocs(osb, &context->dealloc);
return ret;
}
@@ -3846,10 +3845,9 @@ unlock:
ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
brelse(ref_root_bh);
- if (!ret && ocfs2_dealloc_has_cluster(&dealloc)) {
+ if (!ret && ocfs2_dealloc_has_cluster(&dealloc))
ocfs2_schedule_truncate_log_flush(osb, 1);
- ocfs2_run_deallocs(osb, &dealloc);
- }
+ ocfs2_run_deallocs(osb, &dealloc);
out:
/*
* Empty the extent map so that we may get the right extent
@@ -4135,10 +4133,9 @@ out_unlock_refcount:
ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
brelse(ref_root_bh);
out:
- if (ocfs2_dealloc_has_cluster(&dealloc)) {
+ if (ocfs2_dealloc_has_cluster(&dealloc))
ocfs2_schedule_truncate_log_flush(osb, 1);
- ocfs2_run_deallocs(osb, &dealloc);
- }
+ ocfs2_run_deallocs(osb, &dealloc);
return ret;
}
@@ -4691,10 +4688,9 @@ loff_t ocfs2_reflink_remap_blocks(struct
}
out:
- if (ocfs2_dealloc_has_cluster(&dealloc)) {
+ if (ocfs2_dealloc_has_cluster(&dealloc))
ocfs2_schedule_truncate_log_flush(osb, 1);
- ocfs2_run_deallocs(osb, &dealloc);
- }
+ ocfs2_run_deallocs(osb, &dealloc);
return ret;
}
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7241,10 +7241,9 @@ out_unlock:
ref_tree, 1);
brelse(ref_root_bh);
- if (ocfs2_dealloc_has_cluster(&dealloc)) {
+ if (ocfs2_dealloc_has_cluster(&dealloc))
ocfs2_schedule_truncate_log_flush(OCFS2_SB(old_inode->i_sb), 1);
- ocfs2_run_deallocs(OCFS2_SB(old_inode->i_sb), &dealloc);
- }
+ ocfs2_run_deallocs(OCFS2_SB(old_inode->i_sb), &dealloc);
out:
return ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 461/713] ocfs2: bound namelen in dlm_migrate_request_handler
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 460/713] ocfs2: always run deallocs on copy-on-write completion Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 462/713] ocfs2: validate lengths in dlm_mig_lockres_handler Greg Kroah-Hartman
` (262 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Joseph Qi, Changwei Ge,
Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi, Mark Fasheh,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit ea5b5609305a8437bc955a0834a530c12246d78f upstream.
Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm".
The o2dlm receive handlers trust u8 length and count fields from the wire
without bounding them, so a node in a DLM domain can corrupt or panic any
other node with a malformed message. Three defects:
- dlm_migrate_request_handler() passes migrate->namelen unchecked to
dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an
o2dlm_mle slab object: a heap out-of-bounds write of up to ~215
attacker-controlled bytes.
- dlm_mig_lockres_handler() passes mres->lockname_len unchecked to
dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname
slab object: a heap out-of-bounds write of up to ~223 bytes.
- the same handler trusts mres->num_locks without checking that the
message is large enough to hold that many entries, so
dlm_process_recovery_data() walks mres->ml[] past the kmalloc(data_len)
copy and trips a BUG_ON (an out-of-bounds read ending in a panic).
The other o2dlm receive handlers already reject an oversized name; the
migration and recovery handlers have omitted it since the DLM was added
(see the Fixes tags). Patch 1 bounds namelen; patch 2 validates
lockname_len, num_locks, and the payload size. Conforming recovery and
migration traffic is unaffected.
o2net authenticates peers only by the DLM domain key, so any node that has
joined the domain -- including a compromised or malicious member -- can
send these messages. There is no local trigger; the attacker must already
be a member of the cluster.
Each sink was confirmed under KASAN with an out-of-tree module mirroring
it exactly -- a kmem_cache/kmalloc of the real destination size, then the
same unclamped memcpy/loop: slab-out-of-bounds Write for the two writes,
Read for the recovery walk, and a panic. A userspace AddressSanitizer
build faults identically under -m32 and -m64. Scrubbed logs are available
on request.
I reported this privately to security@kernel.org and the ocfs2 maintainers
on 2026-06-20; with no response after the standard embargo period I am
posting the fix publicly. I have no embargo requirement.
This patch (of 2):
A node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied
name length (migrate->namelen) without bounding it. dlm_init_mle() then
copies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[]
array of an o2dlm_mle slab object, so a malformed message from a cluster
peer overflows the slab object by up to ~215 bytes: a heap out-of-bounds
write of attacker-controlled data, reachable by any node in the domain.
Reject an oversized name, the way dlm_master_request_handler() and the
other o2dlm receive handlers already do; the migration handler omits the
check entirely. Conforming messages are unaffected.
Link: https://lore.kernel.org/20260629-b4-disp-94fb6521-v1-0-6953bcc0421f@proton.me
Link: https://lore.kernel.org/20260629-b4-disp-94fb6521-v1-1-6953bcc0421f@proton.me
Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmmaster.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -3099,6 +3099,12 @@ int dlm_migrate_request_handler(struct o
name = migrate->name;
namelen = migrate->namelen;
+ if (namelen > DLM_LOCKID_NAME_MAX) {
+ mlog(ML_ERROR, "%s: invalid name length %u in migrate request\n",
+ dlm->name, namelen);
+ ret = -EINVAL;
+ goto leave;
+ }
hash = dlm_lockid_hash(name, namelen);
/* preallocate.. if this fails, abort */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 462/713] ocfs2: validate lengths in dlm_mig_lockres_handler
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 461/713] ocfs2: bound namelen in dlm_migrate_request_handler Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 463/713] ocfs2: validate rl_used against rl_count in refcount block validator Greg Kroah-Hartman
` (261 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit b54e03d9b3697d25f4a0063cf717d459c5e3ad94 upstream.
A node receiving a DLM_MIG_LOCKRES message trusts several fields of the
peer-supplied dlm_migratable_lockres without validation. num_locks and
lockname_len are bounded only on the sending side, and the message is
never checked to actually carry num_locks migratable_lock entries. As a
result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the
kmalloc(data_len) copy of the message (an out-of-bounds read that ends in
a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the
fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write).
Both are reachable by any node in the domain.
Validate these fields right after dlm_grab(), before anything uses them --
including the not-joined error path, which already prints mres->lockname
with the unbounded lockname_len as a %.*s precision. Reject the message
unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <=
DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the
payload is large enough to hold the claimed locks. Conforming recovery
and migration messages are unaffected.
Link: https://lore.kernel.org/20260629-b4-disp-94fb6521-v1-2-6953bcc0421f@proton.me
Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmrecovery.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1357,6 +1357,15 @@ int dlm_mig_lockres_handler(struct o2net
if (!dlm_grab(dlm))
return -EINVAL;
+ if (mres->lockname_len > DLM_LOCKID_NAME_MAX ||
+ mres->num_locks > DLM_MAX_MIGRATABLE_LOCKS ||
+ be16_to_cpu(msg->data_len) < struct_size(mres, ml, mres->num_locks)) {
+ mlog(ML_ERROR, "%s: invalid lockres migration message from %u\n",
+ dlm->name, mres->master);
+ dlm_put(dlm);
+ return -EINVAL;
+ }
+
if (!dlm_joined(dlm)) {
mlog(ML_ERROR, "Domain %s not joined! "
"lockres %.*s, master %u\n",
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 463/713] ocfs2: validate rl_used against rl_count in refcount block validator
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 462/713] ocfs2: validate lengths in dlm_mig_lockres_handler Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 464/713] ocfs2: validate directory-index entry counts when reading metadata Greg Kroah-Hartman
` (260 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit 4ca62df6bc0708947b48da3f6a712ecb8e73929c upstream.
ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array
with:
for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) {
rec = &rb->rf_records.rl_recs[i];
...
rl_recs[] lives in a single metadata block (4096 bytes on the common
configuration), so its real capacity is fixed by
ocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the
16-byte ocfs2_refcount_rec). rl_used and rl_count are both read directly
off disk by ocfs2_validate_refcount_block() and are never checked against
that capacity, nor against each other, before any refcount/reflink/CoW
operation walks the array.
A crafted (or corrupted) refcount block with rl_used == 0xffff makes the
loop above walk far past the end of the block, dereferencing rl_recs[i]
for i up to 65534. The resulting index is then handed to the sibling
ocfs2_insert_refcount_rec(), whose insert-shift does:
if (index < le16_to_cpu(rf_list->rl_used))
memmove(&rf_list->rl_recs[index + 1],
&rf_list->rl_recs[index],
(le16_to_cpu(rf_list->rl_used) - index) *
sizeof(struct ocfs2_refcount_rec));
i.e. a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an
offset already past the block. This is reachable from an ordinary reflink
(FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent
whose cpos sorts past every real record in the leaf forces the lookup to
run off the end instead of returning early on a match. The attacker model
is local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a
raw write to the block device backing an already-mounted ocfs2 filesystem.
ocfs2_validate_refcount_block() already validates the block's ECC,
signature, rf_blkno and rf_fs_generation, but never rl_count/rl_used
against the block's actual on-disk capacity. This is the same class of
gap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c) already closes
for the sibling extent-list header, which checks both the record capacity
and the "used" bound before any code walks h_list.l_recs[]:
if (le16_to_cpu(eb->h_list.l_count) != ocfs2_extent_recs_per_eb(sb)) {
rc = ocfs2_error(...);
goto bail;
}
if (le16_to_cpu(eb->h_list.l_next_free_rec) >
le16_to_cpu(eb->h_list.l_count)) {
rc = ocfs2_error(...);
goto bail;
}
Add the equivalent pair of checks to ocfs2_validate_refcount_block():
reject a refcount block whose rl_count does not match the fixed per-block
capacity returned by ocfs2_refcount_recs_per_rb(), and reject rl_used >
rl_count. Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set,
because in that case the same union bytes hold an ocfs2_extent_list
(rf_list), not the refcount record list (rf_records) -- that layout is
already validated separately by ocfs2_validate_extent_block() when the
referenced extent block is read. This mirrors the existing
"!(rb->rf_flags & OCFS2_REFCOUNT_TREE_FL)" guard used elsewhere in this
file (e.g. ocfs2_get_refcount_rec()) to decide whether rf_records or
rf_list is the live member of the union.
With this in place, a forged rl_used/rl_count is caught at block
validation time (ocfs2_error()), consistent with every other corruption
check in this function, instead of driving an out-of-bounds read in
ocfs2_find_refcount_rec_in_rl() and a subsequent out-of-bounds memmove()
in ocfs2_insert_refcount_rec().
Verified against a crafted image on a v6.19 KASAN (KASAN_GENERIC) build:
replaying the same reflink (FICLONE) reliably hit a KASAN report in
__ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() before this patch,
and triggers no report once ocfs2_validate_refcount_block() rejects the
forged rl_used/rl_count.
Link: https://lore.kernel.org/20260709132609.44233-1-security@auditcode.ai
Fixes: f2c870e3b12e ("ocfs2: Add ocfs2_read_refcount_block.")
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Assisted-by: AuditCode-AI:2026.07
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/refcounttree.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -116,6 +116,33 @@ static int ocfs2_validate_refcount_block
le32_to_cpu(rb->rf_fs_generation));
goto out;
}
+
+ /*
+ * rf_records (rl_count/rl_used/rl_recs[]) is only meaningful when
+ * this block is not an interior tree block (OCFS2_REFCOUNT_TREE_FL);
+ * in that case the same union bytes hold an extent list (rf_list)
+ * instead, which is validated by ocfs2_validate_extent_block().
+ */
+ if (!(le32_to_cpu(rb->rf_flags) & OCFS2_REFCOUNT_TREE_FL)) {
+ if (le16_to_cpu(rb->rf_records.rl_count) !=
+ ocfs2_refcount_recs_per_rb(sb)) {
+ rc = ocfs2_error(sb,
+ "Refcount block #%llu has an invalid rl_count of %u\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(rb->rf_records.rl_count));
+ goto out;
+ }
+
+ if (le16_to_cpu(rb->rf_records.rl_used) >
+ le16_to_cpu(rb->rf_records.rl_count)) {
+ rc = ocfs2_error(sb,
+ "Refcount block #%llu has an invalid rl_used of %u (rl_count %u)\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(rb->rf_records.rl_used),
+ le16_to_cpu(rb->rf_records.rl_count));
+ goto out;
+ }
+ }
out:
return rc;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 464/713] ocfs2: validate directory-index entry counts when reading metadata
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 463/713] ocfs2: validate rl_used against rl_count in refcount block validator Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 465/713] ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin() Greg Kroah-Hartman
` (259 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Doruk Tan Ozturk, Joseph Qi,
Joel Becker, Kees Cook, Mark Fasheh, Junxiao Bi, Changwei Ge,
Jun Piao, Heming Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <doruk@0sec.ai>
commit bc70726ddad53c7e9a9a85915bf2415b0d4f42f9 upstream.
ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
signature of an indexed-directory block before it reaches higher-level
callers, but neither validator bounds the ocfs2_dx_entry_list counts
against the capacity of the block that holds them.
ocfs2_dx_dir_search() then walks
for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++)
dx_entry = &entry_list->de_entries[i];
over de_num_used entries with no bounds check. entry_list is either
dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root,
dx_root->dr_entries. A crafted on-disk image can set de_num_used (and
de_count, which is the __counted_by_le() bound of de_entries) to 0xffff
and make the walk read far past the end of the 4KB metadata block, giving
a slab out-of-bounds read reachable from any path lookup, stat() or open()
on an indexed directory once the image is mounted.
Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during
block read") already bounds dr_list for the non-inline dx_root, but left
the inline dr_entries path and the dx_leaf dl_list unchecked. Add the
same read-time validation for both entry lists: de_count must equal the
capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and
de_num_used must not exceed de_count, rejecting corrupted metadata with
-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry
array.
de_count is always written as exactly the block capacity when a leaf or
inline root is formatted, so the equality check does not reject any valid
image.
Found by 0sec automated security-research tooling (https://0sec.ai).
Link: https://lore.kernel.org/20260713205625.92391-1-doruk@0sec.ai
Fixes: 9b7895efac90 ("ocfs2: Add a name indexed b-tree to directory inodes")
Fixes: 4ed8a6bb083b ("ocfs2: Store dir index records inline")
Assisted-by: 0sec:claude-opus-4-8
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dir.c | 45 +++++++++++++++++++++++++++++++++++++++++----
1 file changed, 41 insertions(+), 4 deletions(-)
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -625,6 +625,28 @@ static int ocfs2_validate_dx_root(struct
le16_to_cpu(el->l_count));
goto bail;
}
+ } else {
+ struct ocfs2_dx_entry_list *dl_list = &dx_root->dr_entries;
+
+ if (le16_to_cpu(dl_list->de_count) !=
+ ocfs2_dx_entries_per_root(sb)) {
+ ret = ocfs2_error(sb,
+ "Dir Index Root # %llu has invalid de_count %u (expected %u)\n",
+ (unsigned long long)le64_to_cpu(dx_root->dr_blkno),
+ le16_to_cpu(dl_list->de_count),
+ ocfs2_dx_entries_per_root(sb));
+ goto bail;
+ }
+
+ if (le16_to_cpu(dl_list->de_num_used) >
+ le16_to_cpu(dl_list->de_count)) {
+ ret = ocfs2_error(sb,
+ "Dir Index Root # %llu has invalid de_num_used %u (de_count %u)\n",
+ (unsigned long long)le64_to_cpu(dx_root->dr_blkno),
+ le16_to_cpu(dl_list->de_num_used),
+ le16_to_cpu(dl_list->de_count));
+ goto bail;
+ }
}
bail:
@@ -664,10 +686,25 @@ static int ocfs2_validate_dx_leaf(struct
return ret;
}
- if (!OCFS2_IS_VALID_DX_LEAF(dx_leaf)) {
- ret = ocfs2_error(sb, "Dir Index Leaf has bad signature %.*s\n",
- 7, dx_leaf->dl_signature);
- }
+ if (!OCFS2_IS_VALID_DX_LEAF(dx_leaf))
+ return ocfs2_error(sb, "Dir Index Leaf has bad signature %.*s\n",
+ 7, dx_leaf->dl_signature);
+
+ if (le16_to_cpu(dx_leaf->dl_list.de_count) !=
+ ocfs2_dx_entries_per_leaf(sb))
+ return ocfs2_error(sb,
+ "Dir Index Leaf # %llu has invalid de_count %u (expected %u)\n",
+ (unsigned long long)le64_to_cpu(dx_leaf->dl_blkno),
+ le16_to_cpu(dx_leaf->dl_list.de_count),
+ ocfs2_dx_entries_per_leaf(sb));
+
+ if (le16_to_cpu(dx_leaf->dl_list.de_num_used) >
+ le16_to_cpu(dx_leaf->dl_list.de_count))
+ return ocfs2_error(sb,
+ "Dir Index Leaf # %llu has invalid de_num_used %u (de_count %u)\n",
+ (unsigned long long)le64_to_cpu(dx_leaf->dl_blkno),
+ le16_to_cpu(dx_leaf->dl_list.de_num_used),
+ le16_to_cpu(dx_leaf->dl_list.de_count));
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 465/713] ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 464/713] ocfs2: validate directory-index entry counts when reading metadata Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 466/713] ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Greg Kroah-Hartman
` (258 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Changwei Ge, Heming Zhao,
Joel Becker, Jun Piao, Junxiao Bi, Mark Fasheh, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
commit af09df89db9a68a1d76df0f75667998135bc8d65 upstream.
Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2.
This series fixes three related issues in o2hb_region_pin(), all are from
the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster:
Pin/unpin o2hb regions"):
1) It is called with o2hb_live_lock (a spinlock) held, but the
underlying configfs_depend_item() sleeps (takes inode rwsem and
pins the filesystem). This triggers BUG under
CONFIG_DEBUG_ATOMIC_SLEEP.
2) When called from the configfs drop_item callback, it creates a
lock order inversion: parent inode_lock -> configfs root
inode_lock, which can deadlock against subsystem unregistration
paths taking root -> parent.
3) If pinning fails partway through o2hb_region_inc_user(), the
o2hb_dependent_users counter is leaked and partially-pinned
regions are never released, leaving heartbeat regions
unprotected on subsequent mounts.
Patch 1 reworks o2hb_region_pin() to drop o2hb_live_lock across each
sleeping configfs_depend_item() call, using a config_item reference to
keep the region alive while unlocked.
Patch 2 adds a from_callback parameter to select
configfs_depend_item_unlocked() when called from configfs context,
avoiding the inode_lock nesting.
Patch 3 fixes the error path in o2hb_region_inc_user() to unpin and
decrement the counter on failure.
This patch (of 3):
o2hb_region_pin() is always called with the o2hb_live_lock spinlock held
(from o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item()), but it
calls o2nm_depend_item() -> configfs_depend_item(), which sleeps: it pins
the configfs filesystem and takes the configfs root inode rwsem. Under
CONFIG_DEBUG_ATOMIC_SLEEP this triggers:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c
in_atomic(): 1, ... name: mount.ocfs2
down_write
configfs_depend_item
o2hb_region_pin
o2hb_region_inc_user
o2hb_register_callback
dlm_register_domain_handlers
...
ocfs2_dlm_init
ocfs2_mount_volume
ocfs2_fill_super
Rework o2hb_region_pin() to pin one region at a time with the lock dropped
across the sleeping call: under o2hb_live_lock find the next eligible
region and take a config_item reference to keep it alive, drop the lock,
call o2nm_depend_item(), then retake the lock and record the pin. The
config_item_put() is done with the lock released as well, since
o2hb_region_release() also acquires o2hb_live_lock and can sleep. The
region list may change while unlocked, so the scan restarts from the top
after each pin. Local heartbeat still pins only the matching region;
global heartbeat pins all eligible regions.
The unpin path is unaffected: configfs_undepend_item() only takes a
spinlock and does not sleep.
Link: https://lore.kernel.org/20260722124933.430554-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20260722124933.430554-2-joseph.qi@linux.alibaba.com
Fixes: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/heartbeat.c | 126 ++++++++++++++++++++++++++++++++++---------
1 file changed, 101 insertions(+), 25 deletions(-)
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -43,6 +43,14 @@ static DECLARE_RWSEM(o2hb_callback_sem);
* whenever any of the threads sees activity from the node in its region.
*/
static DEFINE_SPINLOCK(o2hb_live_lock);
+/*
+ * Serializes region pin/unpin dependency management (o2hb_dependent_users
+ * and the o2nm_depend_item()/o2nm_undepend_item() calls). o2hb_region_pin()
+ * has to drop o2hb_live_lock across the sleeping o2nm_depend_item(), so the
+ * spinlock alone can no longer keep pin and unpin mutually exclusive; this
+ * mutex, taken outside o2hb_live_lock, does.
+ */
+static DEFINE_MUTEX(o2hb_dependency_mutex);
static struct list_head o2hb_live_slots[O2NM_MAX_NODES];
static unsigned long o2hb_live_node_bitmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
static LIST_HEAD(o2hb_node_events);
@@ -2142,6 +2150,7 @@ static void o2hb_heartbeat_group_drop_it
* If global heartbeat active and there are dependent users,
* pin all regions if quorum region count <= CUT_OFF
*/
+ mutex_lock(&o2hb_dependency_mutex);
spin_lock(&o2hb_live_lock);
if (!o2hb_dependent_users)
@@ -2153,6 +2162,7 @@ static void o2hb_heartbeat_group_drop_it
unlock:
spin_unlock(&o2hb_live_lock);
+ mutex_unlock(&o2hb_dependency_mutex);
}
static ssize_t o2hb_heartbeat_group_dead_threshold_show(struct config_item *item,
@@ -2292,46 +2302,108 @@ EXPORT_SYMBOL_GPL(o2hb_setup_callback);
*/
static int o2hb_region_pin(const char *region_uuid)
{
- int ret = 0, found = 0;
- struct o2hb_region *reg;
+ int ret = 0, found;
+ struct o2hb_region *reg, *pinned;
char *uuid;
assert_spin_locked(&o2hb_live_lock);
- list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
- if (reg->hr_item_dropped)
- continue;
+ do {
+ found = 0;
+ pinned = NULL;
- uuid = config_item_name(®->hr_item);
+ list_for_each_entry(reg, &o2hb_all_regions, hr_all_item) {
+ if (reg->hr_item_dropped)
+ continue;
- /* local heartbeat */
- if (region_uuid) {
- if (strcmp(region_uuid, uuid))
+ uuid = config_item_name(®->hr_item);
+
+ /* local heartbeat */
+ if (region_uuid) {
+ if (strcmp(region_uuid, uuid))
+ continue;
+ found = 1;
+ }
+
+ if (reg->hr_item_pinned || reg->hr_item_dropped) {
+ if (found)
+ break;
continue;
- found = 1;
+ }
+
+ /*
+ * Found a region that needs pinning. Take a reference
+ * so it stays alive while we drop the lock below.
+ */
+ pinned = reg;
+ config_item_get(®->hr_item);
+ break;
}
- if (reg->hr_item_pinned || reg->hr_item_dropped)
- goto skip_pin;
+ if (!pinned)
+ break;
+
+ uuid = config_item_name(&pinned->hr_item);
+
+ /*
+ * o2nm_depend_item() -> configfs_depend_item() can sleep (it
+ * takes the configfs root inode rwsem), so it must not run
+ * under o2hb_live_lock. Drop the lock across it; @pinned is
+ * kept alive by the reference taken above. The region list may
+ * change while unlocked, so we rescan from the top afterwards.
+ */
+ spin_unlock(&o2hb_live_lock);
/* Ignore ENOENT only for local hb (userdlm domain) */
- ret = o2nm_depend_item(®->hr_item);
+ ret = o2nm_depend_item(&pinned->hr_item);
+
+ spin_lock(&o2hb_live_lock);
if (!ret) {
- mlog(ML_CLUSTER, "Pin region %s\n", uuid);
- reg->hr_item_pinned = 1;
- } else {
- if (ret == -ENOENT && found)
- ret = 0;
- else {
- mlog(ML_ERROR, "Pin region %s fails with %d\n",
- uuid, ret);
+ /*
+ * o2hb_live_lock was dropped across o2nm_depend_item().
+ * o2hb_set_quorum_device() runs in the heartbeat thread
+ * without o2hb_dependency_mutex, so for global heartbeat
+ * it may have crossed O2HB_PIN_CUT_OFF and unpinned the
+ * regions while we slept. If that happened this pin is
+ * no longer wanted; undo it and stop rather than
+ * resurrecting it on the rescan below.
+ */
+ if (!region_uuid &&
+ bitmap_weight(o2hb_quorum_region_bitmap,
+ O2NM_MAX_REGIONS) > O2HB_PIN_CUT_OFF) {
+ o2nm_undepend_item(&pinned->hr_item);
+ spin_unlock(&o2hb_live_lock);
+ config_item_put(&pinned->hr_item);
+ spin_lock(&o2hb_live_lock);
break;
}
+ mlog(ML_CLUSTER, "Pin region %s\n", uuid);
+ pinned->hr_item_pinned = 1;
+ } else if (ret == -ENOENT && (found || !region_uuid)) {
+ /*
+ * For local hb (found): ignore ENOENT from userdlm
+ * domains as before. For global hb (!region_uuid):
+ * the region may have been detached from configfs
+ * while the lock was dropped — skip it and continue
+ * pinning the remaining regions.
+ */
+ ret = 0;
+ } else {
+ mlog(ML_ERROR, "Pin region %s fails with %d\n",
+ uuid, ret);
}
-skip_pin:
- if (found)
- break;
- }
+
+ /*
+ * config_item_put() may drop the last reference and run
+ * o2hb_region_release(), which also grabs o2hb_live_lock and
+ * can sleep, so it must happen with the lock released.
+ */
+ spin_unlock(&o2hb_live_lock);
+ config_item_put(&pinned->hr_item);
+ spin_lock(&o2hb_live_lock);
+
+ /* local hb pins a single matching region */
+ } while (!ret && !region_uuid);
return ret;
}
@@ -2376,6 +2448,7 @@ static int o2hb_region_inc_user(const ch
{
int ret = 0;
+ mutex_lock(&o2hb_dependency_mutex);
spin_lock(&o2hb_live_lock);
/* local heartbeat */
@@ -2398,11 +2471,13 @@ static int o2hb_region_inc_user(const ch
unlock:
spin_unlock(&o2hb_live_lock);
+ mutex_unlock(&o2hb_dependency_mutex);
return ret;
}
static void o2hb_region_dec_user(const char *region_uuid)
{
+ mutex_lock(&o2hb_dependency_mutex);
spin_lock(&o2hb_live_lock);
/* local heartbeat */
@@ -2421,6 +2496,7 @@ static void o2hb_region_dec_user(const c
unlock:
spin_unlock(&o2hb_live_lock);
+ mutex_unlock(&o2hb_dependency_mutex);
}
int o2hb_register_callback(const char *region_uuid,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 466/713] ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 465/713] ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin() Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 467/713] ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Greg Kroah-Hartman
` (257 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Changwei Ge, Heming Zhao,
Joel Becker, Jun Piao, Junxiao Bi, Mark Fasheh, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
commit cd789996db3c87427343f54f509d17810bd7ba7c upstream.
o2hb_heartbeat_group_drop_item() is called from configfs rmdir with the
parent directory's inode_lock held. It calls o2hb_region_pin() ->
o2nm_depend_item() -> configfs_depend_item(), which acquires the configfs
root inode_lock. This creates a parent -> root inode_lock nesting that
could deadlock against paths taking root -> parent (e.g. subsystem
unregistration).
Fix this by using configfs_depend_item_unlocked() when o2hb_region_pin()
is called from a configfs callback context. This variant skips the root
inode_lock when caller and target are in the same subsystem, which is safe
because VFS already holds a lock preventing unregistration.
Add o2nm_depend_item_unlocked() wrapper and a from_callback parameter to
o2hb_region_pin() to select the appropriate variant.
Link: https://lore.kernel.org/20260722124933.430554-3-joseph.qi@linux.alibaba.com
Fixes: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/heartbeat.c | 17 ++++++++++-------
fs/ocfs2/cluster/nodemanager.c | 6 ++++++
fs/ocfs2/cluster/nodemanager.h | 1 +
3 files changed, 17 insertions(+), 7 deletions(-)
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -146,7 +146,7 @@ static unsigned int o2hb_dependent_users
* In global heartbeat mode, we pin/unpin all o2hb regions. This solution
* works for both file system and userdlm domains.
*/
-static int o2hb_region_pin(const char *region_uuid);
+static int o2hb_region_pin(const char *region_uuid, bool from_callback);
static void o2hb_region_unpin(const char *region_uuid);
/* Only sets a new threshold if there are no active regions.
@@ -2158,7 +2158,7 @@ static void o2hb_heartbeat_group_drop_it
if (bitmap_weight(o2hb_quorum_region_bitmap,
O2NM_MAX_REGIONS) <= O2HB_PIN_CUT_OFF)
- o2hb_region_pin(NULL);
+ o2hb_region_pin(NULL, true);
unlock:
spin_unlock(&o2hb_live_lock);
@@ -2300,7 +2300,7 @@ EXPORT_SYMBOL_GPL(o2hb_setup_callback);
* In local, we only pin the matching region. In global we pin all the active
* regions.
*/
-static int o2hb_region_pin(const char *region_uuid)
+static int o2hb_region_pin(const char *region_uuid, bool from_callback)
{
int ret = 0, found;
struct o2hb_region *reg, *pinned;
@@ -2355,7 +2355,10 @@ static int o2hb_region_pin(const char *r
spin_unlock(&o2hb_live_lock);
/* Ignore ENOENT only for local hb (userdlm domain) */
- ret = o2nm_depend_item(&pinned->hr_item);
+ if (from_callback)
+ ret = o2nm_depend_item_unlocked(&pinned->hr_item);
+ else
+ ret = o2nm_depend_item(&pinned->hr_item);
spin_lock(&o2hb_live_lock);
if (!ret) {
@@ -2453,8 +2456,8 @@ static int o2hb_region_inc_user(const ch
/* local heartbeat */
if (!o2hb_global_heartbeat_active()) {
- ret = o2hb_region_pin(region_uuid);
- goto unlock;
+ ret = o2hb_region_pin(region_uuid, false);
+ goto unlock;
}
/*
@@ -2467,7 +2470,7 @@ static int o2hb_region_inc_user(const ch
if (bitmap_weight(o2hb_quorum_region_bitmap,
O2NM_MAX_REGIONS) <= O2HB_PIN_CUT_OFF)
- ret = o2hb_region_pin(NULL);
+ ret = o2hb_region_pin(NULL, false);
unlock:
spin_unlock(&o2hb_live_lock);
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -777,6 +777,12 @@ int o2nm_depend_item(struct config_item
return configfs_depend_item(&o2nm_cluster_group.cs_subsys, item);
}
+int o2nm_depend_item_unlocked(struct config_item *item)
+{
+ return configfs_depend_item_unlocked(&o2nm_cluster_group.cs_subsys,
+ item);
+}
+
void o2nm_undepend_item(struct config_item *item)
{
configfs_undepend_item(item);
--- a/fs/ocfs2/cluster/nodemanager.h
+++ b/fs/ocfs2/cluster/nodemanager.h
@@ -64,6 +64,7 @@ void o2nm_node_get(struct o2nm_node *nod
void o2nm_node_put(struct o2nm_node *node);
int o2nm_depend_item(struct config_item *item);
+int o2nm_depend_item_unlocked(struct config_item *item);
void o2nm_undepend_item(struct config_item *item);
int o2nm_depend_this_node(void);
void o2nm_undepend_this_node(void);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 467/713] ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 466/713] ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 468/713] ocfs2: fix cached cluster count after suballocator reclaim Greg Kroah-Hartman
` (256 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Mark Fasheh, Joel Becker,
Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
commit 12c2ab42dbe227956c765e2674364bfca5de0533 upstream.
In o2hb_region_inc_user(), o2hb_dependent_users is incremented
unconditionally before calling o2hb_region_pin(). If the pin fails, the
counter is never decremented and any partially-pinned regions are never
unpinned, since the caller does not call o2hb_region_dec_user() on error.
The leaked counter causes subsequent o2hb_region_inc_user() calls to skip
pinning entirely (the > 1 check), leaving heartbeat regions unprotected.
Fix by rolling back on failure: call o2hb_region_unpin(NULL) to release
any partially-pinned regions and decrement o2hb_dependent_users to restore
the pre-increment state.
Link: https://lore.kernel.org/20260722124933.430554-4-joseph.qi@linux.alibaba.com
Fixes: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/cluster/heartbeat.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -2469,8 +2469,13 @@ static int o2hb_region_inc_user(const ch
goto unlock;
if (bitmap_weight(o2hb_quorum_region_bitmap,
- O2NM_MAX_REGIONS) <= O2HB_PIN_CUT_OFF)
+ O2NM_MAX_REGIONS) <= O2HB_PIN_CUT_OFF) {
ret = o2hb_region_pin(NULL, false);
+ if (ret) {
+ o2hb_region_unpin(NULL);
+ o2hb_dependent_users--;
+ }
+ }
unlock:
spin_unlock(&o2hb_live_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 468/713] ocfs2: fix cached cluster count after suballocator reclaim
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 467/713] ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 469/713] ocfs2: fix readdir position truncation on 32-bit kernels Greg Kroah-Hartman
` (255 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
commit 621c2bcb87548ff6fe7ec1116f9b27ed87fbeb48 upstream.
When reclaiming a suballocator block group, first reduce the on-disk
cluster count by cl_cpg. The current code then subtracts that new count
(fe->i_clusters) from the old cached count
(OCFS2_I(alloc_inode)->ip_clusters).
For an allocator with N block groups, that leaves the cache at
N * cl_cpg - (N * cl_cpg - cl_cpg) = cl_cpg
i.e. ip_clusters -= (fe->i_clusters - cl_cpg) leaves ip_clusters equal to
cl_cpg regardless of N. This happens to be correct when reclaiming from
two block groups, but undercounts the clusters from three block groups
onwards. The incorrect cache value is also used immediately to update
i_blocks.
Assign the updated on-disk count to the cache, matching the allocation and
inode refresh paths.
In a QEMU test using a clean 256 MiB OCFS2 image and a 10,000-file
create/delete workload, the first buggy reclaim left the on-disk
(fe->i_clusters) and cached (ip_clusters) counts at 2048 and 512 clusters
respectively; later reclaims underflowed the cache. With this change, the
cache matched the on-disk count across all four reclaims: 2048, 1536,
1024, and 512 clusters.
Link: https://lore.kernel.org/20260805113920.385959-1-matthias.goergens@gmail.com
Fixes: 4a54331616b3 ("ocfs2: give ocfs2 the ability to reclaim suballocator free bg")
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/suballoc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index a4a2b87a45fe..20c3aec6b987 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -2759,7 +2759,7 @@ static int _ocfs2_reclaim_suballoc_to_main(handle_t *handle,
fe->i_clusters = cpu_to_le32(tmp_used - le16_to_cpu(cl->cl_cpg));
spin_lock(&OCFS2_I(alloc_inode)->ip_lock);
- OCFS2_I(alloc_inode)->ip_clusters -= le32_to_cpu(fe->i_clusters);
+ OCFS2_I(alloc_inode)->ip_clusters = le32_to_cpu(fe->i_clusters);
fe->i_size = cpu_to_le64(ocfs2_clusters_to_bytes(alloc_inode->i_sb,
le32_to_cpu(fe->i_clusters)));
spin_unlock(&OCFS2_I(alloc_inode)->ip_lock);
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 469/713] ocfs2: fix readdir position truncation on 32-bit kernels
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 468/713] ocfs2: fix cached cluster count after suballocator reclaim Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 470/713] openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Greg Kroah-Hartman
` (254 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andreas Dilger, Jan Kara, Ojaswin Mujoo, Ritesh Harjani (IBM),
Ted Tso, zhangyi (F), Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit a63308ab426f3a3c7e33b02c150ea59054620261 upstream.
In ocfs2_dir_foreach_blk_el(), the directory cookie position is
rebuilt with
ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) | offset;
`ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is
unsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask
~(sb->s_blocksize - 1)
is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB
block size). In the AND expression with the 64-bit `ctx->pos`, that
unsigned operand is zero-extended to 64 bits per the usual arithmetic
conversions, yielding 0x00000000fffff000. The high 32 bits of
`ctx->pos` are silently cleared, even though directory size is
allowed to exceed 4 GiB.
When readdir() crosses the 4 GiB boundary on a 32-bit kernel the
position is reset back into the first 4 GiB block, making the
re-validation path re-enumerate already-returned dirents indefinitely.
This is ocfs2_dir_foreach_blk_el(), the extent-list readdir path taken
for all non-inline directories, so a directory large enough to cross
4 GiB reaches it.
This is the same class of bug that commit 3dce5bb82c97 ("exfat: Fix
bitwise operation having different size") fixed in exfat, and the
fix mirrors the equivalent ext4 fix in this series. Cast the operand
to loff_t so the mask is 64-bit before the AND:
ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) | offset;
64-bit kernels are unaffected.
Link: https://lore.kernel.org/20260806022044.167962-3-zhanxusheng@xiaomi.com
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Jan Kara <jack@suse.cz>
Cc: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Ted Ts'o <tytso@mit.edu>
Cc: "zhangyi (F)" <yi.zhang@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -1954,7 +1954,7 @@ static int ocfs2_dir_foreach_blk_el(stru
i += le16_to_cpu(de->rec_len);
}
offset = i;
- ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1))
+ ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1))
| offset;
*f_version = inode_query_iversion(inode);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 470/713] openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 469/713] ocfs2: fix readdir position truncation on 32-bit kernels Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 471/713] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
` (253 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Ahmet Memis, Stafford Horne
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet Memis <ali@iusegentoo.com>
commit 78004e9a87f240df03e2f73120d291763c32e0a7 upstream.
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.
l.lwz r29,0(r4)
l.lwz r27,0(r5)
l.sw 0(r4),r27
l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.
Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/openrisc/kernel/entry.S | 43 +++++++++++++++++++++++++++++++++++++++----
1 file changed, 39 insertions(+), 4 deletions(-)
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -1223,15 +1223,50 @@ _no_syscall_trace:
*
*/
+/* Keep this literal; hi()/lo() can't use the UL-suffixed TASK_SIZE. */
+#define OR1K_ATOMIC_ADDR_LIMIT 0x7ffffffc
+
ENTRY(sys_or1k_atomic)
/* FIXME: This ignores r3 and always does an XCHG */
+
+ /* Check both user pointers before accessing them. */
+ l.movhi r13,hi(OR1K_ATOMIC_ADDR_LIMIT)
+ l.ori r13,r13,lo(OR1K_ATOMIC_ADDR_LIMIT)
+ l.sfgtu r4,r13
+ l.bf 9f
+ l.nop
+ l.sfgtu r5,r13
+ l.bf 9f
+ l.nop
+
DISABLE_INTERRUPTS(r17,r19)
- l.lwz r29,0(r4)
- l.lwz r27,0(r5)
- l.sw 0(r4),r27
- l.sw 0(r5),r29
+10: l.lwz r29,0(r4)
+11: l.lwz r27,0(r5)
+12: l.sw 0(r4),r27
+13: l.sw 0(r5),r29
ENABLE_INTERRUPTS(r17)
l.jr r9
l.or r11,r0,r0
+ /*
+ * Either pointer was outside user space, or turned out to be
+ * unmapped/inaccessible when we actually touched it.
+ */
+9: l.jr r9
+ l.addi r11,r0,-EFAULT
+
+ .section .fixup, "ax"
+14:
+ ENABLE_INTERRUPTS(r17)
+ l.j 9b
+ l.nop
+ .previous
+
+ .section __ex_table, "a"
+ .long 10b, 14b
+ .long 11b, 14b
+ .long 12b, 14b
+ .long 13b, 14b
+ .previous
+
/* ============================================================[ EOF ]=== */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 471/713] openvswitch: Fix CT limit teardown use-after-free
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 470/713] openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 472/713] openvswitch: only skb_tx_error() a packet we are about to drop Greg Kroah-Hartman
` (252 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Nan Li, Yuqi Xu, Ren Wei,
Ilya Maximets, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuqi Xu <xuyuqiabc@gmail.com>
commit 403f96c32c9e24600093d7d0c61c17daeedca957 upstream.
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com
Co-developed-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.1787280296.git.xuyuqiabc@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/openvswitch/conntrack.c | 120 ++++++++++++++++++++++++++++----------------
net/openvswitch/conntrack.h | 6 +-
net/openvswitch/datapath.c | 10 +++
net/openvswitch/datapath.h | 8 ++
4 files changed, 98 insertions(+), 46 deletions(-)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -933,10 +933,14 @@ static int ovs_ct_check_limit(struct net
const struct ovs_conntrack_info *info)
{
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+ const struct ovs_ct_limit_info *ct_limit_info;
u32 per_zone_limit, connections;
u32 conncount_key;
+ ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
+ if (!ct_limit_info)
+ return 0;
+
conncount_key = info->zone.id;
per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
@@ -1585,40 +1589,55 @@ static void __ovs_ct_free_action(struct
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
{
+ struct ovs_ct_limit_info *info;
int i, err;
- ovs_net->ct_limit_info = kmalloc_obj(*ovs_net->ct_limit_info);
- if (!ovs_net->ct_limit_info)
+ info = kmalloc_obj(*info);
+ if (!info)
return -ENOMEM;
- ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
- ovs_net->ct_limit_info->limits =
+ info->default_limit = OVS_CT_LIMIT_DEFAULT;
+ info->limits =
kmalloc_objs(struct hlist_head, CT_LIMIT_HASH_BUCKETS);
- if (!ovs_net->ct_limit_info->limits) {
- kfree(ovs_net->ct_limit_info);
+ if (!info->limits) {
+ kfree(info);
return -ENOMEM;
}
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
- INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
+ INIT_HLIST_HEAD(&info->limits[i]);
- ovs_net->ct_limit_info->data = nf_conncount_init(net, sizeof(u32));
+ info->data = nf_conncount_init(net, sizeof(u32));
- if (IS_ERR(ovs_net->ct_limit_info->data)) {
- err = PTR_ERR(ovs_net->ct_limit_info->data);
- kfree(ovs_net->ct_limit_info->limits);
- kfree(ovs_net->ct_limit_info);
+ if (IS_ERR(info->data)) {
+ err = PTR_ERR(info->data);
+ kfree(info->limits);
+ kfree(info);
pr_err("openvswitch: failed to init nf_conncount %d\n", err);
return err;
}
+ rcu_assign_pointer(ovs_net->ct_limit_info, info);
return 0;
}
-static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
+static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net)
+{
+ return rcu_replace_pointer(ovs_net->ct_limit_info, NULL,
+ lockdep_ovsl_is_held());
+}
+
+/* The CT limit state must be detached by ovs_ct_limit_exit_start() and an
+ * RCU grace period must elapse before this function runs. The pernet core
+ * guarantees the grace period between the .pre_exit and .exit callbacks.
+ */
+static void ovs_ct_limit_exit_finish(struct net *net, void *data)
{
- const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
+ const struct ovs_ct_limit_info *info = data;
int i;
+ if (!info)
+ return;
+
nf_conncount_destroy(net, info->data);
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
struct hlist_head *head = &info->limits[i];
@@ -1626,7 +1645,7 @@ static void ovs_ct_limit_exit(struct net
struct hlist_node *next;
hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
- kfree_rcu(ct_limit, rcu);
+ kfree(ct_limit);
}
kfree(info->limits);
kfree(info);
@@ -1665,12 +1684,13 @@ static bool check_zone_id(int zone_id, u
return false;
}
-static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
- struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net,
+ struct nlattr *nla_zone_limit)
{
struct ovs_zone_limit *zone_limit;
- int rem;
+ struct ovs_ct_limit_info *info;
u16 zone;
+ int rem;
rem = NLA_ALIGN(nla_len(nla_zone_limit));
zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
@@ -1679,6 +1699,7 @@ static int ovs_ct_limit_set_zone_limit(s
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
info->default_limit = zone_limit->limit;
ovs_unlock();
} else if (unlikely(!check_zone_id(
@@ -1695,6 +1716,7 @@ static int ovs_ct_limit_set_zone_limit(s
ct_limit->limit = zone_limit->limit;
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
ct_limit_set(info, ct_limit);
ovs_unlock();
}
@@ -1709,12 +1731,13 @@ static int ovs_ct_limit_set_zone_limit(s
return 0;
}
-static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
- struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net,
+ struct nlattr *nla_zone_limit)
{
struct ovs_zone_limit *zone_limit;
- int rem;
+ struct ovs_ct_limit_info *info;
u16 zone;
+ int rem;
rem = NLA_ALIGN(nla_len(nla_zone_limit));
zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
@@ -1723,6 +1746,7 @@ static int ovs_ct_limit_del_zone_limit(s
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
info->default_limit = OVS_CT_LIMIT_DEFAULT;
ovs_unlock();
} else if (unlikely(!check_zone_id(
@@ -1730,6 +1754,7 @@ static int ovs_ct_limit_del_zone_limit(s
OVS_NLERR(true, "zone id is out of range");
} else {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
ct_limit_del(info, zone);
ovs_unlock();
}
@@ -1773,6 +1798,7 @@ static int __ovs_ct_limit_get_zone_limit
return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
}
+/* Called with RCU read lock held. */
static int ovs_ct_limit_get_zone_limit(struct net *net,
struct nlattr *nla_zone_limit,
struct ovs_ct_limit_info *info,
@@ -1796,12 +1822,10 @@ static int ovs_ct_limit_get_zone_limit(s
&zone))) {
OVS_NLERR(true, "zone id is out of range");
} else {
- rcu_read_lock();
limit = ct_limit_get(info, zone);
err = __ovs_ct_limit_get_zone_limit(
net, info->data, zone, limit, reply);
- rcu_read_unlock();
if (err)
return err;
}
@@ -1816,6 +1840,7 @@ static int ovs_ct_limit_get_zone_limit(s
return 0;
}
+/* Called with RCU read lock held. */
static int ovs_ct_limit_get_all_zone_limit(struct net *net,
struct ovs_ct_limit_info *info,
struct sk_buff *reply)
@@ -1828,19 +1853,16 @@ static int ovs_ct_limit_get_all_zone_lim
if (err)
return err;
- rcu_read_lock();
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
head = &info->limits[i];
hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
err = __ovs_ct_limit_get_zone_limit(net, info->data,
ct_limit->zone, ct_limit->limit, reply);
if (err)
- goto exit_err;
+ return err;
}
}
-exit_err:
- rcu_read_unlock();
return err;
}
@@ -1850,7 +1872,6 @@ static int ovs_ct_limit_cmd_set(struct s
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
@@ -1863,8 +1884,8 @@ static int ovs_ct_limit_cmd_set(struct s
goto exit_err;
}
- err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
- ct_limit_info);
+ err = ovs_ct_limit_set_zone_limit(ovs_net,
+ a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
if (err)
goto exit_err;
@@ -1884,7 +1905,6 @@ static int ovs_ct_limit_cmd_del(struct s
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
@@ -1897,8 +1917,8 @@ static int ovs_ct_limit_cmd_del(struct s
goto exit_err;
}
- err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
- ct_limit_info);
+ err = ovs_ct_limit_del_zone_limit(ovs_net,
+ a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
if (err)
goto exit_err;
@@ -1918,7 +1938,7 @@ static int ovs_ct_limit_cmd_get(struct s
struct ovs_header *ovs_reply_header;
struct net *net = sock_net(skb->sk);
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+ struct ovs_ct_limit_info *ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
@@ -1932,18 +1952,19 @@ static int ovs_ct_limit_cmd_get(struct s
goto exit_err;
}
+ rcu_read_lock();
+ ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
err = ovs_ct_limit_get_zone_limit(
net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
reply);
- if (err)
- goto exit_err;
} else {
err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
reply);
- if (err)
- goto exit_err;
}
+ rcu_read_unlock();
+ if (err)
+ goto exit_err;
nla_nest_end(reply, nla_reply);
genlmsg_end(reply, ovs_reply_header);
@@ -2016,12 +2037,29 @@ int ovs_ct_init(struct net *net)
#endif
}
-void ovs_ct_exit(struct net *net)
+/* Must be called with ovs_mutex held. Detaches the RCU-protected
+ * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for
+ * ovs_ct_exit_finish() to complete the teardown after an RCU grace period.
+ */
+void ovs_ct_exit_start(struct net *net __maybe_unused)
+{
+#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
+ struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+
+ ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net);
+#endif
+}
+
+/* Completes the CT limit teardown. The pernet core guarantees an RCU
+ * grace period between detaching the state in ovs_ct_exit_start() and
+ * this call, so no RCU readers remain.
+ */
+void ovs_ct_exit_finish(struct net *net)
{
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- ovs_ct_limit_exit(net, ovs_net);
+ ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data);
#endif
if (ovs_net->xt_label)
--- a/net/openvswitch/conntrack.h
+++ b/net/openvswitch/conntrack.h
@@ -14,7 +14,8 @@ enum ovs_key_attr;
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
int ovs_ct_init(struct net *);
-void ovs_ct_exit(struct net *);
+void ovs_ct_exit_start(struct net *net);
+void ovs_ct_exit_finish(struct net *net);
bool ovs_ct_verify(struct net *, enum ovs_key_attr attr);
int ovs_ct_copy_action(struct net *, const struct nlattr *,
const struct sw_flow_key *, struct sw_flow_actions **,
@@ -40,7 +41,8 @@ void ovs_ct_free_action(const struct nla
static inline int ovs_ct_init(struct net *net) { return 0; }
-static inline void ovs_ct_exit(struct net *net) { }
+static inline void ovs_ct_exit_start(struct net *net) { }
+static inline void ovs_ct_exit_finish(struct net *net) { }
static inline bool ovs_ct_verify(struct net *net, int attr)
{
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2756,6 +2756,13 @@ static void __net_exit list_vports_from_
}
}
+static void __net_exit ovs_pre_exit_net(struct net *dnet)
+{
+ ovs_lock();
+ ovs_ct_exit_start(dnet);
+ ovs_unlock();
+}
+
static void __net_exit ovs_exit_net(struct net *dnet)
{
struct datapath *dp, *dp_next;
@@ -2766,7 +2773,7 @@ static void __net_exit ovs_exit_net(stru
ovs_lock();
- ovs_ct_exit(dnet);
+ ovs_ct_exit_finish(dnet);
list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
__dp_destroy(dp);
@@ -2790,6 +2797,7 @@ static void __net_exit ovs_exit_net(stru
static struct pernet_operations ovs_net_ops = {
.init = ovs_init_net,
+ .pre_exit = ovs_pre_exit_net,
.exit = ovs_exit_net,
.id = &ovs_net_id,
.size = sizeof(struct ovs_net),
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -164,7 +164,10 @@ struct dp_upcall_info {
* Protected by genl_mutex.
* @dp_notify_work: A work notifier to handle port unregistering.
* @masks_rebalance: A work to periodically optimize flow table caches.
- * @ct_limit_info: A hash table of conntrack zone connection limits.
+ * @ct_limit_info: Hash table of conntrack zone connection limits. Protected
+ * by RCU; updates and teardown are serialized by ovs_mutex. May be NULL during
+ * netns teardown.
+ * @ct_limit_exit_data: CT limit state detached at .pre_exit, freed at .exit.
* @xt_label: Whether connlables are configured for the network or not.
*/
struct ovs_net {
@@ -172,7 +175,8 @@ struct ovs_net {
struct work_struct dp_notify_work;
struct delayed_work masks_rebalance;
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- struct ovs_ct_limit_info *ct_limit_info;
+ struct ovs_ct_limit_info __rcu *ct_limit_info;
+ struct ovs_ct_limit_info *ct_limit_exit_data;
#endif
bool xt_label;
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 472/713] openvswitch: only skb_tx_error() a packet we are about to drop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 471/713] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 473/713] ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Greg Kroah-Hartman
` (251 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Norbert Szetei, Ilya Maximets,
Jongmin Jang, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
commit 0dbc2398fca3bb33eda963849f865ddb1b3aa05e upstream.
queue_userspace_packet() borrows the packet skb -- it only copies it into
a private netlink message (user_skb) and does not own it; on return
do_execute_actions() keeps forwarding it through the flow's remaining
actions. Its error path nevertheless calls skb_tx_error(skb), which via
skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,
stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc
says "skb must be freed afterwards").
For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is
what makes esp_input() skb_cow_data() before in-place AEAD; once it is
stripped a later local ESP-in-UDP delivery decrypts in place over pages
the sender does not own -- an unprivileged page-cache write (the
"Fragnesia" primitive).
do_execute_actions() ignores output_userspace()'s return value, so any
action after a failed USERSPACE upcall inherits the stripped skb.
Move the skb_tx_error() to the flow-miss drop path - the "default"
branch of ovs_dp_process_packet()'s switch(error), before kfree_skb().
The call has been here since commit 36d5fe6a0007 ("core, nfqueue,
openvswitch: Orphan frags in skb_zerocopy and handle errors") but was
harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate
in-place decrypt; only then did stripping it on a still-forwarded skb
become a page-cache write primitive.
Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Tested-by: Jongmin Jang <payload.jang@gmail.com>
Link: https://patch.msgid.link/55A52703-7548-4A55-A9CE-2A37145BDCAD@doyensec.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/openvswitch/datapath.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -285,6 +285,7 @@ void ovs_dp_process_packet(struct sk_buf
consume_skb(skb);
break;
default:
+ skb_tx_error(skb);
kfree_skb(skb);
break;
}
@@ -601,8 +602,6 @@ static int queue_userspace_packet(struct
err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
user_skb = NULL;
out:
- if (err)
- skb_tx_error(skb);
consume_skb(user_skb);
consume_skb(nskb);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 473/713] ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 472/713] openvswitch: only skb_tx_error() a packet we are about to drop Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 474/713] arm64: compat: Fix decrementing LDM/STM alignment emulation Greg Kroah-Hartman
` (250 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 8a906c0b4f1ba123a95c166f644d2383bf30a420 upstream.
The cvt_legacy_sysex_to_ump() initialises only the first word of the
output packet and ORs the data bytes into it. The second word is left
alone, and the conversion context is kept across calls, so it still
carries the previous packet's bytes. Those stale bits corrupt the new
data. Any SysEx longer than six data bytes is affected.
A SysEx with the twelve data bytes 01..0c comes out as:
30160102 03040506
30260708 0b0e0f0e
The second packet declares six data bytes and four of them are wrong,
inside the declared length.
The sibling cvt_legacy_cmd_to_ump() already clears the second word. Do
the same here.
Fixes: 0b5288f5fe63 ("ALSA: ump: Add legacy raw MIDI support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260808014554.3550153-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/ump_convert.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/core/ump_convert.c
+++ b/sound/core/ump_convert.c
@@ -258,6 +258,7 @@ static int cvt_legacy_sysex_to_ump(struc
else
status = UMP_SYSEX_STATUS_CONTINUE;
*data = ump_compose(UMP_MSG_TYPE_DATA, group, status, cvt->len);
+ data[1] = 0;
offset = 8;
for (i = 0; i < cvt->len; i++) {
*data |= cvt->buf[i] << offset;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 474/713] arm64: compat: Fix decrementing LDM/STM alignment emulation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 473/713] ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 475/713] arm64: proton-pack: Restore the nospectre_bhb command-line option Greg Kroah-Hartman
` (249 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Karl Mehltretter,
Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit f5b8b9037df387394a73aab47c5437bbac975077 upstream.
The compat alignment emulator inherited unsigned long data addresses from
the 32-bit ARM implementation.
In do_alignment_ldmstm(), nr_regs is an unsigned int holding the transfer
size. The function uses the same address addition for both transfer
directions, negating nr_regs first for a decrementing LDM or STM. The
32-bit negation wraps before the addition, so the handler adds nearly
4 GiB instead of subtracting the transfer size.
The resulting address lies outside the compat task's address space, so
decrementing LDM/STM emulation fails, while incrementing forms work.
For example, a backwards-moving copy routine using decrementing LDM/STM can
take an alignment fault when called with unaligned pointers. The compat
handler should emulate the transfer, but this bug instead causes SIGBUS.
The offset negated in do_alignment_finish_ldst() is offset_union.un, which
is already unsigned long and does not have this width mismatch.
Make nr_regs unsigned long so its negation and the address arithmetic
use the same width.
Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads")
Cc: stable@vger.kernel.org
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/compat_alignment.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/kernel/compat_alignment.c
+++ b/arch/arm64/kernel/compat_alignment.c
@@ -114,8 +114,8 @@ do_alignment_ldrdstrd(unsigned long addr
static int
do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
{
- unsigned int rd, rn, nr_regs, regbits;
- unsigned long eaddr, newaddr;
+ unsigned int rd, rn, regbits;
+ unsigned long eaddr, newaddr, nr_regs;
unsigned int val;
/* count the number of registers in the mask to be transferred */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 475/713] arm64: proton-pack: Restore the nospectre_bhb command-line option
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 474/713] arm64: compat: Fix decrementing LDM/STM alignment emulation Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 476/713] ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Greg Kroah-Hartman
` (248 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit 2f6fc0612607c95489c960aaefc8cb5578cdab8c upstream.
Commit 7f1635737823 ("arm64: proton-pack: Fix hard lockup due to print in
scheduler context") moved the "mitigation disabled" printks into
spectre_print_disabled_mitigations(). For spectre-v2 and spectre-v4 only
the pr_info_once() calls were removed, but for spectre-bhb the whole
branch went with the print:
- } else if (cpu_mitigations_off() || __nospectre_bhb) {
- pr_info_once("spectre-bhb mitigation disabled ...\n");
spectre_bhb_enable_mitigation() therefore no longer tests __nospectre_bhb
or cpu_mitigations_off() and the mitigation is enabled regardless of the
command line. The parameter is still parsed and its flag is still checked
by spectre_print_disabled_mitigations(), so the kernel prints "spectre-bhb
mitigation disabled by command-line option" while
/sys/devices/system/cpu/vulnerabilities/spectre_v2 reports "Mitigation:
CSV2, BHB" and the vectors are switched to EL1_VECTOR_BHB_LOOP.
The only remaining escape is the SPECTRE_VULNERABLE arm at the top of the
chain, which a CSV2 core never reaches, so from Cortex-A76 and Neoverse N1
onwards both nospectre_bhb and mitigations=off are ignored. Both are
documented in Documentation/admin-guide/kernel-parameters.txt.
The identical mistake was made on the neighbouring compile-time-option
branch immediately before this regression and fixed shortly afterwards;
this command-line branch was missed.
build_bhb_mitigation() in arch/arm64/net/bpf_jit_comp.c still tests both
flags, so nospectre_bhb currently keeps the exception-vector loop while
dropping the cBPF epilogue mitigation.
Restore the check, folded into a spectre_bhb_mitigations_off() helper
alongside its spectre_v2/v4 counterparts, and use it for the boot-time
print in spectre_print_disabled_mitigations() as well. The print itself
already lives there and does not need restoring.
Tested under QEMU with -cpu neoverse-n1 (CSV2, no ECBHB, no CLRBHB).
Before, spectre_v2 read "Mitigation: CSV2, BHB" with and without the
option; after, nospectre_bhb and mitigations=off both give "Mitigation:
CSV2, but not BHB" and a boot without either is unchanged.
Fixes: 7f1635737823 ("arm64: proton-pack: Fix hard lockup due to print in scheduler context")
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/proton-pack.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/arch/arm64/kernel/proton-pack.c
+++ b/arch/arm64/kernel/proton-pack.c
@@ -1023,6 +1023,11 @@ static int __init parse_spectre_bhb_para
}
early_param("nospectre_bhb", parse_spectre_bhb_param);
+static bool spectre_bhb_mitigations_off(void)
+{
+ return __nospectre_bhb || cpu_mitigations_off();
+}
+
void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
{
bp_hardening_cb_t cpu_cb;
@@ -1036,6 +1041,8 @@ void spectre_bhb_enable_mitigation(const
/* No point mitigating Spectre-BHB alone. */
} else if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) {
/* Do nothing */
+ } else if (spectre_bhb_mitigations_off()) {
+ /* Mitigation disabled on the command line */
} else if (supports_ecbhb(SCOPE_LOCAL_CPU)) {
state = SPECTRE_MITIGATED;
set_bit(BHB_HW, &system_bhb_mitigations);
@@ -1201,6 +1208,6 @@ void spectre_print_disabled_mitigations(
if (spectre_v4_mitigations_off())
pr_info("spectre-v4 %s", spectre_disabled_suffix);
- if (__nospectre_bhb || cpu_mitigations_off())
+ if (spectre_bhb_mitigations_off())
pr_info("spectre-bhb %s", spectre_disabled_suffix);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 476/713] ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 475/713] arm64: proton-pack: Restore the nospectre_bhb command-line option Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 477/713] ASoC: codecs: aw88261: only check PLL and clock state at power-up Greg Kroah-Hartman
` (247 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christopher Tolang, Mark Brown
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Tolang <christophertolang@gmail.com>
commit e2aa5ad3be41accfcdcccc62348f21af7baa3a38 upstream.
This model requires an additional detection quirk to enable the internal
microphone.
Fixes: fa991481b8b2 ("ASoC: amd: add YC machine driver using dmic")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI Codex
Signed-off-by: Christopher Tolang <christophertolang@gmail.com>
Link: https://patch.msgid.link/20260823113221.19744-1-christophertolang@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -846,6 +846,13 @@ static const struct dmi_system_id yc_acp
{
.driver_data = &acp6x_card,
.matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Thin A15 B7UC"),
+ }
+ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
DMI_MATCH(DMI_PRODUCT_NAME, "M7601RM"),
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 477/713] ASoC: codecs: aw88261: only check PLL and clock state at power-up
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 476/713] ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 478/713] dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G Greg Kroah-Hartman
` (246 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jorijn van der Graaf, Mark Brown
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
commit 06b6f1245567a4be862c3e1cc74577922ceb05fb upstream.
The SYSST check performed during device start requires SWS (amplifier
switching, bit 8) and BSTS (boost finished, bit 9) on top of PLL lock
and clock stability. Those bits cannot be asserted at this point in the
sequence: the check runs after amppd release but before the
hmute/ULS-hmute release, and the amplifier neither switches nor
finishes ramping its boost converter while it is still muted. With the
Fairphone (Gen. 6) firmware profile, aw88261_dev_start() therefore
always fails with
check sysst fail, reg_val=0x0011, check:0x311
and playback aborts, even though the amplifier is fine and PLL lock
and stable clocks are present.
Check only PLL lock and clock stability, for which a definition
already exists; this still re-validates the clocks after amppd release
(aw88261_dev_check_syspll() checked them before it). This matches the
vendor aw882xx driver, which only validates PLL lock and clock
stability at this stage, and the in-tree aw88399 driver, which skips
the SWS check whenever the amplifier may legitimately not be switching
(AW88399_BIT_SYSST_NOSWS_CHECK).
Fixes: 028a2ae25691 ("ASoC: codecs: Add aw88261 amplifier driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Link: https://patch.msgid.link/20260704192857.88366-1-jorijnvdgraaf@catcrafts.net
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/aw88261.c | 6 +++---
sound/soc/codecs/aw88261.h | 6 ------
2 files changed, 3 insertions(+), 9 deletions(-)
--- a/sound/soc/codecs/aw88261.c
+++ b/sound/soc/codecs/aw88261.c
@@ -206,10 +206,10 @@ static int aw88261_dev_check_sysst(struc
return ret;
check_val = reg_val & (~AW88261_BIT_SYSST_CHECK_MASK)
- & AW88261_BIT_SYSST_CHECK;
- if (check_val != AW88261_BIT_SYSST_CHECK) {
+ & AW88261_BIT_PLL_CHECK;
+ if (check_val != AW88261_BIT_PLL_CHECK) {
dev_dbg(aw_dev->dev, "check sysst fail, reg_val=0x%04x, check:0x%x",
- reg_val, AW88261_BIT_SYSST_CHECK);
+ reg_val, AW88261_BIT_PLL_CHECK);
usleep_range(AW88261_2000_US, AW88261_2000_US + 10);
} else {
return 0;
--- a/sound/soc/codecs/aw88261.h
+++ b/sound/soc/codecs/aw88261.h
@@ -194,12 +194,6 @@
AW88261_OTHS_OT_VALUE | \
AW88261_PLLS_LOCKED_VALUE))
-#define AW88261_BIT_SYSST_CHECK \
- (AW88261_BSTS_FINISHED_VALUE | \
- AW88261_SWS_SWITCHING_VALUE | \
- AW88261_CLKS_STABLE_VALUE | \
- AW88261_PLLS_LOCKED_VALUE)
-
#define AW88261_ULS_HMUTE_START_BIT (14)
#define AW88261_ULS_HMUTE_BITS_LEN (1)
#define AW88261_ULS_HMUTE_MASK \
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 478/713] dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 477/713] ASoC: codecs: aw88261: only check PLL and clock state at power-up Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 479/713] hwmon: (max6621) fix negative temperature offset and crit readings Greg Kroah-Hartman
` (245 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Graf, Feng Tang,
Marek Szyprowski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Graf <graf@amazon.com>
commit 1476cca098f6d3a553fcec6fe9b7d86e15c00b59 upstream.
numa_cma=0:4G reserves nothing at all. dma_numa_cma_reserve() copies the
requested size into a local int before handing it to
cma_declare_contiguous_nid(), so 0x100000000 truncates to zero and the
loop skips the node silently. Both parameters are documented in
kernel-parameters.txt as nn[MG], so that is the syntax the documentation
invites.
Which bits survive decides what a request turns into: 4G, 8G and 16G
reserve nothing, 2G, 3G and 6G sign-extend into a size the allocator
rejects with a warning, and 5G quietly reserves 1G.
It reaches further than those parameters. On a CMA_SIZE_PERNUMA kernel
with no per-node parameter, dma_numa_cma_reserve() takes the per-node
size from the default area, so a plain cma=4G on a multi-node machine
feeds that size through the same local and loses every per-node area.
numa_cma_size[] and pernuma_size_bytes are both phys_addr_t, so use it
for the local too, and give early_numa_cma() separate variables for the
node id and the size while in there.
Fixes: d5cae2261b86 ("dma-contiguous: simplify numa cma area handling")
Cc: stable@vger.kernel.org
Assisted-by: Kiro:claude-opus-5
Signed-off-by: Alexander Graf <graf@amazon.com>
Reviewed-by: Feng Tang <feng.tang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260821224252.70640-1-graf@amazon.com
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/dma/contiguous.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
index f754079a287d..66093460584e 100644
--- a/kernel/dma/contiguous.c
+++ b/kernel/dma/contiguous.c
@@ -140,21 +140,22 @@ static bool numa_cma_configured __initdata;
static int __init early_numa_cma(char *p)
{
int nid, count = 0;
- unsigned long tmp;
+ unsigned long node;
+ phys_addr_t size;
char *s = p;
while (*s) {
- if (sscanf(s, "%lu%n", &tmp, &count) != 1)
+ if (sscanf(s, "%lu%n", &node, &count) != 1)
break;
if (s[count] == ':') {
- if (tmp >= MAX_NUMNODES)
+ if (node >= MAX_NUMNODES)
break;
- nid = array_index_nospec(tmp, MAX_NUMNODES);
+ nid = array_index_nospec(node, MAX_NUMNODES);
s += count + 1;
- tmp = memparse(s, &s);
- numa_cma_size[nid] = tmp;
+ size = memparse(s, &s);
+ numa_cma_size[nid] = size;
if (*s == ',')
s++;
@@ -207,9 +208,10 @@ static void __init dma_numa_cma_reserve(void)
pernuma_size_bytes = cma_get_size(dma_contiguous_default_area);
for_each_node(nid) {
- int size, ret;
+ phys_addr_t size;
char name[CMA_MAX_NAME];
struct cma **cma;
+ int ret;
if (!node_online(nid)) {
if (pernuma_size_bytes || numa_cma_size[nid])
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 479/713] hwmon: (max6621) fix negative temperature offset and crit readings
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 478/713] dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 480/713] hwmon: (max6621) fix temperature clamp range Greg Kroah-Hartman
` (244 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Guenter Roeck
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit acc52bd431e2d8698fae8d82a74ac45d79b62e0a upstream.
max6621_read() reads the CONFIG2 offset and the critical alert threshold
registers into a u32 and scales them without sign extension:
/* offset */ *val = (regval >> MAX6621_REG_TEMP_SHIFT) * 1000L;
/* crit */ *val = regval * 1000L;
Both attributes are writable and their write paths clamp to a negative
minimum and encode negative values, so a value written as negative is read
back as a large positive number. For example, writing a -10 degrees C
offset stores max6621_temp_mc2reg(-10000) = (-10 << 6) = 0xfd80; the read
then computes 0xfd80 >> 6 = 1014 -> 1014000 instead of -10000.
Cast the register value to s16 before scaling so the read preserves the
sign the write path encodes. The temperature input path already uses an s8
intermediate and is left unchanged.
Fixes: 92b64580f14b ("hwmon: (max6621) Add support for Maxim MAX6621 temperature sensor")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Link: https://lore.kernel.org/r/ad0baddbd6163cf73545c8e9273258136718585c.1786334038.git.congnt264@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/max6621.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/max6621.c
+++ b/drivers/hwmon/max6621.c
@@ -239,7 +239,7 @@ max6621_read(struct device *dev, enum hw
if (ret)
return ret;
- *val = (regval >> MAX6621_REG_TEMP_SHIFT) *
+ *val = ((s16)regval >> MAX6621_REG_TEMP_SHIFT) *
1000L;
break;
@@ -254,7 +254,7 @@ max6621_read(struct device *dev, enum hw
if (ret)
return ret;
- *val = regval * 1000L;
+ *val = (s16)regval * 1000L;
break;
case hwmon_temp_crit_alarm:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 480/713] hwmon: (max6621) fix temperature clamp range
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 479/713] hwmon: (max6621) fix negative temperature offset and crit readings Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 481/713] i2c: mxs: fix DMA channel leak on probe error Greg Kroah-Hartman
` (243 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Guenter Roeck
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit 24fbeb83d9b750a36da42cb835a154d80fd3d495 upstream.
MAX6621_TEMP_INPUT_MIN and MAX6621_TEMP_INPUT_MAX are used to clamp the
writable offset and critical thresholds. They are defined as -127000 and
128000.
The driver decodes the temperature through an s8 and its own comment in
max6621_read() documents an 8-bit two's complement value, whose range is
-128 to +127 degrees C. The current limits therefore reject the valid
-128 degrees C and accept +128 degrees C, which does not fit the 8-bit
range.
Correct the limits to -128000 and 127000.
Fixes: 92b64580f14b ("hwmon: (max6621) Add support for Maxim MAX6621 temperature sensor")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Link: https://lore.kernel.org/r/9d3a4f1895a47794bb359a2a32fb1ccd6a15812c.1786334038.git.congnt264@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/max6621.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/max6621.c
+++ b/drivers/hwmon/max6621.c
@@ -17,8 +17,8 @@
#define MAX6621_DRV_NAME "max6621"
#define MAX6621_TEMP_INPUT_REG_NUM 9
-#define MAX6621_TEMP_INPUT_MIN -127000
-#define MAX6621_TEMP_INPUT_MAX 128000
+#define MAX6621_TEMP_INPUT_MIN -128000
+#define MAX6621_TEMP_INPUT_MAX 127000
#define MAX6621_TEMP_ALERT_CHAN_SHIFT 1
#define MAX6621_TEMP_S0D0_REG 0x00
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 481/713] i2c: mxs: fix DMA channel leak on probe error
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 480/713] hwmon: (max6621) fix temperature clamp range Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 482/713] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Greg Kroah-Hartman
` (242 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Frank Li, Andi Shyti
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 777979e627115734052b323d2721cdb500e81dcf upstream.
mxs_i2c_probe() requests an exclusive DMA channel before resetting the
controller and registering the I2C adapter. If either later operation
fails, probe returns without releasing the channel because the remove
callback is not invoked after a failed probe.
Use devm_dma_request_chan() so the device core releases the channel on
probe failure and driver detach. Remove the manual release from the
remove callback because the channel is now device-managed.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 62885f59a261 ("MXS: Implement DMA support into mxs-i2c")
Assisted-by: unnamed:claude-opus-4.8 typestate
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Cc: <stable@vger.kernel.org> # v3.7+
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260815151720.3757460-1-ruoyuw560@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-mxs.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -839,7 +839,7 @@ static int mxs_i2c_probe(struct platform
}
/* Setup the DMA */
- i2c->dmach = dma_request_chan(dev, "rx-tx");
+ i2c->dmach = devm_dma_request_chan(dev, "rx-tx");
if (IS_ERR(i2c->dmach)) {
return dev_err_probe(dev, PTR_ERR(i2c->dmach),
"Failed to request dma\n");
@@ -877,9 +877,6 @@ static void mxs_i2c_remove(struct platfo
i2c_del_adapter(&i2c->adapter);
- if (i2c->dmach)
- dma_release_channel(i2c->dmach);
-
writel(MXS_I2C_CTRL0_SFTRST, i2c->regs + MXS_I2C_CTRL0_SET);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 482/713] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 481/713] i2c: mxs: fix DMA channel leak on probe error Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 483/713] lockd: pin next file across nlm_inspect_file lock-drop Greg Kroah-Hartman
` (241 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yifei Gao, Corey Minyard
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Gao <gyf161023@gmail.com>
commit 05ec76cfbce653e07cec19b9b8b20e33449d5d87 upstream.
Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
the command receivers from intf->cmd_rcvrs and freeing them, updating
only the comment that explains why the barrier is needed.
The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
rcvr->user from that lookup within the same read-side section. Without
the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
reader still holds a pointer to it, causing a use-after-free.
The rework only made srcu unnecessary for the interfaces list; the
cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
before freeing the receivers.
Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
Message-ID: <20260825234630.1196170-1-gyf161023@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ip
}
}
mutex_unlock(&intf->cmd_rcvrs_mutex);
+ synchronize_rcu();
while (rcvrs) {
rcvr = rcvrs;
rcvrs = rcvr->next;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 483/713] lockd: pin next file across nlm_inspect_file lock-drop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 482/713] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 484/713] lockd: fix NLMv4 GRANTED_MSG handling Greg Kroah-Hartman
` (240 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 526c49cff3f72c3ec74752016380c7567040581b upstream.
nlm_traverse_files() pins the current file with f_count++ across
a mutex_unlock for nlm_inspect_file(), but nothing pins the saved
next pointer. A concurrent nlm_release_file() can kfree the next
file during the unlock window, and the iterator dereferences freed
memory on the next loop step.
Pin both current and next before the lock-drop. Advance by
swapping the pinned cursors at the end of each iteration so next
is always held alive across the unlock.
Always call nlm_file_release() after dropping the iteration pin,
regardless of whether the file matched the predicate. Use
nlm_file_inuse(), which does a live walk of the inode lock list,
rather than the cached f_locks field, so skipped files that never
ran nlm_inspect_file() are evaluated correctly.
Because every file in a hash bucket is now pinned and released,
files skipped by the is_failover_file predicate that have no
locks, blocks, shares, or external references are deleted during
traversal. The old code never evaluated skipped files for
cleanup. The new behavior is intentional: such files are stale
and should not persist in the table.
Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svcsubs.c | 53 ++++++++++++++++++++++++++++++-----------------------
1 file changed, 30 insertions(+), 23 deletions(-)
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -350,12 +350,10 @@ nlm_file_inuse(struct nlm_file *file)
return 0;
}
-static void nlm_close_files(struct nlm_file *file)
+static void nlm_file_release(struct nlm_file *file)
{
- if (file->f_file[O_RDONLY])
- nlmsvc_ops->fclose(file->f_file[O_RDONLY]);
- if (file->f_file[O_WRONLY])
- nlmsvc_ops->fclose(file->f_file[O_WRONLY]);
+ if (!nlm_file_inuse(file))
+ nlm_delete_file(file);
}
/*
@@ -365,32 +363,41 @@ static int
nlm_traverse_files(void *data, nlm_host_match_fn_t match,
int (*is_failover_file)(void *data, struct nlm_file *file))
{
- struct hlist_node *next;
- struct nlm_file *file;
+ struct nlm_file *file, *next;
int i, ret = 0;
mutex_lock(&nlm_file_mutex);
for (i = 0; i < FILE_NRHASH; i++) {
- hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) {
- if (is_failover_file && !is_failover_file(data, file))
- continue;
+ file = hlist_entry_safe(nlm_files[i].first,
+ struct nlm_file, f_list);
+ if (file)
file->f_count++;
- mutex_unlock(&nlm_file_mutex);
+ while (file) {
+ /*
+ * Pin the next neighbour before we drop the mutex
+ * for nlm_inspect_file(); a concurrent
+ * nlm_release_file() under the same mutex would
+ * otherwise be free to unlink and kfree it during
+ * the unlock window, leaving us to dereference a
+ * freed slab when we walked to next afterwards.
+ */
+ next = hlist_entry_safe(file->f_list.next,
+ struct nlm_file, f_list);
+ if (next)
+ next->f_count++;
- /* Traverse locks, blocks and shares of this file
- * and update file->f_locks count */
- if (nlm_inspect_file(data, file, match))
- ret = 1;
+ if (!is_failover_file || is_failover_file(data, file)) {
+ mutex_unlock(&nlm_file_mutex);
- mutex_lock(&nlm_file_mutex);
- file->f_count--;
- /* No more references to this file. Let go of it. */
- if (list_empty(&file->f_blocks) && !file->f_locks
- && !file->f_shares && !file->f_count) {
- hlist_del(&file->f_list);
- nlm_close_files(file);
- kfree(file);
+ if (nlm_inspect_file(data, file, match))
+ ret = 1;
+
+ mutex_lock(&nlm_file_mutex);
}
+
+ file->f_count--;
+ nlm_file_release(file);
+ file = next;
}
}
mutex_unlock(&nlm_file_mutex);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 484/713] lockd: fix NLMv4 GRANTED_MSG handling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 483/713] lockd: pin next file across nlm_inspect_file lock-drop Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 485/713] lockd: fix NULL dereference on lockowner allocation failure Greg Kroah-Hartman
` (239 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, NeilBrown,
Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <okorniev@redhat.com>
commit 88e90d3f7e0251770e52d85c5319f037024b2c59 upstream.
GRANTED_MSG is a server-to-client callback, so it runs on the client,
where nfsd never registers nlmsvc_ops. The nlm4svc_lookup_host()
helper is for the server-side request handlers
(TEST/LOCK/CANCEL/UNLOCK), which reach nlmsvc_ops->fopen and must
reject requests when nfsd isn't running. GRANTED_MSG only calls
nlmclnt_grant(). Instead, of calling nlm4svc_lookup_host(), which
results in a client failing a GRANTED_MSG call, call
nlmsvc_lookup_host().
Fixes: 62721885e861 ("lockd: Use xdrgen XDR functions for the NLMv4 GRANTED_MSG procedure")
Cc: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Reviewed-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260625211852.31972-1-okorniev@redhat.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc4proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index 080dffce9d8e..b73004a7987e 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -872,7 +872,8 @@ static __be32 nlm4svc_proc_granted_msg(struct svc_rqst *rqstp)
struct nlm4_testargs_wrapper *argp = rqstp->rq_argp;
struct nlm_host *host;
- host = nlm4svc_lookup_host(rqstp, argp->xdrgen.alock.caller_name, false);
+ host = nlmsvc_lookup_host(rqstp, argp->xdrgen.alock.caller_name.data,
+ argp->xdrgen.alock.caller_name.len);
if (!host)
return rpc_system_err;
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 485/713] lockd: fix NULL dereference on lockowner allocation failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 484/713] lockd: fix NLMv4 GRANTED_MSG handling Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 486/713] lockd: fix swapped arguments in nlmsvc_match_ip() Greg Kroah-Hartman
` (238 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Trond Myklebust
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 4c7fc129db061c7daab841c4f3c342d894832362 upstream.
nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().
That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.
Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/clntproc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -487,9 +487,12 @@ static const struct file_lock_operations
static void nlmclnt_locks_init_private(struct file_lock *fl, struct nlm_host *host)
{
fl->fl_u.nfs_fl.state = 0;
+ fl->fl_ops = NULL;
fl->fl_u.nfs_fl.owner = nlmclnt_find_lockowner(host,
fl->c.flc_owner);
INIT_LIST_HEAD(&fl->fl_u.nfs_fl.list);
+ if (!fl->fl_u.nfs_fl.owner)
+ return;
fl->fl_ops = &nlmclnt_lock_ops;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 486/713] lockd: fix swapped arguments in nlmsvc_match_ip()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 485/713] lockd: fix NULL dereference on lockowner allocation failure Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 487/713] nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Greg Kroah-Hartman
` (237 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oscar Ou, Chuck Lever
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Ou <oscarou@synology.com>
commit b9060689f49dc663e9a3d069c4a65ff63a836e66 upstream.
When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,
nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server
sockaddr as the opaque @data argument:
nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);
The match callback is later invoked from nlm_traverse_locks() as:
match(lockhost, host);
where the first argument is the nlm_host that owns the lock, and the
second argument is the @data that was originally passed down (here the
server sockaddr). This is the convention every other match callback
relies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):
arg1 is the real nlm_host, arg2 is the caller-supplied reference value.
nlmsvc_match_ip() has had these two arguments reversed ever since the
unlock-by-IP feature was introduced in commit 4373ea84c84d ("lockd:
unlock lockd locks associated with a given server ip"):
return rpc_cmp_addr(nlm_srcaddr(host), datap);
Here @host is actually the server sockaddr, so nlm_srcaddr(host)
dereferences a struct sockaddr as a struct nlm_host and reads garbage
at the offset of h_srcaddr; meanwhile @datap is actually the lock
owner's nlm_host but is compared as a sockaddr. As a result the
comparison practically never matches and locks are not released for the
requested IP.
Swap the arguments so the lock owner's source address is compared
against the requested server address:
return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);
Fixes: 4373ea84c84d ("lockd: unlock lockd locks associated with a given server ip")
Cc: stable@vger.kernel.org
Signed-off-by: Oscar Ou <oscarou@synology.com>
[ cel: fix the misleading typedef parameter names too ]
Link: https://patch.msgid.link/20260617075738.1151797-1-oscarou@synology.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/lockd.h | 2 +-
fs/lockd/svcsubs.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/fs/lockd/lockd.h
+++ b/fs/lockd/lockd.h
@@ -314,7 +314,7 @@ void nsm_release(struct nsm_handle *n
* This is used in garbage collection and resource reclaim
* A return value != 0 means destroy the lock/block/share
*/
-typedef int (*nlm_host_match_fn_t)(void *cur, struct nlm_host *ref);
+typedef int (*nlm_host_match_fn_t)(void *owner, struct nlm_host *ref);
/*
* Server-side lock handling
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -557,7 +557,7 @@ EXPORT_SYMBOL_GPL(nlmsvc_unlock_all_by_s
static int
nlmsvc_match_ip(void *datap, struct nlm_host *host)
{
- return rpc_cmp_addr(nlm_srcaddr(host), datap);
+ return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);
}
/**
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 487/713] nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 486/713] lockd: fix swapped arguments in nlmsvc_match_ip() Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 488/713] nvme: zero the discard fallback page Greg Kroah-Hartman
` (236 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Laurence Oberman,
Justin Tee, Ewan D. Milne, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <emilne@redhat.com>
commit 22eb631bf86ee3246f47885e4fa94154a46863e4 upstream.
nvme_fc_create_hw_io_queues() will call __nvme_fc_delete_hw_queue() for the
last queue on which __nvme_fc_create_hw_queue() reported an error when deleting
all the io queues if they cannot all be created. This is incorrect since the
last queue did not actually get created.
The most recent change to this code was commit 17a1ec08ce70 ("nvme/fc: simplify
error handling of nvme_fc_create_hw_io_queues") which moved the cleanup to the
delete_queues: label and changed the loop bounds, however the code was not
correct prior to this change in a different way. The original commit
e399441de911 ("nvme-fabrics: Add host support for FC transport") had a
different error which called __nvme_fc_delete_hw_queue() on queue index 0 which
is used for the admin queue.
Fix this by correcting the initial loop index when deleting the io queues.
Fixes: 17a1ec08ce70 ("nvme/fc: simplify error handling of nvme_fc_create_hw_io_queues")
Fixes: e399441de911 ("nvme-fabrics: Add host support for FC transport")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2318,7 +2318,7 @@ nvme_fc_create_hw_io_queues(struct nvme_
return 0;
delete_queues:
- for (; i > 0; i--)
+ for (--i; i > 0; i--)
__nvme_fc_delete_hw_queue(ctrl, &ctrl->queues[i], i);
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 488/713] nvme: zero the discard fallback page
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 487/713] nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 489/713] nvme-pci: disable controller on admin queue IRQ setup failure Greg Kroah-Hartman
` (235 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit bededeaaeff404978a5a8e2a605a6c3017cddd3e upstream.
nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) *
NVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many ranges
the command declares, because some devices ignore the 'Number of Ranges'
field - the Fixes: commit records two that read past the declared ranges.
A single-range discard fills only the first 16 bytes.
Normally the buffer comes from kzalloc() and the other 4080 bytes are
zero. When that allocation fails the code falls back to the
per-controller ctrl->discard_page, which nvme_init_ctrl() obtains with
alloc_page(GFP_KERNEL) and nothing ever zeroes, so those 4080 bytes are
whatever the page last held and are handed to the controller. Reaching
it requires the kzalloc(GFP_ATOMIC | __GFP_NOWARN) to fail, that is
memory pressure; it is not remotely triggerable. Failing the allocation
under KMSAN reproduces it, with the leaked tail full of vmemmap struct
page pointers. The extent in the report is a partial transfer of the
payload, not the whole 4096 bytes; the 16-byte boundary in it is the one
declared range:
[ 11.991601] BUG: KMSAN: uninit-value in dma_map_phys+0x14c8/0x1900
[ 11.991969] dma_map_phys+0x14c8/0x1900
[ 11.992220] dma_map_page_attrs+0xcf/0x130
[ 11.992485] e1000_xmit_frame+0x4099/0x6d10
[ 11.992768] dev_hard_start_xmit+0x22f/0xa80
[ 11.993068] sch_direct_xmit+0x35c/0xcb0
[ 11.993315] __dev_queue_xmit+0x1ee5/0x5eb0
[ 11.993608] ip_finish_output2+0x1903/0x1c30
[ 11.993881] ip_finish_output+0x288/0x870
[ 11.994125] ip_output+0x15e/0x400
[ 11.994365] __ip_queue_xmit+0x1e85/0x1fb0
[ 11.994639] ip_queue_xmit+0x60/0x80
[ 11.994899] __tcp_transmit_skb+0x4e71/0x5fa0
[ 11.995210] tcp_write_xmit+0x3a36/0x9160
[ 11.995533] __tcp_push_pending_frames+0xc5/0x3c0
[ 11.995854] tcp_push+0x7dc/0x840
[ 11.996076] tcp_sendmsg_locked+0x766c/0x8400
[ 11.996371] tcp_sendmsg+0x4b/0x90
[ 11.996572] inet_sendmsg+0x134/0x2a0
[ 11.996823] __sock_sendmsg+0x265/0x360
[ 11.997076] sock_sendmsg+0x100/0x1e0
[ 11.997293] nvme_tcp_try_send+0x196f/0x6370
[ 11.997605] nvme_tcp_queue_rq+0x1d54/0x20b0
[ 11.997882] blk_mq_dispatch_rq_list+0x5ee/0x2e50
[ 11.998175] __blk_mq_sched_dispatch_requests+0x16dc/0x24a0
[ 11.998539] blk_mq_sched_dispatch_requests+0x11b/0x2c0
[ 11.998865] blk_mq_run_work_fn+0x13b/0x280
[ 11.999146] process_scheduled_works+0x966/0x1ad0
[ 11.999465] worker_thread+0xe44/0x1480
[ 11.999709] kthread+0x53b/0x600
[ 11.999927] ret_from_fork+0x29f/0x7c0
[ 12.000191] ret_from_fork_asm+0x1a/0x30
[ 12.000460]
[ 12.000558] Uninit was created at:
[ 12.000788] __alloc_frozen_pages_noprof+0x8bf/0xd30
[ 12.001096] alloc_pages_mpol+0x1d0/0x5f0
[ 12.001326] alloc_pages_noprof+0x102/0x290
[ 12.001627] nvme_init_ctrl+0x5a3/0x9f0
[ 12.001891] nvme_tcp_create_ctrl+0xd75/0x19b0
[ 12.002170] nvmf_dev_write+0x4c68/0x4fd0
[ 12.002426] vfs_write+0x587/0x1a10
[ 12.002636] __x64_sys_write+0x207/0x4f0
[ 12.002874] x64_sys_call+0x2ff0/0x3ea0
[ 12.003123] do_syscall_64+0x147/0x3b0
[ 12.003400] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 12.003680]
[ 12.003777] Bytes 16-2843 of 2844 are uninitialized
[ 12.004068] Memory access of size 2844 starts at ffff888109f82000
[ 12.004412]
[ 12.004530] CPU: 0 UID: 0 PID: 101 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMECTL-gf5098b6bae76 #1 PREEMPT(lazy)
[ 12.005127] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 12.005762] Workqueue: kblockd blk_mq_run_work_fn
[ 12.006073] =====================================================
Allocate the page with __GFP_ZERO. The single allocation site covers
every use of it: bytes no discard has written stay zero, and bytes one
did write hold that controller's own range list, which it has already
been sent.
Fixes: 530436c45ef2 ("nvme: Discard workaround for non-conformant devices")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5195,7 +5195,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctr
BUILD_BUG_ON(NVME_DSM_MAX_RANGES * sizeof(struct nvme_dsm_range) >
PAGE_SIZE);
- ctrl->discard_page = alloc_page(GFP_KERNEL);
+ ctrl->discard_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
if (!ctrl->discard_page) {
ret = -ENOMEM;
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 489/713] nvme-pci: disable controller on admin queue IRQ setup failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 488/713] nvme: zero the discard fallback page Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 490/713] nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Greg Kroah-Hartman
` (234 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Ijae Kim,
Myeonghun Pak, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 08660a5c8d497f43191635d97efd31cd35051f15 upstream.
nvme_pci_configure_admin_queue() enables the controller and then requests
the admin queue interrupt. If queue_request_irq() fails it returns without
disabling the controller, and no caller compensates: nvme_pci_enable() only
frees the IRQ vectors and calls pci_disable_device(), after which
nvme_dev_disable() treats the controller as dead and skips nvme_disable_ctrl().
The controller is left enabled (CC.EN set) on this error path.
Disable it in the failure path, while the PCI device is still enabled so the
CC.EN clear handshake completes.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: b60503ba432b ("NVMe: New driver")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2400,6 +2400,7 @@ static int nvme_pci_configure_admin_queu
result = queue_request_irq(nvmeq);
if (result) {
dev->online_queues--;
+ nvme_disable_ctrl(&dev->ctrl, false);
return result;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 490/713] nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 489/713] nvme-pci: disable controller on admin queue IRQ setup failure Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 491/713] nvme-tcp: fix host memory disclosure on R2T for a read command Greg Kroah-Hartman
` (233 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36 upstream.
Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes
processing") established that blk_rq_payload_bytes() must not be read
without first checking blk_rq_nr_phys_segments(), and recorded the
result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side
was left as it was.
The two differ for REQ_OP_WRITE_ZEROES, which has no physical segments
but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched
while the receive gate lets a C2HData through and nvme_tcp_recv_data()
copies into whatever the previous command on that tag left there. The
driver-private area is zeroed only when the tag set is allocated.
Reproduced with a test target that leaves a residual iterator on a tag
and then sends a C2HData for a WRITE_ZEROES command on the same tag:
BUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330
Write of size 512 at addr ffe728c2175dfa81 by task kworker/0:1H/103
CPU: 0 UID: 0 PID: 103 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme_tcp_wq nvme_tcp_io_work
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
kasan_report+0xce/0x100
? _copy_to_iter+0x642/0x1330
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x3c/0x60
_copy_to_iter+0x642/0x1330
? __pfx_sock_has_perm+0x10/0x10
? worker_thread+0x45b/0xd10
? __pfx__copy_to_iter+0x10/0x10
? _raw_spin_lock_bh+0x83/0xe0
? __pfx__raw_spin_lock_bh+0x10/0x10
__skb_datagram_iter+0xf3/0x820
? __pfx_simple_copy_to_iter+0x10/0x10
? __asan_memcpy+0x3c/0x60
? skb_copy_bits+0x58d/0x830
skb_copy_datagram_iter+0x37/0x120
nvme_tcp_recv_skb+0xa07/0x4320
? __pfx_nvme_tcp_recv_skb+0x10/0x10
__tcp_read_sock+0x1ab/0x810
? __pfx_nvme_tcp_recv_skb+0x10/0x10
? __pfx_lock_sock_nested+0x10/0x10
? __pfx___tcp_read_sock+0x10/0x10
nvme_tcp_try_recv+0x152/0x1e0
? __pfx_nvme_tcp_try_recv+0x10/0x10
? __pfx_mutex_unlock+0x10/0x10
nvme_tcp_io_work+0x1e4/0x6c0
? __schedule+0x181a/0x49f0
? __pfx_nvme_tcp_io_work+0x10/0x10
process_one_work+0x633/0x1030
Keep the blk_rq_payload_bytes() test and add req->data_len to it. The
old test is what rejects a C2HData naming a tag that is no longer in
flight, because blk_update_request() zeroes rq->__data_len on
completion; req->data_len and req->curr_bio are driver-private and
survive completion, so they cannot stand in for it. Setup initialises
the iterator only when both req->curr_bio and req->data_len are set, so
the gate now tests the same two.
Fixes: 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes processing")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/tcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -644,6 +644,7 @@ static int nvme_tcp_process_nvme_cqe(str
static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue,
struct nvme_tcp_data_pdu *pdu)
{
+ struct nvme_tcp_request *req;
struct request *rq;
rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
@@ -654,7 +655,8 @@ static int nvme_tcp_handle_c2h_data(stru
return -ENOENT;
}
- if (!blk_rq_payload_bytes(rq)) {
+ req = blk_mq_rq_to_pdu(rq);
+ if (!blk_rq_payload_bytes(rq) || !req->curr_bio || !req->data_len) {
dev_err(queue->ctrl->ctrl.device,
"queue %d tag %#x unexpected data\n",
nvme_tcp_queue_id(queue), rq->tag);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 491/713] nvme-tcp: fix host memory disclosure on R2T for a read command
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 490/713] nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 492/713] nvme-tcp: reject a read that transferred too few bytes Greg Kroah-Hartman
` (232 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 6efbc52237facda35d2d874fe1765bb4839275d8 upstream.
nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.
The command then completes normally and nothing is logged.
Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.
Reject an R2T for a request that is not a write.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/tcp.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -750,6 +750,13 @@ static int nvme_tcp_handle_r2t(struct nv
}
req = blk_mq_rq_to_pdu(rq);
+ if (unlikely(rq_data_dir(rq) != WRITE)) {
+ dev_err(queue->ctrl->ctrl.device,
+ "req %d unexpected r2t for a non-write command\n",
+ rq->tag);
+ return -EPROTO;
+ }
+
if (unlikely(!r2t_length)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len is %u, probably a bug...\n",
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 492/713] nvme-tcp: reject a read that transferred too few bytes
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 491/713] nvme-tcp: fix host memory disclosure on R2T for a read command Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 493/713] sctp: stop processing a packet once its association is deleted Greg Kroah-Hartman
` (231 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Keith Busch
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12 upstream.
nvme_tcp_recv_data() completes a request once the current C2HData PDU
has been consumed. Nothing compares the total bytes received against
the length the command asked for: struct nvme_tcp_request has no
receive-side counter, queue->data_remaining is per queue, and
blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally
with no residual concept anywhere above.
A controller can therefore answer a 4096-byte read with 512 bytes and
have it reported as a complete read; user space then gets 4096 bytes of
which 3584 are whatever was already in the page. I reproduced that with
a test target.
Count the bytes received and refuse to complete a successful read whose
count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in
nvme_tcp_process_nvme_cqe(). The success test shifts req->status right
by one, because the driver keeps the wire value there and shifts it on
completion, so the check must see what the completion path will see.
Only REQ_OP_READ is checked, because there the length comes from the
sectors the request covers; a passthrough command is built by its
submitter, which picks both command and buffer, so the kernel has
nothing to compare against.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/tcp.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -80,6 +80,7 @@ struct nvme_tcp_request {
struct bio *curr_bio;
struct iov_iter iter;
+ u32 data_recvd;
/* send state */
size_t offset;
@@ -615,6 +616,29 @@ static void nvme_tcp_error_recovery(stru
queue_work(nvme_reset_wq, &to_tcp_ctrl(ctrl)->err_work);
}
+/*
+ * NVMe has no short read: a read that completes successfully must
+ * have transferred everything it asked for.
+ */
+static bool nvme_tcp_data_in_short(struct nvme_tcp_queue *queue,
+ struct request *rq)
+{
+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+
+ if (le16_to_cpu(req->status) >> 1)
+ return false;
+ if (req_op(rq) != REQ_OP_READ || !req->data_len)
+ return false;
+ if (likely(req->data_recvd == req->data_len))
+ return false;
+
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d tag %#x short data-in: got %u of %u\n",
+ nvme_tcp_queue_id(queue), rq->tag,
+ req->data_recvd, req->data_len);
+ return true;
+}
+
static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue,
struct nvme_completion *cqe)
{
@@ -634,6 +658,9 @@ static int nvme_tcp_process_nvme_cqe(str
if (req->status == cpu_to_le16(NVME_SC_SUCCESS))
req->status = cqe->status;
+ if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+ return -EPROTO;
+
if (!nvme_try_complete_req(rq, req->status, cqe->result))
nvme_complete_rq(rq);
queue->nr_cqe++;
@@ -965,6 +992,7 @@ static int nvme_tcp_recv_data(struct nvm
*len -= recv_len;
*offset += recv_len;
queue->data_remaining -= recv_len;
+ req->data_recvd += recv_len;
}
if (!queue->data_remaining) {
@@ -973,6 +1001,8 @@ static int nvme_tcp_recv_data(struct nvm
queue->ddgst_remaining = NVME_TCP_DIGEST_LENGTH;
} else {
if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) {
+ if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+ return -EPROTO;
nvme_tcp_end_request(rq,
le16_to_cpu(req->status));
queue->nr_cqe++;
@@ -1021,6 +1051,9 @@ static int nvme_tcp_recv_ddgst(struct nv
pdu->command_id);
struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+ if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+ return -EPROTO;
+
nvme_tcp_end_request(rq, le16_to_cpu(req->status));
queue->nr_cqe++;
}
@@ -2753,6 +2786,7 @@ static blk_status_t nvme_tcp_setup_cmd_p
req->status = cpu_to_le16(NVME_SC_SUCCESS);
req->offset = 0;
req->data_sent = 0;
+ req->data_recvd = 0;
req->pdu_len = 0;
req->pdu_sent = 0;
req->h2cdata_left = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 493/713] sctp: stop processing a packet once its association is deleted
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 492/713] nvme-tcp: reject a read that transferred too few bytes Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 494/713] sctp: drop a chunk if its transport was removed Greg Kroah-Hartman
` (230 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Xin Long,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 47e15a8d12e366d0d261bcbc394394f44418938d upstream.
sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is
NULL, and caches the result in chunk->asoc and chunk->transport without
taking a reference.
A packet that matches no association is handed to the endpoint, so a peer
can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The
COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and
with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),
so the association and its transports are freed.
The endpoint loop has no counterpart to the asoc->base.dead check in
sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed
transport and is then passed to sctp_do_sm() with the freed association.
The transport is freed through RCU, so this needs the packet to come off
the socket backlog, where the loop runs in task context.
The endpoint loop cannot do the same check: it holds no reference on the
association, so reading asoc->base.dead would itself be a use-after-free.
Mark the packet for discard in the command interpreter, just before it
deletes the association. That is also before sctp_inq_free() releases the
chunk on the association receive path.
sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary
association, while the one the packet belongs to stays alive. A restarting
peer can bundle DATA behind its COOKIE ECHO, so compare against
chunk->asoc and leave that case alone.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/an-YYtoqw1QpTXUL@v4bel
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/sm_sideeffect.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1332,6 +1332,10 @@ static int sctp_cmd_interpreter(enum sct
sctp_outq_uncork(&asoc->outqueue, gfp);
local_cork = 0;
}
+ /* No chunk left in this packet may use this asoc. */
+ if (event_type == SCTP_EVENT_T_CHUNK &&
+ chunk->asoc == asoc)
+ chunk->pdiscard = 1;
/* Delete the current association. */
sctp_cmd_delete_tcb(commands, asoc);
asoc = NULL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 494/713] sctp: drop a chunk if its transport was removed
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 493/713] sctp: stop processing a packet once its association is deleted Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 495/713] sctp: fix NULL deref on untransmitted RECONF completion Greg Kroah-Hartman
` (229 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Xin Long,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 03a9d10ecf71f54b2af8020935f2033d4a132be5 upstream.
sctp_rcv() resolves the transport once per packet and leaves it in
chunk->transport. The lookup reference, or the one sctp_add_backlog() takes
if the socket is owned by userspace, keeps it around until the chunk has
been processed.
An authenticated ASCONF DEL-IP can remove it in the meantime.
sctp_assoc_rm_peer() takes the transport out of the association and calls
sctp_transport_free(), which tags it dead and drops the reference the
association held. There is a window on both paths: the packet can sit on
the socket backlog, and on the direct path the lookup completes before
bh_lock_sock().
The DATA chunk in that packet puts the removed transport back into
asoc->peer.last_data_from. Once the packet is done that reference goes
away and the transport is freed by RCU, so the next delayed SACK carries
the pointer into the SACK chunk and sctp_outq_select_transport() reads the
freed transport's state.
Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check.
Both paths reach it with the association's socket lock held. The peer
retransmits it.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/aoUJHQmxL0LFIMCw@v4bel
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/inqueue.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -71,8 +71,11 @@ void sctp_inq_free(struct sctp_inq *queu
*/
void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
{
- /* Directly call the packet handling routine. */
- if (chunk->rcvr->dead) {
+ /* Directly call the packet handling routine. Drop the chunk if the
+ * receiver or the transport it was looked up on is gone.
+ */
+ if (chunk->rcvr->dead ||
+ (chunk->transport && chunk->transport->dead)) {
sctp_chunk_free(chunk);
return;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 495/713] sctp: fix NULL deref on untransmitted RECONF completion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 494/713] sctp: drop a chunk if its transport was removed Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 496/713] sctp: distinguish sequence zero from wildcard in reconf lookup Greg Kroah-Hartman
` (228 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Xin Long, Weiming Shi,
Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec upstream.
sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
sctp_process_strreset_resp() complete a pending stream reconfiguration
request by stopping the reconf timer on the transport it was sent on:
t = asoc->strreset_chunk->transport;
if (timer_delete(&t->reconf_timer))
sctp_transport_put(t);
chunk->transport is assigned by __sctp_packet_append_chunk() when the
chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
the reconf timer at that same point. A request already published in
asoc->strreset_chunk but not yet transmitted has neither, so completing
it dereferences NULL.
Two ways to get there. sctp_send_asconf_del_ip() sets
asoc->src_out_of_asoc_ok without sending anything when the address being
removed is the association's last one, and sctp_outq_flush_ctrl() then
leaves every non-ASCONF control chunk queued; as only
sctp_process_asconf_ack() clears that flag, it persists. An unprivileged
process that removes such an address and then asks for a stream reset
panics the kernel from softirq. A peer needs neither ASCONF nor local
help: sctp_cmd_interpreter() uncorks the outqueue only once the whole
packet has been processed, so a reply built while walking a RECONF chunk
stays untransmitted for the rest of that walk, and one RECONF chunk
carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
Response] -- or two RECONF chunks in one packet -- reaches the same
dereference.
KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
RIP: 0010:timer_delete+0x67/0x110
Call Trace:
<IRQ>
sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)
sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)
sctp_do_sm (net/sctp/sm_sideeffect.c:1172)
sctp_assoc_bh_rcv (net/sctp/associola.c:1044)
sctp_rcv (net/sctp/input.c:243)
ip_local_deliver (net/ipv4/ip_input.c:262)
process_backlog (net/core/dev.c:6680)
</IRQ>
A response can only acknowledge a request that was actually sent, so do
not match asoc->strreset_chunk while chunk->transport is NULL. Guarding
the lookup covers all three completion sites.
Fixes: 810544764536 ("sctp: implement receiver-side procedures for the Outgoing SSN Reset Request Parameter")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei <xmei5@asu.edu>
Suggested-by: Xin Long <lucien.xin@gmail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260823172857.896146-2-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -488,7 +488,7 @@ static struct sctp_paramhdr *sctp_chunk_
struct sctp_reconf_chunk *hdr;
union sctp_params param;
- if (!chunk)
+ if (!chunk || !chunk->transport)
return NULL;
hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 496/713] sctp: distinguish sequence zero from wildcard in reconf lookup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 495/713] sctp: fix NULL deref on untransmitted RECONF completion Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 497/713] sctp: fix stream->outcnt underflow on duplicate RECONF responses Greg Kroah-Hartman
` (227 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Simon Horman, Xin Long,
Jun Yang, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yang <junvyyang@tencent.com>
commit 63f44178f0a0f86060c9b576d6efab8a3ffa403e upstream.
Zero is a valid response sequence after strreset_outseq wraps, but
sctp_chunk_lookup_strreset_param() currently treats it as a wildcard.
Add match_seq so response lookups match zero exactly while the one
type-only lookup can still ignore the sequence.
Fixes: 50a41591f110 ("sctp: implement receiver-side procedures for the Add Outgoing Streams Request Parameter")
Cc: stable@kernel.org
Suggested-by: Simon Horman <horms@kernel.org>
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Jun Yang <junvyyang@tencent.com>
Link: https://patch.msgid.link/20260824081832.98717-2-juny24602@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/stream.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -482,7 +482,7 @@ out:
static struct sctp_paramhdr *sctp_chunk_lookup_strreset_param(
struct sctp_association *asoc, __be32 resp_seq,
- __be16 type)
+ __be16 type, bool match_seq)
{
struct sctp_chunk *chunk = asoc->strreset_chunk;
struct sctp_reconf_chunk *hdr;
@@ -499,7 +499,7 @@ static struct sctp_paramhdr *sctp_chunk_
*/
struct sctp_strreset_tsnreq *req = param.v;
- if ((!resp_seq || req->request_seq == resp_seq) &&
+ if ((!match_seq || req->request_seq == resp_seq) &&
(!type || type == req->param_hdr.type))
return param.v;
}
@@ -564,7 +564,7 @@ struct sctp_chunk *sctp_process_strreset
if (asoc->strreset_chunk) {
if (!sctp_chunk_lookup_strreset_param(
asoc, outreq->response_seq,
- SCTP_PARAM_RESET_IN_REQUEST)) {
+ SCTP_PARAM_RESET_IN_REQUEST, true)) {
/* same process with outstanding isn't 0 */
result = SCTP_STRRESET_ERR_IN_PROGRESS;
goto out;
@@ -816,7 +816,7 @@ struct sctp_chunk *sctp_process_strreset
if (asoc->strreset_chunk) {
if (!sctp_chunk_lookup_strreset_param(
- asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
+ asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS, false)) {
/* same process with outstanding isn't 0 */
result = SCTP_STRRESET_ERR_IN_PROGRESS;
goto out;
@@ -927,7 +927,8 @@ struct sctp_chunk *sctp_process_strreset
struct sctp_paramhdr *req;
__u32 result;
- req = sctp_chunk_lookup_strreset_param(asoc, resp->response_seq, 0);
+ req = sctp_chunk_lookup_strreset_param(asoc, resp->response_seq, 0,
+ true);
if (!req)
return NULL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 497/713] sctp: fix stream->outcnt underflow on duplicate RECONF responses
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 496/713] sctp: distinguish sequence zero from wildcard in reconf lookup Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 498/713] power: supply: bq24257: fix use-after-free on remove Greg Kroah-Hartman
` (226 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, TencentOS Corvus AI,
Xin Long, Jun Yang, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yang <junvyyang@tencent.com>
commit 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e upstream.
A cached RECONF chunk may contain more than one request parameter. A
duplicate response can therefore find and process the same ADD_OUT request
again while another parameter is still outstanding, rolling back outcnt
twice and possibly underflowing it.
Track outstanding request types as bits and clear each bit after its first
response. Later responses for the same request are then ignored.
Fixes: 11ae76e67a17 ("sctp: implement receiver-side procedures for the Reconf Response Parameter")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Link: https://lore.kernel.org/netdev/20260730110225.37371-1-juny24602@gmail.com/
Suggested-by: Xin Long <lucien.xin@gmail.com>
Assisted-by: tencentos-corvus-ai:kimi-k3
Signed-off-by: Jun Yang <junvyyang@tencent.com>
Link: https://patch.msgid.link/20260824081832.98717-3-juny24602@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/sctp/structs.h | 2 +-
net/sctp/stream.c | 39 ++++++++++++++++++++++++++++-----------
2 files changed, 29 insertions(+), 12 deletions(-)
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -2057,7 +2057,7 @@ struct sctp_association {
force_delay:1;
__u8 strreset_enable;
- __u8 strreset_outstanding; /* request param count on the fly */
+ __u8 strreset_outstanding; /* request param bitmask on the fly */
__u32 strreset_outseq; /* Update after receiving response */
__u32 strreset_inseq; /* Update after receiving request */
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -22,6 +22,15 @@
#include <net/sctp/sm.h>
#include <net/sctp/stream_sched.h>
+#define SCTP_STRRESET_MASK(type) \
+ BIT(ntohs(type) - ntohs(SCTP_PARAM_RESET_OUT_REQUEST))
+#define SCTP_STRRESET_TEST(asoc, type) \
+ ((asoc)->strreset_outstanding & SCTP_STRRESET_MASK(type))
+#define SCTP_STRRESET_SET(asoc, type) \
+ ((asoc)->strreset_outstanding |= SCTP_STRRESET_MASK(type))
+#define SCTP_STRRESET_CLEAR(asoc, type) \
+ ((asoc)->strreset_outstanding &= ~SCTP_STRRESET_MASK(type))
+
static void sctp_stream_shrink_out(struct sctp_stream *stream, __u16 outcnt)
{
struct sctp_association *asoc;
@@ -372,7 +381,10 @@ int sctp_send_reset_streams(struct sctp_
goto out;
}
- asoc->strreset_outstanding = out + in;
+ if (out)
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_OUT_REQUEST);
+ if (in)
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_IN_REQUEST);
out:
return retval;
@@ -417,7 +429,7 @@ int sctp_send_reset_assoc(struct sctp_as
return retval;
}
- asoc->strreset_outstanding = 1;
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_TSN_REQUEST);
return 0;
}
@@ -474,7 +486,10 @@ int sctp_send_add_streams(struct sctp_as
goto out;
}
- asoc->strreset_outstanding = !!out + !!in;
+ if (out)
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_ADD_OUT_STREAMS);
+ if (in)
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_ADD_IN_STREAMS);
out:
return retval;
@@ -564,13 +579,14 @@ struct sctp_chunk *sctp_process_strreset
if (asoc->strreset_chunk) {
if (!sctp_chunk_lookup_strreset_param(
asoc, outreq->response_seq,
- SCTP_PARAM_RESET_IN_REQUEST, true)) {
+ SCTP_PARAM_RESET_IN_REQUEST, true) ||
+ !SCTP_STRRESET_TEST(asoc, SCTP_PARAM_RESET_IN_REQUEST)) {
/* same process with outstanding isn't 0 */
result = SCTP_STRRESET_ERR_IN_PROGRESS;
goto out;
}
- asoc->strreset_outstanding--;
+ SCTP_STRRESET_CLEAR(asoc, SCTP_PARAM_RESET_IN_REQUEST);
asoc->strreset_outseq++;
if (!asoc->strreset_outstanding) {
@@ -669,7 +685,7 @@ struct sctp_chunk *sctp_process_strreset
SCTP_SO(stream, i)->state = SCTP_STREAM_CLOSED;
asoc->strreset_chunk = chunk;
- asoc->strreset_outstanding = 1;
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_OUT_REQUEST);
sctp_chunk_hold(asoc->strreset_chunk);
result = SCTP_STRRESET_PERFORMED;
@@ -816,13 +832,14 @@ struct sctp_chunk *sctp_process_strreset
if (asoc->strreset_chunk) {
if (!sctp_chunk_lookup_strreset_param(
- asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS, false)) {
+ asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS, false) ||
+ !SCTP_STRRESET_TEST(asoc, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
/* same process with outstanding isn't 0 */
result = SCTP_STRRESET_ERR_IN_PROGRESS;
goto out;
}
- asoc->strreset_outstanding--;
+ SCTP_STRRESET_CLEAR(asoc, SCTP_PARAM_RESET_ADD_IN_STREAMS);
asoc->strreset_outseq++;
if (!asoc->strreset_outstanding) {
@@ -899,7 +916,7 @@ struct sctp_chunk *sctp_process_strreset
goto out;
asoc->strreset_chunk = chunk;
- asoc->strreset_outstanding = 1;
+ SCTP_STRRESET_SET(asoc, SCTP_PARAM_RESET_ADD_OUT_STREAMS);
sctp_chunk_hold(asoc->strreset_chunk);
stream->outcnt = outcnt;
@@ -929,7 +946,7 @@ struct sctp_chunk *sctp_process_strreset
req = sctp_chunk_lookup_strreset_param(asoc, resp->response_seq, 0,
true);
- if (!req)
+ if (!req || !SCTP_STRRESET_TEST(asoc, req->type))
return NULL;
result = ntohl(resp->result);
@@ -1079,7 +1096,7 @@ struct sctp_chunk *sctp_process_strreset
nums, 0, GFP_ATOMIC);
}
- asoc->strreset_outstanding--;
+ SCTP_STRRESET_CLEAR(asoc, req->type);
asoc->strreset_outseq++;
/* remove everything for this reconf request */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 498/713] power: supply: bq24257: fix use-after-free on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 497/713] sctp: fix stream->outcnt underflow on duplicate RECONF responses Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 499/713] power: supply: bq256xx: drain usb_work before freeing the charger Greg Kroah-Hartman
` (225 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 9d34c9d660c3d0931d2cc749c46c47cf31f96e48 upstream.
The STAT-pin interrupt is devm-managed, so it stays armed until the devm
cleanup that runs after remove() returns. remove() cancels
bq->iilimit_setup_work while the threaded handler can still fire; that
handler reschedules the work and dereferences bq, so the work runs
against freed memory once devm frees bq.
Make the delayed work device-managed with devm_delayed_work_autocancel(),
registered before the interrupt request. The devm cleanup then releases
the interrupt first, so the handler can no longer reschedule the work,
and cancels the work before bq is freed. The explicit
cancel_delayed_work_sync() in remove() is no longer needed and is dropped.
Found by static analysis.
Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260731143554.334179-1-fanwu01@zju.edu.cn
Link: https://patch.msgid.link/20260801051958.354528-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/bq24257_charger.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/drivers/power/supply/bq24257_charger.c
+++ b/drivers/power/supply/bq24257_charger.c
@@ -18,6 +18,7 @@
#include <linux/gpio/consumer.h>
#include <linux/interrupt.h>
#include <linux/delay.h>
+#include <linux/devm-helpers.h>
#include <linux/acpi.h>
#include <linux/of.h>
@@ -1003,10 +1004,6 @@ static int bq24257_probe(struct i2c_clie
if (bq->info->chip == BQ24250)
bq->iilimit_autoset_enable = false;
- if (bq->iilimit_autoset_enable)
- INIT_DELAYED_WORK(&bq->iilimit_setup_work,
- bq24257_iilimit_setup_work);
-
/*
* The BQ24250 doesn't have a dedicated Power Good (PG) pin so let's
* not probe for it and instead use a SW-based approach to determine
@@ -1047,6 +1044,14 @@ static int bq24257_probe(struct i2c_clie
return ret;
}
+ if (bq->iilimit_autoset_enable) {
+ ret = devm_delayed_work_autocancel(dev,
+ &bq->iilimit_setup_work,
+ bq24257_iilimit_setup_work);
+ if (ret)
+ return ret;
+ }
+
ret = devm_request_threaded_irq(dev, client->irq, NULL,
bq24257_irq_handler_thread,
IRQF_TRIGGER_FALLING |
@@ -1064,9 +1069,6 @@ static void bq24257_remove(struct i2c_cl
{
struct bq24257_device *bq = i2c_get_clientdata(client);
- if (bq->iilimit_autoset_enable)
- cancel_delayed_work_sync(&bq->iilimit_setup_work);
-
bq24257_field_write(bq, F_RESET, 1); /* reset to defaults */
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 499/713] power: supply: bq256xx: drain usb_work before freeing the charger
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 498/713] power: supply: bq24257: fix use-after-free on remove Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 500/713] power: supply: bq25890: Fix power_supply reference leak Greg Kroah-Hartman
` (224 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 2dd6cd823777bea6d9a880a12a92a73ec76aee0b upstream.
The USB-PHY notifier queues usb_work, whose handler calls
power_supply_changed(bq->charger). The reset devm action only unregisters
the notifier and was registered before the power supplies, so devm frees
bq->charger on unwind before the action runs; a usb_work still queued can
then dereference it.
Register the reset action after the power supplies, so it unregisters
the notifiers and drains usb_work before the supplies are released.
Initialize usb_work and obtain the PHY references before registering
the notifiers, so the worker cannot run before the supplies exist.
Found by static analysis.
Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260804145511.103470-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/bq256xx_charger.c | 29 +++++++++++++++--------------
1 file changed, 15 insertions(+), 14 deletions(-)
--- a/drivers/power/supply/bq256xx_charger.c
+++ b/drivers/power/supply/bq256xx_charger.c
@@ -896,6 +896,8 @@ static void bq256xx_charger_reset(void *
if (!IS_ERR_OR_NULL(bq->usb3_phy))
usb_unregister_notifier(bq->usb3_phy, &bq->usb_nb);
+
+ cancel_work_sync(&bq->usb_work);
}
static int bq256xx_set_charger_property(struct power_supply *psy,
@@ -1721,24 +1723,12 @@ static int bq256xx_probe(struct i2c_clie
return ret;
}
- ret = devm_add_action_or_reset(dev, bq256xx_charger_reset, bq);
- if (ret)
- return ret;
+ INIT_WORK(&bq->usb_work, bq256xx_usb_work);
+ bq->usb_nb.notifier_call = bq256xx_usb_notifier;
/* OTG reporting */
bq->usb2_phy = devm_usb_get_phy(dev, USB_PHY_TYPE_USB2);
- if (!IS_ERR_OR_NULL(bq->usb2_phy)) {
- INIT_WORK(&bq->usb_work, bq256xx_usb_work);
- bq->usb_nb.notifier_call = bq256xx_usb_notifier;
- usb_register_notifier(bq->usb2_phy, &bq->usb_nb);
- }
-
bq->usb3_phy = devm_usb_get_phy(dev, USB_PHY_TYPE_USB3);
- if (!IS_ERR_OR_NULL(bq->usb3_phy)) {
- INIT_WORK(&bq->usb_work, bq256xx_usb_work);
- bq->usb_nb.notifier_call = bq256xx_usb_notifier;
- usb_register_notifier(bq->usb3_phy, &bq->usb_nb);
- }
ret = bq256xx_power_supply_init(bq, &psy_cfg, dev);
if (ret) {
@@ -1746,6 +1736,17 @@ static int bq256xx_probe(struct i2c_clie
return ret;
}
+ /* Register after the power supplies so devm runs it first. */
+ ret = devm_add_action_or_reset(dev, bq256xx_charger_reset, bq);
+ if (ret)
+ return ret;
+
+ if (!IS_ERR_OR_NULL(bq->usb2_phy))
+ usb_register_notifier(bq->usb2_phy, &bq->usb_nb);
+
+ if (!IS_ERR_OR_NULL(bq->usb3_phy))
+ usb_register_notifier(bq->usb3_phy, &bq->usb_nb);
+
if (client->irq) {
ret = devm_request_threaded_irq(dev, client->irq, NULL,
bq256xx_irq_handler_thread,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 500/713] power: supply: bq25890: Fix power_supply reference leak
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 499/713] power: supply: bq256xx: drain usb_work before freeing the charger Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 501/713] power: supply: charger-manager: register regulators before exposing sysfs Greg Kroah-Hartman
` (223 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
commit 863c32a83e4235eb0cbf6106f2b124e645302156 upstream.
bq25890_fw_probe() acquires a reference to a secondary charger using
power_supply_get_by_name(), but the reference is not released on later
probe failures or on driver detach.
In particular, failures after bq25890_fw_probe() returns successfully,
such as a failure in bq25890_hw_init(), also leak the reference.
Register a device-managed cleanup action immediately after acquiring
the secondary charger. This releases the reference on all subsequent
probe failures and on driver detach.
Found by code review.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Cc: stable@vger.kernel.org
Fixes: d54bf877fd87 ("power: supply: bq25890: Add support for having a secondary charger IC")
Link: https://patch.msgid.link/20260722044416.1623621-1-make_ruc2021@163.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/bq25890_charger.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/power/supply/bq25890_charger.c
+++ b/drivers/power/supply/bq25890_charger.c
@@ -1389,6 +1389,14 @@ static int bq25890_fw_read_u32_props(str
return 0;
}
+static void bq25890_release_secondary_chrg(void *data)
+{
+ struct bq25890_device *bq = data;
+
+ power_supply_put(bq->secondary_chrg);
+ bq->secondary_chrg = NULL;
+}
+
static int bq25890_fw_probe(struct bq25890_device *bq)
{
int ret;
@@ -1401,6 +1409,10 @@ static int bq25890_fw_probe(struct bq258
bq->secondary_chrg = power_supply_get_by_name(str);
if (!bq->secondary_chrg)
return -EPROBE_DEFER;
+
+ ret = devm_add_action_or_reset(bq->dev, bq25890_release_secondary_chrg, bq);
+ if (ret)
+ return ret;
}
/* Optional, left at 0 if property is not present */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 501/713] power: supply: charger-manager: register regulators before exposing sysfs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 500/713] power: supply: bq25890: Fix power_supply reference leak Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 502/713] power: supply: cros_usbpd-charger: bound the EC-reported port count Greg Kroah-Hartman
` (222 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit c57cb36f76eb7ced45f57af1a890d8f3a6d76342 upstream.
charger_manager_remove() and the err_reg_extcon probe error path free each
charger regulator with regulator_put() before tearing down the power_supply
sysfs entries (power_supply_unregister()). charger_manager_remove() also
calls try_charger_enable(cm, false) after the regulator_put() loop. A
concurrent write to a charger's externally_control sysfs attribute that
lands between regulator_put() and power_supply_unregister() can run
charger_externally_control_store() and call try_charger_enable(), which,
when charging is enabled, dereferences the already-freed consumer handle.
When charging is enabled, try_charger_enable(cm, false) in .remove() also
dereferences the freed handles directly. Both leave use-after-free windows.
Symmetrically, probe registers the sysfs entries (power_supply_register)
before acquiring the regulators (regulator_get, inside
charger_manager_register_extcon), so userspace can reach externally_control
before the regulators are available.
Split charger_manager_register_extcon() on the sync/async boundary:
charger_manager_get_regulators() (regulator_get only, no async producer)
now runs before power_supply_register() so sysfs is not live before
regulators are available, and charger_manager_register_extcon() keeps only
the extcon notifier/work setup, still after power_supply_register() so a
power_supply_register() failure cannot reach extcon setup. This keeps the
sysfs setup/teardown ordering symmetric without introducing an asynchronous
producer on the earlier probe-error path.
Move power_supply_unregister() and try_charger_enable(cm, false) ahead of
the regulator_put() loop on both teardown paths, and adjust err_reg_extcon
(power_supply_unregister() then fall through err_regulator for
regulator_put(); get_regulators self-rolls back on its own failure).
This does not address the separate extcon-notifier-driven deref of the same
handles, which needs its own synchronization design.
Found by an in-house static analysis tool.
Fixes: 3950c7865cd7 ("charger-manager: Add support sysfs entry for charger")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260728030123.230202-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/charger-manager.c | 54 +++++++++++++++++++++++----------
1 file changed, 39 insertions(+), 15 deletions(-)
--- a/drivers/power/supply/charger-manager.c
+++ b/drivers/power/supply/charger-manager.c
@@ -1014,6 +1014,29 @@ static int charger_extcon_init(struct ch
return 0;
}
+static int charger_manager_get_regulators(struct charger_manager *cm)
+{
+ struct charger_desc *desc = cm->desc;
+ struct charger_regulator *charger;
+ int i, ret;
+
+ for (i = 0; i < desc->num_charger_regulators; i++) {
+ charger = &desc->charger_regulators[i];
+ charger->consumer = regulator_get(cm->dev,
+ charger->regulator_name);
+ if (IS_ERR(charger->consumer)) {
+ dev_err(cm->dev, "Cannot find charger(%s)\n",
+ charger->regulator_name);
+ ret = PTR_ERR(charger->consumer);
+ while (i-- > 0)
+ regulator_put(desc->charger_regulators[i].consumer);
+ return ret;
+ }
+ charger->cm = cm;
+ }
+ return 0;
+}
+
/**
* charger_manager_register_extcon - Register extcon device to receive state
* of charger cable.
@@ -1036,15 +1059,6 @@ static int charger_manager_register_extc
for (i = 0; i < desc->num_charger_regulators; i++) {
charger = &desc->charger_regulators[i];
- charger->consumer = regulator_get(cm->dev,
- charger->regulator_name);
- if (IS_ERR(charger->consumer)) {
- dev_err(cm->dev, "Cannot find charger(%s)\n",
- charger->regulator_name);
- return PTR_ERR(charger->consumer);
- }
- charger->cm = cm;
-
for (j = 0; j < charger->num_cables; j++) {
struct charger_cable *cable = &charger->cables[j];
@@ -1580,13 +1594,23 @@ static int charger_manager_probe(struct
}
psy_cfg.attr_grp = desc->sysfs_groups;
+ /*
+ * Acquire charger regulators before exposing the sysfs entries, so
+ * userspace cannot reach externally_control before the regulators
+ * (and charger->cm) are available. Mirrors the order in remove().
+ */
+ ret = charger_manager_get_regulators(cm);
+ if (ret < 0)
+ return ret;
+
cm->charger_psy = power_supply_register(&pdev->dev,
&cm->charger_psy_desc,
&psy_cfg);
if (IS_ERR(cm->charger_psy)) {
dev_err(&pdev->dev, "Cannot register charger-manager with name \"%s\"\n",
cm->charger_psy_desc.name);
- return PTR_ERR(cm->charger_psy);
+ ret = PTR_ERR(cm->charger_psy);
+ goto err_regulator;
}
/* Register extcon device for charger cable */
@@ -1620,11 +1644,11 @@ static int charger_manager_probe(struct
return 0;
err_reg_extcon:
+ power_supply_unregister(cm->charger_psy);
+err_regulator:
for (i = 0; i < desc->num_charger_regulators; i++)
regulator_put(desc->charger_regulators[i].consumer);
- power_supply_unregister(cm->charger_psy);
-
return ret;
}
@@ -1642,12 +1666,12 @@ static void charger_manager_remove(struc
cancel_work_sync(&setup_polling);
cancel_delayed_work_sync(&cm_monitor_work);
- for (i = 0 ; i < desc->num_charger_regulators ; i++)
- regulator_put(desc->charger_regulators[i].consumer);
+ try_charger_enable(cm, false);
power_supply_unregister(cm->charger_psy);
- try_charger_enable(cm, false);
+ for (i = 0 ; i < desc->num_charger_regulators ; i++)
+ regulator_put(desc->charger_regulators[i].consumer);
}
static const struct platform_device_id charger_manager_id[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 502/713] power: supply: cros_usbpd-charger: bound the EC-reported port count
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 501/713] power: supply: charger-manager: register regulators before exposing sysfs Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 503/713] power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Greg Kroah-Hartman
` (221 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Tzung-Bi Shih,
Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 48355ce49359740f52e94d3623f6fc557ce341f0 upstream.
cros_usbpd_charger_probe() reads two port counts from the EC and uses
one of them, num_charger_ports, as the loop bound when populating a
fixed-size array:
struct port_data *ports[EC_USB_PD_MAX_PORTS]; /* 8 entries */
...
for (i = 0; i < charger->num_charger_ports; i++)
charger->ports[charger->num_registered_psy++] = port;
Both num_usbpd_ports (from EC_CMD_USB_PD_PORTS) and num_charger_ports
(from EC_CMD_CHARGE_PORT_COUNT) are u8 values reported by the EC. The
only validation is a sanity check that compares the two EC-reported
values against each other:
if (num_charger_ports < num_usbpd_ports ||
num_charger_ports > num_usbpd_ports + 1)
return -EPROTO;
It never checks either count against EC_USB_PD_MAX_PORTS, the size of
the ports[] array. A malfunctioning, malicious or compromised EC that
reports num_usbpd_ports == num_charger_ports == N for any N > 8 (for
example both 255) passes this check, and the loop then writes N pointers
into the 8-entry ports[] array embedded in the devm_kzalloc()'d
charger_data, overflowing it by up to 255 - 8 = 247 entries (~1976
bytes): a slab out-of-bounds write.
Reject a port count larger than the ports[] array can hold.
Fixes: f68b883e8fad ("power: supply: add cros-ec USBPD charger driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20260616-b4-disp-5e197080-v2-1-8aa5bffce945@proton.me
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/cros_usbpd-charger.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/power/supply/cros_usbpd-charger.c
+++ b/drivers/power/supply/cros_usbpd-charger.c
@@ -588,10 +588,13 @@ static int cros_usbpd_charger_probe(stru
/*
* Sanity checks on the number of ports:
- * there should be at most 1 dedicated port
+ * there should be at most 1 dedicated port, and the count must
+ * not exceed the maximum number of supported ports
+ * (EC_USB_PD_MAX_PORTS).
*/
if (charger->num_charger_ports < charger->num_usbpd_ports ||
- charger->num_charger_ports > (charger->num_usbpd_ports + 1)) {
+ charger->num_charger_ports > (charger->num_usbpd_ports + 1) ||
+ charger->num_charger_ports > EC_USB_PD_MAX_PORTS) {
dev_err(dev, "Unexpected number of charge port count\n");
ret = -EPROTO;
goto fail_nowarn;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 503/713] power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 502/713] power: supply: cros_usbpd-charger: bound the EC-reported port count Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 504/713] power: supply: lp8727: fix use-after-free in lp8727_release_irq() Greg Kroah-Hartman
` (220 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jameson Thies, Benson Leung,
Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <jthies@google.com>
commit 657cd3a42e937276262c0a8ae6b01a87004309de upstream.
Currently the cros_usbpd-charger driver probe iterates based on raw
charger port count returned by the embedded controller. The only check
is against the number of USB PD ports which the embedded controller
also defines. A malicious embedded controller could return an inaccurate
port count (up to 255) resulting in an out of bounds write and
subsequent memory corruption.
Update helper functions in cros_usbpd-charger to limit port counts to
EC_USB_PD_MAX_PORTS.
Fixes: 3af15cfacd1e ("power: supply: cros: add support for dedicated port")
Cc: stable@vger.kernel.org
Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://patch.msgid.link/20260722195059.1420738-1-jthies@google.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/cros_usbpd-charger.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/power/supply/cros_usbpd-charger.c
+++ b/drivers/power/supply/cros_usbpd-charger.c
@@ -124,6 +124,11 @@ static int cros_usbpd_charger_get_num_po
if (ret < 0)
return ret;
+ if (resp.port_count > EC_USB_PD_MAX_PORTS) {
+ dev_warn(charger->dev, "Charge port count out of bounds\n");
+ return EC_USB_PD_MAX_PORTS;
+ }
+
return resp.port_count;
}
@@ -137,6 +142,11 @@ static int cros_usbpd_charger_get_usbpd_
if (ret < 0)
return ret;
+ if (resp.num_ports > EC_USB_PD_MAX_PORTS) {
+ dev_warn(charger->dev, "USB PD port count out of bounds\n");
+ return EC_USB_PD_MAX_PORTS;
+ }
+
return resp.num_ports;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 504/713] power: supply: lp8727: fix use-after-free in lp8727_release_irq()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 503/713] power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 505/713] power: supply: lp8788-charger: fix use-after-free on remove Greg Kroah-Hartman
` (219 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit ceb6ac43b0f591722401922ceb958ce2616935e0 upstream.
lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms
pchg->work via schedule_delayed_work(). lp8727_release_irq() currently
cancels the work before freeing the IRQ, so an IRQ delivered in between
can re-arm the work through the threaded handler. After .remove returns
the devm layer frees pchg while lp8727_delayed_func() may still run and
dereference it.
Free the IRQ first so the threaded handler is quiesced and can no longer
queue work, then cancel the delayed work to drain the final generation.
This issue was found by an in-house static analysis tool.
Fixes: d71fda016102 ("lp8727_charger: Clean up the interrupt handler")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260807033520.8551-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/lp8727_charger.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/power/supply/lp8727_charger.c
+++ b/drivers/power/supply/lp8727_charger.c
@@ -280,10 +280,10 @@ static int lp8727_setup_irq(struct lp872
static void lp8727_release_irq(struct lp8727_chg *pchg)
{
- cancel_delayed_work_sync(&pchg->work);
-
if (pchg->irq)
free_irq(pchg->irq, pchg);
+
+ cancel_delayed_work_sync(&pchg->work);
}
static enum power_supply_property lp8727_charger_prop[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 505/713] power: supply: lp8788-charger: fix use-after-free on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 504/713] power: supply: lp8727: fix use-after-free in lp8727_release_irq() Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 506/713] power: supply: pf1550: enable charging when battery profile exists Greg Kroah-Hartman
` (218 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 831c29a12d560f8a3225f43050b3fbb5dfd79c66 upstream.
lp8788_charger_remove() flushes charger_work before unregistering the
IRQs. An IRQ thread can queue charger_work after flush_work() has
returned. The work can then run after devres frees pchg and dereference
it in lp8788_charger_event().
Unregister the IRQs first. free_irq() waits for any running threaded
handler, so no handler can queue more work afterwards. Then use
cancel_work_sync() to cancel pending work or wait for running work to
finish.
This issue was found by an in-house static analysis tool.
Fixes: 98a276649358 ("power_supply: Add new lp8788 charger driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260802035442.421697-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/lp8788-charger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/supply/lp8788-charger.c
+++ b/drivers/power/supply/lp8788-charger.c
@@ -710,8 +710,8 @@ static void lp8788_charger_remove(struct
{
struct lp8788_charger *pchg = platform_get_drvdata(pdev);
- flush_work(&pchg->charger_work);
lp8788_irq_unregister(pdev, pchg);
+ cancel_work_sync(&pchg->charger_work);
}
static struct platform_driver lp8788_charger_driver = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 506/713] power: supply: pf1550: enable charging when battery profile exists
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 505/713] power: supply: lp8788-charger: fix use-after-free on remove Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 507/713] power: supply: qcom_battmgr: fix use-after-free Greg Kroah-Hartman
` (217 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Frank Li, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit af4ee48a09cfb7a2440cc4822e9fda43a76cfbe5 upstream.
PF1550 starts in charger mode 1, where charging is disabled. The driver
comment says that mode 2 should be selected for applications using a
battery, but the condition is inverted: PF1550_CHG_BAT_ON is written only
when power_supply_get_battery_info() fails.
Consequently, a board with a valid monitored-battery profile is left in
the default charger-off mode, while a board without battery information
enables charging with fallback settings.
Select mode 2 when battery information is available.
Fixes: 4b6b6433a97d ("power: supply: pf1550: add battery charger support")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/097F0559A936ACCB+20260724095437.368905-1-raoxu@uniontech.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/pf1550-charger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/supply/pf1550-charger.c
+++ b/drivers/power/supply/pf1550-charger.c
@@ -514,7 +514,7 @@ static int pf1550_reg_init(struct pf1550
* a battery. The other supported mode is mode 2, the charger is turned
* on to charge a battery when present.
*/
- if (power_supply_get_battery_info(chg->charger, &info)) {
+ if (!power_supply_get_battery_info(chg->charger, &info)) {
ret = regmap_write(chg->pf1550->regmap,
PF1550_CHARG_REG_CHG_OPER,
PF1550_CHG_BAT_ON);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 507/713] power: supply: qcom_battmgr: fix use-after-free
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 506/713] power: supply: pf1550: enable charging when battery profile exists Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 508/713] power: supply: qcom_battmgr: terminate the strings from firmware Greg Kroah-Hartman
` (216 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 4e40befedfc8ed86f44e1f81df92d13c149c9f8d upstream.
qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service
comes up, and the worker recovers battmgr through container_of() to issue
firmware requests. The PMIC GLINK client stays on the client list until
its devres release action runs, so a PDR notification can keep queueing
the work, and a pending or running worker can access battmgr after devres
frees it.
Make enable_work device-managed with devm_work_autocancel(), registered
before the PMIC GLINK client is allocated. The devres cleanup then
releases the client first, so no further notification can queue the work,
and cancels the work before battmgr is freed.
This issue was found by an in-house static analysis tool.
Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260731022006.317192-1-fanwu01@zju.edu.cn
Link: https://patch.msgid.link/20260801051923.354496-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/qcom_battmgr.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -5,6 +5,7 @@
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/auxiliary_bus.h>
+#include <linux/devm-helpers.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/nvmem-consumer.h>
@@ -1648,7 +1649,6 @@ static int qcom_battmgr_probe(struct aux
psy_cfg_supply.supplied_to = qcom_battmgr_battery;
psy_cfg_supply.num_supplicants = 1;
- INIT_WORK(&battmgr->enable_work, qcom_battmgr_enable_worker);
mutex_init(&battmgr->lock);
init_completion(&battmgr->ack);
@@ -1711,6 +1711,11 @@ static int qcom_battmgr_probe(struct aux
"failed to register wireless charing power supply\n");
}
+ ret = devm_work_autocancel(dev, &battmgr->enable_work,
+ qcom_battmgr_enable_worker);
+ if (ret)
+ return ret;
+
battmgr->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BATTMGR,
qcom_battmgr_callback,
qcom_battmgr_pdr_notify,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 508/713] power: supply: qcom_battmgr: terminate the strings from firmware
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 507/713] power: supply: qcom_battmgr: fix use-after-free Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 509/713] power: supply: rt9455: quiesce delayed work before teardown Greg Kroah-Hartman
` (215 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit ab1112df8f4ffa88cb024dd370c432ced80f77d8 upstream.
The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the
firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and
leaves the destination without a terminator.
Those destinations are model_number, serial_number and oem_info, each
BATTMGR_STRING_LEN and declared next to each other. They go out to user
space as val->strval, which power_supply_format_property() prints with
"%s", so a firmware string that fills the whole field makes that read run
into the following members.
Use strscpy() so the copy always terminates, the way the SM8350 path
already does for the same field.
Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260727074119.2585463-1-sammiee5311@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/qcom_battmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -1232,7 +1232,7 @@ static void qcom_battmgr_sc8280xp_strcpy
memcpy(dest, src + 1, len);
dest[len] = '\0';
} else {
- memcpy(dest, src, BATTMGR_STRING_LEN);
+ strscpy(dest, src, BATTMGR_STRING_LEN);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 509/713] power: supply: rt9455: quiesce delayed work before teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 508/713] power: supply: qcom_battmgr: terminate the strings from firmware Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 510/713] power: supply: twl4030_charger: cancel workers via devm Greg Kroah-Hartman
` (214 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 3e7a1ebc32fad5a558254a478efd401c17a24381 upstream.
The threaded IRQ handler can queue pwr_rdy_work,
max_charging_time_work and batt_presence_work. pwr_rdy_work and
batt_presence_work can also queue max_charging_time_work, while
batt_presence_work can requeue itself.
rt9455_remove() cancels max_charging_time_work before
batt_presence_work. The latter can therefore queue
max_charging_time_work after it has already been cancelled:
rt9455_remove() workqueue
cancel pwr_rdy_work
cancel max_charging_time_work
batt_presence_work queues
max_charging_time_work
cancel batt_presence_work
return
devres frees rt9455_info
max_charging_time_work dereferences
rt9455_info
The IRQ also remains registered until devres cleanup and can queue more
work after any of the cancellation calls. If rt9455_hw_init() fails
after the IRQ has been requested, probe returns without cancelling work
that may already have been queued. A pending callback can then access
rt9455_info after it has been freed.
Register rt9455_cancel_all_delayed_works() through
devm_add_action_or_reset() right after devm_power_supply_register().
devres invokes the action in reverse registration order, after the
managed IRQ has been freed and before rt9455_info is released, so the
delayed works are drained in both rt9455_remove() and the probe error
path. Cancel pwr_rdy_work and batt_presence_work before
max_charging_time_work because both can queue the latter.
This issue was found by an in-house static analysis tool.
Fixes: e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260723225310.12663-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/rt9455_charger.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/drivers/power/supply/rt9455_charger.c
+++ b/drivers/power/supply/rt9455_charger.c
@@ -1582,6 +1582,19 @@ static const struct regmap_config rt9455
.cache_type = REGCACHE_MAPLE,
};
+static void rt9455_cancel_all_delayed_works(void *data)
+{
+ struct rt9455_info *info = data;
+
+ /*
+ * Both pwr_rdy_work and batt_presence_work can queue
+ * max_charging_time_work, so cancel them first.
+ */
+ cancel_delayed_work_sync(&info->pwr_rdy_work);
+ cancel_delayed_work_sync(&info->batt_presence_work);
+ cancel_delayed_work_sync(&info->max_charging_time_work);
+}
+
static int rt9455_probe(struct i2c_client *client)
{
struct i2c_adapter *adapter = client->adapter;
@@ -1672,6 +1685,10 @@ static int rt9455_probe(struct i2c_clien
goto put_usb_notifier;
}
+ ret = devm_add_action_or_reset(dev, rt9455_cancel_all_delayed_works, info);
+ if (ret)
+ goto put_usb_notifier;
+
ret = devm_request_threaded_irq(dev, client->irq, NULL,
rt9455_irq_handler_thread,
IRQF_TRIGGER_LOW | IRQF_ONESHOT,
@@ -1712,10 +1729,6 @@ static void rt9455_remove(struct i2c_cli
if (info->nb.notifier_call)
usb_unregister_notifier(info->usb_phy, &info->nb);
#endif
-
- cancel_delayed_work_sync(&info->pwr_rdy_work);
- cancel_delayed_work_sync(&info->max_charging_time_work);
- cancel_delayed_work_sync(&info->batt_presence_work);
}
static const struct i2c_device_id rt9455_i2c_id_table[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 510/713] power: supply: twl4030_charger: cancel workers via devm
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 509/713] power: supply: rt9455: quiesce delayed work before teardown Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 511/713] power: supply: ucs1002: fix use-after-free on remove Greg Kroah-Hartman
` (213 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Maoyi Xie,
Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 6eba34732524067da2aad5ddfdfbc641ded10e9e upstream.
bci is devm-allocated. Two workers (bci->work and bci->current_worker)
dereference it. twl4030_bci_remove() disables charging and masks
interrupts. It cancels neither worker. A worker pending at remove() can
run after devm frees bci.
The USB transceiver comes from devm_usb_get_phy_by_node(). devm
unregisters its notifier only after remove() returns. A cancel_work_sync()
in remove() can then race a notifier reschedule. devm_work_autocancel()
and devm_delayed_work_autocancel() avoid that. They cancel the workers
during devm release, before bci is freed.
The current_worker is registered first, since devm will cancel in
reverse order and bci->work can reschedule current_worker.
Suggested-by: Sebastian Reichel <sre@kernel.org>
Fixes: d6ccc442b1210 ("twl4030_charger: Make the driver atomic notifier safe")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260702172128.2001753-1-maoyixie.tju@gmail.com
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260725072540.3092504-1-maoyixie.tju@gmail.com
[Move comment about order into the commit message]
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/twl4030_charger.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/power/supply/twl4030_charger.c
+++ b/drivers/power/supply/twl4030_charger.c
@@ -14,6 +14,7 @@
#include <linux/err.h>
#include <linux/of.h>
#include <linux/platform_device.h>
+#include <linux/devm-helpers.h>
#include <linux/interrupt.h>
#include <linux/mfd/twl.h>
#include <linux/power_supply.h>
@@ -1002,8 +1003,15 @@ static int twl4030_bci_probe(struct plat
platform_set_drvdata(pdev, bci);
- INIT_WORK(&bci->work, twl4030_bci_usb_work);
- INIT_DELAYED_WORK(&bci->current_worker, twl4030_current_worker);
+ ret = devm_delayed_work_autocancel(&pdev->dev, &bci->current_worker,
+ twl4030_current_worker);
+ if (ret)
+ return ret;
+
+ ret = devm_work_autocancel(&pdev->dev, &bci->work,
+ twl4030_bci_usb_work);
+ if (ret)
+ return ret;
bci->channel_vac = devm_iio_channel_get(&pdev->dev, "vac");
if (IS_ERR(bci->channel_vac)) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 511/713] power: supply: ucs1002: fix use-after-free on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 510/713] power: supply: twl4030_charger: cancel workers via devm Greg Kroah-Hartman
@ 2026-09-04 4:57 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 512/713] power: supply: max17040: propagate register read errors Greg Kroah-Hartman
` (212 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Lucas Stach,
Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 609af0ceeaefdfa42cd01dd060b20f2e41f9a232 upstream.
ucs1002 has no remove callback, so unbind runs entirely through devm.
The alert IRQ handler queues the health_poll delayed work, and the work
reschedules itself while the chip reports a bad-health condition. devm
frees the alert IRQ, which only synchronizes the handler; it does not
cancel the delayed work, which can then run after devm frees the driver
data and dereference it.
Register health_poll with devm_delayed_work_autocancel() before the
alert IRQ is requested. devm then frees the IRQ before cancelling the
work, so the handler can no longer queue it and the work is cancelled
before the driver data is freed.
This issue was found by an in-house static analysis tool.
Fixes: 81196e2e57fc ("power: supply: ucs1002: fix some health status issues")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://patch.msgid.link/20260802051249.424015-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/ucs1002_power.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/power/supply/ucs1002_power.c
+++ b/drivers/power/supply/ucs1002_power.c
@@ -11,6 +11,7 @@
#include <linux/kernel.h>
#include <linux/kthread.h>
#include <linux/device.h>
+#include <linux/devm-helpers.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/of_irq.h>
@@ -640,7 +641,10 @@ static int ucs1002_probe(struct i2c_clie
}
info->health = POWER_SUPPLY_HEALTH_GOOD;
- INIT_DELAYED_WORK(&info->health_poll, ucs1002_health_poll);
+ ret = devm_delayed_work_autocancel(dev, &info->health_poll,
+ ucs1002_health_poll);
+ if (ret)
+ return ret;
if (irq_a_det > 0) {
ret = devm_request_threaded_irq(dev, irq_a_det, NULL,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 512/713] power: supply: max17040: propagate register read errors
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-09-04 4:57 ` [PATCH 7.2 511/713] power: supply: ucs1002: fix use-after-free on remove Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 513/713] power: supply: max17040: drop incorrect I2C functionality check Greg Kroah-Hartman
` (211 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianing Li, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianing Li <m13940358460@163.com>
commit 659cc3d8d5ef246263873fce72c8cadeeed073cc upstream.
max17040_get_vcell() and max17040_get_soc() ignore errors returned by
regmap_read(). When an I2C transfer fails, the uninitialized register
value is converted and reported to userspace as a valid voltage or state
of charge. The polling worker can also replace the cached state of charge
with the bogus value and emit a spurious change event.
Propagate read errors through the power supply get_property callback and
keep the last valid cached state of charge when polling fails.
Fixes: c6f4a42de60b ("Add MAX17040 Fuel Gauge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jianing Li <m13940358460@163.com>
Link: https://patch.msgid.link/20260727064825.948-1-m13940358460@163.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/max17040_battery.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
--- a/drivers/power/supply/max17040_battery.c
+++ b/drivers/power/supply/max17040_battery.c
@@ -192,8 +192,11 @@ static int max17040_raw_vcell_to_uvolts(
static int max17040_get_vcell(struct max17040_chip *chip)
{
u32 vcell;
+ int ret;
- regmap_read(chip->regmap, MAX17040_VCELL, &vcell);
+ ret = regmap_read(chip->regmap, MAX17040_VCELL, &vcell);
+ if (ret)
+ return ret;
return max17040_raw_vcell_to_uvolts(chip, vcell);
}
@@ -201,8 +204,11 @@ static int max17040_get_vcell(struct max
static int max17040_get_soc(struct max17040_chip *chip)
{
u32 soc;
+ int ret;
- regmap_read(chip->regmap, MAX17040_SOC, &soc);
+ ret = regmap_read(chip->regmap, MAX17040_SOC, &soc);
+ if (ret)
+ return ret;
return soc >> (chip->quirk_double_soc ? 9 : 8);
}
@@ -261,7 +267,11 @@ static int max17040_get_of_data(struct m
static void max17040_check_changes(struct max17040_chip *chip)
{
- chip->soc = max17040_get_soc(chip);
+ int soc;
+
+ soc = max17040_get_soc(chip);
+ if (soc >= 0)
+ chip->soc = soc;
}
static void max17040_queue_work(struct max17040_chip *chip)
@@ -396,10 +406,16 @@ static int max17040_get_property(struct
val->intval = max17040_get_online(chip);
break;
case POWER_SUPPLY_PROP_VOLTAGE_NOW:
- val->intval = max17040_get_vcell(chip);
+ ret = max17040_get_vcell(chip);
+ if (ret < 0)
+ return ret;
+ val->intval = ret;
break;
case POWER_SUPPLY_PROP_CAPACITY:
- val->intval = max17040_get_soc(chip);
+ ret = max17040_get_soc(chip);
+ if (ret < 0)
+ return ret;
+ val->intval = ret;
break;
case POWER_SUPPLY_PROP_CAPACITY_ALERT_MIN:
val->intval = chip->low_soc_alert;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 513/713] power: supply: max17040: drop incorrect I2C functionality check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 512/713] power: supply: max17040: propagate register read errors Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 514/713] power: supply: max17040: synchronize work cancellation on suspend Greg Kroah-Hartman
` (210 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianing Li, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianing Li <m13940358460@163.com>
commit 4e4b9f5ce9dfb8ed4b8d1262a504b8043ac09d87 upstream.
max17040_probe() rejects adapters that do not advertise
I2C_FUNC_SMBUS_BYTE. The driver does not issue SMBus byte transactions,
however. Its regmap has 8-bit registers and 16-bit big-endian values, for
which regmap-i2c supports either raw I2C transfers or SMBus word-data
transactions.
Consequently, an adapter providing raw I2C transfers or SMBus word data
but not SMBus byte transactions is rejected even though regmap can access
the device. Conversely, the current check can pass an adapter that regmap
cannot use.
Drop the stale check and let devm_regmap_init_i2c() validate and select
the supported transfer method.
Fixes: 6455a8a84bdfd ("power: supply: max17040: Use regmap i2c")
Cc: stable@vger.kernel.org
Signed-off-by: Jianing Li <m13940358460@163.com>
Link: https://patch.msgid.link/20260731084259.916-1-m13940358460@163.com
[Fixed Fixes tag, so that it points to the regmap introduction instead of the initial driver addition]
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/max17040_battery.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/power/supply/max17040_battery.c
+++ b/drivers/power/supply/max17040_battery.c
@@ -474,16 +474,12 @@ static const struct power_supply_desc ma
static int max17040_probe(struct i2c_client *client)
{
const struct i2c_device_id *id = i2c_client_get_device_id(client);
- struct i2c_adapter *adapter = client->adapter;
struct power_supply_config psy_cfg = {};
struct max17040_chip *chip;
enum chip_id chip_id;
bool enable_irq = false;
int ret;
- if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
- return -EIO;
-
chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL);
if (!chip)
return -ENOMEM;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 514/713] power: supply: max17040: synchronize work cancellation on suspend
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 513/713] power: supply: max17040: drop incorrect I2C functionality check Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 515/713] s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Greg Kroah-Hartman
` (209 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianing Li, Sebastian Reichel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianing Li <m13940358460@163.com>
commit 86a3a8a926aa5969c329d1df2d3259f189961bbc upstream.
max17040_work() requeues itself after every poll. cancel_delayed_work()
only cancels a pending instance and does not wait for a callback that is
already running.
If system suspend races with the polling callback, the callback can
continue accessing the fuel gauge and requeue itself after the suspend
callback returns.
Use cancel_delayed_work_sync() to ensure polling is quiesced before
suspend completes.
Fixes: c6f4a42de60b ("Add MAX17040 Fuel Gauge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jianing Li <m13940358460@163.com>
Link: https://patch.msgid.link/20260810004701.1683-1-m13940358460@163.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/max17040_battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/supply/max17040_battery.c
+++ b/drivers/power/supply/max17040_battery.c
@@ -580,7 +580,7 @@ static int max17040_suspend(struct devic
// disable soc alert to prevent wakeup
max17040_set_soc_alert(chip, 0);
else
- cancel_delayed_work(&chip->work);
+ cancel_delayed_work_sync(&chip->work);
if (client->irq && device_may_wakeup(dev))
enable_irq_wake(client->irq);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 515/713] s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 514/713] power: supply: max17040: synchronize work cancellation on suspend Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 516/713] s390/percpu: Fix MVIY_PERCPU() with older binutils Greg Kroah-Hartman
` (208 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Carstens,
Christian Borntraeger, Thomas Richter, Vasily Gorbik
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
commit 337bd95507a16063687cfc286ea90de5cca48c37 upstream.
The command 'perf stat -e cycles -- <command>' crashes the kernel
when CPUs are hotplug added during that run.
Root cause is the allocation of struct cpu_cf_events at first
event initialization. The allocation is dynamic and the first
event that has task context creates such a structure for
each online CPU. This is not sufficient. CPUs may be offline
during event creation and can be set online during the
perf run time. For example commands
# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf stat -e cycles -i -- stress-ng -t10s --matrix X
# sleep 1
# echo 1 > /sys/devices/system/cpu/cpu1/online
create an event for CPUs 0,2-X. Since the events are created with
task-context, the scheduler will eventually schedule the program
on CPU1. This CPU has not created and initialized any per
CPU event infrastructure as that CPU was not online at the time
of the perf invocation. Thus when the scheduler runs stress-ng
on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:
struct cpu_cf_events *cpuhw = this_cpu_cfhw();
This function call is invoked after the task stress-ng has been
made runnable on CPU1. And this_cpu_cfhw() returns NULL.
The result is a panic:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
....
Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80)
....
Call Trace:
[<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80
[<000003ef82bb5e3e>] event_sched_in+0xae/0x190
[<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390
[<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0
[<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50
[<000003ef82bb6a30>] ctx_sched_in+0x180/0x260
[<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0
[<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0
[<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250
....
Last Breaking-Event-Address:
[<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40
The issue arises only in per-task context when the CPUMF facility is
used and the scheduler picks a random CPU for such a process to run on.
The scheduler enables the CPUMF infrastructure via PMU callback
functions pmu::add() and pmu::del().
Introduce a CPU hotplug prepare/dead callback pair which creates and
removes the per CPU counter data while the CPU is offline. Count the
users which track every CPU (cpu == -1), that is perf_event_open()
events with task context and /dev/hwctr device sessions, in the new
counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
This ensures the infrastructure is available when
new CPU is selected to run the per-task context process.
In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
pointer to data structures is set to NULL before the data is freed
to prevent interrupt handlers to access stale data.
[gor@linux.ibm.com: change commit message]
Fixes: 9b9cf3c77e7e ("s390/cpum_cf: rework PER_CPU_DEFINE of struct cpu_cf_events")
Cc: stable@vger.kernel.org # v6.5+
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/perf_cpum_cf.c | 215 ++++++++++++++++++++++++++--------------
1 file changed, 142 insertions(+), 73 deletions(-)
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -110,6 +110,7 @@ struct cpu_cf_ptr {
static struct cpu_cf_root { /* Anchor to per CPU data */
refcount_t refcnt; /* Overall active events */
+ unsigned int tskctx; /* Users tracking all CPUs (cpu == -1) */
struct cpu_cf_ptr __percpu *cfptr;
} cpu_cf_root;
@@ -118,13 +119,15 @@ static struct cpu_cf_root { /* Anchor t
* user space in task context with perf_event_open() and close()
* system calls.
*
- * This mutex serializes functions cpum_cf_alloc_cpu() called at event
- * initialization via cpumf_pmu_event_init() and function cpum_cf_free_cpu()
- * called at event removal via call back function hw_perf_event_destroy()
- * when the event is deleted. They are serialized to enforce correct
- * bookkeeping of pointer and reference counts anchored by
- * struct cpu_cf_root and the access to cpu_cf_root::refcnt and the
- * per CPU pointers stored in cpu_cf_root::cfptr.
+ * This mutex serializes the allocation and removal of the per CPU counter
+ * data via cpum_cf_alloc_cpu() and cpum_cf_free_cpu(). They are called with
+ * this mutex held at event initialization via cpumf_pmu_event_init(), at
+ * event removal via call back function hw_perf_event_destroy() when the
+ * event is deleted, and from the CPU hotplug prepare/dead callbacks. The
+ * mutex enforces correct bookkeeping of pointer and reference counts
+ * anchored by struct cpu_cf_root and protects the access to
+ * cpu_cf_root::refcnt, cpu_cf_root::tskctx and the per CPU pointers
+ * stored in cpu_cf_root::cfptr.
*/
static DEFINE_MUTEX(pmc_reserve_mutex);
@@ -167,12 +170,14 @@ static void cpum_cf_reset_cpu(void *flag
}
/* Free per CPU data when the last event is removed. */
-static void cpum_cf_free_root(void)
+static void cpum_cf_free_root(unsigned int num)
{
- if (!refcount_dec_and_test(&cpu_cf_root.refcnt))
+ struct cpu_cf_ptr __percpu *p = cpu_cf_root.cfptr;
+
+ if (!refcount_sub_and_test(num, &cpu_cf_root.refcnt))
return;
- free_percpu(cpu_cf_root.cfptr);
cpu_cf_root.cfptr = NULL;
+ free_percpu(p);
irq_subclass_unregister(IRQ_SUBCLASS_MEASUREMENT_ALERT);
on_each_cpu(cpum_cf_reset_cpu, NULL, 1);
debug_sprintf_event(cf_dbg, 4, "%s root.refcnt %u cfptr %d\n",
@@ -186,17 +191,17 @@ static void cpum_cf_free_root(void)
* CPUs possible, which might be larger than the number of CPUs currently
* online.
*/
-static int cpum_cf_alloc_root(void)
+static int cpum_cf_alloc_root(unsigned int num)
{
int rc = 0;
- if (refcount_inc_not_zero(&cpu_cf_root.refcnt))
+ if (refcount_add_not_zero(num, &cpu_cf_root.refcnt))
return rc;
/* The memory is already zeroed. */
cpu_cf_root.cfptr = alloc_percpu(struct cpu_cf_ptr);
if (cpu_cf_root.cfptr) {
- refcount_set(&cpu_cf_root.refcnt, 1);
+ refcount_set(&cpu_cf_root.refcnt, num);
on_each_cpu(cpum_cf_reset_cpu, NULL, 1);
irq_subclass_register(IRQ_SUBCLASS_MEASUREMENT_ALERT);
} else {
@@ -206,20 +211,23 @@ static int cpum_cf_alloc_root(void)
return rc;
}
-/* Free CPU counter data structure for a PMU */
-static void cpum_cf_free_cpu(int cpu)
+/*
+ * Remove num references to the CPU counter data structure of a PMU.
+ * Called with pmc_reserve_mutex held.
+ */
+static void cpum_cf_free_cpu(int cpu, unsigned int num)
{
struct cpu_cf_events *cpuhw;
struct cpu_cf_ptr *p;
- mutex_lock(&pmc_reserve_mutex);
+ lockdep_assert_held(&pmc_reserve_mutex);
/*
* When invoked via CPU hotplug handler, there might be no events
* installed or that particular CPU might not have an
* event installed. This anchor pointer can be NULL!
*/
if (!cpu_cf_root.cfptr)
- goto out;
+ return;
p = per_cpu_ptr(cpu_cf_root.cfptr, cpu);
cpuhw = p->cpucf;
/*
@@ -227,28 +235,29 @@ static void cpum_cf_free_cpu(int cpu)
* installed on that CPU, but on different CPUs.
*/
if (!cpuhw)
- goto out;
+ return;
- if (refcount_dec_and_test(&cpuhw->refcnt)) {
- kfree(cpuhw);
+ if (refcount_sub_and_test(num, &cpuhw->refcnt)) {
p->cpucf = NULL;
+ kfree(cpuhw);
}
- cpum_cf_free_root();
-out:
- mutex_unlock(&pmc_reserve_mutex);
+ cpum_cf_free_root(num);
}
-/* Allocate CPU counter data structure for a PMU. Called under mutex lock. */
-static int cpum_cf_alloc_cpu(int cpu)
+/*
+ * Add num references to the CPU counter data structure of a PMU and
+ * allocate it when necessary. Called with pmc_reserve_mutex held.
+ */
+static int cpum_cf_alloc_cpu(int cpu, unsigned int num)
{
struct cpu_cf_events *cpuhw;
struct cpu_cf_ptr *p;
int rc;
- mutex_lock(&pmc_reserve_mutex);
- rc = cpum_cf_alloc_root();
+ lockdep_assert_held(&pmc_reserve_mutex);
+ rc = cpum_cf_alloc_root(num);
if (rc)
- goto unlock;
+ return rc;
p = per_cpu_ptr(cpu_cf_root.cfptr, cpu);
cpuhw = p->cpucf;
@@ -256,12 +265,12 @@ static int cpum_cf_alloc_cpu(int cpu)
cpuhw = kzalloc_obj(*cpuhw);
if (cpuhw) {
p->cpucf = cpuhw;
- refcount_set(&cpuhw->refcnt, 1);
+ refcount_set(&cpuhw->refcnt, num);
} else {
rc = -ENOMEM;
}
} else {
- refcount_inc(&cpuhw->refcnt);
+ refcount_add(num, &cpuhw->refcnt);
}
if (rc) {
/*
@@ -269,10 +278,8 @@ static int cpum_cf_alloc_cpu(int cpu)
* cpu_cf_event in not created, its destroy() function is not
* invoked. Adjust the reference counter for the anchor.
*/
- cpum_cf_free_root();
+ cpum_cf_free_root(num);
}
-unlock:
- mutex_unlock(&pmc_reserve_mutex);
return rc;
}
@@ -284,39 +291,70 @@ unlock:
* perf_event_open() with task context and /dev/hwctr interface.
* If cpu is non-zero install event on this CPU only. This setup handles
* perf_event_open() with CPU context.
+ * Users with cpu == -1 are counted in cpu_cf_root::tskctx. The CPU hotplug
+ * prepare and dead callbacks use this count to install and remove the per
+ * CPU counter data on a new or dying CPU.
*/
-static int cpum_cf_alloc(int cpu)
+static int cpum_cf_alloc_cpuslocked(int cpu)
{
cpumask_var_t mask;
int rc;
+ lockdep_assert_cpus_held();
if (cpu == -1) {
if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
return -ENOMEM;
+ mutex_lock(&pmc_reserve_mutex);
for_each_online_cpu(cpu) {
- rc = cpum_cf_alloc_cpu(cpu);
+ rc = cpum_cf_alloc_cpu(cpu, 1);
if (rc) {
for_each_cpu(cpu, mask)
- cpum_cf_free_cpu(cpu);
+ cpum_cf_free_cpu(cpu, 1);
break;
}
cpumask_set_cpu(cpu, mask);
}
+ if (!rc)
+ cpu_cf_root.tskctx++;
+ mutex_unlock(&pmc_reserve_mutex);
free_cpumask_var(mask);
} else {
- rc = cpum_cf_alloc_cpu(cpu);
+ mutex_lock(&pmc_reserve_mutex);
+ rc = cpum_cf_alloc_cpu(cpu, 1);
+ mutex_unlock(&pmc_reserve_mutex);
}
return rc;
}
-static void cpum_cf_free(int cpu)
+static int cpum_cf_alloc(int cpu)
+{
+ int rc;
+
+ cpus_read_lock();
+ rc = cpum_cf_alloc_cpuslocked(cpu);
+ cpus_read_unlock();
+ return rc;
+}
+
+static void cpum_cf_free_cpuslocked(int cpu)
{
+ lockdep_assert_cpus_held();
+ mutex_lock(&pmc_reserve_mutex);
if (cpu == -1) {
+ cpu_cf_root.tskctx--;
for_each_online_cpu(cpu)
- cpum_cf_free_cpu(cpu);
+ cpum_cf_free_cpu(cpu, 1);
} else {
- cpum_cf_free_cpu(cpu);
+ cpum_cf_free_cpu(cpu, 1);
}
+ mutex_unlock(&pmc_reserve_mutex);
+}
+
+static void cpum_cf_free(int cpu)
+{
+ cpus_read_lock();
+ cpum_cf_free_cpuslocked(cpu);
+ cpus_read_unlock();
}
#define CF_DIAG_CTRSET_DEF 0xfeef /* Counter set header mark */
@@ -1090,53 +1128,67 @@ static refcount_t cfset_opencnt = REFCOU
static DEFINE_MUTEX(cfset_ctrset_mutex);
/*
- * CPU hotplug handles only /dev/hwctr device.
- * For perf_event_open() the CPU hotplug handling is done on kernel common
- * code:
+ * CPU hotplug handling:
+ *
+ * cpum_cf_prepare_cpu() and cpum_cf_dead_cpu() run while the new or dying
+ * CPU is offline. They create and remove the per CPU counter data for all
+ * users tracking every CPU (cpu == -1), that is perf_event_open() events
+ * with task context and /dev/hwctr device sessions. Each such user holds
+ * one reference to the per CPU counter data of each CPU. Therefore install
+ * and remove one reference per user, tracked in cpu_cf_root::tskctx. This
+ * guarantees the per CPU counter data exists before the new CPU executes
+ * its first task and is removed only after the dying CPU is gone.
+ *
+ * cpum_cf_online_cpu() and cpum_cf_offline_cpu() run while the new or
+ * dying CPU is online. They handle only the counter set state of open
+ * /dev/hwctr device sessions on that CPU. For perf_event_open() events
+ * nothing is done:
* - CPU add: Nothing is done since a file descriptor can not be created
* and returned to the user.
* - CPU delete: Handled by common code via pmu_disable(), pmu_stop() and
- * pmu_delete(). The event itself is removed when the file descriptor is
- * closed.
+ * pmu_delete(). During task exit processing of grouped perf events
+ * triggered by CPU hotplug processing, pmu_disable() is called as part
+ * of perf context removal process. The event itself is removed when the
+ * event file descriptor is closed.
*/
+static int cpum_cf_prepare_cpu(unsigned int cpu)
+{
+ int rc = 0;
+
+ mutex_lock(&pmc_reserve_mutex);
+ if (cpu_cf_root.tskctx)
+ rc = cpum_cf_alloc_cpu(cpu, cpu_cf_root.tskctx);
+ mutex_unlock(&pmc_reserve_mutex);
+ return rc;
+}
+
+static int cpum_cf_dead_cpu(unsigned int cpu)
+{
+ mutex_lock(&pmc_reserve_mutex);
+ if (cpu_cf_root.tskctx)
+ cpum_cf_free_cpu(cpu, cpu_cf_root.tskctx);
+ mutex_unlock(&pmc_reserve_mutex);
+ return 0;
+}
+
static int cfset_online_cpu(unsigned int cpu);
static int cpum_cf_online_cpu(unsigned int cpu)
{
- int rc = 0;
-
- /*
- * Ignore notification for perf_event_open().
- * Handle only /dev/hwctr device sessions.
- */
mutex_lock(&cfset_ctrset_mutex);
- if (refcount_read(&cfset_opencnt)) {
- rc = cpum_cf_alloc_cpu(cpu);
- if (!rc)
- cfset_online_cpu(cpu);
- }
+ if (refcount_read(&cfset_opencnt))
+ cfset_online_cpu(cpu);
mutex_unlock(&cfset_ctrset_mutex);
- return rc;
+ return 0;
}
static int cfset_offline_cpu(unsigned int cpu);
static int cpum_cf_offline_cpu(unsigned int cpu)
{
- /*
- * During task exit processing of grouped perf events triggered by CPU
- * hotplug processing, pmu_disable() is called as part of perf context
- * removal process. Therefore do not trigger event removal now for
- * perf_event_open() created events. Perf common code triggers event
- * destruction when the event file descriptor is closed.
- *
- * Handle only /dev/hwctr device sessions.
- */
mutex_lock(&cfset_ctrset_mutex);
- if (refcount_read(&cfset_opencnt)) {
+ if (refcount_read(&cfset_opencnt))
cfset_offline_cpu(cpu);
- cpum_cf_free_cpu(cpu);
- }
mutex_unlock(&cfset_ctrset_mutex);
return 0;
}
@@ -1183,7 +1235,7 @@ static void cpumf_measurement_alert(stru
static int cfset_init(void);
static int __init cpumf_pmu_init(void)
{
- int rc;
+ int state, rc;
/* Extract counter measurement facility information */
if (!cpum_cf_avail() || qctri(&cpumf_ctr_info))
@@ -1225,11 +1277,24 @@ static int __init cpumf_pmu_init(void)
cfset_init();
}
+ rc = cpuhp_setup_state(CPUHP_BP_PREPARE_DYN,
+ "perf/s390/cf:prepare",
+ cpum_cf_prepare_cpu, cpum_cf_dead_cpu);
+ if (rc < 0)
+ goto out3;
+ state = rc;
+
rc = cpuhp_setup_state(CPUHP_AP_PERF_S390_CF_ONLINE,
"perf/s390/cf:online",
cpum_cf_online_cpu, cpum_cf_offline_cpu);
- return rc;
+ if (rc < 0)
+ goto out4;
+ return 0;
+out4:
+ cpuhp_remove_state(state);
+out3:
+ perf_pmu_unregister(&cpumf_pmu);
out2:
debug_unregister_view(cf_dbg, &debug_sprintf_view);
debug_unregister(cf_dbg);
@@ -1385,6 +1450,7 @@ static void cfset_all_stop(struct cfset_
*/
static int cfset_release(struct inode *inode, struct file *file)
{
+ cpus_read_lock();
mutex_lock(&cfset_ctrset_mutex);
/* Open followed by close/exit has no private_data */
if (file->private_data) {
@@ -1395,9 +1461,10 @@ static int cfset_release(struct inode *i
}
if (refcount_dec_and_test(&cfset_opencnt)) { /* Last close */
on_each_cpu(cfset_release_cpu, NULL, 1);
- cpum_cf_free(-1);
+ cpum_cf_free_cpuslocked(-1);
}
mutex_unlock(&cfset_ctrset_mutex);
+ cpus_read_unlock();
return 0;
}
@@ -1416,15 +1483,17 @@ static int cfset_open(struct inode *inod
return -EPERM;
file->private_data = NULL;
+ cpus_read_lock();
mutex_lock(&cfset_ctrset_mutex);
if (!refcount_inc_not_zero(&cfset_opencnt)) { /* First open */
- rc = cpum_cf_alloc(-1);
+ rc = cpum_cf_alloc_cpuslocked(-1);
if (!rc) {
cfset_session_init();
refcount_set(&cfset_opencnt, 1);
}
}
mutex_unlock(&cfset_ctrset_mutex);
+ cpus_read_unlock();
/* nonseekable_open() never fails */
return rc ?: nonseekable_open(inode, file);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 516/713] s390/percpu: Fix MVIY_PERCPU() with older binutils
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 515/713] s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 517/713] s390/dasd: Do not complete a failed ESE read as successful Greg Kroah-Hartman
` (207 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Heiko Carstens,
Vasily Gorbik
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit 101782f8945a125044347312d74d488c05741c4a upstream.
Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient
this_cpu operations") introduced MVIY_PERCPU(), which stringifies
arguments that are already C string literals. This generates an
assembler macro invocation with whitespace-separated quoted arguments:
GEN_MVIY "459712" "%r3"
GNU as versions prior to binutils 2.39 drop the separating whitespace
between quoted macro arguments during input scrubbing. They
consequently parse the invocation as a single argument and emit
repeated warnings:
Warning: missing closing `"'
The .ifc in GEN_MVIY never matches and GNU as exits successfully
without emitting the mviy instruction. As a result, the interrupted
per-CPU sequence is not marked in lowcore and the exception return
path cannot repair the per-CPU address register after migration.
All MVIY_PERCPU() callers pass C string literals. Use them directly
and separate the assembler macro arguments with an explicit comma. The
resulting invocation is:
GEN_MVIY 459712, %r3
This form is unambiguous for GNU as and LLVM's integrated assembler.
This behavior was fixed in GNU as from binutils 2.39, but Linux
supports binutils 2.30.
Fixes: a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/percpu.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
index 1d955dd0defa..feb58acf87d6 100644
--- a/arch/s390/include/asm/percpu.h
+++ b/arch/s390/include/asm/percpu.h
@@ -107,8 +107,8 @@
" .endif\n" \
".endr\n" \
".endm\n" \
- ALTERNATIVE("GEN_MVIY " __stringify(disp) " " __stringify(reg) "\n", \
- "GEN_MVIY " __stringify(dispalt) " " __stringify(reg) "\n", \
+ ALTERNATIVE("GEN_MVIY " disp ", " reg "\n", \
+ "GEN_MVIY " dispalt ", " reg "\n", \
ALT_FEATURE(MFEATURE_LOWCORE)) \
".purgem GEN_MVIY\n"
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 517/713] s390/dasd: Do not complete a failed ESE read as successful
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 516/713] s390/percpu: Fix MVIY_PERCPU() with older binutils Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 518/713] s390/dasd: Guard sysfs discipline callbacks against unallocated private data Greg Kroah-Hartman
` (206 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Höppner, Stefan Haberland,
Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <sth@linux.ibm.com>
commit cddb447c62466f3076938ce120028d7b591f9f37 upstream.
dasd_int_handler() completes an NRF read of an unallocated ESE track by
calling ese_read() and unconditionally marking the request
DASD_CQR_SUCCESS. dasd_eckd_ese_read() can return an error before it has
zeroed the destination buffer: a failed sense-data parse or a current
track outside the requested range both return early, leaving the
destination pages untouched. The request is still completed successfully,
so the block layer is handed stale / uninitialized memory instead of
zeros.
Check the ese_read() return value and fail the request through the normal
error path instead of forcing DASD_CQR_SUCCESS.
Fixes: 5e6bdd37c552 ("s390/dasd: fix data corruption for thin provisioned devices")
Cc: stable@vger.kernel.org
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20260805111612.1285190-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1698,8 +1698,10 @@ void dasd_int_handler(struct ccw_device
return;
}
if (rq_data_dir(req) == READ) {
- device->discipline->ese_read(cqr, irb);
- cqr->status = DASD_CQR_SUCCESS;
+ if (device->discipline->ese_read(cqr, irb))
+ cqr->status = DASD_CQR_ERROR;
+ else
+ cqr->status = DASD_CQR_SUCCESS;
cqr->stopclk = now;
dasd_device_clear_timer(device);
dasd_schedule_device_bh(device);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 518/713] s390/dasd: Guard sysfs discipline callbacks against unallocated private data
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 517/713] s390/dasd: Do not complete a failed ESE read as successful Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 519/713] s390/dasd: Propagate partial completion length across ERP recovery Greg Kroah-Hartman
` (205 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Höppner, Stefan Haberland,
Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <sth@linux.ibm.com>
commit 2a1780f9fc2493bd34c418a0be6fc58943afcecf upstream.
Several sysfs show/store handlers call a discipline callback that
dereferences device->private, either directly or through the
DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline
is assigned before check_device() allocates device->private, so an
unprivileged read of one of these world-readable attributes in that window
dereferences a NULL pointer and panics.
Guard the dereference inside each callback that actually touches
device->private.
Fixes: c729696bcf8b ("s390/dasd: Recognise data for ESE volumes")
Cc: stable@vger.kernel.org
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20260805111612.1285190-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_eckd.c | 40 ++++++++++++++++++++++++++++++++++++++--
1 file changed, 38 insertions(+), 2 deletions(-)
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1492,6 +1492,8 @@ static void dasd_eckd_reset_path(struct
struct dasd_eckd_private *private = device->private;
unsigned long flags;
+ if (!private)
+ return;
if (!private->fcx_max_data)
private->fcx_max_data = get_fcx_max_data(device);
spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
@@ -1647,6 +1649,9 @@ static int dasd_eckd_is_ese(struct dasd_
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->vsq.vol_info.ese;
}
@@ -1654,6 +1659,9 @@ static int dasd_eckd_ext_pool_id(struct
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->vsq.extent_pool_id;
}
@@ -1667,6 +1675,9 @@ static int dasd_eckd_space_configured(st
struct dasd_eckd_private *private = device->private;
int rc;
+ if (!private)
+ return 0;
+
rc = dasd_eckd_read_vol_info(device);
return rc ? : private->vsq.space_configured;
@@ -1681,6 +1692,9 @@ static int dasd_eckd_space_allocated(str
struct dasd_eckd_private *private = device->private;
int rc;
+ if (!private)
+ return 0;
+
rc = dasd_eckd_read_vol_info(device);
return rc ? : private->vsq.space_allocated;
@@ -1690,6 +1704,9 @@ static int dasd_eckd_logical_capacity(st
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->vsq.logical_capacity;
}
@@ -1832,7 +1849,11 @@ static int dasd_eckd_read_ext_pool_info(
static int dasd_eckd_ext_size(struct dasd_device *device)
{
struct dasd_eckd_private *private = device->private;
- struct dasd_ext_pool_sum eps = private->eps;
+ struct dasd_ext_pool_sum eps;
+
+ if (!private)
+ return 0;
+ eps = private->eps;
if (!eps.flags.extent_size_valid)
return 0;
@@ -1848,6 +1869,9 @@ static int dasd_eckd_ext_pool_warn_thrsh
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->eps.warn_thrshld;
}
@@ -1855,6 +1879,9 @@ static int dasd_eckd_ext_pool_cap_at_war
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->eps.flags.capacity_at_warnlevel;
}
@@ -1865,6 +1892,9 @@ static int dasd_eckd_ext_pool_oos(struct
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->eps.flags.pool_oos;
}
@@ -5938,8 +5968,11 @@ static int dasd_eckd_query_host_access(s
struct ccw1 *ccw;
int rc;
+ if (!private)
+ return -ENODEV;
+
/* not available for HYPER PAV alias devices */
- if (!device->block && private->lcu->pav == HYPER_PAV)
+ if (!device->block && private->lcu && private->lcu->pav == HYPER_PAV)
return -EOPNOTSUPP;
/* may not be supported by the storage server */
@@ -6804,6 +6837,9 @@ static int dasd_eckd_hpf_enabled(struct
{
struct dasd_eckd_private *private = device->private;
+ if (!private)
+ return 0;
+
return private->fcx_max_data ? 1 : 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 519/713] s390/dasd: Propagate partial completion length across ERP recovery
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 518/713] s390/dasd: Guard sysfs discipline callbacks against unallocated private data Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 520/713] PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Greg Kroah-Hartman
` (204 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Höppner, Stefan Haberland,
Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <sth@linux.ibm.com>
commit 6fb5ba2e7e43173a3761e46f091070a8185efa14 upstream.
dasd_default_erp_postaction() copies the timing and device state from
the finished ERP request back to the original request but drops
proc_bytes. A request that was partially completed, an ESE read of a
not-yet-allocated track returns fewer bytes than requested, and then
recovered through the ERP chain loses its partial-completion length.
__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole
request instead of requeueing the remainder, silently returning zeroed
data for the part that was never read.
Carry proc_bytes over to the original request like the other
per-request state.
Fixes: 5e6bdd37c552 ("s390/dasd: fix data corruption for thin provisioned devices")
Cc: stable@vger.kernel.org
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20260805111612.1285190-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_erp.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/s390/block/dasd_erp.c
+++ b/drivers/s390/block/dasd_erp.c
@@ -123,6 +123,7 @@ struct dasd_ccw_req *dasd_default_erp_po
int success;
unsigned long startclk, stopclk;
struct dasd_device *startdev;
+ unsigned int proc_bytes;
BUG_ON(cqr->refers == NULL || cqr->function == NULL);
@@ -130,6 +131,7 @@ struct dasd_ccw_req *dasd_default_erp_po
startclk = cqr->startclk;
stopclk = cqr->stopclk;
startdev = cqr->startdev;
+ proc_bytes = cqr->proc_bytes;
/* free all ERPs - but NOT the original cqr */
while (cqr->refers != NULL) {
@@ -147,6 +149,7 @@ struct dasd_ccw_req *dasd_default_erp_po
cqr->startclk = startclk;
cqr->stopclk = stopclk;
cqr->startdev = startdev;
+ cqr->proc_bytes = proc_bytes;
if (success)
cqr->status = DASD_CQR_DONE;
else {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 520/713] PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 519/713] s390/dasd: Propagate partial completion length across ERP recovery Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 521/713] PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Greg Kroah-Hartman
` (203 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Thomas Gleixner,
Aditya Garg, Shradha Gupta, Naman Jain, Michael Kelley, Wei Liu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <namjain@linux.microsoft.com>
commit 86bdd16e8f390d51bae9e77a4bc4164ca2f580fe upstream.
The Hyper-V vPCI MSI irqchip never installs an irq_retrigger() callback.
On CPU hot-unplug fixup_irqs() migrates the interrupts which are affine to
the outgoing CPU to a new target. If an interrupt still has its pending bit
set in the outgoing CPU's IRR at that point, fixup_irqs() resends it on the
new target through the irqchip's irq_retrigger() callback. As the Hyper-V
PCI/MSI chip does not provide that callback, the pending interrupt is
silently dropped, which can result in lost interrupts, stalls and "No irq
handler for vector" messages during CPU hotplug.
Install irq_chip_retrigger_hierarchy() as the irq_retrigger() callback for
the Hyper-V PCI/MSI irqchip, so that a pending interrupt is resent on its
new target CPU via the parent x86 vector domain.
Fixes: 4daace0d8ce85 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs")
Cc: stable@vger.kernel.org
Suggested-by: Long Li <longli@microsoft.com>
Suggested-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Aditya Garg <gargaditya@linux.microsoft.com>
Reviewed-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-hyperv.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -2119,6 +2119,7 @@ static bool hv_pcie_init_dev_msi_info(st
info->ops->msi_prepare = hv_msi_prepare;
chip->irq_set_affinity = irq_chip_set_affinity_parent;
+ chip->irq_retrigger = irq_chip_retrigger_hierarchy;
if (IS_ENABLED(CONFIG_X86))
chip->flags |= IRQCHIP_MOVE_DEFERRED;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 521/713] PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 520/713] PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 522/713] PCI: meson: Fix GPIO state while requesting PERST# Greg Kroah-Hartman
` (202 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamad Raizudeen, Bjorn Helgaas,
Manivannan Sadhasivam
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
commit 23d7eed5974989de56273c964d7e510e4aad91e8 upstream.
pci_quirk_enable_intel_rp_mpc_acs() reads a 32-bit DWORD from the MPC
register, sets bit 26 (INTEL_MPC_REG_IRBNCE), but it writes it back using
pci_write_config_word().
Because bit 26 resides in the upper 16 bits of the 32-bit register, a
16-bit write drops the newly set bit. The quirk logs that it is enabling
IRBNCE, but the hardware never actually receives the command.
Use pci_write_config_dword() to ensure the full 32-bit value is written
back to the hardware.
Fixes: d99321b63b1f ("PCI: Enable quirks for PCIe ACS on Intel PCH root ports")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723171203.4892-1-raizudeen.kerneldev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5361,7 +5361,7 @@ static void pci_quirk_enable_intel_rp_mp
if (!(mpc & INTEL_MPC_REG_IRBNCE)) {
pci_info(dev, "Enabling MPC IRBNCE\n");
mpc |= INTEL_MPC_REG_IRBNCE;
- pci_write_config_word(dev, INTEL_MPC_REG, mpc);
+ pci_write_config_dword(dev, INTEL_MPC_REG, mpc);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 522/713] PCI: meson: Fix GPIO state while requesting PERST#
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 521/713] PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 523/713] PCI: starfive: Fix resource leaks on error paths in host_init() Greg Kroah-Hartman
` (201 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronald Claveau,
Manivannan Sadhasivam, Bjorn Helgaas, Neil Armstrong
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Claveau <linux-kernel-dev@aliel.fr>
commit 40fb390cbcc11797c44c16dabdf763ec87643671 upstream.
Meson devicetree defines the PERST# GPIO as 'reset' GPIO. Commit
4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
inverted the PERST# assertion logic to use proper GPIO descriptor semantics
and moved the polarity configuration to the device tree as GPIO_ACTIVE_LOW.
However, the initial PERST# GPIO state "GPIOD_OUT_LOW" was not updated
accordingly.
This results in the enumeration failure of the endpoint devices as
PERST# would get deasserted while requesting the GPIO even before
power and REFCLK becomes stable.
Without this fix:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: SSS flag set, parallel bus scan disabled
ahci 0000:01:00.0: Controller reset failed (0xffffffff)
ahci 0000:01:00.0: probe with driver ahci failed with error -5
With this fix:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: AHCI vers 0001.0300, 32 command slots, 6 Gbps, SATA mode
ahci 0000:01:00.0: 1/1 ports implemented (port mask 0x1)
ahci 0000:01:00.0: flags: 64bit ncq led clo only pio ccc
Change the GPIO request flag from GPIOD_OUT_LOW to GPIOD_OUT_HIGH to get
the right behaviour.
Fixes: 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
[mani: CCed stable and commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616-fix-meson-pcie-reset-gpio-v1-1-fca404b4c8be@aliel.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pci-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/controller/dwc/pci-meson.c
+++ b/drivers/pci/controller/dwc/pci-meson.c
@@ -401,7 +401,7 @@ static int meson_pcie_probe(struct platf
return PTR_ERR(mp->phy);
}
- mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+ mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(mp->reset_gpio)) {
dev_err(dev, "get reset gpio failed\n");
return PTR_ERR(mp->reset_gpio);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 523/713] PCI: starfive: Fix resource leaks on error paths in host_init()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 522/713] PCI: meson: Fix GPIO state while requesting PERST# Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 524/713] PCI: plda: Fix use-after-free of event IRQs during teardown Greg Kroah-Hartman
` (200 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Tariq, Manivannan Sadhasivam
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Tariq <alitariq45892@gmail.com>
commit 22877a061f81c5d58041e384b3131684bec636b9 upstream.
starfive_pcie_host_init() acquires the PHY, clocks/resets, and an
optional regulator in sequence, but does not correctly unwind these
resources when a later step fails.
If starfive_pcie_clk_rst_init() fails after the PHY has already been
successfully enabled, the function returns directly without disabling
the PHY, leaking it and leaving it powered.
If regulator_enable() fails for the optional vpcie3v3 regulator, the
failure is only logged; the function falls through and returns
success, leaving the driver believing the regulator is enabled while
continuing to configure PCIe hardware that may be unpowered. This
also leaves the clocks and PHY enabled with nothing to clean them up.
Disable the PHY on the clk/reset failure path, and disable the
clocks/resets and PHY, then return the error, if the regulator fails
to enable.
Build-tested and boot-tested on StarFive VisionFive 2 v1.2A
Fixes: 05a75df4182e ("PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots")
Fixes: 39b91eb40c6a ("PCI: starfive: Add JH7110 PCIe controller")
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260716102053.185276-1-alitariq45892@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/plda/pcie-starfive.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/plda/pcie-starfive.c b/drivers/pci/controller/plda/pcie-starfive.c
index 298036c3e7f9..628f8c8d6747 100644
--- a/drivers/pci/controller/plda/pcie-starfive.c
+++ b/drivers/pci/controller/plda/pcie-starfive.c
@@ -304,12 +304,14 @@ static int starfive_pcie_host_init(struct plda_pcie_rp *plda)
ret = starfive_pcie_clk_rst_init(pcie);
if (ret)
- return ret;
+ goto err_disable_phy;
if (pcie->vpcie3v3) {
ret = regulator_enable(pcie->vpcie3v3);
- if (ret)
+ if (ret) {
dev_err_probe(dev, ret, "failed to enable vpcie3v3 regulator\n");
+ goto err_clk_rst;
+ }
}
if (pcie->reset_gpio)
@@ -379,6 +381,13 @@ static int starfive_pcie_host_init(struct plda_pcie_rp *plda)
dev_info(dev, "port link down\n");
return 0;
+
+err_clk_rst:
+ starfive_pcie_clk_rst_deinit(pcie);
+err_disable_phy:
+ starfive_pcie_disable_phy(pcie);
+
+ return ret;
}
static const struct plda_pcie_host_ops sf_host_ops = {
--
2.55.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 524/713] PCI: plda: Fix use-after-free of event IRQs during teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 523/713] PCI: starfive: Fix resource leaks on error paths in host_init() Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 525/713] PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Greg Kroah-Hartman
` (199 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Tariq, Manivannan Sadhasivam
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Tariq <alitariq45892@gmail.com>
commit 26b73bae01d6eb81a4a38f36101812f20b2639de upstream.
plda_pcie_irq_domain_deinit() removes pcie->event_domain via
irq_domain_remove(), but the per-event IRQs mapped from that domain
are requested with devm_request_irq() in plda_init_interrupts(). The
actual free_irq() for a devm-managed IRQ is deferred by devres until
after the calling probe()/remove() function returns.
This means irq_domain_remove() can free the domain's internal data
before the deferred free_irq() for IRQs still mapped into it has run.
When devres later processes that deferred cleanup, it can end up
dereferencing the already-freed domain.
Free each event IRQ explicitly with devm_free_irq() before removing
the domain. This triggers the free immediately and removes the IRQ
from the devres tracking list, so devres will not attempt to free it
a second time later.
Also dispose of the event, INTx, and MSI IRQ mappings with
irq_dispose_mapping() before their owning domains are removed.
Finally, guard the calls to irq_set_chained_handler_and_data() for
pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when
those fields hold a valid (>0) IRQ number.
This is a pre-existing issue, flagged by automated review during work
on an earlier, unrelated patch to this driver.
Build-tested and boot-tested on StarFive VisionFive v1.2A board
Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions")
Closes: https://lore.kernel.org/linux-pci/20260714115343.4D49E1F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723140434.675512-2-alitariq45892@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/plda/pcie-plda-host.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
--- a/drivers/pci/controller/plda/pcie-plda-host.c
+++ b/drivers/pci/controller/plda/pcie-plda-host.c
@@ -559,9 +559,27 @@ EXPORT_SYMBOL_GPL(plda_pcie_setup_iomems
static void plda_pcie_irq_domain_deinit(struct plda_pcie_rp *pcie)
{
- irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
- irq_set_chained_handler_and_data(pcie->msi_irq, NULL, NULL);
- irq_set_chained_handler_and_data(pcie->intx_irq, NULL, NULL);
+ u32 i, event_irq;
+
+ if (pcie->irq > 0)
+ irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
+ if (pcie->msi_irq > 0)
+ irq_set_chained_handler_and_data(pcie->msi_irq, NULL, NULL);
+ if (pcie->intx_irq > 0)
+ irq_set_chained_handler_and_data(pcie->intx_irq, NULL, NULL);
+
+ for_each_set_bit(i, &pcie->events_bitmap, pcie->num_events) {
+ event_irq = irq_find_mapping(pcie->event_domain, i);
+ if (event_irq) {
+ devm_free_irq(pcie->dev, event_irq, pcie);
+ irq_dispose_mapping(event_irq);
+ }
+ }
+
+ if (pcie->intx_irq)
+ irq_dispose_mapping(pcie->intx_irq);
+ if (pcie->msi_irq)
+ irq_dispose_mapping(pcie->msi_irq);
irq_domain_remove(pcie->msi.dev_domain);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 525/713] PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 524/713] PCI: plda: Fix use-after-free of event IRQs during teardown Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 526/713] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Greg Kroah-Hartman
` (198 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Tariq, Manivannan Sadhasivam
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Tariq <alitariq45892@gmail.com>
commit 19a30bbb6477bfd7e3109b7a2943e6597ee9de37 upstream.
plda_init_interrupts() initializes IRQ domains and creates IRQ mapping but
does not unwind them when later step fails.
If platform_get_irq() or either irq_create_mapping() fails
in plda_init_interrupts(), the domains are never deinitialized. If
irq_create_mapping() fails, port->intx_irq stays initialized.
Hence, remove the IRQ domains in the error path by calling
plda_pcie_irq_domain_deinit().
Since plda_pcie_irq_domain_deinit() now disposes of the intx_irq and
msi_irq mappings itself before removing their domains, the msi_irq
mapping failure path can go directly to err_irq_domain_deinit instead of
disposing of port->intx_irq separately first.
This issue was found by automated review of sashiko-bot
Fixes: 4602c370bdf6 ("PCI: microchip: Move IRQ functions to pcie-plda-host.c")
Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions")
Closes: https://lore.kernel.org/linux-pci/20260718120701.DF4111F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723142824.726655-1-alitariq45892@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/plda/pcie-plda-host.c | 28 ++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
--- a/drivers/pci/controller/plda/pcie-plda-host.c
+++ b/drivers/pci/controller/plda/pcie-plda-host.c
@@ -419,6 +419,8 @@ static int plda_pcie_init_irq_domains(st
return plda_allocate_msi_domains(port);
}
+static void plda_pcie_irq_domain_deinit(struct plda_pcie_rp *pcie);
+
int plda_init_interrupts(struct platform_device *pdev,
struct plda_pcie_rp *port,
const struct plda_event *event)
@@ -440,14 +442,17 @@ int plda_init_interrupts(struct platform
}
port->irq = platform_get_irq(pdev, 0);
- if (port->irq < 0)
- return -ENODEV;
+ if (port->irq < 0) {
+ ret = -ENODEV;
+ goto err_irq_domain_deinit;
+ }
for_each_set_bit(i, &port->events_bitmap, port->num_events) {
event_irq = irq_create_mapping(port->event_domain, i);
if (!event_irq) {
dev_err(dev, "failed to map hwirq %d\n", i);
- return -ENXIO;
+ ret = -ENXIO;
+ goto err_irq_domain_deinit;
}
if (event->request_event_irq)
@@ -459,7 +464,7 @@ int plda_init_interrupts(struct platform
if (ret) {
dev_err(dev, "failed to request IRQ %d\n", event_irq);
- return ret;
+ goto err_irq_domain_deinit;
}
}
@@ -467,7 +472,8 @@ int plda_init_interrupts(struct platform
event->intx_event);
if (!port->intx_irq) {
dev_err(dev, "failed to map INTx interrupt\n");
- return -ENXIO;
+ ret = -ENXIO;
+ goto err_irq_domain_deinit;
}
/* Plug the INTx chained handler */
@@ -475,8 +481,11 @@ int plda_init_interrupts(struct platform
port->msi_irq = irq_create_mapping(port->event_domain,
event->msi_event);
- if (!port->msi_irq)
- return -ENXIO;
+ if (!port->msi_irq) {
+ dev_err(dev, "failed to map MSI interrupt\n");
+ ret = -ENXIO;
+ goto err_irq_domain_deinit;
+ }
/* Plug the MSI chained handler */
irq_set_chained_handler_and_data(port->msi_irq, plda_handle_msi, port);
@@ -485,6 +494,11 @@ int plda_init_interrupts(struct platform
irq_set_chained_handler_and_data(port->irq, plda_handle_event, port);
return 0;
+
+err_irq_domain_deinit:
+ plda_pcie_irq_domain_deinit(port);
+
+ return ret;
}
EXPORT_SYMBOL_GPL(plda_init_interrupts);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 526/713] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 525/713] PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 527/713] PCI/sysfs: Fix read byte order in pci_read_legacy_io() Greg Kroah-Hartman
` (197 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Harvey, Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <tharvey@gateworks.com>
commit 062fb7f816439da6bf3860386889343482a66bd4 upstream.
The Pericom PI7C9X2G608 6-port Gen2 PCIe switch is also affected by the
PI7C9X2G errata per the errata document:
E2: ACS P2P Request Redirect Is Not Functional
Apply the same quirk to this PCI ID as well to apply the workaround
required if using ACS.
Fixes: acd61ffb2f16 ("PCI: Add ACS quirk for Pericom PI7C9X2G switches")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260720215718.2139510-1-tharvey@gateworks.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -6263,6 +6263,10 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_P
pci_fixup_pericom_acs_store_forward);
DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_PERICOM, 0xb404,
pci_fixup_pericom_acs_store_forward);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_PERICOM, 0x2608,
+ pci_fixup_pericom_acs_store_forward);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_PERICOM, 0x2608,
+ pci_fixup_pericom_acs_store_forward);
static void nvidia_ion_ahci_fixup(struct pci_dev *pdev)
{
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 527/713] PCI/sysfs: Fix read byte order in pci_read_legacy_io()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 526/713] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 528/713] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
` (196 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 5b95212de6dcd7e0275cea7f894fe7226c7d9f29 upstream.
pci_read_legacy_io() passes the sysfs buffer directly to pci_legacy_read():
return pci_legacy_read(bus, off, (u32 *)buf, count);
The PowerPC implementation stores the result as a native-endian integer:
*((u16 *)val) = in_le16(addr);
On big-endian PowerPC this stores the bytes in the wrong order, so
a 2-byte read of a device register returns different bytes than two
1-byte reads at the same addresses. The same applies to 4-byte
reads. On little-endian the native byte order already matches PCI
I/O port byte order, so the conversion is a no-op.
Thus, let pci_legacy_read() store into a local u32 variable, then
copy the I/O port value to the sysfs buffer using put_unaligned_le16()
and put_unaligned_le32() for the 2 and 4 byte cases, converting from
the native integer to little-endian byte order matching PCI I/O port
space.
No changes are needed for the Alpha platform.
The legacy_io file is root-only and exists only on Alpha and PowerPC,
the two architectures that define HAVE_PCI_LEGACY.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616163131.2763281-2-kwilczynski@kernel.org
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-sysfs.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -888,12 +888,30 @@ static ssize_t pci_read_legacy_io(struct
char *buf, loff_t off, size_t count)
{
struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj));
+ u32 val = 0;
+ int ret;
/* Only support 1, 2 or 4 byte accesses */
if (count != 1 && count != 2 && count != 4)
return -EINVAL;
- return pci_legacy_read(bus, off, (u32 *)buf, count);
+ ret = pci_legacy_read(bus, off, &val, count);
+ if (ret < 0)
+ return ret;
+
+ switch (count) {
+ case 1:
+ buf[0] = *(u8 *)&val;
+ break;
+ case 2:
+ put_unaligned_le16(*(u16 *)&val, buf);
+ break;
+ case 4:
+ put_unaligned_le32(val, buf);
+ break;
+ }
+
+ return ret;
}
/**
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 528/713] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 527/713] PCI/sysfs: Fix read byte order in pci_read_legacy_io() Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 529/713] PCI/AER: Emit TLP Log only for unmasked errors Greg Kroah-Hartman
` (195 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit b14b2bab88d7099ab4447560cbe4b40945e5c069 upstream.
Currently, the boundary checks in pci_read_config() and pci_write_config()
reject only offsets beyond the effective configuration space size.
An access at an offset exactly equal to that size passes the check, has its
length clamped to zero, and then invokes pci_config_pm_runtime_get() and
pci_config_pm_runtime_put() around transfer blocks that do nothing.
This is a problem because pci_config_pm_runtime_get() synchronously resumes
the upstream bridge through pm_runtime_get_sync() and resumes the device
itself through pm_runtime_resume() when it is in D3cold, only for the
handler to return zero immediately afterwards. Such a spurious wakeup
wastes power and adds needless resume latency.
The sysfs core already clamps accesses against the attribute size set
through the bin_size() callback, which reports either 256 or 4096 bytes.
As such, the affected accesses are reads at offset 64 (or 128 for CardBus
devices) through files opened without CAP_SYS_ADMIN, and reads and writes
at the exact configuration space size on devices where a quirk sets a
non-standard size.
Reject accesses at the boundary offset as well, so they return early before
any runtime PM involvement, matching the procfs implementations in
proc_bus_pci_read() and proc_bus_pci_write().
The value returned to userspace at these offsets remains zero, so the
change is not visible to userspace.
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
[bhelgaas: tweak commit log, order tags]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260720204356.1501749-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -718,7 +718,7 @@ static ssize_t pci_read_config(struct fi
else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)
size = 128;
- if (off > size)
+ if (off >= size)
return 0;
if (off + count > size) {
size -= off;
@@ -799,7 +799,7 @@ static ssize_t pci_write_config(struct f
add_taint(TAINT_USER, LOCKDEP_STILL_OK);
}
- if (off > dev->cfg_size)
+ if (off >= dev->cfg_size)
return 0;
if (off + count > dev->cfg_size) {
size = dev->cfg_size - off;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 529/713] PCI/AER: Emit TLP Log only for unmasked errors
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 528/713] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 530/713] PCI/AER: Fix mapping of errors to agent & layer Greg Kroah-Hartman
` (194 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit a8bf2dd750de7d682fdaa2127f4e3217ce9c4a82 upstream.
Per PCIe r7.0 sec 6.2.5, the prefix and header of an offending TLP is only
recorded for unmasked Uncorrectable Errors. Yet when the AER driver
determines whether a prefix and header has been logged, it does not take
the Uncorrectable Error Mask Register into account. Fix it.
Fixes: 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.6.19+
Link: https://patch.msgid.link/2e712b96ba5bfc729d78bfc23f7fb7d285aa3d6d.1784905909.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/aer.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -942,7 +942,8 @@ void pci_print_aer(struct pci_dev *dev,
status = aer->uncor_status;
mask = aer->uncor_mask;
info.level = KERN_ERR;
- tlp_header_valid = tlp_header_logged(status, aer->cap_control);
+ tlp_header_valid = tlp_header_logged(status & ~mask,
+ aer->cap_control);
}
info.status = status;
@@ -1336,7 +1337,7 @@ int aer_get_device_error_info(struct aer
pci_read_config_dword(dev, aer + PCI_ERR_CAP, &aercc);
info->first_error = PCI_ERR_CAP_FEP(aercc);
- if (tlp_header_logged(info->status, aercc)) {
+ if (tlp_header_logged(info->status & ~info->mask, aercc)) {
info->tlp_header_valid = 1;
pcie_read_tlp_log(dev, aer + PCI_ERR_HEADER_LOG,
aer + PCI_ERR_PREFIX_LOG,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 530/713] PCI/AER: Fix mapping of errors to agent & layer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 529/713] PCI/AER: Emit TLP Log only for unmasked errors Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 531/713] PCI/ASPM: Avoid L0s for Realtek RTS525A Greg Kroah-Hartman
` (193 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 1017599755b8b578a671f8fac175bce56189d01c upstream.
PCIe r7.0 sec 6.2.7 documents the agent and layer of each Correctable and
Uncorrectable Error. Based on this spec section, the AER driver maps
detected errors to an agent and layer using a set of macros and logs them.
Most errors listed in sec 6.2.7 map to the "Receiver" agent and
"Transaction Layer", so the macros use these as defaults unless an error
maps to something else.
However the macros have not been amended since their introduction in 2006
with commit 6c2b374d7485 ("PCI-Express AER implemetation: AER core and
aerdriver"). They are still based on PCIe r1.0 sec 7.2.5 (renumbered to
6.2.7 in PCIe r1.1 and newer).
Amend the macros to map errors introduced since then to the appropriate
agent and layer.
PCIe r2.1 introduced a new "Component" agent and "General" layer for
Internal Errors and Header Log Overflow. Add them to the macros.
Unsupported Request is currently mapped to the "Requester" agent, even
though it is reported by the "Receiver". Fix the incorrect mapping.
Sec 6.2.7 neglects to list an agent for Data Link Protocol Error and
Surprise Down Error. Map the latter to "Component" because PCIe r7.0 sec
3.2.1 states that the error is "associated with the detecting Port". Map
the former to "Receiver" because every occurrence of Data Link Protocol
Error in the spec refers to it being logged in the Receiving Port. I have
had these errata reported to the PCI-SIG Protocol Working Group. (There's
also a layout erratum in the REPLAY_NUM Rollover row wherein columns are
shifted to the left, but that's already corrected in the PCIe r7.1 draft
as of 2026-04-07.)
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/aec4820a75e949b332585a08cb1808fda7f40ea4.1784905909.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/aer.c | 24 +++++++++++++++++++-----
1 file changed, 19 insertions(+), 5 deletions(-)
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -428,23 +428,32 @@ void pci_aer_exit(struct pci_dev *dev)
#define AER_AGENT_REQUESTER 1
#define AER_AGENT_COMPLETER 2
#define AER_AGENT_TRANSMITTER 3
+#define AER_AGENT_COMPONENT 4
#define AER_AGENT_REQUESTER_MASK(t) ((t == AER_CORRECTABLE) ? \
- 0 : (PCI_ERR_UNC_COMP_TIME|PCI_ERR_UNC_UNSUP))
+ 0 : PCI_ERR_UNC_COMP_TIME)
#define AER_AGENT_COMPLETER_MASK(t) ((t == AER_CORRECTABLE) ? \
0 : PCI_ERR_UNC_COMP_ABORT)
#define AER_AGENT_TRANSMITTER_MASK(t) ((t == AER_CORRECTABLE) ? \
- (PCI_ERR_COR_REP_ROLL|PCI_ERR_COR_REP_TIMER) : 0)
+ (PCI_ERR_COR_REP_ROLL|PCI_ERR_COR_REP_TIMER) : \
+ (PCI_ERR_UNC_POISON_BLK|PCI_ERR_UNC_ATOMEG| \
+ PCI_ERR_UNC_DMWR_BLK|PCI_ERR_UNC_XLAT_BLK| \
+ PCI_ERR_UNC_TLPPRE))
+#define AER_AGENT_COMPONENT_MASK(t) ((t == AER_CORRECTABLE) ? \
+ (PCI_ERR_COR_INTERNAL|PCI_ERR_COR_LOG_OVER) : \
+ (PCI_ERR_UNC_INTN|PCI_ERR_UNC_SURPDN))
#define AER_GET_AGENT(t, e) \
((e & AER_AGENT_COMPLETER_MASK(t)) ? AER_AGENT_COMPLETER : \
(e & AER_AGENT_REQUESTER_MASK(t)) ? AER_AGENT_REQUESTER : \
(e & AER_AGENT_TRANSMITTER_MASK(t)) ? AER_AGENT_TRANSMITTER : \
+ (e & AER_AGENT_COMPONENT_MASK(t)) ? AER_AGENT_COMPONENT : \
AER_AGENT_RECEIVER)
#define AER_PHYSICAL_LAYER_ERROR 0
#define AER_DATA_LINK_LAYER_ERROR 1
#define AER_TRANSACTION_LAYER_ERROR 2
+#define AER_GENERAL_ERROR 3
#define AER_PHYSICAL_LAYER_ERROR_MASK(t) ((t == AER_CORRECTABLE) ? \
PCI_ERR_COR_RCVR : 0)
@@ -452,11 +461,14 @@ void pci_aer_exit(struct pci_dev *dev)
(PCI_ERR_COR_BAD_TLP| \
PCI_ERR_COR_BAD_DLLP| \
PCI_ERR_COR_REP_ROLL| \
- PCI_ERR_COR_REP_TIMER) : PCI_ERR_UNC_DLP)
+ PCI_ERR_COR_REP_TIMER) : (PCI_ERR_UNC_DLP|PCI_ERR_UNC_SURPDN))
+#define AER_GENERAL_ERROR_MASK(t) ((t == AER_CORRECTABLE) ? \
+ (PCI_ERR_COR_INTERNAL|PCI_ERR_COR_LOG_OVER) : PCI_ERR_UNC_INTN)
#define AER_GET_LAYER_ERROR(t, e) \
((e & AER_PHYSICAL_LAYER_ERROR_MASK(t)) ? AER_PHYSICAL_LAYER_ERROR : \
(e & AER_DATA_LINK_LAYER_ERROR_MASK(t)) ? AER_DATA_LINK_LAYER_ERROR : \
+ (e & AER_GENERAL_ERROR_MASK(t)) ? AER_GENERAL_ERROR : \
AER_TRANSACTION_LAYER_ERROR)
/*
@@ -471,7 +483,8 @@ static const char * const aer_error_seve
static const char *aer_error_layer[] = {
"Physical Layer",
"Data Link Layer",
- "Transaction Layer"
+ "Transaction Layer",
+ "General",
};
static const char *aer_correctable_error_string[] = {
@@ -548,7 +561,8 @@ static const char *aer_agent_string[] =
"Receiver ID",
"Requester ID",
"Completer ID",
- "Transmitter ID"
+ "Transmitter ID",
+ "Component ID",
};
#define aer_stats_dev_attr(name, stats_array, strings_array, \
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 531/713] PCI/ASPM: Avoid L0s for Realtek RTS525A
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 530/713] PCI/AER: Fix mapping of errors to agent & layer Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Greg Kroah-Hartman
` (192 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Lee, Bjorn Helgaas, Lukas Wunner,
Manivannan Sadhasivam
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Lee <max.lee@canonical.com>
commit ec3d987fcaf92516d13ee18c305c82281557046d upstream.
The Realtek RTS525A PCIe card reader reports an AER Correctable Replay
Timer Timeout storm when ASPM L0s is enabled on its link. On an affected
HP ZBook Power 16 inch G11, the Root Port received tens of millions of AER
interrupts from the RTS525A even when the rtsx_pci driver was blacklisted
and the endpoint was not enabled by a driver.
For example:
pcieport 0000:00:1c.6: AER: Multiple Correctable error message received from 0000:58:00.0
rtsx_pci 0000:58:00.0: PCIe Bus Error: severity=Correctable, type=Data Link Layer, (Transmitter ID)
rtsx_pci 0000:58:00.0: device [10ec:525a] error status/mask=00001000/00006000
rtsx_pci 0000:58:00.0: [12] Timeout
pcieport 0000:00:1c.6: AER: Correctable error message received from 0000:58:00.0
Testing with OS-native AER control showed that disabling only L0s on the
RTS525A link stops new AER interrupt and counter growth while leaving L1
enabled. Disabling L1, L1 substates, or Clock PM alone did not stop the
storm.
Prevent the broken L0s configuration by removing L0s from the RTS525A
advertised ASPM capability. This avoids enabling the non-working ASPM
state instead of masking the resulting AER Replay Timer Timeout reports.
Signed-off-by: Max Lee <max.lee@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260707021527.639611-1-max.lee@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2507,6 +2507,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+/* Realtek RTS525A generates a Replay Timer Timeout storm when L0s is enabled. */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x525a, quirk_disable_aspm_l0s);
+
static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
{
pcie_aspm_remove_cap(dev,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 531/713] PCI/ASPM: Avoid L0s for Realtek RTS525A Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 9:02 ` Lukas Wunner
2026-09-04 4:58 ` [PATCH 7.2 533/713] PCI/MSI: Enable memory decoding before restoring MSI-X messages Greg Kroah-Hartman
` (191 subsequent siblings)
723 siblings, 1 reply; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darshit Shah, Bjorn Helgaas,
Lukas Wunner, Kuppuswamy Sathyanarayanan
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darshit Shah <darnshah@amazon.de>
commit 97ca178c899d0049210d325b123ed024eb5ac000 upstream.
PCIe r7.0, sec 6.2.11, "Implementation Note: Determination of DPC Control",
recommends that "... operating systems always link control of DPC to the
control of Advanced Error Reporting."
Any PCIe device may advertise AER, but only Root Ports and Root Complex
Event Collectors can generate AER interrupts, so the AER driver only binds
to RPs and RCECs.
Any Root Port or Switch Downstream Port may advertise Downstream Port
Containment (DPC), but previously the DPC driver was limited to devices the
AER driver could bind to, i.e., only RPs that advertised AER.
Since any Port with DPC can generate DPC interrupts, allow the DPC driver
to bind to such a Port as long as the OS controls AER, regardless of
whether the AER driver binds to it.
Signed-off-by: Darshit Shah <darnshah@amazon.de>
[bhelgaas: commit log, reorder || operands to simplify patch]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251211164257.81655-1-darnshah@amazon.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/portdrv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/pcie/portdrv.c
+++ b/drivers/pci/pcie/portdrv.c
@@ -264,7 +264,7 @@ static int get_port_device_capability(st
*/
if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC) &&
pci_aer_available() &&
- (pcie_ports_dpc_native || (services & PCIE_PORT_SERVICE_AER)))
+ (pcie_ports_dpc_native || host->native_aer))
services |= PCIE_PORT_SERVICE_DPC;
/* Enable bandwidth control if more than one speed is supported. */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 533/713] PCI/MSI: Enable memory decoding before restoring MSI-X messages
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 534/713] PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
` (190 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Farhan Ali, Bjorn Helgaas,
Thomas Gleixner, Niklas Schnelle
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <alifm@linux.ibm.com>
commit 231c7a57d19304beb0931e6cbe3a4929daf49747 upstream.
The current MSI-X restoration path assumes the Command register Memory bit
is enabled when writing MSI-X messages. But it's possible the last saved
and restored state of a device may not have the Memory bit enabled, even if
a device driver later enables Memory bit and MSI-X. Attempting to access
Memory space without Memory bit enabled can lead to Unsupported Request
(UR) from the device. Fix this by enabling Memory bit and restore it
afterwards.
Fixes: 41017f0cac92 ("[PATCH] PCI: MSI(X) save/restore for suspend/resume")
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
[bhelgaas: comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260805165518.794-6-alifm@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/msi/msi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -870,6 +870,7 @@ void __pci_restore_msix_state(struct pci
{
struct msi_desc *entry;
bool write_msg;
+ u16 cmd;
if (!dev->msix_enabled)
return;
@@ -879,6 +880,14 @@ void __pci_restore_msix_state(struct pci
pci_msix_clear_and_set_ctrl(dev, 0,
PCI_MSIX_FLAGS_ENABLE | PCI_MSIX_FLAGS_MASKALL);
+ /*
+ * The restored device state may not have Memory Space enabled.
+ * Since the MSI-X Table and PBA are in Memory Space, enable it
+ * while restoring them.
+ */
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
+ pci_write_config_word(dev, PCI_COMMAND, cmd | PCI_COMMAND_MEMORY);
+
write_msg = arch_restore_msi_irqs(dev);
scoped_guard (msi_descs_lock, &dev->dev) {
@@ -889,6 +898,7 @@ void __pci_restore_msix_state(struct pci
}
}
+ pci_write_config_word(dev, PCI_COMMAND, cmd);
pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 534/713] PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 533/713] PCI/MSI: Enable memory decoding before restoring MSI-X messages Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 535/713] PCI/proc: Use file_ns_capable() when checking config space read access Greg Kroah-Hartman
` (189 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 4ff664a81d729b37f2eb65de80a670abfb61c9a0 upstream.
Currently, proc_bus_pci_read() and proc_bus_pci_write() do not return early
for zero-length configuration space accesses at valid offsets.
Such an access invokes pci_config_pm_runtime_get() and
pci_config_pm_runtime_put() around transfer blocks that do nothing.
This is a problem because pci_config_pm_runtime_get() synchronously resumes
the upstream bridge through pm_runtime_get_sync(), and resumes the device
itself through pm_runtime_resume() when it is in D3cold, only for the
handler to return zero immediately afterwards. Such a spurious wakeup
wastes power and adds needless resume latency.
The sysfs core already returns early for in-range zero-length binary
attribute accesses before pci_read_config() or pci_write_config() is
invoked. In contrast, the VFS forwards zero-length requests to the procfs
callbacks, where they continue into runtime PM handling.
Return early from proc_bus_pci_read() and proc_bus_pci_write() when nbytes
is zero, before any runtime PM involvement.
The value returned to userspace at these offsets remains zero,
so the change is not visible to userspace.
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
[bhelgaas: order tags]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260729075909.1219906-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/proc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -46,6 +46,9 @@ static ssize_t proc_bus_pci_read(struct
else
size = 64;
+ if (!nbytes)
+ return 0;
+
if (pos >= size)
return 0;
if (nbytes >= size)
@@ -122,6 +125,9 @@ static ssize_t proc_bus_pci_write(struct
if (ret)
return ret;
+ if (!nbytes)
+ return 0;
+
if (pos >= size)
return 0;
if (nbytes >= size)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 535/713] PCI/proc: Use file_ns_capable() when checking config space read access
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 534/713] PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 536/713] PCI/proc: Warn on writes to kernel-exclusive config space regions Greg Kroah-Hartman
` (188 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit f82f53e75eff382fc8f56b73279b54f7cf5a5c65 upstream.
proc_bus_pci_read() decides how much of the config space is readable based
on capable(CAP_SYS_ADMIN), which checks the credentials of the task calling
read(), not the credentials of the process that opened the file.
The sysfs equivalent, pci_read_config(), has checked the credentials of the
opening process since commit de139a339395 ("pci: check caps from sysfs file
open to read device dependent config space"), so a privileged process can
open the config space file and pass the file descriptor to an unprivileged
process (for example, a process running a KVM guest with an assigned
device), which can then read the entire config space. The check was
subsequently routed through the LSM framework in commit 47970b1b2aa6 ("pci:
use security_capable() when checking capablities during config space read")
and converted to the dedicated helper in commit ab0fa82b2df9 ("pci-sysfs:
use proper file capability helper function").
Thus, the two interfaces check the same capability against different
credentials. Checking the credentials of the task calling read() makes the
outcome depend on who reads rather than who opened, so the restriction is
bypassed whenever a more privileged process reads through the descriptor.
Checking the credentials recorded in file->f_cred settles the decision at
open() time and ties it to the file, where it cannot change with the
caller.
Use file_ns_capable() to check CAP_SYS_ADMIN against the credentials in
effect when the file was opened, bringing the procfs interface in line with
the sysfs behaviour.
As a result, a file descriptor opened by a privileged process and passed to
an unprivileged one now allows the entire config space to be read through
procfs, matching sysfs.
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260720204145.1500105-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -39,7 +39,7 @@ static ssize_t proc_bus_pci_read(struct
* undefined locations (think of Intel PIIX4 as a typical example).
*/
- if (capable(CAP_SYS_ADMIN))
+ if (file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN))
size = dev->cfg_size;
else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)
size = 128;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 536/713] PCI/proc: Warn on writes to kernel-exclusive config space regions
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 535/713] PCI/proc: Use file_ns_capable() when checking config space read access Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 537/713] iommu/amd: Put PCI device after handling PPR faults Greg Kroah-Hartman
` (187 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 3359e044d597dd5344f17613e4be6b6e12067f60 upstream.
Currently, a driver can claim a region of a device's config space as
exclusive using pci_request_config_region_exclusive(), after which a write
to that region originating from user space is expected to emit a warning
and taint the kernel. The check is advisory only, as the write itself is
still allowed to proceed.
Since commit 278294798ac9 ("PCI: Allow drivers to request exclusive config
regions"), the sysfs config space attribute performs this check in
pci_write_config(), but the procfs interface was never updated. A write
performed through /proc/bus/pci/BB/DD.F therefore bypasses the detection
entirely, even though both interfaces offer the same level of access.
Add the same resource_is_exclusive() check to proc_bus_pci_write().
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260729075413.1215821-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/proc.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -14,6 +14,8 @@
#include <linux/capability.h>
#include <linux/uaccess.h>
#include <linux/security.h>
+#include <linux/panic.h>
+#include <linux/sched.h>
#include <asm/byteorder.h>
#include "pci.h"
@@ -128,6 +130,12 @@ static ssize_t proc_bus_pci_write(struct
if (!nbytes)
return 0;
+ if (resource_is_exclusive(&dev->driver_exclusive_resource, pos, nbytes)) {
+ pci_warn_once(dev, "%s: Unexpected write to kernel-exclusive config offset %x",
+ current->comm, pos);
+ add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+ }
+
if (pos >= size)
return 0;
if (nbytes >= size)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 537/713] iommu/amd: Put PCI device after handling PPR faults
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 536/713] PCI/proc: Warn on writes to kernel-exclusive config space regions Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 538/713] iommu/msm: Unwind probe state on registration failure Greg Kroah-Hartman
` (186 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuai Xue, Vasant Hegde,
Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
commit af3b69b16383fbc8fe5f61b5b0150d2e41ede71f upstream.
iommu_call_iopf_notifier() looks up the requester with
pci_get_domain_bus_and_slot(), which returns a PCI device with its
reference count incremented.
Neither the successful iommu_report_device_fault() path nor the abort
path drops that reference, so every handled PPR request leaks a PCI
device reference.
This is the same ownership rule that was fixed for the old iommu_v2
ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device
refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was
added later as a separate PPR/IOPF notifier path.
Drop the PCI device reference after handling the PPR entry.
Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd/ppr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,7 +151,7 @@ static void iommu_call_iopf_notifier(str
/* Submit event */
iommu_report_device_fault(&pdev->dev, &event);
-
+ pci_dev_put(pdev);
return;
out:
@@ -159,6 +159,7 @@ out:
amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
IOMMU_PAGE_RESP_FAILURE,
PPR_TAG(raw[0]) & 0x1FF);
+ pci_dev_put(pdev);
}
void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 538/713] iommu/msm: Unwind probe state on registration failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 537/713] iommu/amd: Put PCI device after handling PPR faults Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 539/713] iommu/sva: Set handle->dev before the SVA handle is visible Greg Kroah-Hartman
` (185 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Weimin Xiong,
Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weimin Xiong <xiongwm2026@163.com>
commit 535a200220ca2c83bc8bf54bd2cbe045d6ee70c4 upstream.
msm_iommu_probe() adds its devm-managed IOMMU object to
qcom_iommu_devices before adding the IOMMU sysfs device and registering
it with the IOMMU core.
If iommu_device_sysfs_add() fails, probe returns with the object still on
qcom_iommu_devices. The driver core then releases the devm allocation,
leaving a dangling list entry that later list walks may dereference.
If iommu_device_register() fails, the same dangling list entry remains
and the sysfs device is left registered as well.
Unwind the sysfs device and global list entry in reverse setup order on
the corresponding failure paths.
Fixes: 42df43b36163 ("iommu/msm: Make use of iommu_device_register interface")
Cc: stable@vger.kernel.org
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Weimin Xiong <xiongwm2026@163.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/msm_iommu.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -784,19 +784,25 @@ static int msm_iommu_probe(struct platfo
"msm-smmu.%pa", &ioaddr);
if (ret) {
pr_err("Could not add msm-smmu at %pa to sysfs\n", &ioaddr);
- return ret;
+ goto err_remove_list;
}
ret = iommu_device_register(&iommu->iommu, &msm_iommu_ops, &pdev->dev);
if (ret) {
pr_err("Could not register msm-smmu at %pa\n", &ioaddr);
- return ret;
+ goto err_remove_sysfs;
}
pr_info("device mapped at %p, irq %d with %d ctx banks\n",
iommu->base, iommu->irq, iommu->ncb);
return ret;
+
+err_remove_sysfs:
+ iommu_device_sysfs_remove(&iommu->iommu);
+err_remove_list:
+ list_del(&iommu->dev_node);
+ return ret;
}
static const struct of_device_id msm_iommu_dt_match[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 539/713] iommu/sva: Set handle->dev before the SVA handle is visible
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 538/713] iommu/msm: Unwind probe state on registration failure Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 540/713] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Greg Kroah-Hartman
` (184 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Xue, Lu Baolu, Kevin Tian,
Jason Gunthorpe, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
commit 530f8f9c3546cb3ebee1b135375aaee08a073ebb upstream.
iommu_attach_device_pasid() installs the new SVA attach handle in the
group PASID lookup before iommu_sva_bind_device() returns. A concurrent
bind can therefore find and reuse the same handle after iommu_sva_lock is
dropped.
handle->dev was initialized after dropping iommu_sva_lock. This leaves a
window where a racing bind can return a handle whose dev pointer is still
NULL. A subsequent iommu_sva_unbind_device() can then dereference it via
handle->dev->iommu_group.
Initialize handle->dev before releasing iommu_sva_lock so any visible SVA
handle is fully initialized.
Fixes: be51b1d6bbff ("iommu/sva: Refactoring iommu_sva_bind/unbind_device()")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommu-sva.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/iommu-sva.c
+++ b/drivers/iommu/iommu-sva.c
@@ -145,8 +145,8 @@ struct iommu_sva *iommu_sva_bind_device(
list_add(&domain->next, &iommu_mm->sva_domains);
out:
refcount_set(&handle->users, 1);
- mutex_unlock(&iommu_sva_lock);
handle->dev = dev;
+ mutex_unlock(&iommu_sva_lock);
return handle;
out_free_domain:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 540/713] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 539/713] iommu/sva: Set handle->dev before the SVA handle is visible Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 541/713] iommu/arm-smmu-v3: Add HAFT support for SVA Greg Kroah-Hartman
` (183 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nicolin Chen, Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit 4379610c79bd88ddbea10e7f6c21e16d4b338c6b upstream.
tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,
whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.
The HW therefore matches only a 20-bit Stream ID.
The bound check rejects only virt_sid > UINT_MAX, which admits a value far
wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit
above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match
on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id
is guest-controlled, a VMM can trigger it.
Validate virt_sid against the field width with FIELD_MAX(), and program the
register with FIELD_PREP() so the value and the field stay consistent.
Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -56,6 +56,8 @@
#define VINTF_ENABLED BIT(0)
#define TEGRA241_VINTF_SID_MATCH(s) (0x0040 + 0x4*(s))
+#define VINTF_SID_MATCH_VIRT_SID GENMASK(20, 1)
+#define VINTF_SID_MATCH_ENABLE BIT(0)
#define TEGRA241_VINTF_SID_REPLACE(s) (0x0080 + 0x4*(s))
#define TEGRA241_VINTF_LVCMDQ_ERR_MAP_64(m) \
@@ -1189,7 +1191,7 @@ static int tegra241_vintf_init_vsid(stru
u64 virt_sid = vdev->virt_id;
int sidx;
- if (virt_sid > UINT_MAX)
+ if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID))
return -EINVAL;
WARN_ON_ONCE(master->num_streams != 1);
@@ -1201,7 +1203,9 @@ static int tegra241_vintf_init_vsid(stru
return sidx;
writel(stream->id, REG_VINTF(vintf, SID_REPLACE(sidx)));
- writel(virt_sid << 1 | 0x1, REG_VINTF(vintf, SID_MATCH(sidx)));
+ writel(FIELD_PREP(VINTF_SID_MATCH_VIRT_SID, virt_sid) |
+ VINTF_SID_MATCH_ENABLE,
+ REG_VINTF(vintf, SID_MATCH(sidx)));
dev_dbg(vintf->cmdqv->dev,
"VINTF%u: allocated SID_REPLACE%d for pSID=%x, vSID=%x\n",
vintf->idx, sidx, stream->id, (u32)virt_sid);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 541/713] iommu/arm-smmu-v3: Add HAFT support for SVA
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 540/713] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 542/713] iommu/arm-smmu-v3: Manage teardown with devm Greg Kroah-Hartman
` (182 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Jason Gunthorpe,
Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit f99d3b4bb095c4966cf58154077e8bb69ee4827f upstream.
Since table access flags cannot be software-managed, if process
pagetables are using HAFT then SVA must require the SMMU to support and
enable it too, otherwise page aging is liable to get out of whack.
For unbinding, we can't disable HAFT atomically with HA as might be
desired, but luckily we can get away with just not disabling HA either.
Cc: stable@vger.kernel.org
Fixes: 62df5870ebf7 ("arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 24 ++++++++++++++----------
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 ++++++++-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 +++
3 files changed, 25 insertions(+), 11 deletions(-)
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
@@ -92,16 +92,6 @@ void arm_smmu_make_sva_cd(struct arm_smm
target->data[1] = cpu_to_le64(virt_to_phys(mm->pgd) &
CTXDESC_CD_1_TTB0_MASK);
-
- /*
- * Enable Hardware Access and Dirty updates (DBM) if supported.
- * This is safe to enable by default, as PTE_WRITE and PTE_DBM
- * share the same bit.
- */
- if (master->smmu->features & ARM_SMMU_FEAT_HA)
- target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HA);
- if (master->smmu->features & ARM_SMMU_FEAT_HD)
- target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HD);
} else {
target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_EPD0);
@@ -114,6 +104,17 @@ void arm_smmu_make_sva_cd(struct arm_smm
target->data[0] &=
cpu_to_le64(~(CTXDESC_CD_0_S | CTXDESC_CD_0_R));
}
+ /*
+ * Enable Hardware Access and Dirty updates (DBM) if supported. This is
+ * safe to enable by default, as PTE_WRITE and PTE_DBM share the same bit,
+ * while the EPD0 config can't get as far as fetching any PTEs anyway.
+ */
+ if (master->smmu->features & ARM_SMMU_FEAT_HA)
+ target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HA);
+ if (master->smmu->features & ARM_SMMU_FEAT_HD)
+ target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HD);
+ if (master->smmu->features & ARM_SMMU_FEAT_HAFT && system_supports_haft())
+ target->data[1] |= cpu_to_le64(CTXDESC_CD_1_HAFT);
/*
* MAIR value is pretty much constant and global, so we can just get it
@@ -211,6 +212,9 @@ bool arm_smmu_sva_supported(struct arm_s
if (system_supports_bbml2_noabort())
feat_mask |= ARM_SMMU_FEAT_BBML2;
+ if (system_supports_haft())
+ feat_mask |= ARM_SMMU_FEAT_HAFT;
+
if ((smmu->features & feat_mask) != feat_mask)
return false;
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4921,10 +4921,14 @@ static void arm_smmu_device_iidr_probe(s
static void arm_smmu_get_httu(struct arm_smmu_device *smmu, u32 reg)
{
- u32 fw_features = smmu->features & (ARM_SMMU_FEAT_HA | ARM_SMMU_FEAT_HD);
+ u32 fw_features = smmu->features & (ARM_SMMU_FEAT_HA | ARM_SMMU_FEAT_HD |
+ ARM_SMMU_FEAT_HAFT);
u32 hw_features = 0;
switch (FIELD_GET(IDR0_HTTU, reg)) {
+ case IDR0_HTTU_ACCESS_DIRTY_HAFT:
+ hw_features |= ARM_SMMU_FEAT_HAFT;
+ fallthrough;
case IDR0_HTTU_ACCESS_DIRTY:
hw_features |= ARM_SMMU_FEAT_HD;
fallthrough;
@@ -5256,6 +5260,9 @@ static int arm_smmu_device_acpi_probe(st
smmu->features |= ARM_SMMU_FEAT_COHERENCY;
switch (FIELD_GET(ACPI_IORT_SMMU_V3_HTTU_OVERRIDE, iort_smmu->flags)) {
+ case IDR0_HTTU_ACCESS_DIRTY_HAFT:
+ smmu->features |= ARM_SMMU_FEAT_HAFT;
+ fallthrough;
case IDR0_HTTU_ACCESS_DIRTY:
smmu->features |= ARM_SMMU_FEAT_HD;
fallthrough;
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
@@ -40,6 +40,7 @@ struct arm_vsmmu;
#define IDR0_HTTU GENMASK(7, 6)
#define IDR0_HTTU_ACCESS 1
#define IDR0_HTTU_ACCESS_DIRTY 2
+#define IDR0_HTTU_ACCESS_DIRTY_HAFT 3
#define IDR0_COHACC (1 << 4)
#define IDR0_TTF GENMASK(3, 2)
#define IDR0_TTF_AARCH64 2
@@ -369,6 +370,7 @@ static inline unsigned int arm_smmu_cdta
#define CTXDESC_CD_0_ASET (1UL << 47)
#define CTXDESC_CD_0_ASID GENMASK_ULL(63, 48)
+#define CTXDESC_CD_1_HAFT (1UL << 3)
#define CTXDESC_CD_1_TTB0_MASK GENMASK_ULL(51, 4)
/*
@@ -922,6 +924,7 @@ struct arm_smmu_device {
#define ARM_SMMU_FEAT_HD (1 << 22)
#define ARM_SMMU_FEAT_S2FWB (1 << 23)
#define ARM_SMMU_FEAT_BBML2 (1 << 24)
+#define ARM_SMMU_FEAT_HAFT (1 << 25)
u32 features;
#define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 542/713] iommu/arm-smmu-v3: Manage teardown with devm
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 541/713] iommu/arm-smmu-v3: Add HAFT support for SVA Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 543/713] iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Greg Kroah-Hartman
` (181 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Nicolin Chen,
Shameer Kolothum, Jason Gunthorpe, Will Deacon
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shameer Kolothum <skolothumtho@nvidia.com>
commit 2bd22a0d40503a65d243b011de146603c8ce1cbc upstream.
arm_smmu_device_remove() manually frees the IOPF queue, destroys the
vmid_map and disables the device, while the IRQs and queues are devm
managed. devm unwinds only after remove() returns, so the cleanup runs
in the wrong order. The IOPF queue is freed before the event-queue IRQ
whose handler uses it.
Manage all of it with devm so the unwind order is correct. Free the IOPF
queue and vmid_map via devm actions, and disable the device from one
registered after arm_smmu_device_reset().
This is also a prerequisite for fixing a Tegra241 CMDQV CMD_SYNC
use-after-free in the subsequent patch.
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++++++++++++++++++--------
1 file changed, 40 insertions(+), 16 deletions(-)
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4398,6 +4398,20 @@ int arm_smmu_cmdq_init(struct arm_smmu_d
return 0;
}
+static void arm_smmu_free_iopf_action(void *data)
+{
+ struct iopf_queue *queue = data;
+
+ iopf_queue_free(queue);
+}
+
+static void arm_smmu_destroy_vmid_map(void *data)
+{
+ struct ida *ida = data;
+
+ ida_destroy(ida);
+}
+
static int arm_smmu_init_queues(struct arm_smmu_device *smmu)
{
int ret;
@@ -4425,6 +4439,11 @@ static int arm_smmu_init_queues(struct a
smmu->evtq.iopf = iopf_queue_alloc(dev_name(smmu->dev));
if (!smmu->evtq.iopf)
return -ENOMEM;
+ ret = devm_add_action_or_reset(smmu->dev,
+ arm_smmu_free_iopf_action,
+ smmu->evtq.iopf);
+ if (ret)
+ return ret;
}
/* priq */
@@ -4503,7 +4522,8 @@ static int arm_smmu_init_strtab(struct a
ida_init(&smmu->vmid_map);
- return 0;
+ return devm_add_action_or_reset(smmu->dev, arm_smmu_destroy_vmid_map,
+ &smmu->vmid_map);
}
static int arm_smmu_init_structures(struct arm_smmu_device *smmu)
@@ -4716,6 +4736,13 @@ static int arm_smmu_device_disable(struc
return ret;
}
+static void arm_smmu_disable_action(void *data)
+{
+ struct arm_smmu_device *smmu = data;
+
+ arm_smmu_device_disable(smmu);
+}
+
static void arm_smmu_write_strtab(struct arm_smmu_device *smmu)
{
struct arm_smmu_strtab_cfg *cfg = &smmu->strtab_cfg;
@@ -5479,7 +5506,7 @@ static int arm_smmu_device_probe(struct
/* Initialise in-memory data structures */
ret = arm_smmu_init_structures(smmu);
if (ret)
- goto err_free_iopf;
+ return ret;
/* Record our private device structure */
platform_set_drvdata(pdev, smmu);
@@ -5489,30 +5516,30 @@ static int arm_smmu_device_probe(struct
/* Reset the device */
ret = arm_smmu_device_reset(smmu);
+ if (ret) {
+ arm_smmu_device_disable(smmu);
+ return ret;
+ }
+
+ /* Register last so it unwinds first, while the CMDQ is still up. */
+ ret = devm_add_action_or_reset(smmu->dev, arm_smmu_disable_action, smmu);
if (ret)
- goto err_disable;
+ return ret;
/* And we're up. Go go go! */
ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL,
"smmu3.%pa", &ioaddr);
if (ret)
- goto err_disable;
+ return ret;
ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev);
if (ret) {
dev_err(dev, "Failed to register iommu\n");
- goto err_free_sysfs;
+ iommu_device_sysfs_remove(&smmu->iommu);
+ return ret;
}
return 0;
-
-err_free_sysfs:
- iommu_device_sysfs_remove(&smmu->iommu);
-err_disable:
- arm_smmu_device_disable(smmu);
-err_free_iopf:
- iopf_queue_free(smmu->evtq.iopf);
- return ret;
}
static void arm_smmu_device_remove(struct platform_device *pdev)
@@ -5521,9 +5548,6 @@ static void arm_smmu_device_remove(struc
iommu_device_unregister(&smmu->iommu);
iommu_device_sysfs_remove(&smmu->iommu);
- arm_smmu_device_disable(smmu);
- iopf_queue_free(smmu->evtq.iopf);
- ida_destroy(&smmu->vmid_map);
}
static void arm_smmu_device_shutdown(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 543/713] iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 542/713] iommu/arm-smmu-v3: Manage teardown with devm Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 544/713] iommu/vt-d: Fix no_iommu to disable platform opt-in Greg Kroah-Hartman
` (180 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peiyang He, Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang He <peiyang_he@smail.nju.edu.cn>
commit b7b0b3851474883d4aba6ed72da87141204b23e5 upstream.
iommu_mock_device_add() first calls iommu_fwspec_init(), which on
success allocates both dev->iommu (via dev_iommu_get()) and
dev->iommu->fwspec. If the subsequent device_add(dev) call fails,
the error path only calls iommu_fwspec_free(dev), which frees
fwspec but leaves dev->iommu still allocated.
This triggers the following kmemleak report when fuzzing with Syzkaller:
BUG: memory leak
unreferenced object 0xffff888011e0a200 (size 192):
comm "syz.1.1695", pid 24885, jiffies 4295222527
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..
ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................
backtrace (crc 25df5bb3):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4575 [inline]
slab_alloc_node mm/slub.c:4899 [inline]
__kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408
iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087
iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385
mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline]
iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072
iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)
in the device_add() failure path. dev_iommu_free() frees both fwspec
and the outer dev_iommu struct and clears dev->iommu.
Link: https://patch.msgid.link/r/76AC62D46B998556+20260711055119.1003477-1-peiyang_he@smail.nju.edu.cn
Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Fixes: 2a918911ed3d ("iommufd: Register iommufd mock devices with fwspec")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -390,7 +390,7 @@ int iommu_mock_device_add(struct device
rc = device_add(dev);
if (rc)
- iommu_fwspec_free(dev);
+ dev_iommu_free(dev);
return rc;
}
EXPORT_SYMBOL_GPL(iommu_mock_device_add);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 544/713] iommu/vt-d: Fix no_iommu to disable platform opt-in
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 543/713] iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 545/713] iommu/vt-d: Force requesting ACS when tboot is enabled Greg Kroah-Hartman
` (179 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kevin Tian, Lu Baolu, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Tian <kevin.tian@intel.com>
commit 219cc978d69ce9b538d0d73936c569d4ca5b0a24 upstream.
If user explicitly requests to disable iommu (via "iommu=off" or
"intel_iommu=off"), there is no reason to force enabling it due
to platform opt-in (for external-facing devices). User should be
aware of any security implication of doing so.
"intel_iommu=off" implements this policy by setting no_platform_optin
to skip platform opt-in in platform_optin_force_iommu().
However, "iommu=off" (no_iommu=1) doesn't set no_platform_optin
hence is broken in this aspect:
- detect_intel_iommu() doesn't request ACS if no_iommu=1
- platform_optin_force_iommu() forces iommu on if external-facing
devices exist and no_platform_optin is not set
This leads to a bad configuration with ACS disabled while DMA
remapping is enabled.
Instead of setting no_platform_optin (will soon be removed) for
no_iommu=1, directly check no_iommu in platform_optin_force_iommu().
Fixes: 89a6079df791 ("iommu/vt-d: Force IOMMU on for platform opt in hint")
Cc: stable@vger.kernel.org
Signed-off-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel/iommu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -2482,10 +2482,11 @@ static bool has_external_pci(void)
static int __init platform_optin_force_iommu(void)
{
- if (!dmar_platform_optin() || no_platform_optin || !has_external_pci())
+ if (no_iommu || !dmar_platform_optin() || no_platform_optin ||
+ !has_external_pci())
return 0;
- if (no_iommu || dmar_disabled)
+ if (dmar_disabled)
pr_info("Intel-IOMMU force enabled due to platform opt in\n");
/*
@@ -2496,7 +2497,6 @@ static int __init platform_optin_force_i
iommu_set_default_passthrough(false);
dmar_disabled = 0;
- no_iommu = 0;
return 1;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 545/713] iommu/vt-d: Force requesting ACS when tboot is enabled
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 544/713] iommu/vt-d: Fix no_iommu to disable platform opt-in Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 546/713] iommupt: Return zero for invalid iova_to_phys() ranges Greg Kroah-Hartman
` (178 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kevin Tian, Lu Baolu, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Tian <kevin.tian@intel.com>
commit 607432b2618b61df81134be0ef2562b8300c1216 upstream.
Currently the conditions of requesting ACS in detect_intel_iommu()
don't include tboot, leading to a possible misconfiguration with ACS
disabled (e.g. due to user opts) while iommu is later forced on by
tboot_force_iommu().
Fix it by checking tboot in detect_intel_iommu().
Fixes: 5d990b627537 ("PCI: add pci_request_acs")
Cc: stable@vger.kernel.org
Signed-off-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel/dmar.c | 15 +++++++++++++--
drivers/iommu/intel/iommu.c | 2 +-
drivers/iommu/intel/iommu.h | 2 ++
3 files changed, 16 insertions(+), 3 deletions(-)
--- a/drivers/iommu/intel/dmar.c
+++ b/drivers/iommu/intel/dmar.c
@@ -915,6 +915,18 @@ dmar_validate_one_drhd(struct acpi_dmar_
return 0;
}
+static bool dmar_required(void)
+{
+ /* tboot supersedes any user/platform opt */
+ if (!intel_iommu_tboot_noforce && tboot_enabled())
+ return true;
+
+ if (!no_iommu && (!dmar_disabled || dmar_platform_optin()))
+ return true;
+
+ return false;
+}
+
void __init detect_intel_iommu(void)
{
int ret;
@@ -928,8 +940,7 @@ void __init detect_intel_iommu(void)
if (!ret)
ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl,
&validate_drhd_cb);
- if (!ret && !no_iommu && !iommu_detected &&
- (!dmar_disabled || dmar_platform_optin())) {
+ if (!ret && !iommu_detected && dmar_required()) {
iommu_detected = 1;
/* Make sure ACS will be enabled */
pci_request_acs();
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -57,7 +57,7 @@ static int rwbf_quirk;
* (used when kernel is launched w/ TXT)
*/
static int force_on = 0;
-static int intel_iommu_tboot_noforce;
+int intel_iommu_tboot_noforce;
static int no_platform_optin;
#define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1354,6 +1354,7 @@ static inline bool ecmd_has_pmu_essentia
extern int dmar_disabled;
extern int intel_iommu_enabled;
+extern int intel_iommu_tboot_noforce;
#else
static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
{
@@ -1366,6 +1367,7 @@ static inline int iommu_calculate_max_sa
#define dmar_disabled (1)
#define intel_iommu_enabled (0)
#define intel_iommu_sm (0)
+#define intel_iommu_tboot_noforce (0)
#endif
static inline const char *decode_prq_descriptor(char *str, size_t size,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 546/713] iommupt: Return zero for invalid iova_to_phys() ranges
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 545/713] iommu/vt-d: Force requesting ACS when tboot is enabled Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 547/713] iommufd: Avoid locking internal accesses during unmap Greg Kroah-Hartman
` (177 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Xue, Lu Baolu, Kevin Tian,
Jason Gunthorpe, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
commit 41cdc2a3d41b505c1dff9e6c1ab4c76d4cc1f995 upstream.
DOMAIN_NS(iova_to_phys) returns a phys_addr_t and follows the IOMMU
iova_to_phys() convention of returning 0 when there is no valid
translation.
make_range() returns a negative errno if the input IOVA cannot be
represented by this page table format. Returning that errno directly
casts it to phys_addr_t. Callers treat zero as no translation and use
non-zero values as physical addresses, so this can make them consume a
bogus physical address instead of seeing a failed translation.
Match the page-table walk failure path and return 0 for range validation
failures too.
Fixes: 9d4c274cd7d5 ("iommupt: Add iova_to_phys op")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/generic_pt/iommu_pt.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/generic_pt/iommu_pt.h
+++ b/drivers/iommu/generic_pt/iommu_pt.h
@@ -224,7 +224,7 @@ phys_addr_t DOMAIN_NS(iova_to_phys)(stru
ret = make_range(common_from_iommu(iommu_table), &range, iova, 1);
if (ret)
- return ret;
+ return 0;
ret = pt_walk_range(&range, __iova_to_phys, &res);
/* PHYS_ADDR_MAX would be a better error code */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 547/713] iommufd: Avoid locking internal accesses during unmap
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 546/713] iommupt: Return zero for invalid iova_to_phys() ranges Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 548/713] iommufd: Release current IOAS on xa_store() failure Greg Kroah-Hartman
` (176 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Xue, Kevin Tian,
Jason Gunthorpe, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
commit 0dbcdf4473a614adbd732d567c9b39ac0e040e0c upstream.
iommufd_access_notify_unmap() skips internal accesses because they do
not have an external unmap callback to invoke.
However, the current test calls iommufd_lock_obj() before checking
whether the access is internal. If iommufd_lock_obj() succeeds, the loop
then sees the internal access and continues, bypassing the matching
iommufd_put_object() used by the normal unmap path. This leaks the
object reference taken by iommufd_lock_obj().
Check for internal accesses first so skipped entries are never locked.
Fixes: 27b77ea5feaa ("iommufd/access: Bypass access->ops->unmap for internal use")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/device.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iommu/iommufd/device.c
+++ b/drivers/iommu/iommufd/device.c
@@ -1307,8 +1307,8 @@ void iommufd_access_notify_unmap(struct
xa_lock(&ioas->iopt.access_list);
xa_for_each(&ioas->iopt.access_list, index, access) {
- if (!iommufd_lock_obj(&access->obj) ||
- iommufd_access_is_internal(access))
+ if (iommufd_access_is_internal(access) ||
+ !iommufd_lock_obj(&access->obj))
continue;
xa_unlock(&ioas->iopt.access_list);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 548/713] iommufd: Release current IOAS on xa_store() failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 547/713] iommufd: Avoid locking internal accesses during unmap Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 549/713] iommufd: Fix UAF in selftest IOPF reporting Greg Kroah-Hartman
` (175 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Xue, Kevin Tian,
Jason Gunthorpe, Joerg Roedel
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
commit 4ac2ce123824d5f885c868fa1f9f4d463141a2ba upstream.
iommufd_take_all_iova_rwsem() takes an object reference and the
iova_rwsem write lock before storing the IOAS in the temporary ioas_list
xarray.
If xa_store() fails, the current IOAS has not been inserted into
ioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS
objects already present in that xarray, so it cannot release the current
IOAS.
Release the current IOAS rwsem and object reference before unwinding the
previously stored entries.
Fixes: 051ae5aa73d7 ("iommufd: Lock all IOAS objects")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/ioas.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/iommu/iommufd/ioas.c
+++ b/drivers/iommu/iommufd/ioas.c
@@ -427,6 +427,8 @@ static int iommufd_take_all_iova_rwsem(s
rc = xa_err(xa_store(ioas_list, index, ioas, GFP_KERNEL));
if (rc) {
+ up_write(&ioas->iopt.iova_rwsem);
+ refcount_dec(&ioas->obj.users);
iommufd_release_all_iova_rwsem(ictx, ioas_list);
return rc;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 549/713] iommufd: Fix UAF in selftest IOPF reporting
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 548/713] iommufd: Release current IOAS on xa_store() failure Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 550/713] platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer Greg Kroah-Hartman
` (174 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Peiyang He,
Jason Gunthorpe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang He <peiyang_he@smail.nju.edu.cn>
commit 8c07df7cdfcf52f1ff276c588612aabc6c6b8399 upstream.
IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from
group->pasid_array without synchronizing against PASID detach,
then a concurrent iommu_report_device_fault() can dereference
that borrowed handle's domain pointer after the detach erases
the handle and frees the backing struct iommufd_attach_handle.
TRIGGER_IOPF then dereferences the freed handle, causing a UAF.
Fix by adding a iopf_rwsem in mock_dev to follow the expected design
of a real driver. Hold its read side across the whole
iommu_report_device_fault() call, and its write side around every
path that attaches, detaches, or replaces a device domain.
This can block new reports and drains in-flight reports before an old
attach handle or the IOPF fault parameter can be removed.
Also take the write side while registering a mock device, since
it can invoke the mock driver's default-domain attach callback.
Closes: https://lore.kernel.org/all/D5E3AA41600B2056+f4e15662-bd2b-43ea-91cb-518de429e72c@smail.nju.edu.cn/
Fixes: ddee19971081 ("iommufd/selftest: Add IOPF support for mock device")
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
Assisted-by: Codex:gpt-5.6-terra
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Link: https://patch.msgid.link/38C8DF0A118B7176+20260811095551.2756745-1-peiyang_he@smail.nju.edu.cn
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/selftest.c | 31 ++++++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -177,6 +177,7 @@ struct mock_dev {
struct device dev;
struct mock_viommu *viommu;
struct rw_semaphore viommu_rwsem;
+ struct rw_semaphore iopf_rwsem;
unsigned long flags;
unsigned long vdev_id;
int id;
@@ -997,6 +998,7 @@ static struct mock_dev *mock_dev_create(
return ERR_PTR(-ENOMEM);
init_rwsem(&mdev->viommu_rwsem);
+ init_rwsem(&mdev->iopf_rwsem);
device_initialize(&mdev->dev);
mdev->flags = dev_flags;
mdev->dev.release = mock_dev_release;
@@ -1022,7 +1024,9 @@ static struct mock_dev *mock_dev_create(
goto err_put;
}
+ down_write(&mdev->iopf_rwsem);
rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev);
+ up_write(&mdev->iopf_rwsem);
if (rc)
goto err_put;
return mdev;
@@ -1077,7 +1081,9 @@ static int iommufd_test_mock_domain(stru
}
sobj->idev.idev = idev;
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
rc = iommufd_device_attach(idev, IOMMU_NO_PASID, &pt_id);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
if (rc)
goto out_unbind;
@@ -1092,7 +1098,9 @@ static int iommufd_test_mock_domain(stru
return 0;
out_detach:
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_device_detach(idev, IOMMU_NO_PASID);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
out_unbind:
iommufd_device_unbind(idev);
out_mdev:
@@ -1136,7 +1144,9 @@ static int iommufd_test_mock_domain_repl
if (IS_ERR(sobj))
return PTR_ERR(sobj);
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
rc = iommufd_device_replace(sobj->idev.idev, IOMMU_NO_PASID, &pt_id);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
if (rc)
goto out_sobj;
@@ -1739,10 +1749,16 @@ static int iommufd_test_trigger_iopf(str
{
struct iopf_fault event = {};
struct iommufd_device *idev;
+ struct mock_dev *mdev;
idev = iommufd_get_device(ucmd, cmd->trigger_iopf.dev_id);
if (IS_ERR(idev))
return PTR_ERR(idev);
+ if (!iommufd_selftest_is_mock_dev(idev->dev)) {
+ iommufd_put_object(ucmd->ictx, &idev->obj);
+ return -EINVAL;
+ }
+ mdev = to_mock_dev(idev->dev);
event.fault.prm.flags = IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE;
if (cmd->trigger_iopf.pasid != IOMMU_NO_PASID)
@@ -1753,7 +1769,9 @@ static int iommufd_test_trigger_iopf(str
event.fault.prm.grpid = cmd->trigger_iopf.grpid;
event.fault.prm.perm = cmd->trigger_iopf.perm;
+ down_read(&mdev->iopf_rwsem);
iommu_report_device_fault(idev->dev, &event);
+ up_read(&mdev->iopf_rwsem);
iommufd_put_object(ucmd->ictx, &idev->obj);
return 0;
@@ -1861,14 +1879,19 @@ static int iommufd_test_pasid_attach(str
if (IS_ERR(sobj))
return PTR_ERR(sobj);
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
rc = iommufd_device_attach(sobj->idev.idev, cmd->pasid_attach.pasid,
&cmd->pasid_attach.pt_id);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
if (rc)
goto out_sobj;
rc = iommufd_ucmd_respond(ucmd, sizeof(*cmd));
- if (rc)
+ if (rc) {
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_device_detach(sobj->idev.idev, cmd->pasid_attach.pasid);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
+ }
out_sobj:
iommufd_put_object(ucmd->ictx, &sobj->obj);
@@ -1885,8 +1908,10 @@ static int iommufd_test_pasid_replace(st
if (IS_ERR(sobj))
return PTR_ERR(sobj);
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
rc = iommufd_device_replace(sobj->idev.idev, cmd->pasid_attach.pasid,
&cmd->pasid_attach.pt_id);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
if (rc)
goto out_sobj;
@@ -1906,7 +1931,9 @@ static int iommufd_test_pasid_detach(str
if (IS_ERR(sobj))
return PTR_ERR(sobj);
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_device_detach(sobj->idev.idev, cmd->pasid_detach.pasid);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_put_object(ucmd->ictx, &sobj->obj);
return 0;
}
@@ -1917,7 +1944,9 @@ void iommufd_selftest_destroy(struct iom
switch (sobj->type) {
case TYPE_IDEV:
+ down_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_device_detach(sobj->idev.idev, IOMMU_NO_PASID);
+ up_write(&sobj->idev.mock_dev->iopf_rwsem);
iommufd_device_unbind(sobj->idev.idev);
mock_dev_destroy(sobj->idev.mock_dev);
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 550/713] platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 549/713] iommufd: Fix UAF in selftest IOPF reporting Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 551/713] platform/x86: ISST: Validate level in perf mask ioctls Greg Kroah-Hartman
` (173 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 83c80495e45eddf64c6525fb582d8db68f256b71 upstream.
set_attribute() populates the security area of the BIOS attribute request
buffer with the current admin password via populate_security_buffer(), then
dumps the whole request buffer with print_hex_dump_bytes(). This can expose
the plaintext admin password in the kernel log.
The same issue was fixed for the password attribute path by
commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump
plaintext password data"). Remove the remaining dump from the BIOS
attribute path.
Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260614045353.143500-1-sammiee5311@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c
+++ b/drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c
@@ -84,7 +84,6 @@ int set_attribute(const char *a_name, co
if (ret < 0)
goto out;
- print_hex_dump_bytes("set attribute data: ", DUMP_PREFIX_NONE, buffer, buffer_size);
ret = call_biosattributes_interface(wmi_priv.bios_attr_wdev,
buffer, buffer_size,
SETATTRIBUTE_METHOD_ID);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 551/713] platform/x86: ISST: Validate level in perf mask ioctls
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 550/713] platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 552/713] platform/x86: ISST: Validate socket ID in clos_assoc ioctl Greg Kroah-Hartman
` (172 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 80e0d353c86a9a168ad6d213f494796294381538 upstream.
isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the
user-provided level as an index into perf_levels[] via
_read_pp_level_info() and _read_bf_level_info(), but neither helper
validates it first.
The adjacent level-info helpers reject levels above max_level before
reading the same per-level register block. Add the same bounds checks to
the mask helpers, and reject disabled SST-PP levels in
isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
This prevents out-of-bounds reads from the per-level offset table on
invalid ioctl input.
Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI")
Fixes: 06a61df83209 ("platform/x86: ISST: Add SST-BF support via TPMI")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260807144003.3498972-3-sammiee5311@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -1261,6 +1261,12 @@ static int isst_if_get_perf_level_mask(v
if (!power_domain_info)
return -EINVAL;
+ if (cpumask.level > power_domain_info->max_level)
+ return -EINVAL;
+
+ if (!(power_domain_info->pp_header.level_en_mask & BIT(cpumask.level)))
+ return -EINVAL;
+
_read_pp_level_info("mask", mask, cpumask.level, SST_PP_INFO_2_OFFSET,
SST_PP_RSLVD_CORE_MASK_START, SST_PP_RSLVD_CORE_MASK_WIDTH,
SST_MUL_FACTOR_NONE)
@@ -1342,6 +1348,9 @@ static int isst_if_get_base_freq_mask(vo
if (!power_domain_info)
return -EINVAL;
+ if (cpumask.level > power_domain_info->max_level)
+ return -EINVAL;
+
_read_bf_level_info("BF-cpumask", mask, cpumask.level, SST_BF_INFO_1_OFFSET,
P1_HI_CORE_MASK_START, P1_HI_CORE_MASK_WIDTH,
SST_MUL_FACTOR_NONE)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 552/713] platform/x86: ISST: Validate socket ID in clos_assoc ioctl
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 551/713] platform/x86: ISST: Validate level in perf mask ioctls Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 553/713] mmc: via-sdmmc: cancel card-detect work on remove Greg Kroah-Hartman
` (171 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit a89f07db0cb95c54dac4a8406c79a04e44a73c3c upstream.
isst_if_clos_assoc() validates the user-supplied socket_id with
'socket_id > topology_max_packages()', but isst_common.sst_inst[] is
allocated with topology_max_packages() entries, so the valid index range
is [0, topology_max_packages()). The '>' comparison lets
socket_id == topology_max_packages() pass and index one entry past the
array.
In addition, isst_common.sst_inst[socket_id] is NULL for an in-range
package that has no bound TPMI SST instance, and the pointer is used
without a NULL check. Both the out-of-bounds entry and the NULL pointer
are then dereferenced by map_partition_power_domain_id() and the
following power_domain_info access.
Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching
the checks already performed by get_instance().
Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260807144003.3498972-2-sammiee5311@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -729,7 +729,7 @@ static long isst_if_clos_assoc(void __us
if (copy_from_user(&clos_assoc, ptr, sizeof(clos_assoc)))
return -EFAULT;
- if (clos_assoc.socket_id > topology_max_packages())
+ if (clos_assoc.socket_id >= topology_max_packages())
return -EINVAL;
cpu = clos_assoc.logical_cpu;
@@ -747,6 +747,8 @@ static long isst_if_clos_assoc(void __us
pkg_id = clos_assoc.socket_id;
sst_inst = isst_common.sst_inst[pkg_id];
+ if (!sst_inst)
+ return -EINVAL;
punit_id = map_partition_power_domain_id(sst_inst, punit_id, &part);
if (punit_id < 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 553/713] mmc: via-sdmmc: cancel card-detect work on remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 552/713] platform/x86: ISST: Validate socket ID in clos_assoc ioctl Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 554/713] mmc: via-sdmmc: stop card-detect handling on probe failure Greg Kroah-Hartman
` (170 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Ulf Hansson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5 upstream.
Disabling the device interrupt and freeing the IRQ prevents new card-detect
work from being queued, but carddet_work already queued by the handler can
still run after via_sd_remove() returns. via_sdc_card_detect() recovers the
host through container_of() and dereferences its MMIO base; once remove()
returns the host can be freed, so that work would touch freed memory.
Cancel carddet_work after freeing the IRQ and before cancelling
finish_bh_work, which the card-detect handler can also queue. carddet_work
can re-enable the interrupt through via_reset_pcictrl(); mask it again
afterwards.
This issue was found by an in-house static analysis tool and confirmed by
manual code review.
Fixes: f0bf7f61b840 ("mmc: Add new via-sdmmc host controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/via-sdmmc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/mmc/host/via-sdmmc.c
+++ b/drivers/mmc/host/via-sdmmc.c
@@ -1199,6 +1199,10 @@ static void via_sd_remove(struct pci_dev
free_irq(pcidev->irq, sdhost);
+ cancel_work_sync(&sdhost->carddet_work);
+ /* carddet_work may re-enable the interrupt via via_reset_pcictrl(). */
+ writeb(0x0, sdhost->pcictrl_mmiobase + VIA_CRDR_PCIINTCTRL);
+
timer_delete_sync(&sdhost->timer);
cancel_work_sync(&sdhost->finish_bh_work);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 554/713] mmc: via-sdmmc: stop card-detect handling on probe failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 553/713] mmc: via-sdmmc: cancel card-detect work on remove Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 555/713] platform/x86: ISST: Add a NULL check for sst_inst[] Greg Kroah-Hartman
` (169 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Ulf Hansson
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 088eaa92fcebaa6b957ccf9635afdf39643a577d upstream.
request_irq() registers the SD card-detect interrupt and the probe enables
it before mmc_add_host() runs. If mmc_add_host() fails, the error path only
unmaps the registers and returns: the interrupt stays registered, so the
handler keeps running against the host once it is freed. via_sdc_isr()
dereferences sdhost and its MMIO base and schedules carddet_work, which
via_sdc_card_detect() also runs against freed memory through its
container_of() dereference.
Add a probe-error path that disables and frees the interrupt and cancels
carddet_work before unmapping. carddet_work can re-enable the device
interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it
again after cancelling the work.
This issue was found by an in-house static analysis tool and confirmed by
manual code review.
Fixes: e4e46fb61e3b ("mmc: via-sdmmc: fix return value check of mmc_add_host()")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/via-sdmmc.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/mmc/host/via-sdmmc.c
+++ b/drivers/mmc/host/via-sdmmc.c
@@ -1153,10 +1153,16 @@ static int via_sd_probe(struct pci_dev *
ret = mmc_add_host(mmc);
if (ret)
- goto unmap;
+ goto free_irq;
return 0;
+free_irq:
+ writeb(0x0, sdhost->pcictrl_mmiobase + VIA_CRDR_PCIINTCTRL);
+ free_irq(pcidev->irq, sdhost);
+ cancel_work_sync(&sdhost->carddet_work);
+ /* carddet_work may re-enable the interrupt via via_reset_pcictrl(). */
+ writeb(0x0, sdhost->pcictrl_mmiobase + VIA_CRDR_PCIINTCTRL);
unmap:
iounmap(sdhost->mmiobase);
release:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 555/713] platform/x86: ISST: Add a NULL check for sst_inst[]
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 554/713] mmc: via-sdmmc: stop card-detect handling on probe failure Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 556/713] platform/x86: ISST: Just allow 2 bits for SST feature enable Greg Kroah-Hartman
` (168 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 3de2776e9d7073765c10c2326c2bda5926811ea6 upstream.
To be consistent with other places, add a NULL check for failed socket
loading by checking isst_common.sst_inst[].
Fixes: d805456c712f ("platform/x86: ISST: Enumerate TPMI SST and create framework")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811222134.3912626-3-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -1381,6 +1381,8 @@ static int isst_if_get_tpmi_instance_cou
return -EINVAL;
sst_inst = isst_common.sst_inst[tpmi_inst.socket_id];
+ if (!sst_inst)
+ return -EINVAL;
tpmi_inst.count = isst_instance_count(sst_inst);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 556/713] platform/x86: ISST: Just allow 2 bits for SST feature enable
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 555/713] platform/x86: ISST: Add a NULL check for sst_inst[] Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 557/713] platform/x86: ISST: Use PP level enable mask Greg Kroah-Hartman
` (167 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 0f377f2b47646abe6ec3616ae6a8670d9ff7eb86 upstream.
Currently only 2 features SST-TF and SST-BF are supported, so only allow
bit 0 and bit 1.
Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-7-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -847,6 +847,7 @@ static long isst_if_clos_assoc(void __us
#define SST_PP_FEATURE_STATE_START 8
#define SST_PP_FEATURE_STATE_WIDTH 8
+#define SST_PP_FEATURE_STATE_VALID_MASK GENMASK(1, 0)
#define SST_BF_FEATURE_SUPPORTED_START 12
#define SST_BF_FEATURE_SUPPORTED_WIDTH 1
@@ -997,6 +998,9 @@ static int isst_if_set_perf_feature(void
if (power_domain_info->write_blocked || !capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (perf_feature.feature & ~SST_PP_FEATURE_STATE_VALID_MASK)
+ return -EINVAL;
+
_write_pp_info("perf_feature", perf_feature.feature, SST_PP_CONTROL_OFFSET,
SST_PP_FEATURE_STATE_START, SST_PP_FEATURE_STATE_WIDTH,
SST_MUL_FACTOR_NONE)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 557/713] platform/x86: ISST: Use PP level enable mask
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 556/713] platform/x86: ISST: Just allow 2 bits for SST feature enable Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 558/713] platform/x86: ISST: Validate logical CPU id and clos id Greg Kroah-Hartman
` (166 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 9b9026943b19d06ebf520b1f4786621947cf43c8 upstream.
Add check for enabled levels only when reading MMIO. Some levels can be
disabled by BIOS. If the level is not enabled, return an error.
Reset the enable and allowed level masks if there is a failure to add a
perf level.
Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-6-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 16 ++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -336,8 +336,11 @@ static int sst_add_perf_profiles(struct
int i;
pd_info->perf_levels = devm_kcalloc(dev, levels, sizeof(struct perf_level), GFP_KERNEL);
- if (!pd_info->perf_levels)
+ if (!pd_info->perf_levels) {
+ pd_info->pp_header.allowed_level_mask = 0;
+ pd_info->pp_header.level_en_mask = 0;
return 0;
+ }
pd_info->ratio_unit = pd_info->pp_header.ratio_unit;
pd_info->avx_levels = SST_MAX_AVX_LEVELS;
@@ -880,7 +883,7 @@ static int isst_if_get_perf_level(void _
SST_PP_FEATURE_STATE_START, SST_PP_FEATURE_STATE_WIDTH, SST_MUL_FACTOR_NONE)
perf_level.enabled = !!(power_domain_info->sst_header.cap_mask & BIT(1));
- level_mask = perf_level.level_mask;
+ level_mask = perf_level.level_mask & power_domain_info->pp_header.level_en_mask;
perf_level.sst_bf_support = 0;
for_each_set_bit(level, &level_mask, BITS_PER_BYTE) {
/*
@@ -1318,6 +1321,9 @@ static int isst_if_get_base_freq_info(vo
if (base_freq.level > power_domain_info->max_level)
return -EINVAL;
+ if (!(power_domain_info->pp_header.level_en_mask & BIT(base_freq.level)))
+ return -EINVAL;
+
_read_bf_level_info("p1_high", base_freq.high_base_freq_mhz, base_freq.level,
SST_BF_INFO_0_OFFSET, SST_BF_P1_HIGH_START, SST_BF_P1_HIGH_WIDTH,
SST_MUL_FACTOR_FREQ)
@@ -1357,6 +1363,9 @@ static int isst_if_get_base_freq_mask(vo
if (cpumask.level > power_domain_info->max_level)
return -EINVAL;
+ if (!(power_domain_info->pp_header.level_en_mask & BIT(cpumask.level)))
+ return -EINVAL;
+
_read_bf_level_info("BF-cpumask", mask, cpumask.level, SST_BF_INFO_1_OFFSET,
P1_HI_CORE_MASK_START, P1_HI_CORE_MASK_WIDTH,
SST_MUL_FACTOR_NONE)
@@ -1454,6 +1463,9 @@ static int isst_if_get_turbo_freq_info(v
if (turbo_freq.level > power_domain_info->max_level)
return -EINVAL;
+ if (!(power_domain_info->pp_header.level_en_mask & BIT(turbo_freq.level)))
+ return -EINVAL;
+
turbo_freq.max_buckets = TRL_MAX_BUCKETS;
turbo_freq.max_trl_levels = TRL_MAX_LEVELS;
turbo_freq.max_clip_freqs = SST_TF_MAX_LP_CLIP_RATIOS;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 558/713] platform/x86: ISST: Validate logical CPU id and clos id
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 557/713] platform/x86: ISST: Use PP level enable mask Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 559/713] platform/x86: ISST: Validate max level for set feature Greg Kroah-Hartman
` (165 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 124e2dbabe460c2a6e7440f4ad8af560131295c9 upstream.
Validate max CLOS ID and logical CPU ID for core power feature.
Reject any clos level or logical CPU number greater than the
supported maximum. These are used to calculate MMIO offset.
Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-2-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 13 ++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -652,6 +652,8 @@ static long isst_if_core_power_state(voi
#define SST_CLOS_CONFIG_MAX_START 16
#define SST_CLOS_CONFIG_MAX_WIDTH 8
+#define SST_MAX_CLOS 3
+
static long isst_if_clos_param(void __user *argp)
{
struct tpmi_per_power_domain_info *power_domain_info;
@@ -660,6 +662,9 @@ static long isst_if_clos_param(void __us
if (copy_from_user(&clos_param, argp, sizeof(clos_param)))
return -EFAULT;
+ if (clos_param.clos > SST_MAX_CLOS)
+ return -EINVAL;
+
power_domain_info = get_instance(clos_param.socket_id, clos_param.power_domain_id);
if (!power_domain_info)
return -EINVAL;
@@ -706,6 +711,8 @@ static long isst_if_clos_param(void __us
#define SST_CLOS_ASSOC_CPUS_PER_REG 16
#define SST_CLOS_ASSOC_BITS_PER_CPU 4
+#define SST_CLOS_ASSOC_MAX_LOGICAL_CPU 63
+
static long isst_if_clos_assoc(void __user *argp)
{
struct isst_if_clos_assoc_cmds assoc_cmds;
@@ -732,9 +739,15 @@ static long isst_if_clos_assoc(void __us
if (copy_from_user(&clos_assoc, ptr, sizeof(clos_assoc)))
return -EFAULT;
+ if (clos_assoc.clos > SST_MAX_CLOS)
+ return -EINVAL;
+
if (clos_assoc.socket_id >= topology_max_packages())
return -EINVAL;
+ if (clos_assoc.logical_cpu > SST_CLOS_ASSOC_MAX_LOGICAL_CPU)
+ return -EINVAL;
+
cpu = clos_assoc.logical_cpu;
clos = clos_assoc.clos;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 559/713] platform/x86: ISST: Validate max level for set feature
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 558/713] platform/x86: ISST: Validate logical CPU id and clos id Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 560/713] platform/x86: ISST: Validate parameter for core power state Greg Kroah-Hartman
` (164 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit e45d6b8472861d3bac86bb37f8556a7c5aca3266 upstream.
Validate the level before setting, so that it fails early instead of
failing later when checking the bit mask for allowed levels.
Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-3-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -951,6 +951,9 @@ static int isst_if_set_perf_level(void _
if (!power_domain_info)
return -EINVAL;
+ if (perf_level.level > power_domain_info->max_level)
+ return -EINVAL;
+
if (power_domain_info->write_blocked || !capable(CAP_SYS_ADMIN))
return -EPERM;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 560/713] platform/x86: ISST: Validate parameter for core power state
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 559/713] platform/x86: ISST: Validate max level for set feature Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 561/713] platform/x86: ISST: Validate parameter for frequency and priority Greg Kroah-Hartman
` (163 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 1700b4f804555467b7eff58dff7acc11d508b3a1 upstream.
Allow only 0 or 1 for core_power enable and priority_type parameters.
Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-4-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -602,6 +602,9 @@ static bool disable_dynamic_sst_features
#define SST_CP_PRIORITY_TYPE_START 1
#define SST_CP_PRIORITY_TYPE_WIDTH 1
+#define SST_CP_MAX_ENABLE 1
+#define SST_CP_MAX_PRIORITY_TYPE 1
+
static long isst_if_core_power_state(void __user *argp)
{
struct tpmi_per_power_domain_info *power_domain_info;
@@ -621,6 +624,10 @@ static long isst_if_core_power_state(voi
if (power_domain_info->write_blocked || !capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (core_power.enable > SST_CP_MAX_ENABLE ||
+ core_power.priority_type > SST_CP_MAX_PRIORITY_TYPE)
+ return -EINVAL;
+
_write_cp_info("cp_enable", core_power.enable, SST_CP_CONTROL_OFFSET,
SST_CP_ENABLE_START, SST_CP_ENABLE_WIDTH, SST_MUL_FACTOR_NONE)
_write_cp_info("cp_prio_type", core_power.priority_type, SST_CP_CONTROL_OFFSET,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 561/713] platform/x86: ISST: Validate parameter for frequency and priority
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 560/713] platform/x86: ISST: Validate parameter for core power state Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 562/713] platform/x86: ISST: Return error during profile addition Greg Kroah-Hartman
` (162 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 574b59bb4b6bfcfd1f639d02f1041b314d43a2e6 upstream.
Validate range for frequency and proportional priority while setting
CLOS parameters.
Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811221514.3905817-5-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -661,6 +661,9 @@ static long isst_if_core_power_state(voi
#define SST_MAX_CLOS 3
+#define SST_MAX_FREQ 0xff
+#define SST_CLOS_MAX_PRIORITY 0x0f
+
static long isst_if_clos_param(void __user *argp)
{
struct tpmi_per_power_domain_info *power_domain_info;
@@ -680,6 +683,15 @@ static long isst_if_clos_param(void __us
if (power_domain_info->write_blocked || !capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (!in_range(clos_param.min_freq_mhz / SST_MUL_FACTOR_FREQ, 0, SST_MAX_FREQ + 1))
+ return -EINVAL;
+
+ if (!in_range(clos_param.max_freq_mhz / SST_MUL_FACTOR_FREQ, 0, SST_MAX_FREQ + 1))
+ return -EINVAL;
+
+ if (!in_range(clos_param.prop_prio, 0, SST_CLOS_MAX_PRIORITY + 1))
+ return -EINVAL;
+
_write_cp_info("clos.min_freq", clos_param.min_freq_mhz,
(SST_CLOS_CONFIG_0_OFFSET + clos_param.clos * SST_REG_SIZE),
SST_CLOS_CONFIG_MIN_START, SST_CLOS_CONFIG_MIN_WIDTH,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 562/713] platform/x86: ISST: Return error during profile addition
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 561/713] platform/x86: ISST: Validate parameter for frequency and priority Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 563/713] platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) Greg Kroah-Hartman
` (161 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit f9a647cb8d90c09633a49a1e766e140e78012444 upstream.
If sst_add_perf_profiles() fails for memory allocation, it continues
to allow SST-CP (core-power) feature. But in practice this is not
very useful as to achieve some frequencies via SST-CP, an SST-PP
(perf-profile) level change is required.
Fixes: 0ab147bb840f ("platform/x86: ISST: Parse SST MMIO and update instance")
Cc: HyeongJun An <sammiee5311@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260811222134.3912626-2-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -339,7 +339,7 @@ static int sst_add_perf_profiles(struct
if (!pd_info->perf_levels) {
pd_info->pp_header.allowed_level_mask = 0;
pd_info->pp_header.level_en_mask = 0;
- return 0;
+ return -ENOMEM;
}
pd_info->ratio_unit = pd_info->pp_header.ratio_unit;
@@ -370,7 +370,7 @@ static int sst_add_perf_profiles(struct
static int sst_main(struct auxiliary_device *auxdev, struct tpmi_per_power_domain_info *pd_info)
{
struct device *dev = &auxdev->dev;
- int i, mask, levels;
+ int i, ret, mask, levels;
*((u64 *)&pd_info->sst_header) = readq(pd_info->sst_base);
pd_info->sst_header.cp_offset *= 8;
@@ -402,8 +402,12 @@ static int sst_main(struct auxiliary_dev
levels = i;
mask <<= 1;
}
+
+ ret = sst_add_perf_profiles(auxdev, pd_info, levels + 1);
+ if (ret)
+ return ret;
+
pd_info->max_level = levels;
- sst_add_perf_profiles(auxdev, pd_info, levels + 1);
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 563/713] platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 562/713] platform/x86: ISST: Return error during profile addition Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 564/713] platform/x86: int1092: Fix potential memory leak in sar_probe() Greg Kroah-Hartman
` (160 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yahia Ahmed, Krishna Chomal,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <krishna.chomal108@gmail.com>
commit a7320d6eb9c4240c948cd9c64582b3bd04cbaf4b upstream.
The HP OMEN MAX 16-ak0xxx (board ID: 8DD6) has the same WMI interface
as other Victus S boards, but requires quirks for correctly switching
thermal profile.
After testing we know that (similar to another HP Omen Max 16 device,
board ID 8D87), the embedded controller on this board does not expose
thermal profile which means we have to intentionally disable EC readback.
Add the DMI board name to victus_s_thermal_profile_boards[] table and
map it to omen_v1_no_ec_thermal_params.
Testing on board 8DD6 confirmed that platform profile is registered
successfully and fan RPMs are readable and controllable.
Tested-by: Yahia Ahmed <yahmedd043@gmail.com>
Cc: stable@vger.kernel.org # v6.18+
Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com>
Link: https://patch.msgid.link/20260623141314.33947-1-krishna.chomal108@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-wmi.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -266,6 +266,10 @@ static const struct dmi_system_id victus
.driver_data = (void *)&omen_v1_no_ec_thermal_params,
},
{
+ .matches = { DMI_MATCH(DMI_BOARD_NAME, "8DD6") },
+ .driver_data = (void *)&omen_v1_no_ec_thermal_params,
+ },
+ {
.matches = { DMI_MATCH(DMI_BOARD_NAME, "8E35") },
.driver_data = (void *)&omen_v1_legacy_thermal_params,
},
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 564/713] platform/x86: int1092: Fix potential memory leak in sar_probe()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 563/713] platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 565/713] platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Greg Kroah-Hartman
` (159 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 30c906cff490c3601ee9ff110fe8115fabe75fd4 upstream.
The memory allocated for device_mode_info in parse_package() called by
sar_get_data() is not freed in some of the error paths in sar_probe().
Fix that by converting to use device managed allocations.
Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260723-platx86-v4-1-93b4a178b595@cse.iitm.ac.in
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/int1092/intel_sar.c | 32 +++++++------------------
1 file changed, 10 insertions(+), 22 deletions(-)
--- a/drivers/platform/x86/intel/int1092/intel_sar.c
+++ b/drivers/platform/x86/intel/int1092/intel_sar.c
@@ -91,8 +91,10 @@ static acpi_status parse_package(struct
item->package.count <= data->total_dev_mode)
return AE_ERROR;
- data->device_mode_info = kmalloc_objs(struct wwan_device_mode_info,
- data->total_dev_mode);
+ data->device_mode_info = devm_kmalloc_array(&context->sar_device->dev,
+ data->total_dev_mode,
+ sizeof(*data->device_mode_info),
+ GFP_KERNEL);
if (!data->device_mode_info)
return AE_ERROR;
@@ -253,7 +255,7 @@ static int sar_probe(struct platform_dev
if (!handle)
return -ENODEV;
- context = kzalloc_obj(*context);
+ context = devm_kzalloc(&device->dev, sizeof(*context), GFP_KERNEL);
if (!context)
return -ENOMEM;
@@ -264,7 +266,7 @@ static int sar_probe(struct platform_dev
result = guid_parse(SAR_DSM_UUID, &context->guid);
if (result) {
dev_err(&device->dev, "SAR UUID parse error: %d\n", result);
- goto r_free;
+ return result;
}
for (reg = 0; reg < MAX_REGULATORY; reg++)
@@ -272,43 +274,29 @@ static int sar_probe(struct platform_dev
if (sar_get_device_mode(device) != AE_OK) {
dev_err(&device->dev, "Failed to get device mode\n");
- result = -EIO;
- goto r_free;
+ return -EIO;
}
result = sysfs_create_group(&device->dev.kobj, &intcsar_group);
if (result) {
dev_err(&device->dev, "sysfs creation failed\n");
- goto r_free;
+ return result;
}
if (acpi_install_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY,
sar_notify, (void *)device) != AE_OK) {
dev_err(&device->dev, "Failed acpi_install_notify_handler\n");
- result = -EIO;
- goto r_sys;
+ sysfs_remove_group(&device->dev.kobj, &intcsar_group);
+ return -EIO;
}
return 0;
-
-r_sys:
- sysfs_remove_group(&device->dev.kobj, &intcsar_group);
-r_free:
- kfree(context);
- return result;
}
static void sar_remove(struct platform_device *device)
{
- struct wwan_sar_context *context = dev_get_drvdata(&device->dev);
- int reg;
-
acpi_remove_notify_handler(ACPI_HANDLE(&device->dev),
ACPI_DEVICE_NOTIFY, sar_notify);
sysfs_remove_group(&device->dev.kobj, &intcsar_group);
- for (reg = 0; reg < MAX_REGULATORY; reg++)
- kfree(context->config_data[reg].device_mode_info);
-
- kfree(context);
}
static struct platform_driver sar_driver = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 565/713] platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 564/713] platform/x86: int1092: Fix potential memory leak in sar_probe() Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 566/713] platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Greg Kroah-Hartman
` (158 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Srinivas Pandruvada,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
commit 62b57396c26a1ce54963709928ea0d01fa522eea upstream.
ecl_ishtp_cl_probe() acquires a reference to an ACPI device via
acpi_find_eclite_device() but fails to release it in the error path
when acpi_opregion_init() fails. This results in a reference count
leak, preventing proper cleanup of the ACPI device.
Calling path: acpi_find_eclite_device() ->
acpi_dev_get_first_match_dev() -> acpi_dev_get_next_match_dev() ->
bus_find_device() -> get_device().
Found by code review.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@vger.kernel.org
Fixes: 7b6bf51de974 ("platform/x86: Add Intel ishtp eclite driver")
Link: https://patch.msgid.link/20260624014910.1226446-1-make_ruc2021@163.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/ishtp_eclite.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/intel/ishtp_eclite.c
+++ b/drivers/platform/x86/intel/ishtp_eclite.c
@@ -600,13 +600,16 @@ static int ecl_ishtp_cl_probe(struct ish
rv = acpi_opregion_init(opr_dev);
if (rv) {
dev_err(cl_data_to_dev(opr_dev), "ACPI opregion init failed\n");
- goto err_exit;
+ goto err_put;
}
/* Reprobe devices depending on ECLite - battery, fan, etc. */
acpi_dev_clear_dependencies(opr_dev->adev);
return 0;
+
+err_put:
+ acpi_dev_put(opr_dev->adev);
err_exit:
ishtp_set_connection_state(ecl_ishtp_cl, ISHTP_CL_DISCONNECTING);
ishtp_cl_disconnect(ecl_ishtp_cl);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 566/713] platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 565/713] platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 567/713] platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Greg Kroah-Hartman
` (157 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Julian Haarmann, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Haarmann <julian.haarmann@student.kit.edu>
commit bbc497b5231829d32c3a53b6e66be1add76c0064 upstream.
On newer Lenovo Yoga devices like the "Yoga 9 2-in-1 14IPH11 - Type 83SE",
the hinge switch WMI query returns extra data in the upper bits
(e.g. 0x50001 laptop mode, 0x50002 tablet mode, ect.).
The driver previously checked for exact matches (0x01 laptop, 0x02 tablet,
ect.) causing newer switches to not work.
Mask the WMI query result to only match the lower byte and ignore upper
bits.
Signed-off-by: Julian Haarmann <julian.haarmann@student.kit.edu>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260614203235.235724-1-julian.haarmann@student.kit.edu
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/lenovo/ymc.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/lenovo/ymc.c
+++ b/drivers/platform/x86/lenovo/ymc.c
@@ -8,6 +8,8 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/acpi.h>
+#include <linux/bitfield.h>
+#include <linux/bits.h>
#include <linux/dmi.h>
#include <linux/input.h>
#include <linux/input/sparse-keymap.h>
@@ -20,6 +22,8 @@
#define LENOVO_YMC_QUERY_INSTANCE 0
#define LENOVO_YMC_QUERY_METHOD 0x01
+#define LENOVO_YMC_STATE_MASK GENMASK(7, 0)
+
static bool force;
module_param(force, bool, 0444);
MODULE_PARM_DESC(force, "Force loading on boards without a convertible DMI chassis-type");
@@ -85,7 +89,9 @@ static void lenovo_ymc_notify(struct wmi
"WMI event data is not an integer\n");
goto free_obj;
}
- code = obj->integer.value;
+
+ /* strip upper bits (e.g. 0x50000) on newer devices */
+ code = FIELD_GET(LENOVO_YMC_STATE_MASK, obj->integer.value);
if (!sparse_keymap_report_event(priv->input_dev, code, 1, true))
dev_warn(&wdev->dev, "Unknown key %d pressed\n", code);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 567/713] platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 566/713] platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 568/713] platform/x86: think-lmi: Fix certificate thumbprint sysfs output Greg Kroah-Hartman
` (156 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hilgad Montelo, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilgad Montelo <hilgad.montelo@gmail.com>
commit 329f10d8be193bf36af124e00b9dd6644cd71724 upstream.
acpi_pcc_retrieve_biosdata() rejects SINF packages only when
pcc->num_sifr is strictly less than hkey->package.count, then
unconditionally writes a trailing sentinel at
pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with
exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that
write needs num_sifr strictly greater than package.count to stay in
bounds -- num_sifr == package.count passes the existing check but
still overflows by one element.
This is exactly the case probe()'s existing num_sifr++ workaround
("Some DSDT-s have an off-by-one bug where the SINF package count is
one higher than the SQTY reported value") is written to accommodate:
when a DSDT's SINF package count equals SQTY+1, the workaround makes
num_sifr equal to package.count, which is precisely the boundary that
overflows here. Found via UBSan (array-index-out-of-bounds) on
hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38
elements: num_sifr becomes 38 after the += 1 workaround, the loop
correctly fills indices 0..37, and the sentinel write then targets
index 38, one past the end -- a silent 4-byte heap overflow on kernels
without CONFIG_UBSAN.
Tightening the rejection check to num_sifr <= package.count would
avoid the overflow but breaks probe() entirely on exactly this
hardware, since num_sifr == package.count is the case the off-by-one
workaround exists to support. Nothing else in the driver reads this
sentinel value back, so simply skip the write when there is no room
for it instead.
Fixes: a3d0dbd18ce9 ("platform/x86: panasonic-laptop: simplify allocation of sinf")
Cc: stable@vger.kernel.org
Signed-off-by: Hilgad Montelo <hilgad.montelo@gmail.com>
Link: https://patch.msgid.link/20260813221744.25668-4-hilgad.montelo@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/panasonic-laptop.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -360,7 +360,16 @@ static int acpi_pcc_retrieve_biosdata(st
} else
pr_err("Invalid HKEY.SINF data\n");
}
- pcc->sinf[hkey->package.count] = -1;
+ /*
+ * pcc->sinf[] has pcc->num_sifr elements (valid indices
+ * 0..num_sifr-1). On DSDTs where SINF's package count equals
+ * num_sifr exactly -- the off-by-one case probe()'s num_sifr++
+ * already allocates a spare element for -- there is no room left
+ * for this trailing sentinel; nothing reads it back, so just skip
+ * the write rather than running one element past the flex array.
+ */
+ if (hkey->package.count < pcc->num_sifr)
+ pcc->sinf[hkey->package.count] = -1;
end:
kfree(buffer.pointer);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 568/713] platform/x86: think-lmi: Fix certificate thumbprint sysfs output
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 567/713] platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 569/713] platform/x86: think-lmi: Free system certificate signatures Greg Kroah-Hartman
` (155 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Mark Pearson,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 4f3183f5ae9b8ddfe338d79a96146a05342bbe50 upstream.
cert_thumbprint() already returns the accumulated output length, but
certificate_thumbprint_show() adds that value to count again, making the
next line use the wrong offset. Errors returned by cert_thumbprint() are
also ignored and their negative values added to count.
Assign the total length to count instead and propagate errors correctly.
Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://patch.msgid.link/20260810120556.149416-2-thorsten.blum@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/lenovo/think-lmi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/lenovo/think-lmi.c
+++ b/drivers/platform/x86/lenovo/think-lmi.c
@@ -745,6 +745,8 @@ static ssize_t certificate_thumbprint_sh
return -EOPNOTSUPP;
for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
+ ssize_t ret;
+
if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) {
/* Format: 'SVC | SMC, Thumbtype' */
wmistr = kasprintf(GFP_KERNEL, "%s,%s",
@@ -756,8 +758,12 @@ static ssize_t certificate_thumbprint_sh
}
if (!wmistr)
return -ENOMEM;
- count += cert_thumbprint(buf, wmistr, count);
+
+ ret = cert_thumbprint(buf, wmistr, count);
kfree(wmistr);
+ if (ret < 0)
+ return ret;
+ count = ret;
}
return count;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 569/713] platform/x86: think-lmi: Free system certificate signatures
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 568/713] platform/x86: think-lmi: Fix certificate thumbprint sysfs output Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 570/713] platform/x86: think-lmi: Fix current password length check Greg Kroah-Hartman
` (154 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Mark Pearson,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit abca989604f60fe29d7170431f819e28ec7d868a upstream.
Multi-certificate support also allows the system authentication object
to store ->signature and ->save_signature, which leak when the driver is
removed. Free the signatures to avoid leaking memory.
Fixes: 5dcb5ef12590 ("platform/x86: think-lmi: Multi-certificate support")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://patch.msgid.link/20260810204106.165895-2-thorsten.blum@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/lenovo/think-lmi.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/platform/x86/lenovo/think-lmi.c
+++ b/drivers/platform/x86/lenovo/think-lmi.c
@@ -1462,6 +1462,10 @@ static void tlmi_release_attr(void)
/* Free up any saved signatures */
kfree(tlmi_priv.pwd_admin->signature);
kfree(tlmi_priv.pwd_admin->save_signature);
+ if (tlmi_priv.pwd_system) {
+ kfree(tlmi_priv.pwd_system->signature);
+ kfree(tlmi_priv.pwd_system->save_signature);
+ }
/* Authentication structures */
list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 570/713] platform/x86: think-lmi: Fix current password length check
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 569/713] platform/x86: think-lmi: Free system certificate signatures Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 571/713] platform/chrome: sensorhub: Bound the EC-reported sensor number Greg Kroah-Hartman
` (153 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Pearson, Thorsten Blum,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 54745d563114b74f6fecebce68cd020d06c1772b upstream.
current_password_store() checks the password length before removing the
trailing newline, which can reject valid passwords that are exactly
->maxlen bytes long.
It also passes ->maxlen to strscpy(), which truncates passwords without
a newline.
Use strchrnul() to measure the password length up to the newline, then
copy that many bytes and add a trailing NUL terminator using strscpy().
Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
Cc: stable@vger.kernel.org
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260818151635.37094-2-thorsten.blum@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/lenovo/think-lmi.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/platform/x86/lenovo/think-lmi.c
+++ b/drivers/platform/x86/lenovo/think-lmi.c
@@ -438,14 +438,13 @@ static ssize_t current_password_store(st
struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
size_t pwdlen;
- pwdlen = strlen(buf);
+ /* Strip newline; setting password won't work if one is present. */
+ pwdlen = strchrnul(buf, '\n') - buf;
/* pwdlen == 0 is allowed to clear the password */
if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
return -EINVAL;
- strscpy(setting->password, buf, setting->maxlen);
- /* Strip out CR if one is present, setting password won't work if it is present */
- strreplace(setting->password, '\n', '\0');
+ strscpy(setting->password, buf, pwdlen + 1);
return count;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 571/713] platform/chrome: sensorhub: Bound the EC-reported sensor number
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 570/713] platform/x86: think-lmi: Fix current password length check Greg Kroah-Hartman
@ 2026-09-04 4:58 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 572/713] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Greg Kroah-Hartman
` (152 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Tzung-Bi Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 833740a2333c2e4db4e02e3d0ffba04e8718a5f3 upstream.
Each EC FIFO event carries an 8-bit sensor number (in->sensor_num).
cros_ec_sensorhub_ring_handler() validates the FIFO event count, the
per-read count and the ring bound, but not the sensor number, which
cros_ec_sensor_ring_process_event() then uses unchecked to index
sensorhub->batch_state[] - allocated with only sensorhub->sensor_num
entries. A sensor number of sensor_num or larger is an out-of-bounds
read and write of batch_state[].
Validate the sensor number in the ring handler, where each event is read
from the EC, and drop a malformed event before it is used.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://lore.kernel.org/r/20260618-b4-disp-adb3f790-v3-1-3a164ed63cbd@proton.me
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -890,6 +890,14 @@ static void cros_ec_sensorhub_ring_handl
for (in = sensorhub->resp->fifo_read.data, j = 0;
j < number_data; j++, in++) {
+ /* Skip event if sensor_num from EC is out of bounds. */
+ if (in->sensor_num >= sensorhub->sensor_num) {
+ dev_warn_ratelimited(sensorhub->dev,
+ "Invalid sensor number %u from EC\n",
+ in->sensor_num);
+ continue;
+ }
+
if (cros_ec_sensor_ring_process_event(
sensorhub, fifo_info,
fifo_timestamp,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 572/713] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-09-04 4:58 ` [PATCH 7.2 571/713] platform/chrome: sensorhub: Bound the EC-reported sensor number Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 573/713] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Greg Kroah-Hartman
` (151 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 9cef693bce96bb4c6952f48d855284cf7fa4f367 upstream.
dev->msg_port is switched to MSG_PORT_S2D before issuing the S2D SMU
commands but is only restored to MSG_PORT_PMC on the success path. The
early "return -EIO" and "return -ENOMEM" leave the port stuck on
MSG_PORT_S2D, so all subsequent SMU communication - including the s2idle
prepare/restore handlers - is directed at the wrong mailbox.
Consolidate the exit path through a single label so the message port is
always restored.
Fixes: 3d7d407dfb05 ("platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260721181756.143084-2-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/amd/pmc/mp1_stb.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
--- a/drivers/platform/x86/amd/pmc/mp1_stb.c
+++ b/drivers/platform/x86/amd/pmc/mp1_stb.c
@@ -289,7 +289,7 @@ int amd_stb_s2d_init(struct amd_pmc_dev
u32 phys_addr_low, phys_addr_hi;
u64 stb_phys_addr;
u32 size = 0;
- int ret;
+ int ret = 0;
if (!enable_stb)
return 0;
@@ -307,8 +307,10 @@ int amd_stb_s2d_init(struct amd_pmc_dev
dev->msg_port = MSG_PORT_S2D;
amd_pmc_send_cmd(dev, S2D_TELEMETRY_SIZE, &size, dev->stb_arg.s2d_msg_id, true);
- if (size != S2D_TELEMETRY_BYTES_MAX)
- return -EIO;
+ if (size != S2D_TELEMETRY_BYTES_MAX) {
+ ret = -EIO;
+ goto out;
+ }
/* Get DRAM size */
ret = amd_pmc_send_cmd(dev, S2D_DRAM_SIZE, &dev->dram_size, dev->stb_arg.s2d_msg_id, true);
@@ -321,12 +323,16 @@ int amd_stb_s2d_init(struct amd_pmc_dev
stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low);
- /* Clear msg_port for other SMU operation */
- dev->msg_port = MSG_PORT_PMC;
-
dev->stb_virt_addr = devm_ioremap(dev->dev, stb_phys_addr, dev->dram_size);
- if (!dev->stb_virt_addr)
- return -ENOMEM;
+ if (!dev->stb_virt_addr) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ ret = 0;
- return 0;
+out:
+ /* Restore the default message port for subsequent SMU operations */
+ dev->msg_port = MSG_PORT_PMC;
+ return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 573/713] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 572/713] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 574/713] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Greg Kroah-Hartman
` (150 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francis De Brabandere,
Mario Limonciello, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 0225c1d637687b03726f00ac65b6def843d2c464 upstream.
amd_stb_s2d_init() discards the return value of several S2D SMU commands.
When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the
failure is only noticed indirectly - if at all - and reported as -EIO,
masking the real error.
More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so
on failure phys_addr_low/hi are left uninitialised and the assembled
address is passed straight to devm_ioremap(). When the SMU leaves them at
zero this maps physical address 0 and trips the ioremap-on-RAM warning:
amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff
ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff
WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:...
Check the return value of each SMU command and propagate it, and reject a
zero physical address before calling devm_ioremap().
Reported-by: Francis De Brabandere <francisdb@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221759
Tested-by: Francis De Brabandere <francisdb@gmail.com>
Fixes: 3d7d407dfb05 ("platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260721181756.143084-4-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/amd/pmc/mp1_stb.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--- a/drivers/platform/x86/amd/pmc/mp1_stb.c
+++ b/drivers/platform/x86/amd/pmc/mp1_stb.c
@@ -306,30 +306,39 @@ int amd_stb_s2d_init(struct amd_pmc_dev
/* Spill to DRAM feature uses separate SMU message port */
dev->msg_port = MSG_PORT_S2D;
- amd_pmc_send_cmd(dev, S2D_TELEMETRY_SIZE, &size, dev->stb_arg.s2d_msg_id, true);
+ ret = amd_pmc_send_cmd(dev, S2D_TELEMETRY_SIZE, &size, dev->stb_arg.s2d_msg_id, true);
+ if (ret)
+ goto out;
if (size != S2D_TELEMETRY_BYTES_MAX) {
ret = -EIO;
goto out;
}
- /* Get DRAM size */
- ret = amd_pmc_send_cmd(dev, S2D_DRAM_SIZE, &dev->dram_size, dev->stb_arg.s2d_msg_id, true);
- if (ret || !dev->dram_size)
+ /* Get DRAM size; fall back to the default if the query fails */
+ if (amd_pmc_send_cmd(dev, S2D_DRAM_SIZE, &dev->dram_size, dev->stb_arg.s2d_msg_id, true) ||
+ !dev->dram_size)
dev->dram_size = S2D_TELEMETRY_DRAMBYTES_MAX;
/* Get STB DRAM address */
- amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low, dev->stb_arg.s2d_msg_id, true);
- amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi, dev->stb_arg.s2d_msg_id, true);
+ ret = amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low,
+ dev->stb_arg.s2d_msg_id, true);
+ if (ret)
+ goto out;
+ ret = amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi,
+ dev->stb_arg.s2d_msg_id, true);
+ if (ret)
+ goto out;
stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low);
-
- dev->stb_virt_addr = devm_ioremap(dev->dev, stb_phys_addr, dev->dram_size);
- if (!dev->stb_virt_addr) {
- ret = -ENOMEM;
+ if (!stb_phys_addr) {
+ dev_err(dev->dev, "S2D phys addr query returned invalid address\n");
+ ret = -ENXIO;
goto out;
}
- ret = 0;
+ dev->stb_virt_addr = devm_ioremap(dev->dev, stb_phys_addr, dev->dram_size);
+ if (!dev->stb_virt_addr)
+ ret = -ENOMEM;
out:
/* Restore the default message port for subsequent SMU operations */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 574/713] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 573/713] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 575/713] platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() Greg Kroah-Hartman
` (149 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francis De Brabandere,
Mario Limonciello, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 76f650a76d6a36a4bee79d94db90a0e935a95477 upstream.
amd_pmc_probe() registers the LPS0 s2idle handler with
acpi_register_lps0_dev() and creates the driver's debugfs directory before
calling amd_stb_s2d_init(), which is the last step in probe that can fail.
When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot
be ioremapped on a long-running system, or the SMU rejects the S2D setup)
the error path only calls pci_dev_put() and returns. This leaves
amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks
the debugfs directory, while the devm-managed resources backing the handler
are torn down.
Reloading the module then walks the corrupted list in
acpi_register_lps0_dev() and hits:
list_add corruption. next->prev should be prev, but was NULL.
kernel BUG at lib/list_debug.c:29!
acpi_register_lps0_dev+0x44/0x80
amd_pmc_probe+0x224/0x380 [amd_pmc]
platform_probe+0x67/0x90
Even without a reload, the stale registration means the next s2idle
transition calls into torn-down driver state.
Unwind the debugfs directory and the LPS0 registration on the
amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call
unconditionally here: it is guarded on the same conditions as
acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already
relies on.
Reported-by: Francis De Brabandere <francisdb@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221759
Tested-by: Francis De Brabandere <francisdb@gmail.com>
Fixes: 83ad6974dd3b ("platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260721181756.143084-6-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -941,13 +941,17 @@ static int amd_pmc_probe(struct platform
amd_pmc_dbgfs_register(dev);
err = amd_stb_s2d_init(dev);
if (err)
- goto err_pci_dev_put;
+ goto err_dbgfs_unregister;
if (IS_ENABLED(CONFIG_AMD_MP2_STB))
amd_mp2_stb_init(dev);
pm_report_max_hw_sleep(U64_MAX);
return 0;
+err_dbgfs_unregister:
+ amd_pmc_dbgfs_unregister(dev);
+ if (IS_ENABLED(CONFIG_SUSPEND))
+ acpi_unregister_lps0_dev(&amd_pmc_s2idle_dev_ops);
err_pci_dev_put:
pci_dev_put(rdev);
return err;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 575/713] platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 574/713] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 576/713] platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Greg Kroah-Hartman
` (148 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit cbb32ff92f8a62212e0f7384b1de986ced92082b upstream.
amd_stb_debugfs_open_v2() switches dev->msg_port to MSG_PORT_S2D to query
S2D telemetry but only restores it to MSG_PORT_PMC on one path. The early
return on the dump_custom_stb path (and the error/allocation returns) leave
the port stuck on MSG_PORT_S2D, so subsequent SMU communication - including
the s2idle prepare/restore handlers - is directed at the wrong mailbox.
Consolidate the exit path through a single label so the message port is
always restored, mirroring the fix in amd_stb_s2d_init().
Reported-by: sashiko.dev
Link: https://sashiko.dev/#/patchset/20260717162023.956346-1-mario.limonciello%40amd.com
Fixes: 2851f4f8ed4e ("platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260721181756.143084-3-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/amd/pmc/mp1_stb.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/drivers/platform/x86/amd/pmc/mp1_stb.c
+++ b/drivers/platform/x86/amd/pmc/mp1_stb.c
@@ -157,7 +157,7 @@ static int amd_stb_debugfs_open_v2(struc
struct amd_pmc_dev *dev = filp->f_inode->i_private;
u32 fsize, num_samples, val, stb_rdptr_offset = 0;
struct amd_stb_v2_data *stb_data_arr;
- int ret;
+ int ret = 0;
/* Write dummy postcode while reading the STB buffer */
ret = amd_stb_write(dev, AMD_PMC_STB_DUMMY_PC);
@@ -176,22 +176,24 @@ static int amd_stb_debugfs_open_v2(struc
* the enhanced dram size. Note that we land here only for the
* platforms that support enhanced dram size reporting.
*/
- if (dump_custom_stb)
- return amd_stb_handle_efr(filp);
+ if (dump_custom_stb) {
+ ret = amd_stb_handle_efr(filp);
+ goto out;
+ }
/* Get the num_samples to calculate the last push location */
ret = amd_pmc_send_cmd(dev, S2D_NUM_SAMPLES, &num_samples, dev->stb_arg.s2d_msg_id, true);
- /* Clear msg_port for other SMU operation */
- dev->msg_port = MSG_PORT_PMC;
if (ret) {
dev_err(dev->dev, "error: S2D_NUM_SAMPLES not supported : %d\n", ret);
- return ret;
+ goto out;
}
fsize = min(num_samples, S2D_TELEMETRY_BYTES_MAX);
stb_data_arr = kmalloc_flex(*stb_data_arr, data, fsize);
- if (!stb_data_arr)
- return -ENOMEM;
+ if (!stb_data_arr) {
+ ret = -ENOMEM;
+ goto out;
+ }
stb_data_arr->size = fsize;
@@ -214,7 +216,10 @@ static int amd_stb_debugfs_open_v2(struc
filp->private_data = stb_data_arr;
- return 0;
+out:
+ /* Restore the default message port for subsequent SMU operations */
+ dev->msg_port = MSG_PORT_PMC;
+ return ret;
}
static ssize_t amd_stb_debugfs_read_v2(struct file *filp, char __user *buf, size_t size,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 576/713] platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 575/713] platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 577/713] platform/x86: hp-bioscfg: advance elem past consumed array elements Greg Kroah-Hartman
` (147 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal,
Mario Limonciello (AMD), Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 40e10e6cc8f70c041431a1e30186807e28ec46e0 upstream.
hp_init_bios_package_attribute() hard-fails when a WMI ACPI package
contains fewer elements than the type-specific expected count (e.g. 11
elements instead of 13 for INTEGER or ENUMERATION attributes). This
causes the entire hp_bioscfg driver to skip attribute enumeration on
older HP hardware whose BIOS returns shortened packages when optional
fields like prerequisites or possible values are absent.
Observed on HP EliteBook 840 G2 (BIOS M71 Ver. 01.31):
hp_bioscfg: ACPI-package does not have enough elements: 11 < 13
The element layout has two tiers:
- Elements 0-9 (SECURITY_LEVEL+1 = 10): common to all attribute types
- Elements 10-N: type-specific (bounds, values, encodings, ...)
The per-type populate functions (hp_populate_*_elements_from_package)
already handle sparse packages correctly via their own elem < count
loop guards and inner-loop bounds checks. The only unsafe case is when
we lack even the common elements needed to register the attribute.
Fix by introducing COMMON_ELEM_CNT to mark the hard minimum (10), and
splitting the check into two tiers:
- Fewer than COMMON_ELEM_CNT elements: hard fail, can't proceed.
- Fewer than expected type-specific elements: warn, but let the
populate function parse what is available.
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260709165900.30615-4-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 11 ++++++++---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 3 +++
2 files changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -661,12 +661,17 @@ static int hp_init_bios_package_attribut
int ret = 0;
/* Take action appropriate to each ACPI TYPE */
- if (obj->package.count < min_elements) {
- pr_err("ACPI-package does not have enough elements: %d < %d\n",
- obj->package.count, min_elements);
+ if (obj->package.count < COMMON_ELEM_CNT) {
+ pr_err("ACPI-package is missing common elements: %d < %d\n",
+ obj->package.count, COMMON_ELEM_CNT);
goto pack_attr_exit;
}
+ if (obj->package.count < min_elements) {
+ pr_warn("ACPI-package has fewer elements than expected: %d < %d, parsing available elements\n",
+ obj->package.count, min_elements);
+ }
+
elements = obj->package.elements;
/* sanity checking */
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.h
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.h
@@ -279,6 +279,9 @@ enum hp_wmi_data_elements {
PSWD_ENCODINGS = 13,
PSWD_IS_SET = 14,
PSWD_ELEM_CNT = 15,
+
+ /* Minimum elements shared by all attribute types (NAME..SECURITY_LEVEL) */
+ COMMON_ELEM_CNT = SECURITY_LEVEL + 1,
};
#define GET_INSTANCE_ID(type) \
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 577/713] platform/x86: hp-bioscfg: advance elem past consumed array elements
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 576/713] platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 578/713] platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Greg Kroah-Hartman
` (146 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 05c808362e808e196f75696b8a64f7aa8b2245ce upstream.
The outer parsing loop in each attribute-type parser advances "elem"
(the index into the ACPI package element array) by exactly one per
iteration, but cases that consume multi-element arrays
(PREREQUISITES, ENUM_POSSIBLE_VALUES, PSWD_ENCODINGS) read "size"
consecutive elements without adjusting "elem" for the extra entries
consumed beyond the first. The next outer iteration then re-reads a
leftover element from the array just consumed instead of the next
real property, and the type check fails on that stale element,
aborting the parse with -EIO.
This produces exactly the failure visible in dmesg on the test
hardware, on every boot:
Error expected type 2 for elem 13, but got type 1 instead
hp_bioscfg: Returned error 0x3, "Invalid command value/Feature not
supported"
Fix by advancing "elem" by (size - 1) after each array-consuming
loop, so the outer loop's own "elem++" lands on the correct next
element. "eloc" is intentionally left alone: it indexes the logical
property schema, not the physical element array, and each array case
is still exactly one logical property regardless of how many physical
elements it spans.
The defect is identical across all five attribute-type parsers
(enum, integer, string, ordered-list, password), which were
copy-pasted from the same template when the driver was introduced.
Fixes: 6b2770bfd6f9 ("platform/x86: hp-bioscfg: enum-attributes")
Fixes: 6f2c06d5a467 ("platform/x86: hp-bioscfg: int-attributes")
Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes")
Fixes: 4b2672ec71a3 ("platform/x86: hp-bioscfg: order-list-attributes")
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-10-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c | 4 ++++
drivers/platform/x86/hp/hp-bioscfg/int-attributes.c | 2 ++
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 2 ++
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 4 ++++
drivers/platform/x86/hp/hp-bioscfg/string-attributes.c | 2 ++
5 files changed, 14 insertions(+)
--- a/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
@@ -227,6 +227,8 @@ static int hp_populate_enumeration_eleme
kfree(str_value);
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case SECURITY_LEVEL:
@@ -280,6 +282,8 @@ static int hp_populate_enumeration_eleme
kfree(str_value);
str_value = NULL;
}
+ if (size)
+ elem += (size < MAX_VALUES_SIZE ? size : MAX_VALUES_SIZE) - 1;
break;
default:
pr_warn("Invalid element: %d found in Enumeration attribute or data may be malformed\n", elem);
--- a/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
@@ -243,6 +243,8 @@ static int hp_populate_integer_elements_
kfree(str_value);
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case SECURITY_LEVEL:
--- a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
@@ -232,6 +232,8 @@ static int hp_populate_ordered_list_elem
kfree(str_value);
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case SECURITY_LEVEL:
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -321,6 +321,8 @@ static int hp_populate_password_elements
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case SECURITY_LEVEL:
password_data->common.security_level = int_value;
@@ -362,6 +364,8 @@ static int hp_populate_password_elements
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case PSWD_IS_SET:
password_data->is_enabled = int_value;
--- a/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
@@ -233,6 +233,8 @@ static int hp_populate_string_elements_f
kfree(str_value);
str_value = NULL;
}
+ if (size)
+ elem += size - 1;
break;
case SECURITY_LEVEL:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 578/713] platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 577/713] platform/x86: hp-bioscfg: advance elem past consumed array elements Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 579/713] platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Greg Kroah-Hartman
` (145 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 1d143d78299d0eb4536698bf98c1815ec69f22a9 upstream.
hp_populate_ordered_list_elements_from_package() differs from the other
per-type parsers: its main loop is bounded only by the fixed per-type
count and never checks elem against the number of elements actually
present in the package,
for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT; elem++, eloc++)
whereas the string, integer, enumeration and password parsers bound
their main loop with "elem < count" as well.
This is safe today because hp_init_bios_package_attribute() rejects any
package with fewer than ORD_ELEM_CNT elements before the parser runs.
An upcoming change, however, relaxes that check to accept shorter
packages.
Bound the loop by the validated element count as well, so it stops at
whichever comes first, the per-type count or the real package size,
for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT && elem < order_obj_count;
elem++, eloc++)
order_obj_count is the validated element count, now correctly forwarded
from the caller. No functional change for packages that enumerate
correctly today.
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260709165900.30615-3-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
@@ -145,7 +145,7 @@ static int hp_populate_ordered_list_elem
if (!order_obj)
return -EINVAL;
- for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT; elem++, eloc++) {
+ for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT && elem < order_obj_count; elem++, eloc++) {
switch (order_obj[elem].type) {
case ACPI_TYPE_STRING:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 579/713] platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 578/713] platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 580/713] platform/x86: hp-bioscfg: fix heap OOB read on empty password write Greg Kroah-Hartman
` (144 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit a7508c7959ff8d037327d377ed21a9c0eabe4674 upstream.
sk_store() and kek_store() strip a trailing newline from the sysfs
write before allocating the key buffer:
length = count;
if (buf[length - 1] == '\n')
length--;
bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL);
but then pass the original "count" (not "length") as the copy size to
hp_wmi_perform_query(), which memcpy()s that many bytes out of the
"length"-sized allocation, reading one byte past it whenever the write
ends in a newline, the normal case for a shell "echo" into sysfs.
KASAN confirms this directly:
BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg]
Read of size 28 at addr ffff88813c8e2b80 by task python3/16022
...
sk_store+0xa7/0x240 [hp_bioscfg]
kernfs_fop_write_iter+0x3e1/0x5d0
...
The buggy address is located 0 bytes inside of
allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b)
Reproduced identically for kek_store, and at multiple write sizes
(28, 57, 201 bytes), each time reading exactly one byte past a
kmemdup() allocation one byte smaller than the write.
Fix by passing "length" instead of "count" to hp_wmi_perform_query()
in both functions.
Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-3-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -238,7 +238,7 @@ static ssize_t sk_store(struct kobject *
ret = hp_wmi_perform_query(HPWMI_SECUREPLATFORM_SET_SK,
HPWMI_SECUREPLATFORM,
(void *)bioscfg_drv.spm_data.signing_key,
- count, 0);
+ length, 0);
if (!ret) {
bioscfg_drv.spm_data.mechanism = SIGNING_KEY;
@@ -274,7 +274,7 @@ static ssize_t kek_store(struct kobject
ret = hp_wmi_perform_query(HPWMI_SECUREPLATFORM_SET_KEK,
HPWMI_SECUREPLATFORM,
(void *)bioscfg_drv.spm_data.endorsement_key,
- count, 0);
+ length, 0);
if (!ret) {
bioscfg_drv.spm_data.mechanism = ENDORSEMENT_KEY;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 580/713] platform/x86: hp-bioscfg: fix heap OOB read on empty password write
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 579/713] platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 581/713] platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Greg Kroah-Hartman
` (143 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 2b2ec354f905c14e3270e8ec3ab50f7d8ad73bab upstream.
validate_password_input() computes length = strlen(buf) and then
checks buf[length - 1] to strip a trailing newline, without checking
that length is nonzero first. Writing an empty string (a bare '\n')
to current_password or new_password gives length == 0, and
buf[length - 1] reads buf[-1], one byte before the heap allocation
holding the copied input.
KASAN confirms this directly:
BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]
Read of size 1 at addr ffff88811bd8da9f by task sh/13740
...
store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]
current_password_store+0x14/0x20 [hp_bioscfg]
...
The buggy address is located 23 bytes to the right of
allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88)
Reproduced identically via new_password_store. Execution continues
past the bad read (the garbage byte only affects whether "length" is
decremented by one), so the write completes and returns success; this
is a pure information read past the buffer, not a crash, but it is
still an out-of-bounds access KASAN correctly flags.
Fix by only checking buf[length - 1] when length is nonzero.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-4-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -66,7 +66,7 @@ static int validate_password_input(int i
struct password_data *password_data = &bioscfg_drv.password_data[instance_id];
length = strlen(buf);
- if (buf[length - 1] == '\n')
+ if (length > 0 && buf[length - 1] == '\n')
length--;
if (length > MAX_PASSWD_SIZE)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 581/713] platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 580/713] platform/x86: hp-bioscfg: fix heap OOB read on empty password write Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 582/713] platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Greg Kroah-Hartman
` (142 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 2ea12a467a9cb12170417b30784fe26a243a75fe upstream.
current_password_store() and new_password_store() both call
store_password_instance() with is_current = true:
static ssize_t new_password_store(...)
{
return store_password_instance(kobj, buf, count, true);
}
so a write to new_password is routed to current_password instead, and
the new_password field is never written by either sysfs entry point.
Fix by passing false from new_password_store(), matching what the
is_current parameter is meant to select.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-8-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -123,7 +123,7 @@ static ssize_t new_password_store(struct
struct kobj_attribute *attr,
const char *buf, size_t count)
{
- return store_password_instance(kobj, buf, count, true);
+ return store_password_instance(kobj, buf, count, false);
}
static struct kobj_attribute password_new_password = __ATTR_WO(new_password);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 582/713] platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 581/713] platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 583/713] platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Greg Kroah-Hartman
` (141 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit dc03f05e419f3460342fb7564884f244622634b6 upstream.
hp_get_string_from_buffer() clamps the converted string length against
the destination buffer size with "size > dst_size", so when the
converted length is exactly equal to dst_size, conv_dst_size is left
at dst_size and the unconditional NUL terminator write
dst[conv_dst_size] = 0;
lands one byte past the destination buffer. This is the same shape of
bug as the previously fixed off-by-one in hp_convert_hexstr_to_str():
the buffer is sized correctly for the content, but the terminator
write is never checked against that size.
Fix by changing the comparison to ">=" so conv_dst_size is always left
with room for the terminator.
All fixed-size destinations that reach this function (path[512],
current_value[512], current_password/current_value[64], and the
per-entry buffers in encodings[][512] and prerequisites[][512]) are
affected.
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-2-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -85,7 +85,7 @@ int hp_get_string_from_buffer(u8 **buffe
* bytes.
*/
conv_dst_size = size;
- if (size > dst_size)
+ if (size >= dst_size)
conv_dst_size = dst_size - 1;
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 583/713] platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 582/713] platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 584/713] platform/x86: hp-bioscfg: pass validated element count to package parsers Greg Kroah-Hartman
` (140 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit cb6b1b0fb236a9581cae213c2a9182e68cc3ffe5 upstream.
The ACPI_TYPE_STRING case explicitly skips the string conversion for
elem == ORD_LIST_ELEMENTS:
if (elem != PREREQUISITES && elem != ORD_LIST_ELEMENTS) {
ret = hp_convert_hexstr_to_str(..., &str_value, &value_len);
if (ret)
continue;
}
so by the time the ORD_LIST_ELEMENTS case in the eloc switch runs,
str_value is NULL (it was freed and reset to NULL at the end of the
previous iteration). That case then does:
ret = hp_convert_hexstr_to_str(str_value, value_len, &tmpstr, &tmp_len);
hp_convert_hexstr_to_str() rejects a NULL input with -EINVAL, which
sends this function to exit_list, and exit_list unconditionally
returns 0. The net effect is that any ordered-list attribute with
elements present silently ends up with an empty elements list, with no
error surfaced anywhere.
Fix by converting the current element directly, order_obj[elem], the
same way the PREREQUISITES case already handles its own array
elements, instead of reusing the unrelated str_value/value_len left
over from earlier processing.
Fixes: 4b2672ec71a3 ("platform/x86: hp-bioscfg: order-list-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260812111829.172273-9-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
@@ -263,7 +263,9 @@ static int hp_populate_ordered_list_elem
* Ordered list data is stored in hex and comma separated format
* Convert the data and split it to show each element
*/
- ret = hp_convert_hexstr_to_str(str_value, value_len, &tmpstr, &tmp_len);
+ ret = hp_convert_hexstr_to_str(order_obj[elem].string.pointer,
+ order_obj[elem].string.length,
+ &tmpstr, &tmp_len);
if (ret)
goto exit_list;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 584/713] platform/x86: hp-bioscfg: pass validated element count to package parsers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 583/713] platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 585/713] platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Greg Kroah-Hartman
` (139 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit e0ddfd77c0c320b7d12b6c9169303b140b798775 upstream.
The per-type package parsers are handed the wrong element count.
hp_init_bios_package_attribute() validates obj->package.count and then
calls one of the five hp_populate_*_package_data() wrappers (string,
integer, enumeration, ordered list, password). Each wrapper forwards a
count to its hp_populate_*_elements_from_package() parser, but instead
of forwarding the validated obj->package.count it derives the count
from elements[0]. elements[0] is the NAME field and is always an
ACPI_TYPE_STRING, so reading ->package.count from it in fact reads
->string.length through the union acpi_object. The parsers thus bound
themselves against the length of the name string rather than against
the real number of elements in the package.
This is safe today because hp_init_bios_package_attribute() refuses any
package that has fewer than the type's element count, so a parser only
ever runs on a full package and never reads past it regardless of the
bogus bound.
An upcoming change relaxes that check to accept shorter packages. Once
a parser can receive fewer elements than its per-type count, a bound
taken from the name length no longer reflects the array size, and the
"elem < count" loop conditions and "elem + n >= count" sub-loop guards
read past the end of elements[] - an out-of-bounds heap read.
Forward the validated obj->package.count to every *_package_data()
wrapper so the parsers bound themselves against the real package size.
This does not change behaviour for the packages that enumerate
correctly today and is a prerequisite for accepting shorter packages
safely.
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260709165900.30615-2-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 5 +++++
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 5 +++++
drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c | 4 +++-
drivers/platform/x86/hp/hp-bioscfg/int-attributes.c | 4 +++-
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 6 ++++--
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 6 ++++--
drivers/platform/x86/hp/hp-bioscfg/string-attributes.c | 4 +++-
7 files changed, 27 insertions(+), 7 deletions(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -736,26 +736,31 @@ static int hp_init_bios_package_attribut
switch (attr_type) {
case HPWMI_STRING_TYPE:
ret = hp_populate_string_package_data(elements,
+ obj->package.count,
instance_id,
attr_name_kobj);
break;
case HPWMI_INTEGER_TYPE:
ret = hp_populate_integer_package_data(elements,
+ obj->package.count,
instance_id,
attr_name_kobj);
break;
case HPWMI_ENUMERATION_TYPE:
ret = hp_populate_enumeration_package_data(elements,
+ obj->package.count,
instance_id,
attr_name_kobj);
break;
case HPWMI_ORDERED_LIST_TYPE:
ret = hp_populate_ordered_list_package_data(elements,
+ obj->package.count,
instance_id,
attr_name_kobj);
break;
case HPWMI_PASSWORD_TYPE:
ret = hp_populate_password_package_data(elements,
+ obj->package.count,
instance_id,
attr_name_kobj);
break;
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.h
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.h
@@ -404,6 +404,7 @@ int hp_populate_string_buffer_data(u8 *b
int hp_alloc_string_data(void);
void hp_exit_string_attributes(void);
int hp_populate_string_package_data(union acpi_object *str_obj,
+ int str_obj_count,
int instance_id,
struct kobject *attr_name_kobj);
@@ -414,6 +415,7 @@ int hp_populate_integer_buffer_data(u8 *
int hp_alloc_integer_data(void);
void hp_exit_integer_attributes(void);
int hp_populate_integer_package_data(union acpi_object *integer_obj,
+ int integer_obj_count,
int instance_id,
struct kobject *attr_name_kobj);
@@ -424,6 +426,7 @@ int hp_populate_enumeration_buffer_data(
int hp_alloc_enumeration_data(void);
void hp_exit_enumeration_attributes(void);
int hp_populate_enumeration_package_data(union acpi_object *enum_obj,
+ int enum_obj_count,
int instance_id,
struct kobject *attr_name_kobj);
@@ -435,6 +438,7 @@ int hp_populate_ordered_list_buffer_data
int hp_alloc_ordered_list_data(void);
void hp_exit_ordered_list_attributes(void);
int hp_populate_ordered_list_package_data(union acpi_object *order_obj,
+ int order_obj_count,
int instance_id,
struct kobject *attr_name_kobj);
@@ -443,6 +447,7 @@ int hp_populate_password_buffer_data(u8
int instance_id,
struct kobject *attr_name_kobj);
int hp_populate_password_package_data(union acpi_object *password_obj,
+ int password_obj_count,
int instance_id,
struct kobject *attr_name_kobj);
int hp_alloc_password_data(void);
--- a/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
@@ -304,10 +304,12 @@ exit_enumeration_package:
* Populate all properties of an instance under enumeration attribute
*
* @enum_obj: ACPI object with enumeration data
+ * @enum_obj_count: Number of elements in @enum_obj
* @instance_id: The instance to enumerate
* @attr_name_kobj: The parent kernel object
*/
int hp_populate_enumeration_package_data(union acpi_object *enum_obj,
+ int enum_obj_count,
int instance_id,
struct kobject *attr_name_kobj)
{
@@ -316,7 +318,7 @@ int hp_populate_enumeration_package_data
enum_data->attr_name_kobj = attr_name_kobj;
hp_populate_enumeration_elements_from_package(enum_obj,
- enum_obj->package.count,
+ enum_obj_count,
instance_id);
hp_update_attribute_permissions(enum_data->common.is_readonly,
&enumeration_current_val);
--- a/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/int-attributes.c
@@ -277,10 +277,12 @@ exit_integer_package:
* Populate all properties of an instance under integer attribute
*
* @integer_obj: ACPI object with integer data
+ * @integer_obj_count: Number of elements in @integer_obj
* @instance_id: The instance to enumerate
* @attr_name_kobj: The parent kernel object
*/
int hp_populate_integer_package_data(union acpi_object *integer_obj,
+ int integer_obj_count,
int instance_id,
struct kobject *attr_name_kobj)
{
@@ -288,7 +290,7 @@ int hp_populate_integer_package_data(uni
integer_data->attr_name_kobj = attr_name_kobj;
hp_populate_integer_elements_from_package(integer_obj,
- integer_obj->package.count,
+ integer_obj_count,
instance_id);
hp_update_attribute_permissions(integer_data->common.is_readonly,
&integer_current_val);
--- a/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c
@@ -302,10 +302,12 @@ exit_list:
* Populate all properties of an instance under ordered_list attribute
*
* @order_obj: ACPI object with ordered_list data
+ * @order_obj_count: Number of elements in @order_obj
* @instance_id: The instance to enumerate
* @attr_name_kobj: The parent kernel object
*/
-int hp_populate_ordered_list_package_data(union acpi_object *order_obj, int instance_id,
+int hp_populate_ordered_list_package_data(union acpi_object *order_obj, int order_obj_count,
+ int instance_id,
struct kobject *attr_name_kobj)
{
struct ordered_list_data *ordered_list_data = &bioscfg_drv.ordered_list_data[instance_id];
@@ -313,7 +315,7 @@ int hp_populate_ordered_list_package_dat
ordered_list_data->attr_name_kobj = attr_name_kobj;
hp_populate_ordered_list_elements_from_package(order_obj,
- order_obj->package.count,
+ order_obj_count,
instance_id);
hp_update_attribute_permissions(ordered_list_data->common.is_readonly,
&ordered_list_current_val);
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -389,10 +389,12 @@ exit_package:
* Populate all properties for an instance under password attribute
*
* @password_obj: ACPI object with password data
+ * @password_obj_count: Number of elements in @password_obj
* @instance_id: The instance to enumerate
* @attr_name_kobj: The parent kernel object
*/
-int hp_populate_password_package_data(union acpi_object *password_obj, int instance_id,
+int hp_populate_password_package_data(union acpi_object *password_obj, int password_obj_count,
+ int instance_id,
struct kobject *attr_name_kobj)
{
struct password_data *password_data = &bioscfg_drv.password_data[instance_id];
@@ -400,7 +402,7 @@ int hp_populate_password_package_data(un
password_data->attr_name_kobj = attr_name_kobj;
hp_populate_password_elements_from_package(password_obj,
- password_obj->package.count,
+ password_obj_count,
instance_id);
hp_friendly_user_name_update(password_data->common.path,
--- a/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/string-attributes.c
@@ -265,10 +265,12 @@ exit_string_package:
* Populate all properties of an instance under string attribute
*
* @string_obj: ACPI object with string data
+ * @string_obj_count: Number of elements in @string_obj
* @instance_id: The instance to enumerate
* @attr_name_kobj: The parent kernel object
*/
int hp_populate_string_package_data(union acpi_object *string_obj,
+ int string_obj_count,
int instance_id,
struct kobject *attr_name_kobj)
{
@@ -277,7 +279,7 @@ int hp_populate_string_package_data(unio
string_data->attr_name_kobj = attr_name_kobj;
hp_populate_string_elements_from_package(string_obj,
- string_obj->package.count,
+ string_obj_count,
instance_id);
hp_update_attribute_permissions(string_data->common.is_readonly,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 585/713] platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 584/713] platform/x86: hp-bioscfg: pass validated element count to package parsers Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 586/713] io_uring/waitid: honor task_work cancellation Greg Kroah-Hartman
` (138 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal,
Mario Limonciello (AMD), Ilpo Järvinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit b0e2af3ec94e0431adb59d9f249ebbd3b7285158 upstream.
hp_populate_enumeration_elements_from_package() returns -EIO and aborts
enumeration of the entire attribute when any single element has an
unexpected ACPI type. This is observed on HP EliteBook 840 G2 when the
BIOS returns malformed ACPI data following a failed WMI query:
ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Index (0x000000032)
is beyond end of object (length 0x32)
ACPI Error: Aborting method \_SB.WMID.WQBE due to previous error
Error expected type 2 for elem 13, but got type 1 instead
hp_bioscfg: Returned error 0x3,
"Invalid command value/Feature not supported"
Aborting immediately discards the attribute entirely.
Warn about the unexpected element type, free the temporary string, skip
the offending element, and continue parsing the remaining package
instead of failing the whole attribute.
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260709165900.30615-5-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c
@@ -163,10 +163,11 @@ static int hp_populate_enumeration_eleme
/* Check that both expected and read object type match */
if (expected_enum_types[eloc] != enum_obj[elem].type) {
- pr_err("Error expected type %d for elem %d, but got type %d instead\n",
- expected_enum_types[eloc], elem, enum_obj[elem].type);
+ pr_warn("Unexpected element type at elem %d: expected %d, got %d, skipping\n",
+ elem, expected_enum_types[eloc], enum_obj[elem].type);
kfree(str_value);
- return -EIO;
+ str_value = NULL;
+ continue;
}
/* Assign appropriate element value to corresponding field */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 586/713] io_uring/waitid: honor task_work cancellation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 585/713] platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 587/713] io_uring/waitid: avoid siginfo copy during ring teardown Greg Kroah-Hartman
` (137 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 14572de82e5022899e5856008bc9cac97004a88c upstream.
io_waitid_cb() may run through the fallback task_work path when
task_work_add() can no longer queue work to the originating task. The
fallback runs from a kworker and io_uring marks such task work as
canceled through tw.cancel.
io_waitid_cb() currently ignores tw.cancel and calls __do_wait().
waitid is task-context dependent: __do_wait() performs child lookup
relative to current, and the retry path also uses
current->signal->wait_chldexit. If the callback runs from the fallback
kworker, current is therefore not the task that submitted the request.
Honor tw.cancel before entering __do_wait(). Complete the request with
-ECANCELED and skip the siginfo copy, since canceled task work may run
without the submitting task's userspace execution context.
Keep the existing siginfo handling for normal waitid completion and
explicit cancellation.
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://patch.msgid.link/20260818103336.1922818-2-sh_def@163.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/waitid.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -125,7 +125,7 @@ static void io_waitid_remove_wq(struct i
}
}
-static void io_waitid_complete(struct io_kiocb *req, int ret)
+static void io_waitid_complete(struct io_kiocb *req, int ret, bool copy_si)
{
struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
@@ -137,7 +137,10 @@ static void io_waitid_complete(struct io
hlist_del_init(&req->hash_node);
io_waitid_remove_wq(req);
- ret = io_waitid_finish(req, ret);
+ if (copy_si)
+ ret = io_waitid_finish(req, ret);
+ else
+ io_waitid_free(req);
if (ret < 0)
req_set_fail(req);
io_req_set_res(req, ret, 0);
@@ -159,7 +162,7 @@ static bool __io_waitid_cancel(struct io
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
return false;
- io_waitid_complete(req, -ECANCELED);
+ io_waitid_complete(req, -ECANCELED, true);
io_req_queue_tw_complete(req, -ECANCELED);
return true;
}
@@ -202,6 +205,11 @@ static void io_waitid_cb(struct io_tw_re
int ret;
io_tw_lock(ctx, tw);
+ if (unlikely(tw.cancel)) {
+ io_waitid_complete(req, -ECANCELED, false);
+ io_req_task_complete(tw_req, tw);
+ return;
+ }
ret = __do_wait(&iwa->wo);
@@ -229,7 +237,7 @@ static void io_waitid_cb(struct io_tw_re
}
}
- io_waitid_complete(req, ret);
+ io_waitid_complete(req, ret, true);
io_req_task_complete(tw_req, tw);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 587/713] io_uring/waitid: avoid siginfo copy during ring teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 586/713] io_uring/waitid: honor task_work cancellation Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 588/713] io_uring/query: cap user size passed to copy_struct_to_user Greg Kroah-Hartman
` (136 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 2cf20c4e0f72d523b8673053e7120d092ff1f074 upstream.
During ring teardown, io_ring_exit_work() cancels outstanding requests
from a kworker with a NULL tctx. The waitid cancellation path eventually
reaches io_waitid_finish(), which copies the stored siginfo to the
userspace pointer supplied with the request.
Ring-wide teardown does not run in the task context that submitted the
request, so it must not access that task's userspace pointer. Depending
on the address and mm state, the copy may fail with -EFAULT, but the
uaccess itself is inappropriate from the teardown kworker.
Use a no-copy cancellation callback when io_waitid_remove_all() is
called without an owning task context. Complete the request with
-ECANCELED while releasing the waitid state without touching siginfo.
Keep the existing siginfo handling for explicit async cancellation and
task-scoped cancellation.
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://patch.msgid.link/20260818103336.1922818-3-sh_def@163.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/waitid.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -146,7 +146,7 @@ static void io_waitid_complete(struct io
io_req_set_res(req, ret, 0);
}
-static bool __io_waitid_cancel(struct io_kiocb *req)
+static bool __io_waitid_cancel(struct io_kiocb *req, bool copy_si)
{
struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
@@ -162,21 +162,32 @@ static bool __io_waitid_cancel(struct io
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
return false;
- io_waitid_complete(req, -ECANCELED, true);
+ io_waitid_complete(req, -ECANCELED, copy_si);
io_req_queue_tw_complete(req, -ECANCELED);
return true;
}
+static bool io_waitid_cancel_cb(struct io_kiocb *req)
+{
+ return __io_waitid_cancel(req, true);
+}
+
+static bool io_waitid_cancel_nocopy_cb(struct io_kiocb *req)
+{
+ return __io_waitid_cancel(req, false);
+}
+
int io_waitid_cancel(struct io_ring_ctx *ctx, struct io_cancel_data *cd,
unsigned int issue_flags)
{
- return io_cancel_remove(ctx, cd, issue_flags, &ctx->waitid_list, __io_waitid_cancel);
+ return io_cancel_remove(ctx, cd, issue_flags, &ctx->waitid_list, io_waitid_cancel_cb);
}
bool io_waitid_remove_all(struct io_ring_ctx *ctx, struct io_uring_task *tctx,
bool cancel_all)
{
- return io_cancel_remove_all(ctx, tctx, &ctx->waitid_list, cancel_all, __io_waitid_cancel);
+ return io_cancel_remove_all(ctx, tctx, &ctx->waitid_list, cancel_all,
+ tctx ? io_waitid_cancel_cb : io_waitid_cancel_nocopy_cb);
}
static inline bool io_waitid_drop_issue_ref(struct io_kiocb *req)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 588/713] io_uring/query: cap user size passed to copy_struct_to_user
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 587/713] io_uring/waitid: avoid siginfo copy during ring teardown Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 589/713] interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Greg Kroah-Hartman
` (135 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya,
Gabriel Krisman Bertazi, Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
commit ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b upstream.
io_handle_query_entry() clamps hdr.size for the inbound copy_from_user()
but keeps the original user value as usize. copy_struct_to_user() uses
that usize and, when it is larger than the kernel result, clear_user()s
the trailing bytes.
As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing,
including on the error path where res_size stays 0. The interface is
reachable without a ring via IORING_REGISTER_QUERY.
Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_*
interfaces.
Fixes: c265ae75f900 ("io_uring: introduce io_uring querying")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260821103317.91437-1-acharyalaxman8848@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/query.c | 3 +++
1 file changed, 3 insertions(+)
--- a/io_uring/query.c
+++ b/io_uring/query.c
@@ -76,6 +76,9 @@ static int io_handle_query_entry(union i
if (copy_from_user(&hdr, uhdr, sizeof(hdr)))
return -EFAULT;
+ /* copy_struct_to_user() zeros up to usize bytes */
+ if (hdr.size > PAGE_SIZE)
+ return -E2BIG;
usize = hdr.size;
hdr.size = min(hdr.size, IO_MAX_QUERY_SIZE);
udata = u64_to_user_ptr(hdr.query_data);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 589/713] interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 588/713] io_uring/query: cap user size passed to copy_struct_to_user Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 590/713] ipmi: ipmb: validate write message length Greg Kroah-Hartman
` (134 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, Georgi Djakov
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
commit 25c7e242aca084fdc1098248194032317dca625d upstream.
In of_icc_get_by_index() and icc_get(), if the dynamic allocation for
path->name fails via kasprintf(), the error handling path directly
calls kfree(path) to free the path object and returns an error.
However, prior to this point, path_find() calls path_init(), which
already links the path's requests into the req_list of the respective
interconnect nodes via hlist_add_head(). Directly invoking kfree(path)
leaves dangling pointers in the hlist. A subsequent call to icc_get()
or icc_set_bw() will traverse or modify these corrupted lists, triggering
a slab use afterfree.
KASAN report showing the vulnerability when reproducing via debugfs:
BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc
Write of size 8 at addr fff000000d43f748 by task sh/1
...
Call trace:
kasan_report+0xac/0xfc
path_find+0x6f8/0xcfc
icc_get+0x148/0x380
icc_get_set+0xf8/0x2d0
...
Freed by task 1:
kfree+0x1a0/0x4a4
icc_get+0x2cc/0x380
icc_get_set+0xf8/0x2d0
Fix this by replacing kfree(path) with the proper teardown function,
icc_put(path), which safely removes the requests from the req_list using
hlist_del() and drops the provider usage references before freeing the
memory.
Additionally, in icc_get(), ensure that the icc_lock mutex is released
prior to calling icc_put(path) to avoid a deadlock, as icc_put()
internally acquires the same lock.
Fixes: 3791163602f7 ("interconnect: Handle memory allocation errors")
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Link: https://patch.msgid.link/20260416190840.1753468-1-visitorckw@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/interconnect/core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/interconnect/core.c
+++ b/drivers/interconnect/core.c
@@ -548,7 +548,7 @@ struct icc_path *of_icc_get_by_index(str
path->name = kasprintf(GFP_KERNEL, "%s-%s",
src_data->node->name, dst_data->node->name);
if (!path->name) {
- kfree(path);
+ icc_put(path);
path = ERR_PTR(-ENOMEM);
}
@@ -646,8 +646,9 @@ struct icc_path *icc_get(struct device *
path->name = kasprintf(GFP_KERNEL, "%s-%s", src_node->name, dst_node->name);
if (!path->name) {
- kfree(path);
- path = ERR_PTR(-ENOMEM);
+ mutex_unlock(&icc_lock);
+ icc_put(path);
+ return ERR_PTR(-ENOMEM);
}
out:
mutex_unlock(&icc_lock);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 590/713] ipmi: ipmb: validate write message length
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 589/713] interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 591/713] ipmi: Remove all sysfs files on registration failure Greg Kroah-Hartman
` (133 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yousef Alhouseen, Corey Minyard
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit 53637506884dbd5c91a89b1a3547d99d80f8ed2c upstream.
ipmb_write() read message fields before validating the length byte.
A zero or short write can read uninitialized stack bytes.
A length smaller than the SMBus header underflows the block write length.
Require a non-empty buffer and the minimum IPMB request length.
Also require the length byte plus payload before parsing the message.
Fixes: 51bd6f291583 ("Add support for IPMB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Message-ID: <20260624175353.8592-1-alhouseenyousef@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmb_dev_int.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/char/ipmi/ipmb_dev_int.c
+++ b/drivers/char/ipmi/ipmb_dev_int.c
@@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *f
u8 msg[MAX_MSG_LEN];
ssize_t ret;
- if (count > sizeof(msg))
+ if (!count || count > sizeof(msg))
return -EINVAL;
if (copy_from_user(&msg, buf, count))
return -EFAULT;
- if (count < msg[0])
+ if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN ||
+ count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1)
return -EINVAL;
rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 591/713] ipmi: Remove all sysfs files on registration failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 590/713] ipmi: ipmb: validate write message length Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 592/713] ipmi: si: Fix NULL pointer dereference after failed registration Greg Kroah-Hartman
` (132 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Corey Minyard
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
commit b6c46ab0bdee90c238e96ea4a74972118c97900d upstream.
ipmi_add_smi() creates the nr_users and nr_msgs files before trying to
create the maintenance_mode file. If that last creation fails, the error
path removes only nr_users before dropping the final reference to the
interface.
Remove nr_msgs as well so no sysfs attribute embedded in the freed
interface remains registered.
Fixes: 627118470fcc ("ipmi: Add a maintenance mode sysfs file")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Message-ID: <20260803015550.618808-1-dbgh9129@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3741,6 +3741,7 @@ int ipmi_add_smi(struct module *
sysfs_attr_init(&intf->maintenance_mode_devattr.attr);
rv = device_create_file(intf->si_dev, &intf->maintenance_mode_devattr);
if (rv) {
+ device_remove_file(intf->si_dev, &intf->nr_msgs_devattr);
device_remove_file(intf->si_dev, &intf->nr_users_devattr);
goto out_err_bmc_reg;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 592/713] ipmi: si: Fix NULL pointer dereference after failed registration
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 591/713] ipmi: Remove all sysfs files on registration failure Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 593/713] ipmi:msghandler: Cancel work cleanly on an error Greg Kroah-Hartman
` (131 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seiji Nishikawa, Corey Minyard
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Nishikawa <snishika@redhat.com>
commit 6d920a75df9a83ab096b3cde7a643b656e4fdfeb upstream.
try_smi_init() allocates new_smi->si_sm and later calls
ipmi_register_smi_mod(), which maps to ipmi_add_smi().
During ipmi_add_smi(), the upper IPMI message handler obtains the
initial BMC device information through __bmc_get_device_id(). This can
fail if the BMC does not return a successful response to the Get Device
ID command.
When the BMC returns a nonzero completion code, the device-id helper
retries the command and eventually returns -EIO if the device ID still
cannot be fetched.
On this failure path, ipmi_add_smi() logs "Unable to get the device id"
and goes to out_err_started, where it invokes the lower driver's
shutdown callback. try_smi_init() then logs the returned registration
failure:
ipmi_si IPI0001:00: IPMI message handler: Unable to get the device id: -5
ipmi_si IPI0001:00: Unable to register device: error -5
For ipmi_si, the shutdown callback is shutdown_smi(), which cleans up
the SI state machine data, frees smi_info->si_sm, and sets
smi_info->si_sm and smi_info->intf to NULL.
However, intf->in_shutdown is not set on this failed-registration
rollback path. Therefore, the asynchronous redo_bmc_reg work item can
still retry BMC device-id probing after the lower driver has already
cleared its SI state machine data. In the observed case, that retry path
reached start_next_msg(), which passed the NULL smi_info->si_sm pointer
to the selected KCS state machine handler:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
Workqueue: events redo_bmc_reg [ipmi_msghandler]
RIP: start_kcs_transaction+0x2c/0x190 [ipmi_si]
Call Trace:
start_next_msg+0x50/0x80 [ipmi_si]
check_start_timer_thread.part.9+0x3b/0x50 [ipmi_si]
sender+0x69/0x80 [ipmi_si]
i_ipmi_request+0x2ac/0x9d0 [ipmi_msghandler]
__get_device_id.isra.29+0xaa/0x180 [ipmi_msghandler]
__bmc_get_device_id+0xef/0x950 [ipmi_msghandler]
redo_bmc_reg+0x52/0x60 [ipmi_msghandler]
process_one_work+0x1a7/0x360
Set intf->in_shutdown on the out_err_started path before invoking the
lower driver's shutdown callback. This prevents later redo_bmc_reg
retries from using an interface whose lower driver state has been
cleaned up, and applies the same shutdown state to other IPMI interfaces
as well.
Fixes: 2512e40e48d2 ("ipmi: Rework SMI registration failure")
Cc: stable@vger.kernel.org
Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Message-ID: <20260630174348.1483814-1-snishika@redhat.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3759,6 +3759,7 @@ int ipmi_add_smi(struct module *
out_err_bmc_reg:
ipmi_bmc_unregister(intf);
out_err_started:
+ intf->in_shutdown = true;
if (intf->handlers->shutdown)
intf->handlers->shutdown(intf->send_info);
out_err:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 593/713] ipmi:msghandler: Cancel work cleanly on an error
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 592/713] ipmi: si: Fix NULL pointer dereference after failed registration Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 594/713] net/iucv: filter frames in afiucv_hs_rcv() by ingress device Greg Kroah-Hartman
` (130 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nilay Shroff, Corey Minyard
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <corey@minyard.net>
commit ae84a2536577057e97f23f75a202e26d0e86cf01 upstream.
If an error occurs during startup of an IPMI interface, it may have
scheduled work to run. The work needs to be canceled before the
interface can be freed.
Reported-by: Nilay Shroff <nilay@linux.ibm.com>
Closes: https://sourceforge.net/p/openipmi/mailman/message/59375605/
Fixes: 62cd145453d5 ("ipmi:msghandler: Handle error returns from the SMI sender")
Cc: stable@vger.kernel.org # 7.0
Tested-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3766,6 +3766,7 @@ int ipmi_add_smi(struct module *
list_del(&intf->link);
mutex_unlock(&ipmi_interfaces_mutex);
mutex_unlock(&smi_watchers_mutex);
+ cancel_work_sync(&intf->smi_work);
kref_put(&intf->refcount, intf_free);
return rv;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 594/713] net/iucv: filter frames in afiucv_hs_rcv() by ingress device
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 593/713] ipmi:msghandler: Cancel work cleanly on an error Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 595/713] xdp: fix zero-copy frame layout Greg Kroah-Hartman
` (129 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandra Winter, Jakub Kicinski,
Bryam Vargas
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <wintera@linux.ibm.com>
commit 80230a18c164a4b5bbc048fe2768b219ac17bc5a upstream.
afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
name fields in the transport header alone. No check is made against the
net_device the frame arrived on.
This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
socket. Three problems follow.
First, a frame arriving over HiperSockets can be delivered to a socket
bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.
iucv_sock_bind() takes the classic path whenever the requested userid
matches iucv_userid, even on a guest that also has a HiperSockets device
carrying the same identifier. The child socket created by
afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
The socket delivered to accept() is unusable.
Second, a frame arriving on one netdev can be delivered to a socket bound
to a different IQD device. Which can lead to
- Accept-queue exhaustion (DoS)
- Attacker-controlled peer identity in the child socket
- Data injection into existing sockets
- Fabric noise on the IQD fabric, where bogus replies are sent
- killing established connections
Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a
namespace can be delivered to an IUCV socket. So a process in an
unprivileged user and network namespace holding only the CAP_NET_RAW
capability valid within that namespace can send a raw ETH_P_AF_IUCV frame
on its own lo device and have it matched against init_net sockets.
Fix all three by skipping any socket whose hs_dev does not match the
ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress
dev is never NULL, so classic sockets are skipped automatically. An unbound
HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
is only reachable from the exact IQD device it was bound to. Because hs_dev
is always a device in init_net (iucv_sock_bind() scans
for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress
device belongs to another namespace never matches any socket.
Note that AF_IUCV over HiperSockets provides no per-connection
authentication: no sequence numbers, no TLS, no nonce. The four name fields
identifying a connection are exchanged in plaintext on the shared
HiperSockets segment (VCHID). Any host on the same HiperSockets segment
could spoof any frame type against an existing connection. That is a
protocol-level property unchanged by this patch. The fix reduces the attack
surface to peers present on the same HiperSockets segment.
Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport")
Cc: stable@vger.kernel.org
Co-developed-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260821125501.3718748-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/iucv/af_iucv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2079,6 +2079,8 @@ static int afiucv_hs_rcv(struct sk_buff
sk = NULL;
read_lock(&iucv_sk_list.lock);
sk_for_each(sk, &iucv_sk_list.head) {
+ if (iucv_sk(sk)->hs_dev != dev)
+ continue;
if (trans_hdr->flags == AF_IUCV_FLAG_SYN) {
if ((!memcmp(&iucv_sk(sk)->src_name,
trans_hdr->destAppName, 8)) &&
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 595/713] xdp: fix zero-copy frame layout
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 594/713] net/iucv: filter frames in afiucv_hs_rcv() by ingress device Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 596/713] slip: fix use-after-free in sl_sync() Greg Kroah-Hartman
` (128 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 71283aaa6c65b3cec84caf1dc78560985737641f upstream.
xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page
and advertises PAGE_SIZE as its frame size. It allows the copied frame
to occupy the page tail needed by skb_shared_info and records zero
headroom even when metadata separates the frame header from packet data.
An AF_XDP zero-copy packet redirected through cpumap can therefore make
the skb overlap skb_shared_info or place it beyond the allocated page.
Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the
metadata length in frame headroom. Redirect callers already handle a
NULL conversion result.
BUG: KASAN: slab-out-of-bounds in skb_gro_receive
Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146
Call Trace:
skb_gro_receive (net/core/gro.c:174)
udp_gro_receive (net/ipv4/udp_offload.c:812)
inet_gro_receive (net/ipv4/af_inet.c:1539)
dev_gro_receive (net/core/gro.c:515)
gro_receive_skb (net/core/gro.c:633)
cpu_map_kthread_run (kernel/bpf/cpumap.c:395)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Fixes: b0d1beeff2a9 ("xdp: implement convert_to_xdp_frame for MEM_TYPE_ZERO_COPY")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260818154516.793517-1-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/xdp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -585,7 +585,7 @@ struct xdp_frame *xdp_convert_zc_to_xdp_
xdp->data - xdp->data_meta;
totsize = xdp->data_end - xdp->data + metasize;
- if (sizeof(*xdpf) + totsize > PAGE_SIZE)
+ if (sizeof(*xdpf) + totsize > SKB_WITH_OVERHEAD(PAGE_SIZE))
return NULL;
page = dev_alloc_page();
@@ -602,7 +602,7 @@ struct xdp_frame *xdp_convert_zc_to_xdp_
xdpf->data = addr + metasize;
xdpf->len = totsize - metasize;
- xdpf->headroom = 0;
+ xdpf->headroom = metasize;
xdpf->metasize = metasize;
xdpf->frame_sz = PAGE_SIZE;
xdpf->mem_type = MEM_TYPE_PAGE_ORDER0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 596/713] slip: fix use-after-free in sl_sync()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 595/713] xdp: fix zero-copy frame layout Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 597/713] net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Greg Kroah-Hartman
` (127 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Aleksandr Khromov,
Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Khromov <haa@amicon.ru>
commit 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d upstream.
slip_devs[] stores bare net_device pointers and takes no reference on
them. sl_sync() and sl_alloc() walk that table from slip_open() under
rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
sl_setup() installs as dev->priv_destructor.
priv_destructor is called from netdev_run_todo(), which deliberately
runs with the RTNL semaphore released so that it can sleep while waiting
for the device refcount to drop:
/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);
__rtnl_unlock();
...
if (dev->priv_destructor)
dev->priv_destructor(dev); /* slip_devs[i] = NULL */
if (dev->needs_free_netdev)
free_netdev(dev);
...
/* Free network device */
kobject_put(&dev->dev.kobj);
So rtnl_lock() does not serialise slip_open() against the teardown at
all. sl_sync() can load slip_devs[i] while the entry is still published
and dereference it after netdev_run_todo() has run the destructor and
released the device:
CPU0 (slip_open) CPU1 (slip_close)
unregister_netdev()
rtnl_unlock()
netdev_run_todo()
__rtnl_unlock()
rtnl_lock()
sl_sync()
dev = slip_devs[i]
priv_destructor(dev)
slip_devs[i] = NULL
kobject_put(&dev->dev.kobj)
/* dev is freed */
sl = netdev_priv(dev)
if (sl->tty || sl->leased) /* use-after-free */
BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]
BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506
CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
sl_sync drivers/net/slip/slip.c:730 [inline]
slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
tiocsetd drivers/tty/tty_io.c:2428 [inline]
tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712
Allocated by task 6502:
alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719
sl_alloc drivers/net/slip/slip.c:756 [inline]
slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
Freed by task 6497:
device_release+0xa2/0x240 drivers/base/core.c:2507
kobject_put+0x179/0x280 lib/kobject.c:729
netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509
slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906
tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456
tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614
tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782
tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860
Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed
a different source of stale entries - a device left in slip_devs[] after
slip_open() freed it on the registration error path - and does not
address this race, which is why the report survives it.
Drop the entry from ndo_uninit instead. unregister_netdevice() calls
ndo_uninit under RTNL, before the device is queued to netdev_run_todo(),
so an entry that sl_sync() can still see while holding RTNL belongs to a
device that cannot be freed until RTNL is dropped. sl_free_netdev()
stays only for the slip_open() error path, where register_netdevice()
may have failed before ndo_init and ndo_uninit is then not called
either. Both running for the same device is harmless: they run under
the same RTNL section, so the slot cannot have been reused in between.
This also removes the second symptom of the missing exclusion: a
destructor running after sl_alloc() had already handed the slot out to
another channel used to clear a live entry, so sl_sync() stopped at that
NULL, sl_alloc() returned the same index again, and
register_netdevice() failed with -EEXIST because slN was still there.
Reproduced on x86_64 with several threads looping over
open("/dev/ptmx") + ioctl(TIOCSETD, N_SLIP) + close().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 5342b77c4123 ("slip: Clean up create and destroy")
Cc: stable@vger.kernel.org
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Aleksandr Khromov <haa@amicon.ru>
Link: https://patch.msgid.link/20260824100547.164773-1-haa@amicon.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/slip/slip.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -628,9 +628,15 @@ static void sl_uninit(struct net_device
struct slip *sl = netdev_priv(dev);
sl_free_bufs(sl);
+ /* Drop the slip_devs[] entry here rather than from the destructor:
+ * ndo_uninit runs under RTNL, so it cannot race sl_sync().
+ */
+ slip_devs[dev->base_addr] = NULL;
}
-/* Hook the destructor so we can free slip devices at the right point in time */
+/* Only for the slip_open() error path: register_netdevice() can fail before
+ * ndo_init, and then ndo_uninit is not called either.
+ */
static void sl_free_netdev(struct net_device *dev)
{
int i = dev->base_addr;
@@ -657,7 +663,6 @@ static void sl_setup(struct net_device *
{
dev->netdev_ops = &sl_netdev_ops;
dev->needs_free_netdev = true;
- dev->priv_destructor = sl_free_netdev;
dev->hard_header_len = 0;
dev->addr_len = 0;
@@ -908,7 +913,7 @@ static void slip_close(struct tty_struct
#endif
/* Flush network side */
unregister_netdev(sl->dev);
- /* This will complete via sl_free_netdev */
+ /* sl_uninit() has dropped the slip_devs[] entry by now */
}
static void slip_hangup(struct tty_struct *tty)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 597/713] net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 596/713] slip: fix use-after-free in sl_sync() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 598/713] net: tun: bound receive headroom Greg Kroah-Hartman
` (126 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Porcedda, Breno Leitao,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <fabio.porcedda@gmail.com>
commit 1056e79fffd0841f43c6a1b25664b196b3caf1c6 upstream.
Add the followin Telit Cinterion FE990D50 composition:
0x0991: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 10 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0991 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=2aa802d2
C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: stable@vger.kernel.org
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260812054911.447887-1-Fabio.Porcedda@telit.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1360,6 +1360,7 @@ static const struct usb_device_id produc
{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
{QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
{QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x0991, 0)}, /* Telit FE990D50 */
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 598/713] net: tun: bound receive headroom
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 597/713] net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 599/713] net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Greg Kroah-Hartman
` (125 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asim Viladi Oglu Manizada,
Willem de Bruijn, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c9303942c439a117d9b76ce6d6e2116b38ee7 upstream.
tun_get_user() uses tun->align both as skb headroom and when choosing how
much packet data to keep linear. OVS can propagate an oversized headroom
request from another port to TUN or TAP.
When align is larger than the usable space in a one-page skb head,
SKB_MAX_HEAD(align) underflows and the result becomes negative when stored
in good_linear. That value later wraps when assigned to the size_t linear
variable, and tun_alloc_skb() can place skb->data outside the allocated
head.
Bound the headroom stored by TUN to the one-page skb-head budget and the
largest non-sentinel 16-bit skb header offset. Leave one linear byte for
raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
Also pull the raw-TUN protocol byte and the TAP Ethernet header before
accessing them, so these checks remain safe for nonlinear skbs supplied by
other allocation paths.
Fixes: eaea34b23c46 ("net/tun: implement ndo_set_rx_headroom")
Cc: stable@vger.kernel.org
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260812012139.2134643-1-manizada@pm.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/tun.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1107,11 +1107,16 @@ static netdev_features_t tun_net_fix_fea
static void tun_set_headroom(struct net_device *dev, int new_hr)
{
struct tun_struct *tun = netdev_priv(dev);
+ size_t max_headroom;
- if (new_hr < NET_SKB_PAD)
- new_hr = NET_SKB_PAD;
+ max_headroom = min_t(size_t, SKB_MAX_HEAD(0), U16_MAX - 1);
- tun->align = new_hr;
+ if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP)
+ max_headroom -= ETH_HLEN + NET_IP_ALIGN;
+ else
+ max_headroom -= 1;
+
+ tun->align = clamp_t(int, new_hr, NET_SKB_PAD, max_headroom);
}
static void
@@ -1822,7 +1827,13 @@ static ssize_t tun_get_user(struct tun_s
switch (tun->flags & TUN_TYPE_MASK) {
case IFF_TUN:
if (tun->flags & IFF_NO_PI) {
- u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+ u8 ip_version;
+
+ if (!pskb_may_pull(skb, 1)) {
+ err = -EINVAL;
+ goto drop;
+ }
+ ip_version = skb->data[0] >> 4;
switch (ip_version) {
case 4:
@@ -1842,7 +1853,7 @@ static ssize_t tun_get_user(struct tun_s
skb->dev = tun->dev;
break;
case IFF_TAP:
- if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
+ if (!pskb_may_pull(skb, ETH_HLEN)) {
err = -ENOMEM;
drop_reason = SKB_DROP_REASON_HDR_TRUNC;
goto drop;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 599/713] net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 598/713] net: tun: bound receive headroom Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 600/713] net: bnxt: ring the doorbell when SW USO exits early Greg Kroah-Hartman
` (124 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahmad Fatoum, Oleksij Rempel,
Alvin Šipraga, Linus Walleij, Luiz Angelo Daros de Luca,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
commit fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc upstream.
rtl83xx_reset_assert() and rtl83xx_reset_deassert() are only called from
the probe path, which may sleep and is not timing-critical. When the
reset GPIO is provided by a sleeping controller such as an I2C I/O
expander, gpiod_set_value() warns:
WARNING: drivers/gpio/gpiolib.c:4030 at gpiod_set_value+0x44/0x80, CPU#1: kworker/u16:4/61
Hardware name: B&O MAP CA33 Rev f (UNKNOWN) (DT)
Workqueue: events_unbound deferred_probe_work_func
pc : gpiod_set_value+0x44/0x80
lr : rtl83xx_probe+0x1d8/0x3a0
Call trace:
gpiod_set_value+0x44/0x80 (P)
rtl83xx_probe+0x1d8/0x3a0
realtek_mdio_probe+0x24/0xa0
mdio_probe+0x38/0x78
really_probe+0xc4/0x3e0
__driver_probe_device+0x15c/0x1b8
driver_probe_device+0xb4/0x120
__device_attach_driver+0xb8/0x1a0
bus_for_each_drv+0x88/0xf0
__device_attach+0xa0/0x1d8
device_initial_probe+0x54/0x68
bus_probe_device+0x38/0xa0
deferred_probe_work_func+0xb8/0x120
process_one_work+0x184/0x4e8
worker_thread+0x188/0x308
kthread+0x130/0x150
ret_from_fork+0x10/0x20
Switch both helpers to gpiod_set_value_cansleep() so such a reset GPIO can
be used without triggering the warning.
The reset GPIO has been driven with the non-sleeping gpiod_set_value()
since the driver was added in v4.19. The call has since been refactored
across several files - from realtek-smi.c / realtek-mdio.c into the common
rtl83xx.c module and then into the rtl83xx_reset_assert() and
rtl83xx_reset_deassert() helpers (both in v6.9). This patch therefore
applies as-is only to kernels that carry those helpers (v6.9+); older
stable kernels need the same gpiod_set_value_cansleep() conversion at the
corresponding open-coded call sites.
Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
Cc: <stable@vger.kernel.org> # 6.9.x
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://patch.msgid.link/20260814110102.2362246-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/realtek/rtl83xx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/dsa/realtek/rtl83xx.c
+++ b/drivers/net/dsa/realtek/rtl83xx.c
@@ -321,7 +321,7 @@ void rtl83xx_reset_assert(struct realtek
"Failed to assert the switch reset control: %pe\n",
ERR_PTR(ret));
- gpiod_set_value(priv->reset, true);
+ gpiod_set_value_cansleep(priv->reset, true);
}
void rtl83xx_reset_deassert(struct realtek_priv *priv)
@@ -334,7 +334,7 @@ void rtl83xx_reset_deassert(struct realt
"Failed to deassert the switch reset control: %pe\n",
ERR_PTR(ret));
- gpiod_set_value(priv->reset, false);
+ gpiod_set_value_cansleep(priv->reset, false);
}
/**
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 600/713] net: bnxt: ring the doorbell when SW USO exits early
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 599/713] net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 601/713] net: ibm: emac: mal: fix NAPI locking Greg Kroah-Hartman
` (123 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Damato, Michael Chan,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <joe@dama.to>
commit 4e15e89faac9f308baeb01f46c13a051814d2449 upstream.
When a burst of packets is handed down to the driver, the driver defers
the doorbell to the end by setting txr->kick_pending = 1. The normal TX
path handles this, but the SW USO path can miss it if it returns
early.
If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and
txr->kick_pending was previously set to 1, then the TX queue can
stall because the driver wrote some BDs but never wrote the doorbell.
The device won't know to do the TX which would generate the completion
that would wake the queue back up.
Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success
case and check the flag on return. The added check after
bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are
written handling both successful USO and any early returns, which
prevents the TX queue stall mentioned above.
This TX queue stall was observed on a production system with a netdev TX
watchdog informing about the queue stall.
Fixes: cc5d90667db8 ("net: bnxt: Implement software USO")
Cc: stable@vger.kernel.org
Signed-off-by: Joe Damato <joe@dama.to>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260819233213.3673149-1-joe@dama.to
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++++++--
drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c | 4 +---
2 files changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -485,6 +485,7 @@ static netdev_tx_t bnxt_start_xmit(struc
struct bnxt_sw_tx_bd *tx_buf;
__le32 lflags = 0;
skb_frag_t *frag;
+ netdev_tx_t ret;
i = skb_get_queue_mapping(skb);
if (unlikely(i >= bp->tx_nr_rings)) {
@@ -507,8 +508,13 @@ static netdev_tx_t bnxt_start_xmit(struc
#endif
if (skb_is_gso(skb) &&
(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) &&
- !(bp->flags & BNXT_FLAG_UDP_GSO_CAP))
- return bnxt_sw_udp_gso_xmit(bp, txr, txq, skb);
+ !(bp->flags & BNXT_FLAG_UDP_GSO_CAP)) {
+ ret = bnxt_sw_udp_gso_xmit(bp, txr, txq, skb);
+ if (txr->kick_pending)
+ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
+
+ return ret;
+ }
free_size = bnxt_tx_avail(bp, txr);
if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c
@@ -223,9 +223,7 @@ netdev_tx_t bnxt_sw_udp_gso_xmit(struct
netdev_tx_sent_queue(txq, skb->len);
WRITE_ONCE(txr->tx_prod, prod);
- /* Sync BDs before doorbell */
- wmb();
- bnxt_db_write(bp, &txr->tx_db, prod);
+ txr->kick_pending = 1;
if (unlikely(bnxt_tx_avail(bp, txr) <= bp->tx_wake_thresh))
netif_txq_try_stop(txq, bnxt_tx_avail(bp, txr),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 601/713] net: ibm: emac: mal: fix NAPI locking
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 600/713] net: bnxt: ring the doorbell when SW USO exits early Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 602/713] net: ipa: fix stalled modem TX queue after runtime resume Greg Kroah-Hartman
` (122 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Simon Horman,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 43b0213529c6ae2fd4cbf8dbb9baff87a34c27d7 upstream.
Since commit 413f0271f396 ("net: protect NAPI enablement with
netdev_lock()"), napi_enable() and napi_disable() take netdev_lock().
mal_register_commac() and mal_unregister_commac() call these helpers
while holding mal->lock with interrupts disabled. In the unregister
path, napi_disable() may also wait for polling to finish, while the poll
completion path takes mal->lock.
Take netdev_lock() before mal->lock, use the locked NAPI helpers, and
drop mal->lock before napi_disable_locked().
Fixes: 413f0271f396 ("net: protect NAPI enablement with netdev_lock()")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260811070813.377573-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/emac/mal.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -35,6 +35,7 @@ int mal_register_commac(struct mal_insta
{
unsigned long flags;
+ netdev_lock(mal->napi.dev);
spin_lock_irqsave(&mal->lock, flags);
MAL_DBG(mal, "reg(%08x, %08x)" NL,
@@ -44,18 +45,20 @@ int mal_register_commac(struct mal_insta
if ((mal->tx_chan_mask & commac->tx_chan_mask) ||
(mal->rx_chan_mask & commac->rx_chan_mask)) {
spin_unlock_irqrestore(&mal->lock, flags);
+ netdev_unlock(mal->napi.dev);
printk(KERN_WARNING "mal%d: COMMAC channels conflict!\n",
mal->index);
return -EBUSY;
}
if (list_empty(&mal->list))
- napi_enable(&mal->napi);
+ napi_enable_locked(&mal->napi);
mal->tx_chan_mask |= commac->tx_chan_mask;
mal->rx_chan_mask |= commac->rx_chan_mask;
list_add(&commac->list, &mal->list);
spin_unlock_irqrestore(&mal->lock, flags);
+ netdev_unlock(mal->napi.dev);
return 0;
}
@@ -64,7 +67,9 @@ void mal_unregister_commac(struct mal_in
struct mal_commac *commac)
{
unsigned long flags;
+ bool disable_napi;
+ netdev_lock(mal->napi.dev);
spin_lock_irqsave(&mal->lock, flags);
MAL_DBG(mal, "unreg(%08x, %08x)" NL,
@@ -73,10 +78,12 @@ void mal_unregister_commac(struct mal_in
mal->tx_chan_mask &= ~commac->tx_chan_mask;
mal->rx_chan_mask &= ~commac->rx_chan_mask;
list_del_init(&commac->list);
- if (list_empty(&mal->list))
- napi_disable(&mal->napi);
+ disable_napi = list_empty(&mal->list);
spin_unlock_irqrestore(&mal->lock, flags);
+ if (disable_napi)
+ napi_disable_locked(&mal->napi);
+ netdev_unlock(mal->napi.dev);
}
int mal_set_rcbs(struct mal_instance *mal, int channel, unsigned long size)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 602/713] net: ipa: fix stalled modem TX queue after runtime resume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 601/713] net: ibm: emac: mal: fix NAPI locking Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 603/713] net: l2tp: do not propagate multicast notification errors Greg Kroah-Hartman
` (121 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jorijn van der Graaf, Simon Horman,
David S. Miller, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
commit 3cbfd627ee720f3d2460d2cbe2fe9e4130240db6 upstream.
ipa_start_xmit() unconditionally stops the TX queue before calling
pm_runtime_get(), relying on the wake scheduled by runtime resume
(ipa_modem_wake_queue_work()) to restart it once power is ACTIVE.
But that work is queued from within the runtime resume callback,
before the device's power state reaches RPM_ACTIVE, so it can run
while the device is still RPM_RESUMING. The wake is then consumed
too early: the transmit it restarts stops the queue again,
pm_runtime_get() returns -EINPROGRESS without arranging any future
wake (deferred_resume exists only for RPM_SUSPENDING), and after the
resume completes nothing is left to wake the queue. Transmit stalls
permanently: packets pile up in the qdisc behind the stopped queue,
the device runtime-suspends, and since the netdev registers no
ndo_tx_timeout the watchdog never fires. Observed on SM7635
(Fairphone 6) as the cellular data path going permanently deaf
within hours, RX included, since nothing resumes the suspended
endpoints.
Close the window by making the wake work wait for the resume to
complete (pm_runtime_get_sync()) before waking the queue. Every
queue stop is then guaranteed a later wake that happens while power
is ACTIVE; a transmit racing a new suspend/resume cycle re-schedules
the work. If the device could not be resumed, wake the queue anyway
so pending packets are dropped by the transmit path rather than
stranded.
The STARTED power flag used to narrow this window: a wake running
before the transmit path's stop suppressed that stop, but only once,
as the flag was cleared by the first stop it absorbed. Removing the
flag made a single transmit during an in-flight resume sufficient to
strand the queue, which is the form observed.
With an accelerated reproducer (autosuspend delay shortened to 5 ms,
~20 packets/s of TX), an unpatched kernel stalled three times in
230 s / 4380 packets; with this patch the same test ran 3601 s /
70298 packets without a stall.
Fixes: 688de12f080f ("net: ipa: kill the STARTED IPA power flag")
Cc: stable@vger.kernel.org
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260815040302.653650-1-jorijnvdgraaf@catcrafts.net
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipa/ipa_modem.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/net/ipa/ipa_modem.c
+++ b/drivers/net/ipa/ipa_modem.c
@@ -266,13 +266,29 @@ void ipa_modem_suspend(struct net_device
* the modem. We can't enable the queue directly in ipa_modem_resume()
* because transmits restart the instant the queue is awakened; but the
* device power state won't be ACTIVE until *after* ipa_modem_resume()
- * returns.
+ * returns. A transmit restarted before that would stop the queue
+ * again and get -EINPROGRESS from pm_runtime_get(), and with this
+ * work having already run, nothing would ever wake the queue again.
+ * So wait for the resume to complete before waking the queue.
*/
static void ipa_modem_wake_queue_work(struct work_struct *work)
{
struct ipa_priv *priv = container_of(work, struct ipa_priv, work);
+ struct device *dev = priv->ipa->dev;
+ int ret;
+ ret = pm_runtime_get_sync(dev);
+
+ /* Wake the queue even if the device could not be resumed, so
+ * that pending packets are dropped by the transmit path rather
+ * than stranded behind a stopped queue.
+ */
netif_wake_queue(priv->tx->netdev);
+
+ if (ret < 0)
+ pm_runtime_put_noidle(dev);
+ else
+ (void)pm_runtime_put_autosuspend(dev);
}
/** ipa_modem_resume() - resume callback for runtime_pm
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 603/713] net: l2tp: do not propagate multicast notification errors
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 602/713] net: ipa: fix stalled modem TX queue after runtime resume Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 604/713] net: mctp: hold a reference to the route device in mctp_route_lookup() Greg Kroah-Hartman
` (120 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Zihan Xi, Simon Horman,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <zihanx@nebusec.ai>
commit af20e269f7459d2ce69887fdf2fad7caf986c865 upstream.
The tunnel create, tunnel modify, session create, and session modify
netlink handlers send multicast notifications through helpers that can fail
while allocating or encoding a message, or while multicasting it.
For tunnel and session create/modify, a notification is sent after the live
operation has completed. Returning a best-effort notification error as the
command result can therefore report failure for an operation that already
committed and can cause callers to retry and accumulate live objects.
Keep sending notifications for listener visibility, but do not propagate
their best-effort status as the command result. This also keeps the tunnel
modify command consistent with the other notification-only paths.
Fixes: 33f72e6f0c67 ("l2tp : multicast notification to the registered listeners")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/54f48e812ca0424c47ffdb9a8182180921f7e6b2.1787247008.git.zihanx@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_netlink.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -248,8 +248,8 @@ static int l2tp_nl_cmd_tunnel_create(str
kfree(tunnel);
goto out;
}
- ret = l2tp_tunnel_notify(&l2tp_nl_family, info, tunnel,
- L2TP_CMD_TUNNEL_CREATE);
+ l2tp_tunnel_notify(&l2tp_nl_family, info, tunnel,
+ L2TP_CMD_TUNNEL_CREATE);
l2tp_tunnel_put(tunnel);
out:
@@ -305,8 +305,8 @@ static int l2tp_nl_cmd_tunnel_modify(str
goto out;
}
- ret = l2tp_tunnel_notify(&l2tp_nl_family, info,
- tunnel, L2TP_CMD_TUNNEL_MODIFY);
+ l2tp_tunnel_notify(&l2tp_nl_family, info,
+ tunnel, L2TP_CMD_TUNNEL_MODIFY);
l2tp_tunnel_put(tunnel);
@@ -645,8 +645,8 @@ static int l2tp_nl_cmd_session_create(st
session = l2tp_session_get(net, tunnel->sock, tunnel->version,
tunnel_id, session_id);
if (session) {
- ret = l2tp_session_notify(&l2tp_nl_family, info, session,
- L2TP_CMD_SESSION_CREATE);
+ l2tp_session_notify(&l2tp_nl_family, info, session,
+ L2TP_CMD_SESSION_CREATE);
l2tp_session_put(session);
}
}
@@ -710,8 +710,8 @@ static int l2tp_nl_cmd_session_modify(st
if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
session->reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);
- ret = l2tp_session_notify(&l2tp_nl_family, info,
- session, L2TP_CMD_SESSION_MODIFY);
+ l2tp_session_notify(&l2tp_nl_family, info,
+ session, L2TP_CMD_SESSION_MODIFY);
l2tp_session_put(session);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 604/713] net: mctp: hold a reference to the route device in mctp_route_lookup()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 603/713] net: l2tp: do not propagate multicast notification errors Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 605/713] net: openvswitch: fix flow mask use-after-free on flow deletion Greg Kroah-Hartman
` (119 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
commit 408da1df18116c971c3392e21e50586688cd3fbf upstream.
mctp_route_lookup() uses rt->dev without holding a reference on it.
mctp_route_lookup_single() returns the route under RCU only, so the
route's device can be torn down concurrently: mctp_dev_put() drops the
last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()
then reads rt->dev->addrs[0], giving a use-after-free reachable by an
unprivileged local AF_MCTP user on the receive/forwarding path (no
CAP_NET_RAW required):
BUG: KASAN: slab-use-after-free in mctp_route_lookup
Read of size 1 at addr ... by task mctp_uaf/...
mctp_route_lookup
mctp_pkttype_receive
Freed by task ...:
kfree
mctp_dev_put
mctp_dev_notify
In the same window mctp_dst_from_route() -> mctp_dev_hold() also
increments a refcount that has already reached zero
("refcount_t: addition on 0 ... mctp_dev_hold").
This reintroduces the use-after-free class of CVE-2023-3439: the source
address lookup was moved ahead of the point where the destination takes
its device reference.
Take a reference with refcount_inc_not_zero() before touching rt->dev,
skip a device that is already dead, and drop the reference once the
destination has taken its own.
Fixes: 22cb45afd221 ("net: mctp: perform source address lookups when we populate our dst")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Link: https://patch.msgid.link/20260813022102.2792032-1-qwe.aldo@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mctp/route.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -998,14 +998,29 @@ int mctp_route_lookup(struct net *net, u
mtu = mtu ?: rt->mtu;
if (rt->dst_type == MCTP_ROUTE_DIRECT) {
- mctp_eid_t saddr = mctp_dev_saddr(rt->dev);
+ mctp_eid_t saddr;
+
+ /* rt->dev may be going away concurrently: its last
+ * reference is dropped in mctp_dev_put(), which frees
+ * mdev->addrs that mctp_dev_saddr() reads, and
+ * mctp_dst_from_route() takes a reference on it. Pin
+ * it before use, and skip a device that is already
+ * dead rather than resurrecting it.
+ */
+ if (!refcount_inc_not_zero(&rt->dev->refs))
+ break;
+
+ saddr = mctp_dev_saddr(rt->dev);
/* cannot do gateway-ed routes without a src */
- if (saddr == MCTP_ADDR_NULL && depth != 0)
+ if (saddr == MCTP_ADDR_NULL && depth != 0) {
+ mctp_dev_put(rt->dev);
break;
+ }
if (dst)
mctp_dst_from_route(dst, daddr, saddr, mtu, rt);
+ mctp_dev_put(rt->dev);
rc = 0;
break;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 605/713] net: openvswitch: fix flow mask use-after-free on flow deletion
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 604/713] net: mctp: hold a reference to the route device in mctp_route_lookup() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 606/713] net: openvswitch: fix nf_connlabels leak in ovs_ct_init Greg Kroah-Hartman
` (118 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Maximets, Aaron Conole,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <i.maximets@ovn.org>
commit 4e30317ff67a2eb12b4d890d39f72fd7e7117d48 upstream.
The commit in the Fixes tag below made so flow->mask free is scheduled
via RCU right after it is removed from the flow table. The pointer
stays in the flow structure and it can be accessible while in the same
RCU critical section. This is done to avoid requiring ovs_mutex for
the ovs_flow_free().
However, while removing the flow during processing of CMD_DEL, we do
not take RCU read lock before the removal, and ovs_flow_cmd_fill_info()
uses the flow->mask pointer afterwards. The RCU read lock is taken,
but it's already late at that point. The comment on that line
acknowledges that the lock is cosmetic and doesn't serve a real purpose.
This leads to use-after-free if the RCU grace period passes between
removal and the filling. It is a short race window, but it is there
and can lead to a real crash in case memory allocation for the info
takes a bit longer:
BUG: KASAN: slab-use-after-free in __ovs_nla_put_key
net/openvswitch/flow_netlink.c:1996
BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30
net/openvswitch/flow_netlink.c:2250
Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487
Call Trace:
<TASK>
__ovs_nla_put_key net/openvswitch/flow_netlink.c:1996
ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250
ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930
ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556
</TASK>
Allocated by task 9487:
mask_alloc net/openvswitch/flow_table.c:967
flow_mask_insert net/openvswitch/flow_table.c:1012
ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084
ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556
Freed by task 9485:
rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978
rcu_do_batch kernel/rcu/tree.c:2645
rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897
handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622
...
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062
ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info()
to avoid this race. This also helps with cleaning up the forced cast
and the cosmetic RCU read lock. Before the commit in the Fixes tag the
order did not matter as long as the flow object itself was not freed.
A wider RCU critical section could be another option, but we have a
GFP_KERNEL allocation in the way.
Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.
Fixes: 56c19868e115 ("openvswitch: Make flow mask removal symmetric.")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20260815005915.1097270-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/openvswitch/datapath.c | 45 +++++++++++++++++++++++----------------------
1 file changed, 23 insertions(+), 22 deletions(-)
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1472,33 +1472,34 @@ static int ovs_flow_cmd_del(struct sk_bu
goto unlock;
}
- ovs_flow_tbl_remove(&dp->table, flow);
- ovs_unlock();
-
- reply = ovs_flow_cmd_alloc_info((const struct sw_flow_actions __force *) flow->sf_acts,
+ reply = ovs_flow_cmd_alloc_info(ovsl_dereference(flow->sf_acts),
&flow->id, info, false, ufid_flags);
- if (likely(reply)) {
- if (!IS_ERR(reply)) {
- rcu_read_lock(); /*To keep RCU checker happy. */
- err = ovs_flow_cmd_fill_info(flow, ovs_header->dp_ifindex,
- reply, info->snd_portid,
- info->snd_seq, 0,
- OVS_FLOW_CMD_DEL,
- ufid_flags);
- rcu_read_unlock();
- if (WARN_ON_ONCE(err < 0)) {
- kfree_skb(reply);
- goto out_free;
- }
+ if (IS_ERR(reply)) {
+ netlink_set_err(sock_net(skb->sk)->genl_sock, 0, 0,
+ PTR_ERR(reply));
+ reply = NULL;
+ }
- ovs_notify(&dp_flow_genl_family, reply, info);
- } else {
- netlink_set_err(sock_net(skb->sk)->genl_sock, 0, 0,
- PTR_ERR(reply));
+ if (likely(reply)) {
+ err = ovs_flow_cmd_fill_info(flow, ovs_header->dp_ifindex,
+ reply, info->snd_portid,
+ info->snd_seq, 0,
+ OVS_FLOW_CMD_DEL, ufid_flags);
+ if (WARN_ON_ONCE(err < 0)) {
+ kfree_skb(reply);
+ reply = NULL;
}
}
+ /* Removal has to happen after ovs_flow_cmd_fill_info(), as it uses
+ * the flow->mask that can be scheduled to be freed by the
+ * ovs_flow_tbl_remove() and we're not holding the RCU read lock.
+ */
+ ovs_flow_tbl_remove(&dp->table, flow);
+ ovs_unlock();
+
+ if (likely(reply))
+ ovs_notify(&dp_flow_genl_family, reply, info);
-out_free:
ovs_flow_free(flow, true);
return 0;
unlock:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 606/713] net: openvswitch: fix nf_connlabels leak in ovs_ct_init
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 605/713] net: openvswitch: fix flow mask use-after-free on flow deletion Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 607/713] net: phylink: correctly validate returned PCS in phylink_inband_caps Greg Kroah-Hartman
` (117 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Ilya Maximets,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit f9de5db270a4c2641de87ee558c16a9bc6eb4cd8 upstream.
ovs_ct_init() acquires a connlabels reference before initializing the
conntrack limit state. If ovs_ct_limit_init() fails, its error is returned
directly. The pernet core does not invoke the exit callback for the
operation whose initialization failed, so ovs_ct_exit() cannot drop the
reference.
This leaves labels_used elevated when Open vSwitch pernet registration
fails for an existing network namespace. Subsequent conntrack entries in
that namespace may allocate label extensions even though Open vSwitch
failed to register.
Drop the connlabels reference before returning a conntrack limit
initialization error. ovs_ct_limit_init() already releases its partial
state, and the original error remains unchanged.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260815151729.3757984-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/openvswitch/conntrack.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -2022,6 +2022,7 @@ int ovs_ct_init(struct net *net)
{
unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+ int err = 0;
if (nf_connlabels_get(net, n_bits - 1)) {
ovs_net->xt_label = false;
@@ -2031,10 +2032,11 @@ int ovs_ct_init(struct net *net)
}
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- return ovs_ct_limit_init(net, ovs_net);
-#else
- return 0;
+ err = ovs_ct_limit_init(net, ovs_net);
+ if (err && ovs_net->xt_label)
+ nf_connlabels_put(net);
#endif
+ return err;
}
/* Must be called with ovs_mutex held. Detaches the RCU-protected
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 607/713] net: phylink: correctly validate returned PCS in phylink_inband_caps
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 606/713] net: openvswitch: fix nf_connlabels leak in ovs_ct_init Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 608/713] net: ravb: avoid dereferencing an invalid PTP clock Greg Kroah-Hartman
` (116 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Marangi, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
commit f2849b1fd059ec9b3281b771e6ac5aad9feee851 upstream.
In phylink_inband_caps(), the PCS returned by mac_select_pcs is only
checked if NULL but mac_select_pcs can also return an error pointer.
This can cause a kernel panic as phylink_pcs_inband_caps() only checks
if passed PCS is not NULL and directly dereference ops from the phylink_pcs
struct.
Use the IS_ERR_OR_NULL macro to address both case where the returned
PCS can be NULL or an error pointer and prevent a kernel panic.
Cc: stable@vger.kernel.org
Fixes: df874f9e52c3 ("net: phylink: add pcs_inband_caps() method")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://patch.msgid.link/20260817213009.13924-1-ansuelsmth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/phylink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -965,7 +965,7 @@ static unsigned int phylink_inband_caps(
return 0;
pcs = pl->mac_ops->mac_select_pcs(pl->config, interface);
- if (!pcs)
+ if (IS_ERR_OR_NULL(pcs))
return 0;
return phylink_pcs_inband_caps(pcs, interface);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 608/713] net: ravb: avoid dereferencing an invalid PTP clock
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 607/713] net: phylink: correctly validate returned PCS in phylink_inband_caps Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 609/713] net: ravb: serialize PTP clock teardown Greg Kroah-Hartman
` (115 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Xuanqiang Luo,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
commit 1f77af0aaf277413ff32f6ff8c2c4282bd64c897 upstream.
The PTP clock is unavailable before the first open, so querying its
index can dereference a NULL pointer. Registration failures can also
leave an error pointer in priv->ptp.clock.
Cache the PHC index separately and report -1 while no clock is
registered. Normalize registration errors to NULL and preserve the
static timestamping capabilities.
Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260811103733.62599-2-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb.h | 1 +
drivers/net/ethernet/renesas/ravb_main.c | 3 ++-
drivers/net/ethernet/renesas/ravb_ptp.c | 15 +++++++++++++--
3 files changed, 16 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -1028,6 +1028,7 @@ struct ravb_ptp_perout {
struct ravb_ptp {
struct ptp_clock *clock;
struct ptp_clock_info info;
+ int phc_index;
u32 default_addend;
u32 current_addend;
int extts[N_EXT_TS];
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1779,7 +1779,7 @@ static int ravb_get_ts_info(struct net_d
(1 << HWTSTAMP_FILTER_NONE) |
(1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
(1 << HWTSTAMP_FILTER_ALL);
- info->phc_index = ptp_clock_index(priv->ptp.clock);
+ info->phc_index = READ_ONCE(priv->ptp.phc_index);
}
return 0;
@@ -2953,6 +2953,7 @@ static int ravb_probe(struct platform_de
priv->rstc = rstc;
priv->ndev = ndev;
priv->pdev = pdev;
+ priv->ptp.phc_index = -1;
priv->num_tx_ring[RAVB_BE] = BE_TX_RING_SIZE;
priv->num_rx_ring[RAVB_BE] = BE_RX_RING_SIZE;
if (info->nc_queues) {
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -315,6 +315,7 @@ void ravb_ptp_interrupt(struct net_devic
void ravb_ptp_init(struct net_device *ndev, struct platform_device *pdev)
{
struct ravb_private *priv = netdev_priv(ndev);
+ struct ptp_clock *clock;
unsigned long flags;
priv->ptp.info = ravb_ptp_info;
@@ -327,7 +328,15 @@ void ravb_ptp_init(struct net_device *nd
ravb_modify(ndev, GCCR, GCCR_TCSS, GCCR_TCSS_ADJGPTP);
spin_unlock_irqrestore(&priv->lock, flags);
- priv->ptp.clock = ptp_clock_register(&priv->ptp.info, &pdev->dev);
+ clock = ptp_clock_register(&priv->ptp.info, &pdev->dev);
+ if (IS_ERR(clock)) {
+ netdev_err(ndev, "failed to register PTP clock: %pe\n", clock);
+ clock = NULL;
+ }
+
+ priv->ptp.clock = clock;
+ if (clock)
+ WRITE_ONCE(priv->ptp.phc_index, ptp_clock_index(clock));
}
void ravb_ptp_stop(struct net_device *ndev)
@@ -337,5 +346,7 @@ void ravb_ptp_stop(struct net_device *nd
ravb_write(ndev, 0, GIC);
ravb_write(ndev, 0, GIS);
- ptp_clock_unregister(priv->ptp.clock);
+ WRITE_ONCE(priv->ptp.phc_index, -1);
+ if (priv->ptp.clock)
+ ptp_clock_unregister(priv->ptp.clock);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 609/713] net: ravb: serialize PTP clock teardown
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 608/713] net: ravb: avoid dereferencing an invalid PTP clock Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 610/713] net: thunderbolt: Release the Rx HopID that was handed out on mismatch Greg Kroah-Hartman
` (114 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xuanqiang Luo, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
commit 1cb9663789c5b7a12fcd419fcca6d6254c398252 upstream.
ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to
ptp_clock_event() while ptp_clock_unregister() is freeing it. This can
lead to a use-after-free.
Use READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer.
Atomically detach it with xchg() before disabling PTP interrupts, then
synchronize all IRQs which can invoke ravb_ptp_interrupt() before
unregistering the detached clock.
A handler which read the old pointer completes before the clock is
unregistered, while later handlers read NULL and skip the event.
Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260811103733.62599-3-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb.h | 2 +
drivers/net/ethernet/renesas/ravb_main.c | 6 +++--
drivers/net/ethernet/renesas/ravb_ptp.c | 37 ++++++++++++++++++++++++-------
3 files changed, 35 insertions(+), 10 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -1124,6 +1124,8 @@ struct ravb_private {
int msg_enable;
int speed;
int emac_irq;
+ int err_irq;
+ int mgmt_irq;
unsigned no_avb_link:1;
unsigned avb_link_active_low:1;
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2885,11 +2885,13 @@ static int ravb_setup_irqs(struct ravb_p
return error;
if (info->err_mgmt_irqs) {
- error = ravb_setup_irq(priv, "err_a", "err_a", NULL, ravb_multi_interrupt);
+ error = ravb_setup_irq(priv, "err_a", "err_a", &priv->err_irq,
+ ravb_multi_interrupt);
if (error)
return error;
- error = ravb_setup_irq(priv, "mgmt_a", "mgmt_a", NULL, ravb_multi_interrupt);
+ error = ravb_setup_irq(priv, "mgmt_a", "mgmt_a", &priv->mgmt_irq,
+ ravb_multi_interrupt);
if (error)
return error;
}
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -289,16 +289,17 @@ static const struct ptp_clock_info ravb_
void ravb_ptp_interrupt(struct net_device *ndev)
{
struct ravb_private *priv = netdev_priv(ndev);
+ struct ptp_clock *clock = READ_ONCE(priv->ptp.clock);
u32 gis = ravb_read(ndev, GIS);
gis &= ravb_read(ndev, GIC);
- if (gis & GIS_PTCF) {
+ if ((gis & GIS_PTCF) && clock) {
struct ptp_clock_event event;
event.type = PTP_CLOCK_EXTTS;
event.index = 0;
event.timestamp = ravb_read(ndev, GCPT);
- ptp_clock_event(priv->ptp.clock, &event);
+ ptp_clock_event(clock, &event);
}
if (gis & GIS_PTMF) {
struct ravb_ptp_perout *perout = priv->ptp.perout;
@@ -334,19 +335,39 @@ void ravb_ptp_init(struct net_device *nd
clock = NULL;
}
- priv->ptp.clock = clock;
+ WRITE_ONCE(priv->ptp.clock, clock);
if (clock)
WRITE_ONCE(priv->ptp.phc_index, ptp_clock_index(clock));
}
-void ravb_ptp_stop(struct net_device *ndev)
+static void ravb_ptp_disable(struct net_device *ndev)
{
- struct ravb_private *priv = netdev_priv(ndev);
-
ravb_write(ndev, 0, GIC);
ravb_write(ndev, 0, GIS);
+}
+
+static void ravb_ptp_sync_irqs(struct net_device *ndev)
+{
+ struct ravb_private *priv = netdev_priv(ndev);
+
+ synchronize_irq(ndev->irq);
+ if (priv->info->err_mgmt_irqs) {
+ synchronize_irq(priv->err_irq);
+ synchronize_irq(priv->mgmt_irq);
+ }
+}
+
+void ravb_ptp_stop(struct net_device *ndev)
+{
+ struct ravb_private *priv = netdev_priv(ndev);
+ struct ptp_clock *clock;
WRITE_ONCE(priv->ptp.phc_index, -1);
- if (priv->ptp.clock)
- ptp_clock_unregister(priv->ptp.clock);
+ clock = xchg(&priv->ptp.clock, NULL);
+
+ ravb_ptp_disable(ndev);
+ ravb_ptp_sync_irqs(ndev);
+
+ if (clock)
+ ptp_clock_unregister(clock);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 610/713] net: thunderbolt: Release the Rx HopID that was handed out on mismatch
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 609/713] net: ravb: serialize PTP clock teardown Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 611/713] net: thunderbolt: Mark the connection down when bringing it up fails Greg Kroah-Hartman
` (113 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Ye, Mika Westerberg,
Simon Horman, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Ye <fy15309206903@gmail.com>
commit 2f1463554d0561a2fead81e3888604e5c1125e29 upstream.
tb_xdomain_alloc_in_hopid() passes the wanted HopID to ida_alloc_range()
as the lower bound, so a taken id is not an error there: the allocator
returns the next free one above it. tbnet_connected_work() asks for the
peer's transmit path, treats any other id as a failure and returns
without releasing what it got, so that allocation stays live for the rest
of the XDomain connection with nothing left holding a reference to it.
Release the id when it is not the one we asked for, the same way the
error unwind at the end of the function releases the expected one.
Fixes: 180b0689425c ("thunderbolt: Allow multiple DMA tunnels over a single XDomain connection")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Ye <fy15309206903@gmail.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260811-b4-tbnet-hopid-v3-1-9e75d1b51331@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/thunderbolt/main.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/thunderbolt/main.c
+++ b/drivers/net/thunderbolt/main.c
@@ -647,6 +647,8 @@ static void tbnet_connected_work(struct
ret = tb_xdomain_alloc_in_hopid(net->xd, net->remote_transmit_path);
if (ret != net->remote_transmit_path) {
netdev_err(net->dev, "failed to allocate Rx HopID\n");
+ if (ret >= 0)
+ tb_xdomain_release_in_hopid(net->xd, ret);
return;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 611/713] net: thunderbolt: Mark the connection down when bringing it up fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 610/713] net: thunderbolt: Release the Rx HopID that was handed out on mismatch Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 612/713] NTB: ntb_transport: Recycle TX entries before client callbacks Greg Kroah-Hartman
` (112 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Ye, Mika Westerberg,
Simon Horman, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Ye <fy15309206903@gmail.com>
commit 3c8b26ebf525ba5960510f48c6e9936a79ebe76f upstream.
Every failure path in tbnet_connected_work() undoes its own work and
returns without clearing login_sent, so the connection still looks
established. The next tbnet_tear_down() therefore takes its main branch
and repeats a teardown that already happened: it stops rings that are
already stopped, which is a dev_WARN() and fatal under panic_on_warn,
and it releases net->remote_transmit_path even on the HopID mismatch
path, where this connection never owned that id, silently freeing one
that someone else is still using.
Clear login_sent on those paths. That is enough for tbnet_tear_down() to
leave the unwound state alone, and login_received has to stay set: it
records that the peer has logged in and carries the transmit path it gave
us, which nothing on this side can make the peer send again. Two things
change beyond keeping the teardown out of the way: the logout request in
that block is no longer sent, and the peer's next login request now
re-queues our login work rather than connected_work, giving the
connection a fresh login instead of a retry on stale state.
Fixes: e69b6c02b4c3 ("net: Add support for networking over Thunderbolt cable")
Cc: <stable@vger.kernel.org> # 5.13+
Signed-off-by: Fan Ye <fy15309206903@gmail.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260811-b4-tbnet-hopid-v3-2-9e75d1b51331@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/thunderbolt/main.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/net/thunderbolt/main.c
+++ b/drivers/net/thunderbolt/main.c
@@ -626,6 +626,14 @@ static int tbnet_alloc_tx_buffers(struct
return 0;
}
+static void tbnet_connect_failed(struct tbnet *net)
+{
+ /* Leave login_received set: only the peer can make it true again. */
+ mutex_lock(&net->connection_lock);
+ net->login_sent = false;
+ mutex_unlock(&net->connection_lock);
+}
+
static void tbnet_connected_work(struct work_struct *work)
{
struct tbnet *net = container_of(work, typeof(*net), connected_work);
@@ -649,6 +657,7 @@ static void tbnet_connected_work(struct
netdev_err(net->dev, "failed to allocate Rx HopID\n");
if (ret >= 0)
tb_xdomain_release_in_hopid(net->xd, ret);
+ tbnet_connect_failed(net);
return;
}
@@ -693,6 +702,7 @@ err_stop_rings:
tb_ring_stop(net->rx_ring.ring);
tb_ring_stop(net->tx_ring.ring);
tb_xdomain_release_in_hopid(net->xd, net->remote_transmit_path);
+ tbnet_connect_failed(net);
}
static void tbnet_login_work(struct work_struct *work)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 612/713] NTB: ntb_transport: Recycle TX entries before client callbacks
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 611/713] net: thunderbolt: Mark the connection down when bringing it up fails Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 613/713] NTB: ntb_transport: Fail TX enqueue when the QP link is down Greg Kroah-Hartman
` (111 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Dave Jiang,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 256496397287334a19ed80ec7be92bffcae76b9d upstream.
ntb_tx_copy_callback() invokes the client callback before returning the
entry to tx_free_q. The callback may wake a stopped client queue, only
for the next enqueue to find no local entry and return -EBUSY. The window
is narrow, but the retry is unnecessary.
Save the callback data and length, then return the entry to tx_free_q
before invoking the client. A completion callback then means both the
client buffer and transport entry are ready for reuse.
Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260817053519.4135287-2-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1719,9 +1719,16 @@ static void ntb_transport_rxc_db(unsigne
static void ntb_tx_copy_callback(void *data,
const struct dmaengine_result *res)
{
+ struct ntb_payload_header __iomem *hdr;
struct ntb_queue_entry *entry = data;
- struct ntb_transport_qp *qp = entry->qp;
- struct ntb_payload_header __iomem *hdr = entry->tx_hdr;
+ struct ntb_transport_qp *qp;
+ unsigned int len;
+ void *cb_data;
+
+ qp = entry->qp;
+ hdr = entry->tx_hdr;
+ cb_data = entry->cb_data;
+ len = entry->len;
/* we need to check DMA results if we are using DMA */
if (res) {
@@ -1768,15 +1775,13 @@ static void ntb_tx_copy_callback(void *d
* "link down" or similar. Since no payload is being sent in these
* cases, there is nothing to add to the completion queue.
*/
- if (entry->len > 0) {
- qp->tx_bytes += entry->len;
-
- if (qp->tx_handler)
- qp->tx_handler(qp, qp->cb_data, entry->cb_data,
- entry->len);
- }
+ if (len > 0)
+ qp->tx_bytes += len;
ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry, &qp->tx_free_q);
+
+ if (len > 0 && qp->tx_handler)
+ qp->tx_handler(qp, qp->cb_data, cb_data, len);
}
static void ntb_memcpy_tx_on_stack(struct ntb_queue_entry *entry, void __iomem *offset)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 613/713] NTB: ntb_transport: Fail TX enqueue when the QP link is down
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 612/713] NTB: ntb_transport: Recycle TX entries before client callbacks Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 614/713] NTB: ntb_transport: Reject oversized TX buffers Greg Kroah-Hartman
` (110 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Dave Jiang,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 873ce713fef5dde0939220f04f3484ec86a16fba upstream.
Commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") meant to
make ntb_transport_tx_enqueue() drop packets submitted while the QP link
is down, but it only returns 0 without consuming the packet. Zero means
success by this function's contract, so ntb_netdev reports NETDEV_TX_OK
and forgets the skb: nothing queued it, nothing frees it, and it leaks,
one skb for every transmit racing a link-down.
Return -ENOLINK instead, restoring the contract that a non-zero return
leaves the buffer owned by the caller. With the preceding patch,
ntb_netdev frees the skb on non-retryable enqueue failures and returns
NETDEV_TX_OK, so a packet racing with link-down is dropped without leaking
or entering a busy retry loop.
Fixes: f195a1a6fe41 ("ntb: Drop packets when qp link is down")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260817053519.4135287-4-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -2353,9 +2353,8 @@ int ntb_transport_tx_enqueue(struct ntb_
if (!qp || !len)
return -EINVAL;
- /* If the qp link is down already, just ignore. */
if (!qp->link_is_up)
- return 0;
+ return -ENOLINK;
entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
if (!entry) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 614/713] NTB: ntb_transport: Reject oversized TX buffers
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 613/713] NTB: ntb_transport: Fail TX enqueue when the QP link is down Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 615/713] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
` (109 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Dave Jiang,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7 upstream.
ntb_process_tx() handles an oversized buffer by calling tx_handler()
with a NULL data pointer and returning success. ntb_netdev therefore
neither frees the skb in its completion callback nor takes its enqueue
error path, leaking it.
Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring
a queue entry and return -EMSGSIZE. The caller retains ownership of the
buffer, and the preceding netdev patch frees the skb when enqueue
returns this permanent error.
Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260817053519.4135287-5-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1955,15 +1955,6 @@ static int ntb_process_tx(struct ntb_tra
return -EAGAIN;
}
- if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header)) {
- if (qp->tx_handler)
- qp->tx_handler(qp, qp->cb_data, NULL, -EIO);
-
- ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry,
- &qp->tx_free_q);
- return 0;
- }
-
ntb_async_tx(qp, entry);
qp->tx_pkts++;
@@ -2356,6 +2347,9 @@ int ntb_transport_tx_enqueue(struct ntb_
if (!qp->link_is_up)
return -ENOLINK;
+ if (len > qp->tx_max_frame - sizeof(struct ntb_payload_header))
+ return -EMSGSIZE;
+
entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
if (!entry) {
qp->tx_err_no_buf++;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 615/713] net: ntb_netdev: Fix TX busy and drop handling
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 614/713] NTB: ntb_transport: Reject oversized TX buffers Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 616/713] net: ntb_netdev: Avoid double-accounting netif_rx() drops Greg Kroah-Hartman
` (108 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Dave Jiang,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 8aaa47351db0f93a5c5297fbafdfa8bc75e8ae49 upstream.
Currently, ntb_netdev returns NETDEV_TX_BUSY for every enqueue error. It
also increments the drop and error counters while leaving the skb owned
by the qdisc, and may return BUSY with the subqueue still awake.
Retrying a permanent error cannot succeed either.
The unconditional BUSY return and premature accounting date back to the
initial driver. The error-path queue stop was later removed without
changing that return value. The current flow-control code includes a
resource check, but ntb_netdev does not honor its result before enqueue.
Honor the resource check before enqueue. For -EAGAIN and -EBUSY, stop
the subqueue, arm the existing reaper timer, and return BUSY without
touching the skb. For other errors, free the skb, increment tx_dropped,
and return NETDEV_TX_OK.
Fixes: 548c237c0a99 ("net: Add support for NTB virtual ethernet device")
Fixes: d723485cb4ca ("ntb_netdev: remove tx timeout")
Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260817053519.4135287-3-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ntb_netdev.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -199,8 +199,10 @@ static int __ntb_netdev_maybe_stop_tx(st
static int ntb_netdev_maybe_stop_tx(struct net_device *ndev,
struct ntb_netdev_queue *q, int size)
{
- if (__netif_subqueue_stopped(ndev, q->qid) ||
- (ntb_transport_tx_free_entry(q->qp) >= size))
+ if (__netif_subqueue_stopped(ndev, q->qid))
+ return -EBUSY;
+
+ if (ntb_transport_tx_free_entry(q->qp) >= size)
return 0;
return __ntb_netdev_maybe_stop_tx(ndev, q, size);
@@ -256,21 +258,30 @@ static netdev_tx_t ntb_netdev_start_xmit
q = &dev->queues[qid];
- ntb_netdev_maybe_stop_tx(ndev, q, tx_stop);
+ if (unlikely(ntb_netdev_maybe_stop_tx(ndev, q, tx_stop)))
+ return NETDEV_TX_BUSY;
rc = ntb_transport_tx_enqueue(q->qp, skb, skb->data, skb->len);
- if (rc)
- goto err;
+ if (rc) {
+ if (rc == -EAGAIN || rc == -EBUSY) {
+ netif_stop_subqueue(ndev, q->qid);
+ mod_timer(&q->tx_timer,
+ jiffies + usecs_to_jiffies(tx_time));
+ return NETDEV_TX_BUSY;
+ }
+
+ goto drop;
+ }
/* check for next submit */
ntb_netdev_maybe_stop_tx(ndev, q, tx_stop);
return NETDEV_TX_OK;
-err:
+drop:
+ dev_kfree_skb_any(skb);
ndev->stats.tx_dropped++;
- ndev->stats.tx_errors++;
- return NETDEV_TX_BUSY;
+ return NETDEV_TX_OK;
}
static void ntb_netdev_tx_timer(struct timer_list *t)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 616/713] net: ntb_netdev: Avoid double-accounting netif_rx() drops
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 615/713] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 617/713] net: ntb_netdev: Count packets dropped on RX refill failure Greg Kroah-Hartman
` (107 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Koichiro Den
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 82e15be2d8b9efa6fb1750528d9b6f40e6a8eea7 upstream.
netif_rx() already accounts packets it drops in the core rx_dropped
counter. ntb_netdev counts them again as both errors and drops.
Leave netif_rx() drops to the core. Count the packet and bytes
unconditionally since it was received successfully by the driver.
Fixes: 548c237c0a99 ("net: Add support for NTB virtual ethernet device")
Cc: stable@vger.kernel.org
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260819172539.1450821-2-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ntb_netdev.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -155,13 +155,9 @@ static void ntb_netdev_rx_handler(struct
skb->ip_summed = CHECKSUM_NONE;
skb_record_rx_queue(skb, q->qid);
- if (netif_rx(skb) == NET_RX_DROP) {
- ndev->stats.rx_errors++;
- ndev->stats.rx_dropped++;
- } else {
- ndev->stats.rx_packets++;
- ndev->stats.rx_bytes += len;
- }
+ netif_rx(skb);
+ ndev->stats.rx_packets++;
+ ndev->stats.rx_bytes += len;
skb = new_skb;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 617/713] net: ntb_netdev: Count packets dropped on RX refill failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 616/713] net: ntb_netdev: Avoid double-accounting netif_rx() drops Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 618/713] net/mlx5e: do not HW-GRO coalesce small frames Greg Kroah-Hartman
` (106 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Koichiro Den, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 31ded341c375bb2faac1d77ab0012a732ba3e2a6 upstream.
When replacement skb allocation fails, ntb_netdev drops a packet that
was received successfully and requeues the original buffer. The drop is
counted, but rx_packets and rx_bytes are not.
Count every good packet before allocating its replacement.
Fixes: d2121faf133a ("NTB: ntb_netdev: Preserve RX queue depth on allocation failure")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260819172539.1450821-3-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ntb_netdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -144,6 +144,9 @@ static void ntb_netdev_rx_handler(struct
goto enqueue_again;
}
+ ndev->stats.rx_packets++;
+ ndev->stats.rx_bytes += len;
+
new_skb = netdev_alloc_skb(ndev, ndev->mtu + ETH_HLEN);
if (!new_skb) {
ndev->stats.rx_dropped++;
@@ -156,8 +159,6 @@ static void ntb_netdev_rx_handler(struct
skb_record_rx_queue(skb, q->qid);
netif_rx(skb);
- ndev->stats.rx_packets++;
- ndev->stats.rx_bytes += len;
skb = new_skb;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 618/713] net/mlx5e: do not HW-GRO coalesce small frames
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 617/713] net: ntb_netdev: Count packets dropped on RX refill failure Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 619/713] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Greg Kroah-Hartman
` (105 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Glenn Judd, Tariq Toukan,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Glenn Judd <gmj@meta.com>
commit e2466392a0b8496000e12181cb1ee1535eb0da25 upstream.
When hardware GRO (SHAMPO) coalesces a small IPv4/TCP segment that was
padded up to the 60-byte minimum Ethernet frame, the trailing padding is
folded into the merged payload causing padding to be delivered
to the user as payload.
Detecting and reproducing the issue: the selftest
tools/testing/selftests/drivers/net/gro.py subtest
hw_ipv4_data_lrg_1byte sends {100, 1} expecting to receive {101}.
In current code, it receives {106} (100 + 1 payload + 5 pad) instead.
This patch avoids giving the user padding as payload by simply not
coalescing small packets (which fails the subtest; the same approach
and behavior as sw gro). This gains code simplicity at the cost of
more computation (passing an extra skb up the stack) for small packets
that could be coalesced.
The threshold is chosen as ETH_ZLEN + 2 * VLAN_HLEN. This is the largest
frame that may still contain minimum-frame padding (+ 2 VLAN tags), so
anything larger is safe to consider for coalesce. (We do not include
ETH_FCS_LEN in that threshold computation as netdev_fix_features()
drops NETIF_F_GRO_HW whenever NETIF_F_RXFCS is set, so retained FCS
can't reach this path.)
Fixes: 92552d3abd32 ("net/mlx5e: HW_GRO cqe handler implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Glenn Judd <gmj@meta.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260816064259.3279548-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -2263,6 +2263,11 @@ static void mlx5e_handle_rx_cqe_mpwrq_sh
data_offset = wqe_offset & (page_size - 1);
page_idx = wqe_offset >> rq->mpwqe.page_shift;
+ if (unlikely(cqe_bcnt <= ETH_ZLEN + 2 * VLAN_HLEN)) {
+ match = false;
+ flush = true;
+ }
+
if (*skb &&
!(match && mlx5e_hw_gro_skb_has_enough_space(*skb, data_bcnt,
page_size))) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 619/713] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 618/713] net/mlx5e: do not HW-GRO coalesce small frames Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 620/713] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Greg Kroah-Hartman
` (104 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sidraya Jayagond, Yehyeong Lee,
Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 2d1e7c5aaa3326e95e2058457f172ca99a9a4577 upstream.
On a link whose device has max_recv_sge == 1 there is no shared v2 receive
buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44
bytes past the start of the queue entry's inline message:
ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE);
The entry is a 72-byte allocation and the extension starts at offset 68, so
ext->num_rkeys at offset 94 is already past it. This happens on every
SMC-Rv2 link addition, whatever the peer sends:
[ 2.490065] BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.490431] Read of size 2 at addr ffff8880056406de by task smctest/106
[ 2.490709]
[ 2.490792] CPU: 0 UID: 0 PID: 106 Comm: smctest Not tainted 7.2.0-rc5-p1-g77a5d9d9c99f #32 PREEMPT(lazy)
[ 2.490795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 2.490798] Call Trace:
[ 2.490803] <TASK>
[ 2.490805] dump_stack_lvl+0x53/0x70
[ 2.490810] print_report+0xd0/0x630
[ 2.490828] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 2.490832] ? smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.490834] kasan_report+0xce/0x100
[ 2.490836] ? smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.490837] smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.490839] ? smcr_buf_map_lgr+0x1bf/0x2b0
[ 2.490844] smc_llc_cli_add_link+0xca7/0x1e80
[ 2.490848] ? smc_llc_wait+0x355/0x810
[ 2.490850] ? __pfx_smc_llc_wait+0x10/0x10
[ 2.490851] ? __pfx_smc_llc_cli_add_link+0x10/0x10
[ 2.490853] ? __pfx_autoremove_wake_function+0x10/0x10
[ 2.490863] __smc_connect+0x3f5c/0x4980
[ 2.490873] ? __pfx_kernel_connect+0x10/0x10
[ 2.490888] ? __pfx___smc_connect+0x10/0x10
[ 2.490891] ? release_sock+0x148/0x1d0
[ 2.490894] smc_connect+0x42c/0x580
[ 2.490896] __sys_connect+0xfc/0x130
[ 2.490898] ? __pfx___sys_connect+0x10/0x10
[ 2.490900] ? handle_mm_fault+0x1a1/0x430
[ 2.490908] __x64_sys_connect+0x6d/0xb0
[ 2.490909] ? fpregs_assert_state_consistent+0x56/0xe0
[ 2.490917] do_syscall_64+0xf9/0x540
[ 2.490921] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2.490924] RIP: 0033:0x421bb4
[ 2.490927] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d ad 34 09 00 00 74 13 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 55
[ 2.490929] RSP: 002b:00007ffd473b01a8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a
[ 2.490935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000421bb4
[ 2.490936] RDX: 0000000000000010 RSI: 00007ffd473b01d0 RDI: 0000000000000003
[ 2.490937] RBP: 0000000000003930 R08: 0000000000000004 R09: 0000000000000000
[ 2.490938] R10: 00007ffd473b0f98 R11: 0000000000000202 R12: 0000000000000006
[ 2.490939] R13: 00007ffd473b0f87 R14: 0000000000000003 R15: 00007ffd473b0f90
[ 2.490940] </TASK>
[ 2.490941]
[ 2.499545] Allocated by task 44:
[ 2.499693] kasan_save_stack+0x33/0x60
[ 2.499860] kasan_save_track+0x14/0x30
[ 2.500026] __kasan_kmalloc+0x8f/0xa0
[ 2.500190] __kmalloc_cache_noprof+0x158/0x370
[ 2.500393] smc_llc_enqueue+0x72/0x560
[ 2.500559] smc_wr_rx_tasklet_fn+0x474/0xa80
[ 2.500747] tasklet_action_common+0x20f/0x8a0
[ 2.500945] handle_softirqs+0x18e/0x590
[ 2.501115] do_softirq+0x3b/0x60
[ 2.501266] __local_bh_enable_ip+0x61/0x70
[ 2.501446] __alloc_skb+0x732/0x890
[ 2.501604] rxe_init_packet+0x16b/0x4f0
[ 2.501783] prepare_ack_packet+0xb8/0x830
[ 2.501962] rxe_receiver+0x495/0x96e0
[ 2.502125] do_work+0x144/0x470
[ 2.502269] process_one_work+0x633/0x1030
[ 2.502450] worker_thread+0x45b/0xd10
[ 2.502617] kthread+0x2c6/0x3b0
[ 2.502762] ret_from_fork+0x36e/0x5a0
[ 2.502925] ret_from_fork_asm+0x1a/0x30
[ 2.503103]
[ 2.503177] The buggy address belongs to the object at ffff888005640680
[ 2.503177] which belongs to the cache kmalloc-96 of size 96
[ 2.503692] The buggy address is located 22 bytes to the right of
[ 2.503692] allocated 72-byte region [ffff888005640680, ffff8880056406c8)
[ 2.504227]
[ 2.504300] The buggy address belongs to the physical page:
[ 2.504535] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5640
[ 2.504865] flags: 0x100000000000000(node=0|zone=1)
[ 2.505076] page_type: f5(slab)
[ 2.505221] raw: 0100000000000000 ffff888001041280 dead000000000122 0000000000000000
[ 2.505544] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 2.505867] page dumped because: kasan: bad access detected
[ 2.506102]
[ 2.506176] Memory state around the buggy address:
[ 2.506380] ffff888005640580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 2.506683] ffff888005640600: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 2.506987] >ffff888005640680: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 2.507291] ^
[ 2.507548] ffff888005640700: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 2.507850] ffff888005640780: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
Whatever that read finds then bounds the ext->rt[] loop, so a peer that
declares 255 rkeys reads much further. smc_llc_rmt_delete_rkey() has the
same shape for llcv2->rkey[].
Bound both loops by the buffer they read from, and skip the extension
altogether when there is no shared v2 receive buffer. The extension
does arrive on the link, but smc_llc_enqueue() copies only
sizeof(union smc_llc_msg) into the queue entry, so what that code read
past the 44 inline bytes was heap and not peer data.
Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1")
Cc: stable@vger.kernel.org
Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260819023306.644849-3-yhlee@isslab.korea.ac.kr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_llc.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -1000,13 +1000,21 @@ static void smc_llc_save_add_link_rkeys(
struct smc_link *link_new,
u8 *llc_msg)
{
+ const u32 rt_off = offsetof(struct smc_llc_msg_add_link_v2_ext, rt);
struct smc_llc_msg_add_link_v2_ext *ext;
struct smc_link_group *lgr = link->lgr;
int max, i;
+ /* Without a shared v2 receive buffer the extension is not copied
+ * into the queue entry, so not even ext->num_rkeys is there.
+ */
+ if (!smc_link_shared_v2_rxbuf(link))
+ return;
ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg +
SMC_WR_TX_SIZE);
max = min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2);
+ max = min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) /
+ sizeof(ext->rt[0]));
down_write(&lgr->rmbs_lock);
for (i = 0; i < max; i++) {
smc_rtoken_set(lgr, link->link_idx, link_new->link_idx,
@@ -1810,17 +1818,25 @@ static void smc_llc_rmt_delete_rkey(stru
link = qentry->link;
if (lgr->smc_version == SMC_V2) {
+ const u32 rkey_off =
+ offsetof(struct smc_llc_msg_delete_rkey_v2, rkey);
struct smc_llc_msg_delete_rkey_v2 *llcv2;
+ u32 buf_len;
if (smc_link_shared_v2_rxbuf(link)) {
memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc));
llcv2 = (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2;
+ buf_len = SMC_WR_BUF_V2_SIZE;
} else {
llcv2 = (struct smc_llc_msg_delete_rkey_v2 *)llc;
+ buf_len = sizeof(qentry->msg);
}
llcv2->num_inval_rkeys = 0;
max = min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2);
+ /* bound by the buffer llcv2 points at */
+ max = min_t(u32, max, (buf_len - rkey_off) /
+ sizeof(llcv2->rkey[0]));
for (i = 0; i < max; i++) {
if (smc_rtoken_delete(link, llcv2->rkey[i]))
llcv2->num_inval_rkeys++;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 620/713] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 619/713] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 621/713] net/smc: do not dereference an unset send buffer on the SMC-D teardown path Greg Kroah-Hartman
` (103 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, D. Wythe, Sidraya Jayagond,
Yehyeong Lee, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit 8d3c1ab82c11d4fadebf817a825fd221b3e197ea upstream.
smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part
of a v2 message that does not fit into the 44-byte union smc_llc_msg, and
both bound themselves by the size of the buffer it landed in, not by what
arrived. On a link with a shared v2 receive buffer a 44-byte
DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an
earlier message left in lgr->wr_rx_buf_v2, and passes each of them to
smc_rtoken_delete(). One of those 255 matched a registered rtoken and
deleted it. An ADD_LINK on such a link installs up to 255 rtokens from
the same bytes.
Copy the tail into the queue entry, so its length is the length of the
message that arrived, and declare the rkeys that fit inline as a member of
the union instead of reaching them through a cast. The same
DELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited
to the longest tail the two functions can read, so the peer does not pick
the size of the entry.
The bound the previous patch placed on links without a shared v2 receive
buffer is no longer needed.
Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1")
Cc: stable@vger.kernel.org
Suggested-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260819023306.644849-4-yhlee@isslab.korea.ac.kr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_llc.c | 125 ++++++++++++++++++++++++++++++++++++++----------------
net/smc/smc_wr.c | 6 +-
2 files changed, 91 insertions(+), 40 deletions(-)
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -157,6 +157,7 @@ struct smc_llc_msg_confirm_rkey { /* typ
};
#define SMC_LLC_DEL_RKEY_MAX 8
+#define SMC_LLC_DEL_RKEY_V2_INLINE 9
#define SMC_LLC_FLAG_RKEY_RETRY 0x10
#define SMC_LLC_FLAG_RKEY_NEG 0x20
@@ -177,6 +178,15 @@ struct smc_llc_msg_delete_rkey_v2 { /* t
__be32 rkey[];
};
+/* the leading rkeys of a DELETE_RKEY_V2 fit into union smc_llc_msg */
+struct smc_llc_msg_delete_rkey_v2_inline { /* type 0x29 */
+ struct smc_llc_hdr hd;
+ u8 num_rkeys;
+ u8 num_inval_rkeys;
+ u8 reserved[2];
+ __be32 rkey[SMC_LLC_DEL_RKEY_V2_INLINE];
+};
+
union smc_llc_msg {
struct smc_llc_msg_confirm_link confirm_link;
struct smc_llc_msg_add_link add_link;
@@ -186,6 +196,7 @@ union smc_llc_msg {
struct smc_llc_msg_confirm_rkey confirm_rkey;
struct smc_llc_msg_delete_rkey delete_rkey;
+ struct smc_llc_msg_delete_rkey_v2_inline delete_rkey_v2;
struct smc_llc_msg_test_link test_link;
struct {
@@ -194,15 +205,25 @@ union smc_llc_msg {
} raw;
};
+static_assert(SMC_LLC_DEL_RKEY_V2_INLINE ==
+ (sizeof(union smc_llc_msg) -
+ offsetof(struct smc_llc_msg_delete_rkey_v2, rkey)) /
+ sizeof(__be32));
+static_assert(offsetof(struct smc_llc_msg_delete_rkey_v2_inline, rkey) ==
+ offsetof(struct smc_llc_msg_delete_rkey_v2, rkey));
+
#define SMC_LLC_FLAG_RESP 0x80
struct smc_llc_qentry {
struct list_head list;
struct smc_link *link;
+ u16 body_len;
union smc_llc_msg msg;
+ u8 body[] __counted_by(body_len);
};
-static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc);
+static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc,
+ u32 byte_len);
struct smc_llc_qentry *smc_llc_flow_qentry_clr(struct smc_llc_flow *flow)
{
@@ -998,22 +1019,19 @@ static int smc_llc_cli_conf_link(struct
static void smc_llc_save_add_link_rkeys(struct smc_link *link,
struct smc_link *link_new,
- u8 *llc_msg)
+ struct smc_llc_qentry *qentry)
{
const u32 rt_off = offsetof(struct smc_llc_msg_add_link_v2_ext, rt);
struct smc_llc_msg_add_link_v2_ext *ext;
struct smc_link_group *lgr = link->lgr;
int max, i;
- /* Without a shared v2 receive buffer the extension is not copied
- * into the queue entry, so not even ext->num_rkeys is there.
- */
- if (!smc_link_shared_v2_rxbuf(link))
+ /* the rkey count itself is only there if enough bytes arrived */
+ if (qentry->body_len < rt_off)
return;
- ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg +
- SMC_WR_TX_SIZE);
+ ext = (struct smc_llc_msg_add_link_v2_ext *)qentry->body;
max = min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2);
- max = min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) /
+ max = min_t(u32, max, (qentry->body_len - rt_off) /
sizeof(ext->rt[0]));
down_write(&lgr->rmbs_lock);
for (i = 0; i < max; i++) {
@@ -1107,9 +1125,7 @@ int smc_llc_cli_add_link(struct smc_link
if (rc)
goto out_clear_lnk;
if (lgr->smc_version == SMC_V2) {
- u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?
- (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc;
- smc_llc_save_add_link_rkeys(link, lnk_new, llc_msg);
+ smc_llc_save_add_link_rkeys(link, lnk_new, qentry);
} else {
rc = smc_llc_cli_rkey_exchange(link, lnk_new);
if (rc) {
@@ -1509,9 +1525,7 @@ int smc_llc_srv_add_link(struct smc_link
if (rc)
goto out_err;
if (lgr->smc_version == SMC_V2) {
- u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?
- (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc;
- smc_llc_save_add_link_rkeys(link, link_new, llc_msg);
+ smc_llc_save_add_link_rkeys(link, link_new, qentry);
} else {
rc = smc_llc_srv_rkey_exchange(link, link_new);
if (rc)
@@ -1560,7 +1574,8 @@ void smc_llc_add_link_local(struct smc_l
add_llc.hd.common.llc_type = SMC_LLC_ADD_LINK;
smc_llc_init_msg_hdr(&add_llc.hd, link->lgr, sizeof(add_llc));
/* no dev and port needed */
- smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc);
+ smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc,
+ sizeof(union smc_llc_msg));
}
/* worker to process an add link message */
@@ -1596,7 +1611,8 @@ void smc_llc_srv_delete_link_local(struc
del_llc.link_num = del_link_id;
del_llc.reason = htonl(SMC_LLC_DEL_LOST_PATH);
del_llc.hd.flags |= SMC_LLC_FLAG_DEL_LINK_ORDERLY;
- smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc);
+ smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc,
+ sizeof(union smc_llc_msg));
}
static void smc_llc_process_cli_delete_link(struct smc_link_group *lgr)
@@ -1818,27 +1834,28 @@ static void smc_llc_rmt_delete_rkey(stru
link = qentry->link;
if (lgr->smc_version == SMC_V2) {
- const u32 rkey_off =
- offsetof(struct smc_llc_msg_delete_rkey_v2, rkey);
- struct smc_llc_msg_delete_rkey_v2 *llcv2;
- u32 buf_len;
-
- if (smc_link_shared_v2_rxbuf(link)) {
- memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc));
- llcv2 = (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2;
- buf_len = SMC_WR_BUF_V2_SIZE;
- } else {
- llcv2 = (struct smc_llc_msg_delete_rkey_v2 *)llc;
- buf_len = sizeof(qentry->msg);
- }
+ struct smc_llc_msg_delete_rkey_v2_inline *llcv2;
+
+ /* The leading SMC_LLC_DEL_RKEY_V2_INLINE rkeys are declared in
+ * the message itself, any further ones were received into
+ * qentry->body.
+ */
+ llcv2 = &qentry->msg.delete_rkey_v2;
llcv2->num_inval_rkeys = 0;
max = min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2);
- /* bound by the buffer llcv2 points at */
- max = min_t(u32, max, (buf_len - rkey_off) /
- sizeof(llcv2->rkey[0]));
+ max = min_t(u32, max, SMC_LLC_DEL_RKEY_V2_INLINE +
+ qentry->body_len / sizeof(__be32));
for (i = 0; i < max; i++) {
- if (smc_rtoken_delete(link, llcv2->rkey[i]))
+ __be32 rkey;
+
+ if (i < SMC_LLC_DEL_RKEY_V2_INLINE)
+ rkey = llcv2->rkey[i];
+ else
+ memcpy(&rkey, qentry->body +
+ (i - SMC_LLC_DEL_RKEY_V2_INLINE) *
+ sizeof(rkey), sizeof(rkey));
+ if (smc_rtoken_delete(link, rkey))
llcv2->num_inval_rkeys++;
}
memset(&llc->rkey[0], 0, sizeof(llc->rkey));
@@ -2080,18 +2097,52 @@ assign:
wake_up(&link->lgr->llc_msg_waiter);
}
-static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc)
+/* the longest tail either reader of qentry->body can use */
+static u32 smc_llc_max_body_len(union smc_llc_msg *llc)
+{
+ switch (llc->raw.hdr.common.llc_type) {
+ case SMC_LLC_ADD_LINK:
+ return offsetof(struct smc_llc_msg_add_link_v2_ext, rt) +
+ SMC_LLC_RKEYS_PER_MSG_V2 *
+ sizeof(struct smc_llc_msg_add_link_cont_rt);
+ case SMC_LLC_DELETE_RKEY:
+ return (SMC_LLC_RKEYS_PER_MSG_V2 -
+ SMC_LLC_DEL_RKEY_V2_INLINE) * sizeof(__be32);
+ default:
+ return 0;
+ }
+}
+
+static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc,
+ u32 byte_len)
{
struct smc_link_group *lgr = link->lgr;
struct smc_llc_qentry *qentry;
unsigned long flags;
+ u16 body_len = 0;
+
+ /* V2 messages can be longer than the inline union smc_llc_msg. Carry
+ * the remainder in the qentry itself, so that its lifetime and its
+ * length match the message the peer actually sent.
+ */
+ if (lgr->smc_version == SMC_V2 && byte_len > SMC_WR_TX_SIZE)
+ body_len = min_t(u32, byte_len, SMC_WR_BUF_V2_SIZE) -
+ SMC_WR_TX_SIZE;
+ body_len = min_t(u32, body_len, smc_llc_max_body_len(llc));
- qentry = kmalloc_obj(*qentry, GFP_ATOMIC);
+ qentry = kmalloc_flex(*qentry, body, body_len, GFP_ATOMIC);
if (!qentry)
return;
+ qentry->body_len = body_len;
qentry->link = link;
INIT_LIST_HEAD(&qentry->list);
memcpy(&qentry->msg, llc, sizeof(union smc_llc_msg));
+ if (body_len) {
+ u8 *src = smc_link_shared_v2_rxbuf(link) ?
+ (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc;
+
+ memcpy(qentry->body, src + SMC_WR_TX_SIZE, body_len);
+ }
/* process responses immediately */
if ((llc->raw.hdr.flags & SMC_LLC_FLAG_RESP) &&
@@ -2123,7 +2174,7 @@ static void smc_llc_rx_handler(struct ib
return; /* invalid message */
}
- smc_llc_enqueue(link, llc);
+ smc_llc_enqueue(link, llc, wc->byte_len);
}
/***************************** worker, utils *********************************/
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -602,9 +602,9 @@ static void smc_wr_init_sge(struct smc_l
/* With SMC-Rv2 there can be messages larger than SMC_WR_TX_SIZE.
* Each ib_recv_wr gets 2 sges, the second one is a spillover buffer
- * and the same buffer for all sges. When a larger message arrived then
- * the content of the first small sge is copied to the beginning of
- * the larger spillover buffer, allowing easy data mapping.
+ * and the same buffer for all sges. The spillover sge starts at
+ * SMC_WR_TX_SIZE, so the leading bytes of that buffer are never
+ * written.
*/
for (i = 0; i < lnk->wr_rx_cnt; i++) {
int x = i * lnk->wr_rx_sge_cnt;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 621/713] net/smc: do not dereference an unset send buffer on the SMC-D teardown path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 620/713] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 622/713] net/smc: fix socket refcount leak in smc_switch_conns() Greg Kroah-Hartman
` (102 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Sidraya Jayagond,
Tony Lu, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit b395dd319cea422239cb45b998fb38d7e373af87 upstream.
smc_close_stream_wait() calls smc_tx_prepared_sends() from inside its
sk_wait_event() condition, and sk_wait_event() evaluates that condition
once with the socket lock released. smcd_buf_detach() clears
conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group
terminating while a socket waits there leaves the helper dereferencing
NULL, faulting out of close(). SIOCOUTQ reads the field by hand, and
smc_close_cancel_work() drops the lock across two cancel_*_sync() calls.
Sample the pointer once in the helper, report nothing prepared while it is
unset, and bound the ioctl the same way. The receive tasklet dereferences
the field directly in smc_cdc_msg_recv_action(), not through this helper;
1/2 is what keeps it from running that late.
Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Link: https://patch.msgid.link/20260808-b4-disp-22f119e6-v2-2-61647601a6f3@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/af_smc.c | 3 ++-
net/smc/smc_tx.h | 6 +++++-
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -3233,7 +3233,8 @@ int smc_ioctl(struct socket *sock, unsig
return -EINVAL;
}
if (smc->sk.sk_state == SMC_INIT ||
- smc->sk.sk_state == SMC_CLOSED)
+ smc->sk.sk_state == SMC_CLOSED ||
+ !READ_ONCE(smc->conn.sndbuf_desc))
answ = 0;
else
answ = smc->conn.sndbuf_desc->len -
--- a/net/smc/smc_tx.h
+++ b/net/smc/smc_tx.h
@@ -20,11 +20,15 @@
static inline int smc_tx_prepared_sends(struct smc_connection *conn)
{
+ struct smc_buf_desc *sndbuf_desc = READ_ONCE(conn->sndbuf_desc);
union smc_host_cursor sent, prep;
+ if (!sndbuf_desc)
+ return 0;
+
smc_curs_copy(&sent, &conn->tx_curs_sent, conn);
smc_curs_copy(&prep, &conn->tx_curs_prep, conn);
- return smc_curs_diff(conn->sndbuf_desc->len, &sent, &prep);
+ return smc_curs_diff(sndbuf_desc->len, &sent, &prep);
}
void smc_tx_pending(struct smc_connection *conn);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 622/713] net/smc: fix socket refcount leak in smc_switch_conns()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 621/713] net/smc: do not dereference an unset send buffer on the SMC-D teardown path Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 623/713] net/smc: fix use-after-free in smc_rx_pipe_buf_release() Greg Kroah-Hartman
` (101 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahanta Jambigi, Breno Leitao,
Hidayath Khan, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidayath Khan <hidayath@linux.ibm.com>
commit 719296c4aa8213d4ac8002e77d5956d436bc98d0 upstream.
smc_switch_conns() takes a reference on the SMC socket before dropping
lgr->conns_lock, so the connection stays alive while the CDC slot is
fetched:
sock_hold(&smc->sk);
read_unlock_bh(&lgr->conns_lock);
/* pre-fetch buffer outside of send_lock, might sleep */
rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
if (rc)
goto err_out;
The err_out label only drops the wr_tx link reference, so this early exit
returns without the matching sock_put(). The second error exit is not
affected, because sock_put() has already run by then.
A leaked sk_refcnt means the smc_sock is never destroyed. Its send and
receive buffers stay allocated, and for a user socket the reference held
on the network namespace is never released, so the netns can no longer be
torn down.
smc_cdc_get_free_slot() fails when the target link goes down or when the
connection has been killed while the switch is in progress. Both are
reachable during the link failover this function implements, so the leak
is triggered by the same hardware events that make smc_switch_conns() run
in the first place.
Restructure so there is a single sock_put() covering both outcomes,
instead of adding a second one to the error path.
Fixes: 95f7f3e7dc6b ("net/smc: improved fix wait on already cleared link")
Cc: stable@vger.kernel.org
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Link: https://patch.msgid.link/20260820144729.1019399-1-hidayath@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_core.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1148,13 +1148,13 @@ again:
read_unlock_bh(&lgr->conns_lock);
/* pre-fetch buffer outside of send_lock, might sleep */
rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
- if (rc)
- goto err_out;
- /* avoid race with smcr_tx_sndbuf_nonempty() */
- spin_lock_bh(&conn->send_lock);
- smc_switch_link_and_count(conn, to_lnk);
- rc = smc_switch_cursor(smc, pend, wr_buf);
- spin_unlock_bh(&conn->send_lock);
+ if (!rc) {
+ /* avoid race with smcr_tx_sndbuf_nonempty() */
+ spin_lock_bh(&conn->send_lock);
+ smc_switch_link_and_count(conn, to_lnk);
+ rc = smc_switch_cursor(smc, pend, wr_buf);
+ spin_unlock_bh(&conn->send_lock);
+ }
sock_put(&smc->sk);
if (rc)
goto err_out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 623/713] net/smc: fix use-after-free in smc_rx_pipe_buf_release()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 622/713] net/smc: fix socket refcount leak in smc_switch_conns() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 624/713] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Greg Kroah-Hartman
` (100 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahanta Jambigi, Hidayath Khan,
Simon Horman, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidayath Khan <hidayath@linux.ibm.com>
commit c924884743e948e25625b7fbf3ee2a9325a204a7 upstream.
smc_rx_splice() hands RMB pages to a pipe and takes a socket reference
per entry so the smc_sock stays alive until the reader finishes. The
connection does not: a concurrent close runs smc_conn_free(), which
releases the receive buffer back to the link group pool.
smc_rx_pipe_buf_release() tests sk_state before taking the socket lock.
The state can change between the test and the lock, and
smc_rx_update_cons() then dereferences conn->rmb_desc and walks
conn->lgr, which smc_conn_free() has already released. On the
is_reg_err path smcr_buf_unuse() frees the descriptor outright, so
this is a use-after-free.
Take the socket lock first and test conn->freed instead.
smc_conn_free() sets that flag before releasing anything, and every
caller holds the socket lock. The two paths exclude each other: either
the pipe release runs first with everything valid, or it sees the flag
and skips the update.
Fixes: 9014db202cb7 ("smc: add support for splice()")
Cc: stable@vger.kernel.org
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260820074642.966856-3-hidayath@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_rx.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -115,16 +115,15 @@ static void smc_rx_pipe_buf_release(stru
struct pipe_buffer *buf)
{
struct smc_spd_priv *priv = (struct smc_spd_priv *)buf->private;
+ struct smc_connection *conn = &priv->smc->conn;
struct smc_sock *smc = priv->smc;
- struct smc_connection *conn;
struct sock *sk = &smc->sk;
- if (sk->sk_state == SMC_CLOSED ||
- sk->sk_state == SMC_PEERFINCLOSEWAIT ||
- sk->sk_state == SMC_APPFINCLOSEWAIT)
- goto out;
- conn = &smc->conn;
lock_sock(sk);
+ if (conn->freed) {
+ release_sock(sk);
+ goto out;
+ }
smc_rx_update_cons(smc, priv->len);
release_sock(sk);
if (atomic_sub_and_test(priv->len, &conn->splice_pending))
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 624/713] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 623/713] net/smc: fix use-after-free in smc_rx_pipe_buf_release() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 625/713] net/smc: stop killed, freed and out_of_sync sharing a byte Greg Kroah-Hartman
` (99 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sidraya Jayagond, Yehyeong Lee,
Breno Leitao, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit a42a459ef0e54cb0c4b3e43e21cb0e658e664f64 upstream.
smc_llc_srv_add_link() keeps add_llc pointing into the queue entry:
add_llc = &qentry->msg.add_link; smc_llc.c:1482
...
smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494
smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495
...
u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?
(u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; smc_llc.c:1504
smc_llc_save_add_link_rkeys(link, link_new, llc_msg); smc_llc.c:1506
smc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared
v2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is
already freed. Before the Fixes: commit that branch always used
lgr->wr_rx_buf_v2 and add_llc was not used after the free.
Reproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot
and a link forced to max_recv_sge == 1: the entry is freed and read by
the same call, and the freeing frame is smc_llc_srv_add_link() itself.
[ 2.523161] BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11
[ 2.523789]
[ 2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy)
[ 2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 2.523866] Workqueue: smc_hs_wq smc_listen_work
[ 2.523869] Call Trace:
[ 2.523870] <TASK>
[ 2.523871] dump_stack_lvl+0x53/0x70
[ 2.523872] print_report+0xd0/0x630
[ 2.523874] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 2.523876] ? smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.523878] kasan_report+0xce/0x100
[ 2.523879] ? smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350
[ 2.523883] ? smcr_buf_reg_lgr+0x2a4/0x660
[ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50
[ 2.523888] ? _printk+0xba/0xf0
[ 2.523897] ? __pfx_smc_llc_srv_add_link+0x10/0x10
[ 2.523899] ? down_write+0xb0/0x130
[ 2.523903] ? __pfx_down_write+0x10/0x10
[ 2.523905] smc_listen_work+0x489e/0x4d00
[ 2.523907] ? kmem_cache_free+0x1c6/0x3a0
[ 2.523911] ? __pfx_smc_listen_work+0x10/0x10
[ 2.523913] ? release_sock+0x148/0x1d0
[ 2.523915] ? smc_tcp_listen_work+0xb4f/0xfc0
[ 2.523917] ? _raw_spin_lock_irq+0x80/0xe0
[ 2.523918] ? __pfx__raw_spin_lock_irq+0x10/0x10
[ 2.523920] process_one_work+0x633/0x1030
[ 2.523922] ? assign_work+0x11d/0x370
[ 2.523924] worker_thread+0x45b/0xd10
[ 2.523926] ? __pfx_worker_thread+0x10/0x10
[ 2.523928] ? __pfx_worker_thread+0x10/0x10
[ 2.523929] kthread+0x2c6/0x3b0
[ 2.523931] ? recalc_sigpending+0x15c/0x1e0
[ 2.523934] ? __pfx_kthread+0x10/0x10
[ 2.523935] ret_from_fork+0x36e/0x5a0
[ 2.523937] ? __pfx_ret_from_fork+0x10/0x10
[ 2.523938] ? __switch_to+0x572/0xdd0
[ 2.523943] ? __pfx_kthread+0x10/0x10
[ 2.523944] ret_from_fork_asm+0x1a/0x30
[ 2.523947] </TASK>
[ 2.523948]
[ 2.531253] Allocated by task 48:
[ 2.531399] kasan_save_stack+0x33/0x60
[ 2.531570] kasan_save_track+0x14/0x30
[ 2.531737] __kasan_kmalloc+0x8f/0xa0
[ 2.531905] __kmalloc_cache_noprof+0x158/0x370
[ 2.532100] smc_llc_enqueue+0x72/0x560
[ 2.532268] smc_wr_rx_tasklet_fn+0x474/0xa80
[ 2.532491] tasklet_action_common+0x20f/0x8a0
[ 2.532714] handle_softirqs+0x18e/0x590
[ 2.532886] do_softirq+0x3b/0x60
[ 2.533036] __local_bh_enable_ip+0x61/0x70
[ 2.533221] __alloc_skb+0x732/0x890
[ 2.533384] rxe_init_packet+0x16b/0x4f0
[ 2.533567] prepare_ack_packet+0xb8/0x830
[ 2.533760] rxe_receiver+0x495/0x96e0
[ 2.533933] do_work+0x144/0x470
[ 2.534078] process_one_work+0x633/0x1030
[ 2.534257] worker_thread+0x45b/0xd10
[ 2.534424] kthread+0x2c6/0x3b0
[ 2.534569] ret_from_fork+0x36e/0x5a0
[ 2.534737] ret_from_fork_asm+0x1a/0x30
[ 2.534907]
[ 2.534980] Freed by task 11:
[ 2.535112] kasan_save_stack+0x33/0x60
[ 2.535279] kasan_save_track+0x14/0x30
[ 2.535444] kasan_save_free_info+0x3b/0x60
[ 2.535625] __kasan_slab_free+0x43/0x70
[ 2.535798] kfree+0x121/0x380
[ 2.535935] smc_llc_srv_add_link+0x9a8/0x1e50
[ 2.536128] smc_listen_work+0x489e/0x4d00
[ 2.536305] process_one_work+0x633/0x1030
[ 2.536482] worker_thread+0x45b/0xd10
[ 2.536652] kthread+0x2c6/0x3b0
[ 2.536794] ret_from_fork+0x36e/0x5a0
[ 2.536958] ret_from_fork_asm+0x1a/0x30
[ 2.537133]
[ 2.537205] The buggy address belongs to the object at ffff888005219480
[ 2.537205] which belongs to the cache kmalloc-96 of size 96
[ 2.537719] The buggy address is located 94 bytes inside of
[ 2.537719] freed 96-byte region [ffff888005219480, ffff8880052194e0)
[ 2.538216]
[ 2.538289] The buggy address belongs to the physical page:
[ 2.538524] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5219
[ 2.538857] flags: 0x100000000000000(node=0|zone=1)
[ 2.539066] page_type: f5(slab)
[ 2.539210] raw: 0100000000000000 ffff888001041280 dead000000000122 0000000000000000
[ 2.539534] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 2.539863] page dumped because: kasan: bad access detected
[ 2.540098]
[ 2.540170] Memory state around the buggy address:
[ 2.540379] ffff888005219380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2.540684] ffff888005219400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2.540988] >ffff888005219480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 2.541291] ^
[ 2.541548] ffff888005219500: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 2.541857] ffff888005219580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
The offset is past the 72-byte queue entry because the out-of-bounds read
fixed by the next patch is on the same line; what this patch removes is the
free at smc_llc_srv_add_link+0x9a8 happening before the read at +0xaa2.
Detach the entry instead of freeing it there, and free it at the single
exit label. The reject path has to detach as well, otherwise it would be
freed twice.
This changes only the lifetime of the entry. The same read still runs past
its end until the next two patches bound it, so a backport wants all three.
Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1")
Cc: stable@vger.kernel.org
Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260819023306.644849-2-yhlee@isslab.korea.ac.kr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_llc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -1505,7 +1505,7 @@ int smc_llc_srv_add_link(struct smc_link
}
add_llc = &qentry->msg.add_link;
if (add_llc->hd.flags & SMC_LLC_FLAG_ADD_LNK_REJ) {
- smc_llc_flow_qentry_del(&lgr->llc_flow_lcl);
+ smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl);
rc = -ENOLINK;
goto out_err;
}
@@ -1516,7 +1516,8 @@ int smc_llc_srv_add_link(struct smc_link
lgr_new_t = SMC_LGR_ASYMMETRIC_PEER;
}
smc_llc_save_add_link_info(link_new, add_llc);
- smc_llc_flow_qentry_del(&lgr->llc_flow_lcl);
+ /* add_llc still points into qentry, so only detach it here */
+ smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl);
rc = smc_ib_ready_link(link_new);
if (rc)
@@ -1534,14 +1535,14 @@ int smc_llc_srv_add_link(struct smc_link
rc = smc_llc_srv_conf_link(link, link_new, lgr_new_t);
if (rc)
goto out_err;
- kfree(ini);
- return 0;
+ goto out;
out_err:
if (link_new) {
link_new->state = SMC_LNK_INACTIVE;
smcr_link_clear(link_new, false);
}
out:
+ kfree(qentry);
kfree(ini);
if (send_req_add_link_resp)
smc_llc_send_req_add_link_response(req_qentry);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 625/713] net/smc: stop killed, freed and out_of_sync sharing a byte
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 624/713] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 626/713] net/smc: unregister the connection before draining the rx tasklet Greg Kroah-Hartman
` (98 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahanta Jambigi, Hidayath Khan,
Simon Horman, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidayath Khan <hidayath@linux.ibm.com>
commit db51a8658c11a82432b64999519a269c3aabb447 upstream.
The three connection state flags are single-bit bitfields, so they occupy
one byte of struct smc_connection and every store to one is a
read-modify-write of the other two:
u8 killed : 1;
u8 freed : 1;
u8 out_of_sync : 1;
They are not written under a common lock. smc_cdc_msg_validate() sets
out_of_sync from the receive tasklet, while smc_conn_kill() sets killed
from process context under lock_sock(), and the receive path does not defer
to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only
bh_lock_sock().
Give each flag its own byte so a store no longer touches its neighbours.
All readers test them as booleans and are unchanged. struct smc_connection
grows by two bytes.
Fixes: b286a0651e44 ("net/smc: handle incoming CDC validation message")
Cc: stable@vger.kernel.org
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260820074642.966856-2-hidayath@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -277,9 +277,9 @@ struct smc_connection {
* 0 for SMC-R, 32 for SMC-D
*/
u64 peer_token; /* SMC-D token of peer */
- u8 killed : 1; /* abnormal termination */
- u8 freed : 1; /* normal termination */
- u8 out_of_sync : 1; /* out of sync with peer */
+ u8 killed; /* abnormal termination */
+ u8 freed; /* normal termination */
+ u8 out_of_sync; /* out of sync with peer */
};
struct smc_sock { /* smc sock container */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 626/713] net/smc: unregister the connection before draining the rx tasklet
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 625/713] net/smc: stop killed, freed and out_of_sync sharing a byte Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 627/713] net: cap advertised IP tunnel headroom Greg Kroah-Hartman
` (97 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Sidraya Jayagond,
Tony Lu, Jakub Kicinski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 36cdf5d48ca191dcd71c28cadbe0981b1d25318d upstream.
smc_conn_free() calls smc_ism_unset_conn() only while the link group is
still on its device list, and never sets conn->killed.
smc_lgr_terminate_sched() unlinks the group immediately and defers killing
its connections to a work item, so a connection freed in that window keeps
its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the
device can re-arm the receive tasklet after tasklet_kill() has returned. On
the DMB-nocopy path the ghost send buffer is freed right after that drain,
so the re-armed tasklet dereferences it.
Unregister unconditionally and drain before the detach at both teardown
sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.
Clear conn->sndbuf_desc before freeing it as well, so a reader that samples
the pointer cannot get one that is already freed.
Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Link: https://patch.msgid.link/20260808-b4-disp-22f119e6-v2-1-61647601a6f3@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_core.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1209,14 +1209,16 @@ static void smcd_buf_detach(struct smc_c
{
struct smcd_dev *smcd = conn->lgr->smcd;
u64 peer_token = conn->peer_token;
+ struct smc_buf_desc *buf_desc;
if (!conn->sndbuf_desc)
return;
smc_ism_detach_dmb(smcd, peer_token);
- kfree(conn->sndbuf_desc);
+ buf_desc = conn->sndbuf_desc;
conn->sndbuf_desc = NULL;
+ kfree(buf_desc);
}
static void smc_buf_unuse(struct smc_connection *conn,
@@ -1268,11 +1270,10 @@ void smc_conn_free(struct smc_connection
goto lgr_put;
if (lgr->is_smcd) {
- if (!list_empty(&lgr->list))
- smc_ism_unset_conn(conn);
+ smc_ism_unset_conn(conn);
+ tasklet_kill(&conn->rx_tsklet);
if (smc_ism_support_dmb_nocopy(lgr->smcd))
smcd_buf_detach(conn);
- tasklet_kill(&conn->rx_tsklet);
} else {
smc_cdc_wait_pend_tx_wr(conn);
if (current_work() != &conn->abort_work)
@@ -1525,12 +1526,12 @@ static void smc_conn_kill(struct smc_con
smc_sk_wake_ups(smc);
if (conn->lgr->is_smcd) {
smc_ism_unset_conn(conn);
- if (smc_ism_support_dmb_nocopy(conn->lgr->smcd))
- smcd_buf_detach(conn);
if (soft)
tasklet_kill(&conn->rx_tsklet);
else
tasklet_unlock_wait(&conn->rx_tsklet);
+ if (smc_ism_support_dmb_nocopy(conn->lgr->smcd))
+ smcd_buf_detach(conn);
} else {
smc_cdc_wait_pend_tx_wr(conn);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 627/713] net: cap advertised IP tunnel headroom
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 626/713] net/smc: unregister the connection before draining the rx tasklet Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 628/713] net: fix spurious TX timeout after dev_activate() Greg Kroah-Hartman
` (96 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Zhiling Zou, Ido Schimmel,
Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 6b222adeb9340306e2ff97127c76117abb9b3df8 upstream.
IP tunnel devices derive their advertised needed_headroom from lower
output devices. A stack of user-created devices can make the derived
value larger than the 16-bit skb header offsets can represent. Once IP
output reserves it, skb head expansion can wrap those offsets.
The runtime transmit path already caps a growing needed_headroom at 512.
Apply the same cap when tunnel configuration publishes needed_headroom
derived from a lower output device.
Capping the advertised value is safe: IP tunnel transmit still expands
the skb when a packet needs more headroom. A nonsensical stacked
configuration can therefore incur an extra reallocation, but it cannot
publish an unbounded reservation to upper layers.
Fixes: 1a37e412a022 ("net: Use 16bits for *_headers fields of struct skbuff")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/ba04a1fd6bfae2377607fad5d8f80f7eb80fd4c4.1786542637.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ip_tunnels.h | 11 +++++++++--
net/ipv4/ip_tunnel.c | 2 +-
net/ipv6/ip6_gre.c | 7 +++++--
net/ipv6/ip6_tunnel.c | 7 +++++--
net/ipv6/sit.c | 2 +-
5 files changed, 21 insertions(+), 8 deletions(-)
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -629,8 +629,7 @@ struct metadata_dst *iptunnel_metadata_r
int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
int headroom, bool reply);
-static inline void ip_tunnel_adj_headroom(struct net_device *dev,
- unsigned int headroom)
+static inline unsigned int ip_tunnel_limit_headroom(unsigned int headroom)
{
/* we must cap headroom to some upperlimit, else pskb_expand_head
* will overflow header offsets in skb_headers_offset_update().
@@ -640,6 +639,14 @@ static inline void ip_tunnel_adj_headroo
if (headroom > max_allowed)
headroom = max_allowed;
+ return headroom;
+}
+
+static inline void ip_tunnel_adj_headroom(struct net_device *dev,
+ unsigned int headroom)
+{
+ headroom = ip_tunnel_limit_headroom(headroom);
+
if (headroom > READ_ONCE(dev->needed_headroom))
WRITE_ONCE(dev->needed_headroom, headroom);
}
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -317,7 +317,7 @@ static int ip_tunnel_bind_dev(struct net
mtu = min(tdev->mtu, IP_MAX_MTU);
}
- dev->needed_headroom = t_hlen + hlen;
+ dev->needed_headroom = ip_tunnel_limit_headroom(t_hlen + hlen);
mtu -= t_hlen + (dev->type == ARPHRD_ETHER ? dev->hard_header_len : 0);
if (mtu < IPV4_MIN_MTU)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1137,8 +1137,11 @@ static void ip6gre_tnl_link_config_route
return;
if (rt->dst.dev) {
- dev->needed_headroom = rt->dst.dev->hard_header_len +
- t_hlen;
+ unsigned int headroom;
+
+ headroom = rt->dst.dev->hard_header_len + t_hlen;
+ headroom = ip_tunnel_limit_headroom(headroom);
+ dev->needed_headroom = headroom;
if (set_mtu) {
int mtu = rt->dst.dev->mtu - t_hlen;
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1514,8 +1514,11 @@ static void ip6_tnl_link_config(struct i
tdev = __dev_get_by_index(t->net, p->link);
if (tdev) {
- dev->needed_headroom = tdev->hard_header_len +
- tdev->needed_headroom + t_hlen;
+ unsigned int headroom;
+
+ headroom = tdev->hard_header_len + tdev->needed_headroom;
+ headroom += t_hlen;
+ dev->needed_headroom = ip_tunnel_limit_headroom(headroom);
mtu = min_t(unsigned int, tdev->mtu, IP6_MAX_MTU);
mtu = mtu - t_hlen;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1131,7 +1131,7 @@ static void ipip6_tunnel_bind_dev(struct
WRITE_ONCE(dev->mtu, mtu);
hlen = tdev->hard_header_len + tdev->needed_headroom;
}
- dev->needed_headroom = t_hlen + hlen;
+ dev->needed_headroom = ip_tunnel_limit_headroom(t_hlen + hlen);
}
static void ipip6_tunnel_update(struct ip_tunnel *t,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 628/713] net: fix spurious TX timeout after dev_activate()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 627/713] net: cap advertised IP tunnel headroom Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 629/713] net: skbuff: dont touch shared zerocopy state in skb_tx_error() Greg Kroah-Hartman
` (95 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Nicolai Buchwitz,
Jason Xing, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 82aeed2400786bd3f79d88cb8b8f42e6127e5923 upstream.
While debugging another issue today, I found out that my TX queue is
reported as stopped for 4294907392 ms (49.7 days), on a machine that
had been up for four minutes.
bnxt_en 0002:01:00.0 eth0: NETDEV WATCHDOG: CPU: 28: transmit queue 23 timed out 4294907392 ms
4294907392 is not an elapsed time. It is the value of jiffies at that
moment: INITIAL_JIFFIES is 4294667296, which leaves jiffies 59 seconds
short of wrapping.
dev_activate() runs transition_one_qdisc() over every TX queue, which
resets trans_start to 0, and then stamps only queue 0 through
netif_trans_update().
Stamp jiffies instead. A queue stopped across dev_activate() now gets a
full watchdog_timeo of grace, and is still reported if it is stopped
that long.
Fixes: 9b36627acecd ("net: remove dev->trans_start")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://patch.msgid.link/20260825-trans_start-v2-1-286b4d6d70cb@debian.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_generic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -1278,7 +1278,7 @@ static void transition_one_qdisc(struct
rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
if (need_watchdog_p) {
- WRITE_ONCE(dev_queue->trans_start, 0);
+ WRITE_ONCE(dev_queue->trans_start, jiffies);
*need_watchdog_p = 1;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 629/713] net: skbuff: dont touch shared zerocopy state in skb_tx_error()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 628/713] net: fix spurious TX timeout after dev_activate() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 630/713] seg6: reset IP6CB after IPv6 decapsulation Greg Kroah-Hartman
` (94 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Maximets, Norbert Szetei,
Jongmin Jang, Willem de Bruijn, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
commit f66bdb1cc0fcd227a062378f8be0b5873aa5600a upstream.
skb_tx_error() completes the zerocopy uarg and clears
SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears
SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone
shares, while the caller only owns the reference it is about to drop.
Through a clone it tells the producer its pages are free and drops
SKBFL_SHARED_FRAG for an skb that is still in flight.
Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:
clone_execute() sends a skb_clone() into ovs_dp_process_packet() while
do_execute_actions() keeps forwarding the original, and skb_clone()
does not privatise the frags here -- skb_orphan_frags() returns early
on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker
from the packet still being forwarded, and a later local ESP delivery
decrypts in place over frags it does not own privately.
Skip it for a cloned skb. Nothing is lost: skb_release_data() clears
the zerocopy state once the last reference to the shared data goes.
Fixes: 25121173f7b1 ("skb: api to report errors for zero copy skbs")
Cc: stable@vger.kernel.org
Suggested-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Tested-by: Jongmin Jang <payload.jang@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/CFAB292A-674B-4C14-BB2C-BB8830AD5659@doyensec.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1417,10 +1417,13 @@ EXPORT_SYMBOL(skb_dump);
*
* Report xmit error if a device callback is tracking this skb.
* skb must be freed afterwards.
+ *
+ * Does nothing for a cloned skb: the zerocopy state lives in
+ * skb_shinfo(), which the clones share.
*/
void skb_tx_error(struct sk_buff *skb)
{
- if (skb) {
+ if (skb && !skb_cloned(skb)) {
skb_zcopy_downgrade_managed(skb);
skb_zcopy_clear(skb, true);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 630/713] seg6: reset IP6CB after IPv6 decapsulation
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 629/713] net: skbuff: dont touch shared zerocopy state in skb_tx_error() Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 631/713] hwrng: stm32 - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
` (93 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Zhiling Zou, Andrea Mayer,
David S. Miller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit f967455fb2a5a2079b9eb5823e9ccf359174bf9f upstream.
decap_and_validate() pulls the outer SRv6 headers and makes the inner
packet the skb network header. The IPv6 control block still contains
values collected while parsing the outer packet, including nhoff and
extension-header flags.
End.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6
input path. An unprivileged user can reach End.DT6 from a user and net
namespace by installing a local SID and injecting an outer packet with
Hop-by-Hop and Destination Options headers followed by an SRH and a
minimal inner IPv6 packet.
The outer extension headers leave a large nhoff in IP6CB. After
decapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the
inner packet and reads beyond the skb head. KASAN reports:
BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu
ip6_protocol_deliver_rcu+0x1118/0x1450
ip6_input_finish+0x11b/0x240
seg6_local_input_core+0xed/0x2e0
lwtunnel_input+0x1e9/0x4e0
ipv6_rthdr_rcv+0x525f/0x6c50
ip6_protocol_deliver_rcu+0xcb7/0x1450
Before clearing IP6CB for an inner IPv6 packet, save its incoming
interface index and L3 slave state. Restore both after the clear and set
nhoff to the inner IPv6 base-header nexthdr field.
Use IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can
replace skb_iif with the L3 master while IP6CB keeps the receiving
interface. Preserve IP6SKB_L3SLAVE for the same reason.
Fixes: d7a669dd2f8b ("ipv6: sr: add helper functions for seg6local")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/seg6_local.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -261,6 +261,15 @@ static bool decap_and_validate(struct sk
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
IPCB(skb)->iif = iif;
+ } else if (proto == IPPROTO_IPV6) {
+ bool l3slave = ipv6_l3mdev_skb(IP6CB(skb)->flags);
+ int iif = IP6CB(skb)->iif;
+
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ IP6CB(skb)->iif = iif;
+ IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+ if (l3slave)
+ IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
}
return true;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 631/713] hwrng: stm32 - Fix runtime PM cleanup on registration failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 630/713] seg6: reset IP6CB after IPv6 decapsulation Greg Kroah-Hartman
@ 2026-09-04 4:59 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 632/713] mfd: cgbc: Fix teardown ordering in cgbc_remove() Greg Kroah-Hartman
` (92 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 4:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Linus Walleij, Herbert Xu
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit 1163a476a568f6c0f852d469c8e4c5a5f805adac upstream.
stm32_rng_probe() enables autosuspend and runtime PM before registering the
hwrng. If devm_hwrng_register() fails, probe returns with runtime PM left
enabled and autosuspend still selected.
The remove callback also only disables runtime PM and does not undo
pm_runtime_use_autosuspend().
Use devm_pm_runtime_enable() so runtime PM is unwound automatically on
probe failure and driver detach. Since the managed cleanup also disables
runtime PM,drop the remove callback.
Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/hw_random/stm32-rng.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/drivers/char/hw_random/stm32-rng.c
+++ b/drivers/char/hw_random/stm32-rng.c
@@ -368,11 +368,6 @@ static int stm32_rng_init(struct hwrng *
return 0;
}
-static void stm32_rng_remove(struct platform_device *ofdev)
-{
- pm_runtime_disable(&ofdev->dev);
-}
-
static int __maybe_unused stm32_rng_runtime_suspend(struct device *dev)
{
struct stm32_rng_private *priv = dev_get_drvdata(dev);
@@ -590,7 +585,9 @@ static int stm32_rng_probe(struct platfo
pm_runtime_set_autosuspend_delay(dev, 100);
pm_runtime_use_autosuspend(dev);
- pm_runtime_enable(dev);
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ return ret;
return devm_hwrng_register(dev, &priv->rng);
}
@@ -602,7 +599,6 @@ static struct platform_driver stm32_rng_
.of_match_table = stm32_rng_match,
},
.probe = stm32_rng_probe,
- .remove = stm32_rng_remove,
};
module_platform_driver(stm32_rng_driver);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 632/713] mfd: cgbc: Fix teardown ordering in cgbc_remove()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-09-04 4:59 ` [PATCH 7.2 631/713] hwrng: stm32 - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 633/713] mfd: qnap-mcu: keep the reply buffer alive past a command timeout Greg Kroah-Hartman
` (91 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Thomas Richard, Lee Jones
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richard <thomas.richard@bootlin.com>
commit 2970c2db8ab3d97ea6250c14ca49b1e1731115ab upstream.
Release Board Controller session once children are removed by the core.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1783507945.git.u.kleine-koenig%40baylibre.com?part=19
Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver")
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/cgbc-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/mfd/cgbc-core.c
+++ b/drivers/mfd/cgbc-core.c
@@ -364,9 +364,9 @@ static void cgbc_remove(struct platform_
{
struct cgbc_device_data *cgbc = platform_get_drvdata(pdev);
- cgbc_session_release(cgbc);
-
mfd_remove_devices(&pdev->dev);
+
+ cgbc_session_release(cgbc);
}
static struct platform_driver cgbc_driver = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 633/713] mfd: qnap-mcu: keep the reply buffer alive past a command timeout
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 632/713] mfd: cgbc: Fix teardown ordering in cgbc_remove() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 634/713] mfd: sm501: Fix potential memory leaks during remove Greg Kroah-Hartman
` (90 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Ahmet Memis, Lee Jones
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet Memis <ali@iusegentoo.com>
commit 47504742cea7878ebd1bf1491bbed923df6b90b1 upstream.
qnap_mcu_exec() publishes an on-stack buffer to the receive path:
unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];
...
reply->data = rx;
reply->length = length;
and qnap_mcu_receive_buf() writes into it from the serdev receive path,
which runs out of flush_to_ldisc() and is not serialized against
qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec()
holds that mutex across wait_for_completion_timeout().
On a timeout qnap_mcu_exec() returns with reply->data still pointing at
its own frame. A reply that arrives late, or an unsolicited message from
the MCU, is then written into a stack frame that has been left, corrupting
whatever runs next on that stack. The same applies when qnap_mcu_write()
fails, since that path returns without touching the reply state either.
Move the receive buffer into struct qnap_mcu. It is 37 bytes and the
structure is devm_kzalloc()ed, so it lives as long as the driver, and a
late write lands in memory that is still valid and is reinitialized by the
next command. bus_lock keeps commands from sharing it.
This deliberately does not clear reply->data or reply->length on the
timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both
after its
if (!reply->length)
return size;
check: clearing reply->data gives a NULL dereference, and clearing
reply->length alone removes the reply->received == reply->length exit
condition, so the copy loop runs until the uart chunk is consumed and
overruns the buffer. Leaving both set keeps the write bounded by
reply->length, which qnap_mcu_exec() has already checked against
sizeof(mcu->rx).
Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/
Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/qnap-mcu.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/mfd/qnap-mcu.c
+++ b/drivers/mfd/qnap-mcu.c
@@ -56,6 +56,7 @@ struct qnap_mcu_reply {
* @reply: Reply data structure
* @variant: Device variant specific information
* @version: MCU firmware version
+ * @rx: Receive buffer the reply is assembled in
*/
struct qnap_mcu {
struct serdev_device *serdev;
@@ -63,6 +64,7 @@ struct qnap_mcu {
struct qnap_mcu_reply reply;
const struct qnap_mcu_variant *variant;
u8 version[QNAP_MCU_VERSION_LEN];
+ u8 rx[QNAP_MCU_RX_BUFFER_SIZE];
};
/*
@@ -214,19 +216,18 @@ int qnap_mcu_exec(struct qnap_mcu *mcu,
const u8 *cmd_data, size_t cmd_data_size,
u8 *reply_data, size_t reply_data_size)
{
- unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];
size_t length = reply_data_size + QNAP_MCU_CHECKSUM_SIZE;
struct qnap_mcu_reply *reply = &mcu->reply;
int ret = 0;
- if (length > sizeof(rx)) {
+ if (length > sizeof(mcu->rx)) {
dev_err(&mcu->serdev->dev, "expected data too big for receive buffer");
return -EINVAL;
}
guard(mutex)(&mcu->bus_lock);
- reply->data = rx;
+ reply->data = mcu->rx;
reply->length = length;
reply->received = 0;
reinit_completion(&reply->done);
@@ -242,15 +243,15 @@ int qnap_mcu_exec(struct qnap_mcu *mcu,
return -ETIMEDOUT;
}
- if (!qnap_mcu_verify_checksum(rx, reply->received)) {
+ if (!qnap_mcu_verify_checksum(mcu->rx, reply->received)) {
dev_err(&mcu->serdev->dev, "Invalid Checksum received from controller\n");
return -EPROTO;
}
- if (qnap_mcu_reply_is_any_error(mcu, rx, reply->received))
+ if (qnap_mcu_reply_is_any_error(mcu, mcu->rx, reply->received))
return -EPROTO;
- memcpy(reply_data, rx, reply_data_size);
+ memcpy(reply_data, mcu->rx, reply_data_size);
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 634/713] mfd: sm501: Fix potential memory leaks during remove
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 633/713] mfd: qnap-mcu: keep the reply buffer alive past a command timeout Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 635/713] ALSA: 6fire: bound the MIDI event length from the device Greg Kroah-Hartman
` (89 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Lee Jones
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d upstream.
The memory allocated for struct sm501_devdata in sm501_pci_probe() and
sm501_plat_probe() is not freed by the corresponding remove functions
sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to
kfree().
Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/sm501.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1627,6 +1627,7 @@ static void sm501_pci_remove(struct pci_
release_mem_region(sm->io_res->start, 0x100);
pci_disable_device(dev);
+ kfree(sm);
}
static void sm501_plat_remove(struct platform_device *dev)
@@ -1637,6 +1638,7 @@ static void sm501_plat_remove(struct pla
iounmap(sm->regs);
release_mem_region(sm->io_res->start, 0x100);
+ kfree(sm);
}
static const struct pci_device_id sm501_pci_tbl[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 635/713] ALSA: 6fire: bound the MIDI event length from the device
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 634/713] mfd: sm501: Fix potential memory leaks during remove Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 636/713] ALSA: aloop: Check card index validity at probe Greg Kroah-Hartman
` (88 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Federico Kirschbaum, Baul Lee,
Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <baul.lee@xbow.com>
commit a478893b59e36cfe7d77a76b352f2db55502e879 upstream.
usb6fire_comm_receiver_handler() forwards a MIDI event using a length
byte the device supplies, with no bound and no check that the transfer
delivered that many bytes:
if (!urb->status) {
if (rt->receiver_buffer[0] == 0x10) /* midi in event */
if (midi_rt)
midi_rt->in_received(midi_rt,
rt->receiver_buffer + 2,
rt->receiver_buffer[1]);
}
receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so
only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the
device chooses, so a device that answers with 0x10 and a length of 0xFF
makes snd_rawmidi_receive() read 255 bytes starting two bytes into a
64-byte object. The bytes past the buffer are handed to userspace
through the rawmidi read path.
urb->actual_length is not consulted either, so a short transfer leaves
both the type byte and the length byte at their previous values and the
handler acts on stale data.
The receiver URB is submitted from usb6fire_comm_init() at probe, so the
read happens on plug with no user action; forwarding to userspace also
needs a MIDI input substream open, since usb6fire_midi_in_received()
only calls snd_rawmidi_receive() when rt->in is set.
KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device:
BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive
Read of size 255 at addr ffff000009f64682 by task bash/183
__asan_memcpy
snd_rawmidi_receive
usb6fire_midi_in_received [snd_usb_6fire]
usb6fire_comm_receiver_handler [snd_usb_6fire]
Allocated by task 11:
usb6fire_comm_init [snd_usb_6fire]
usb6fire_chip_probe [snd_usb_6fire]
The buggy address is located 2 bytes inside of
allocated 64-byte region [ffff000009f64680, ffff000009f646c0)
Reject the event when the length exceeds the bytes that follow the
header, and require the transfer to have delivered the header plus that
many bytes. The receiver URB is submitted with a 64-byte
transfer_buffer_length, so a genuine device cannot deliver an event
longer than those 62 bytes and nothing valid is dropped.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Link: https://patch.msgid.link/20260805013423.38175-1-baul.lee@xbow.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/6fire/comm.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/sound/usb/6fire/comm.c
+++ b/sound/usb/6fire/comm.c
@@ -36,11 +36,14 @@ static void usb6fire_comm_receiver_handl
struct midi_runtime *midi_rt = rt->chip->midi;
if (!urb->status) {
- if (rt->receiver_buffer[0] == 0x10) /* midi in event */
+ u8 len = rt->receiver_buffer[1];
+
+ if (rt->receiver_buffer[0] == 0x10 && /* midi in event */
+ len <= COMM_RECEIVER_BUFSIZE - 2 &&
+ urb->actual_length >= len + 2)
if (midi_rt)
midi_rt->in_received(midi_rt,
- rt->receiver_buffer + 2,
- rt->receiver_buffer[1]);
+ rt->receiver_buffer + 2, len);
}
if (!rt->chip->shutdown) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 636/713] ALSA: aloop: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 635/713] ALSA: 6fire: bound the MIDI event length from the device Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 637/713] ALSA: bcd2000: clear the URB pointers on disconnect Greg Kroah-Hartman
` (87 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 819b106a9fd2ef3fd8abf898b9a8e4524eca8f48 upstream.
aloop driver blindly trusts that the given devptr->id value is within
the proper card index range at probe. It's OK for the devices the
driver itself creates at the module probe time, but if the device is
bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-2-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/aloop.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -1802,6 +1802,12 @@ static int loopback_probe(struct platfor
int dev = devptr->id;
int err;
+ if (dev < 0 || dev >= SNDRV_CARDS) {
+ dev_warn(&devptr->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
err = snd_devm_card_new(&devptr->dev, index[dev], id[dev], THIS_MODULE,
sizeof(struct loopback), &card);
if (err < 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 637/713] ALSA: bcd2000: clear the URB pointers on disconnect
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 636/713] ALSA: aloop: Check card index validity at probe Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 638/713] ALSA: FCP: do not copy out an uninitialised init response Greg Kroah-Hartman
` (86 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Federico Kirschbaum, Baul Lee,
Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <baul.lee@xbow.com>
commit 459d3a64766f5ca2f1886daeaf24582831a5f5ab upstream.
bcd2000_free_usb_related_resources() frees both URBs and leaves the
pointers behind:
usb_kill_urb(bcd2k->midi_out_urb);
usb_kill_urb(bcd2k->midi_in_urb);
usb_free_urb(bcd2k->midi_out_urb);
usb_free_urb(bcd2k->midi_in_urb);
The rawmidi device outlives that call. A substream that is still open
when the device is unplugged reaches bcd2000_midi_send() from the
trigger path on close. That function writes to the freed URB and then
hands it to the USB core:
bcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE;
...
ret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC);
usb_kill_urb() does not stop a later submission either, so a submit that
races the disconnect can requeue the URB after it has been reaped.
midi_in_urb is exposed the same way: bcd2000_input_complete() resubmits
it from the completion handler.
KASAN on 7.2.0-rc5 (arm64):
BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000]
Write of size 4 at addr ffff00001827d388 by task bpoc/168
__asan_store4
bcd2000_midi_send [snd_bcd2000]
bcd2000_midi_output_trigger [snd_bcd2000]
snd_rawmidi_kernel_write1
close_substream.part.0
Freed by task 168:
usb_free_urb
bcd2000_disconnect [snd_bcd2000]
BUG: KASAN: slab-use-after-free in usb_submit_urb
Read of size 8 at addr ffff00001827d3b8 by task bpoc/168
Clear both pointers after freeing and test them on the paths that can
still run. Poison the URBs before freeing them: usb_poison_urb() waits
for a running completion handler and rejects any later submission, so
after it returns the input path is quiesced and only the rawmidi trigger
path can still reach bcd2000_midi_send(). No unpoison is needed; the
URBs are freed on the next line.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Fixes: b47a22290d58 ("ALSA: MIDI driver for Behringer BCD2000 USB device")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Link: https://patch.msgid.link/20260805013428.38204-1-baul.lee@xbow.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/bcd2000/bcd2000.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/sound/usb/bcd2000/bcd2000.c
+++ b/sound/usb/bcd2000/bcd2000.c
@@ -134,6 +134,9 @@ static void bcd2000_midi_send(struct bcd
if (!midi_out_substream)
return;
+ if (!bcd2k->midi_out_urb)
+ return;
+
/* copy command prefix bytes */
memcpy(bcd2k->midi_out_buf, device_cmd_prefix,
sizeof(device_cmd_prefix));
@@ -178,7 +181,7 @@ static int bcd2000_midi_output_close(str
{
struct bcd2000 *bcd2k = substream->rmidi->private_data;
- if (bcd2k->midi_out_active) {
+ if (bcd2k->midi_out_active && bcd2k->midi_out_urb) {
usb_kill_urb(bcd2k->midi_out_urb);
bcd2k->midi_out_active = 0;
}
@@ -348,11 +351,13 @@ static int bcd2000_init_midi(struct bcd2
static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k,
struct usb_interface *interface)
{
- usb_kill_urb(bcd2k->midi_out_urb);
- usb_kill_urb(bcd2k->midi_in_urb);
+ usb_poison_urb(bcd2k->midi_out_urb);
+ usb_poison_urb(bcd2k->midi_in_urb);
usb_free_urb(bcd2k->midi_out_urb);
usb_free_urb(bcd2k->midi_in_urb);
+ bcd2k->midi_out_urb = NULL;
+ bcd2k->midi_in_urb = NULL;
if (bcd2k->intf) {
usb_set_intfdata(bcd2k->intf, NULL);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 638/713] ALSA: FCP: do not copy out an uninitialised init response
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 637/713] ALSA: bcd2000: clear the URB pointers on disconnect Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 639/713] ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Greg Kroah-Hartman
` (85 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Federico Kirschbaum, Baul Lee,
Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <baul.lee@xbow.com>
commit 4335e387786479889e6db691fe06d345e52ea536 upstream.
fcp_ioctl_init() allocates its response buffer with kmalloc() and copies
the whole buffer back to userspace:
buf_size = init.step0_resp_size + init.step2_resp_size;
void *resp __free(kfree) =
kmalloc(buf_size, GFP_KERNEL);
...
if (copy_to_user(arg->resp, resp, buf_size))
return -EFAULT;
Nothing clears the buffer, and the only writer of its leading
step0_resp_size bytes is the step-0 control transfer:
err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
FCP_USB_REQ_STEP0,
USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
0, private->bInterfaceNumber,
step0_resp, private->step0_resp_size);
if (err < 0)
return err;
usb_fill_control_urb() does not set URB_SHORT_NOT_OK, so a short or
zero-length data stage completes with status 0 and snd_usb_ctl_msg()
returns a small actual_length. The only check is err < 0, so a short
transfer is accepted as success.
snd_usb_ctl_msg() copies the full size back unconditionally:
buf = kmemdup(data, size, GFP_KERNEL);
...
memcpy(data, buf, size);
Bytes the device never wrote are therefore restored into resp unchanged
and copied to userspace. step0_resp_size and step2_resp_size are each
validated only to 1..255, so the caller also picks the slab cache, from
kmalloc-8 up to kmalloc-512.
On 7.2.0-rc5 (arm64), device answering step 0 with a zero-length data
stage, s0 = s2 = 255:
# init_on_alloc off, no spray
step0 window [0,255): nonzero=94/255
000: 00 80 60 06 00 00 ff ff 18 00 00 00 57 01 ea 01
010: 08 78 22 13 00 00 ff ff a8 c4 5f 80 00 80 ff ff
# same kernel, kmalloc-512 pre-seeded with an 8-byte tag
step0 window [0,255): nonzero=219/255 tagbytes=232
# identical run, init_on_alloc=1
step0 window [0,255): nonzero=0/255 tagbytes=0
# all three runs
step2 window [255,510): device words matched=62/62
a8 c4 5f 80 00 80 ff ff is the little-endian kernel text address
ffff8000805fc4a8. The step-2 window is unaffected, so the disclosure is
exactly the step-0 region.
Zero the buffer, and require the step-0 transfer to deliver the full
step0_resp_size bytes so a short data stage is reported as an error.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Fixes: 46757a3e7d50 ("ALSA: FCP: Add Focusrite Control Protocol driver")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Link: https://patch.msgid.link/20260805013804.38839-1-baul.lee@xbow.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/fcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/usb/fcp.c
+++ b/sound/usb/fcp.c
@@ -494,7 +494,7 @@ static int fcp_ioctl_init(struct usb_mix
buf_size = init.step0_resp_size + init.step2_resp_size;
void *resp __free(kfree) =
- kmalloc(buf_size, GFP_KERNEL);
+ kzalloc(buf_size, GFP_KERNEL);
if (!resp)
return -ENOMEM;
@@ -1033,6 +1033,8 @@ static int fcp_init(struct usb_mixer_int
step0_resp, private->step0_resp_size);
if (err < 0)
return err;
+ if (err != private->step0_resp_size)
+ return -EIO;
err = fcp_init_notify(mixer);
if (err < 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 639/713] ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 638/713] ALSA: FCP: do not copy out an uninitialised init response Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 640/713] ALSA: mpu401: Check card index validity at probe Greg Kroah-Hartman
` (84 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 36aa66de481d29edd63cbad9b5c4dc18c340fdf6 upstream.
snd_hdac_ext_stream_reset() polls PPLCCTL for STRST by masking the
register value with AZX_PPLCCTL_STRST:
val = readl(...) & AZX_PPLCCTL_STRST;
The same masked value is then used when clearing STRST. Since val
contains no bits other than STRST, clearing STRST from it always
produces zero. The subsequent writel() therefore writes zero to the
entire PPLCCTL register instead of clearing only the reset bit.
PPLCCTL contains other stream control fields, including the stream tag
in AZX_PPLCCTL_STRM_MASK. Those fields must not be modified as a side
effect of clearing stream reset.
Use snd_hdac_updatel() to clear STRST, matching the existing set-reset
path and preserving all unrelated PPLCCTL bits.
Fixes: df203a4e46f4 ("ALSA: hdac_ext: add extended stream capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/43BB7930B0F07C09+20260813065524.1955696-1-raoxu@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/core/ext/stream.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/hda/core/ext/stream.c
+++ b/sound/hda/core/ext/stream.c
@@ -210,8 +210,8 @@ void snd_hdac_ext_stream_reset(struct hd
break;
udelay(3);
} while (--timeout);
- val &= ~AZX_PPLCCTL_STRST;
- writel(val, hext_stream->pplc_addr + AZX_REG_PPLCCTL);
+ snd_hdac_updatel(hext_stream->pplc_addr, AZX_REG_PPLCCTL,
+ AZX_PPLCCTL_STRST, 0);
udelay(3);
timeout = 50;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 640/713] ALSA: mpu401: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 639/713] ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 641/713] ALSA: mts64: " Greg Kroah-Hartman
` (83 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit f7dcecb92ed192ff5fcf842918fb1aaea84b5bdd upstream.
mpu401 driver blindly trusts that the given devptr->id value is within
the proper card index range at probe. It's OK for the devices the
driver itself creates at the module probe time, but if the device is
bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/mpu401/mpu401.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/mpu401/mpu401.c
+++ b/sound/drivers/mpu401/mpu401.c
@@ -89,6 +89,12 @@ static int snd_mpu401_probe(struct platf
int err;
struct snd_card *card;
+ if (dev < 0 || dev >= SNDRV_CARDS) {
+ dev_warn(&devptr->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
if (port[dev] == SNDRV_AUTO_PORT) {
dev_err(&devptr->dev, "specify port\n");
return -EINVAL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 641/713] ALSA: mts64: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 640/713] ALSA: mpu401: Check card index validity at probe Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 642/713] ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Greg Kroah-Hartman
` (82 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d18a260720f86a5f8b5fcfefc4ba2e9dd01c10f8 upstream.
Although mts64 driver has a check of the given devptr->id value, it
doesn't check for a negative id, which is often given as "none" or
such value when bound via sysfs. This may lead to OOB access for
index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-6-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/mts64.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/mts64.c
+++ b/sound/drivers/mts64.c
@@ -900,6 +900,12 @@ static int snd_mts64_probe(struct platfo
p = platform_get_drvdata(pdev);
platform_set_drvdata(pdev, NULL);
+ if (dev < 0) {
+ dev_warn(&pdev->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
if (dev >= SNDRV_CARDS)
return -ENODEV;
if (!enable[dev])
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 642/713] ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 641/713] ALSA: mts64: " Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 643/713] ALSA: portman2x4: Check card index validity at probe Greg Kroah-Hartman
` (81 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 6c97817e20598e5473094e0e38d1f51f1cf4dfff upstream.
pcxhr_probe() requests pcxhr_threaded_irq() before initializing
mgr->lock, even though the threaded handler takes that mutex.
Initialize the manager locks before request_threaded_irq() so an
early interrupt cannot run against uninitialized mutex state during
probe.
Fixes: 9bef72bdb26e ("ALSA: pcxhr: Use nonatomic PCM ops")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260818144717.2269918-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/pcxhr/pcxhr.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/sound/pci/pcxhr/pcxhr.c
+++ b/sound/pci/pcxhr/pcxhr.c
@@ -1535,6 +1535,13 @@ static int pcxhr_probe(struct pci_dev *p
mgr->pci = pci;
mgr->irq = -1;
+ /* ISR lock */
+ mutex_init(&mgr->lock);
+ mutex_init(&mgr->msg_lock);
+
+ /* init setup mutex*/
+ mutex_init(&mgr->setup_mutex);
+
if (request_threaded_irq(pci->irq, pcxhr_interrupt,
pcxhr_threaded_irq, IRQF_SHARED,
KBUILD_MODNAME, mgr)) {
@@ -1548,13 +1555,6 @@ static int pcxhr_probe(struct pci_dev *p
"Digigram at 0x%lx & 0x%lx, 0x%lx irq %i",
mgr->port[0], mgr->port[1], mgr->port[2], mgr->irq);
- /* ISR lock */
- mutex_init(&mgr->lock);
- mutex_init(&mgr->msg_lock);
-
- /* init setup mutex*/
- mutex_init(&mgr->setup_mutex);
-
mgr->prmh = kmalloc(sizeof(*mgr->prmh) +
sizeof(u32) * (PCXHR_SIZE_MAX_LONG_STATUS -
PCXHR_SIZE_MAX_STATUS),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 643/713] ALSA: portman2x4: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 642/713] ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 644/713] ALSA: serial-u16550: " Greg Kroah-Hartman
` (80 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 3690ef20469d5959378260e2752f2314a2572913 upstream.
Although portman2x4 driver has a check of the given devptr->id value,
it doesn't check for a negative id, which is often given as "none" or
such value when bound via sysfs. This may lead to OOB access for
index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-7-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/portman2x4.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/portman2x4.c
+++ b/sound/drivers/portman2x4.c
@@ -697,6 +697,12 @@ static int snd_portman_probe(struct plat
p = platform_get_drvdata(pdev);
platform_set_drvdata(pdev, NULL);
+ if (dev < 0) {
+ dev_warn(&pdev->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
if (dev >= SNDRV_CARDS)
return -ENODEV;
if (!enable[dev])
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 644/713] ALSA: serial-u16550: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 643/713] ALSA: portman2x4: Check card index validity at probe Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 645/713] ALSA: virmidi: " Greg Kroah-Hartman
` (79 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit e0fb960b227fcdebe22e4f26c9486d60943c0424 upstream.
serial-u16550 driver blindly trusts that the given devptr->id value is
within the proper card index range at probe. It's OK for the devices
the driver itself creates at the module probe time, but if the device
is bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-4-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/serial-u16550.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/serial-u16550.c
+++ b/sound/drivers/serial-u16550.c
@@ -846,6 +846,12 @@ static int snd_serial_probe(struct platf
int err;
int dev = devptr->id;
+ if (dev < 0 || dev >= SNDRV_CARDS) {
+ dev_warn(&devptr->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
switch (adaptor[dev]) {
case SNDRV_SERIAL_SOUNDCANVAS:
ins[dev] = 1;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 645/713] ALSA: virmidi: Check card index validity at probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 644/713] ALSA: serial-u16550: " Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 646/713] ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Greg Kroah-Hartman
` (78 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit b65d5182ecd6b7a24a83d980a0d06e809ef876c5 upstream.
virmidi driver blindly trusts that the given devptr->id value is
within the proper card index range at probe. It's OK for the devices
the driver itself creates at the module probe time, but if the device
is bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a
value out of the range.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-5-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/virmidi.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/drivers/virmidi.c
+++ b/sound/drivers/virmidi.c
@@ -75,6 +75,12 @@ static int snd_virmidi_probe(struct plat
int idx, err;
int dev = devptr->id;
+ if (dev < 0 || dev >= SNDRV_CARDS) {
+ dev_warn(&devptr->dev,
+ "Invalid card index %d, using default 0\n", dev);
+ dev = 0;
+ }
+
err = snd_devm_card_new(&devptr->dev, index[dev], id[dev], THIS_MODULE,
sizeof(struct snd_card_virmidi), &card);
if (err < 0)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 646/713] ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 645/713] ALSA: virmidi: " Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 647/713] ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r Greg Kroah-Hartman
` (77 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eckhart Mohr, Werner Sembach,
Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
commit e72d5659a2606056a0c34af212b46a3275a55bbf upstream.
Fix microphone detection on built in headphone jack for some devices
Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com>
Cc: stable@vger.kernel.org
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://patch.msgid.link/20260821144437.27233-1-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc269.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -8055,6 +8055,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1d05, 0x3033, "TongFang X6SP45xU", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6KK45xU", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d05, 0x30ba, "TongFang XxAF5xxx", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 647/713] ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 646/713] ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 648/713] ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Greg Kroah-Hartman
` (76 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ajrat Makhmutov, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajrat Makhmutov <rauty@altlinux.org>
commit 7097666b993b37f4e47982026b703b2379a364f8 upstream.
The BIOS of the F+ FLAPTOP r laptop (Realtek ALC897, SSID 1e63:6d9a)
declares only pin 0x1b, the headphone output of the 3.5 mm combo jack.
Every other external pin is left at 0x411111f0, so the headset mic pin
0x19 is never parsed and no headset mic input exists. The pin is wired
on this board - retasking it makes the headset mic record.
Reuse ALC897_FIXUP_HP_HSMIC_VERB, which already sets the pin config this
machine needs: 0x19 as a headset mic without its own presence detect.
Only 0x1b reports jack presence here, so a mic pin with presence detect
would leave the driver in auto-mic mode waiting for an event that never
arrives.
Without the quirk the generic parser retasks the lone headphone pin as
an input instead. That surfaces as a "Headphone Mic" input which records
only the internal mic bleed, so the headset mic appears present but dead.
Tested on ALT Linux, kernel 6.12, by recording a CTIA headset mic on the
combo jack with the internal mic as a reference.
ALSA info before the patch:
https://alsa-project.org/db/?f=18363eddea933baee100c9bf461d0e5cf74c8de2
ALSA info after the patch:
https://alsa-project.org/db/?f=48ae2cd7aaf1eb0f24639ce83cd38cfd93b25f76
Cc: stable@vger.kernel.org # 6.12.x
Signed-off-by: Ajrat Makhmutov <rauty@altlinux.org>
Link: https://patch.msgid.link/20260808185500.2564948-1-rauty@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc662.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/codecs/realtek/alc662.c
+++ b/sound/hda/codecs/realtek/alc662.c
@@ -852,6 +852,7 @@ static const struct hda_quirk alc662_fix
SND_PCI_QUIRK(0x1b35, 0x1234, "CZC ET26", ALC662_FIXUP_CZC_ET26),
SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
SND_PCI_QUIRK(0x1c6c, 0x1239, "Compaq N14JP6-V2", ALC897_FIXUP_HP_HSMIC_VERB),
+ SND_PCI_QUIRK(0x1e63, 0x6d9a, "F+ FLAPTOP r", ALC897_FIXUP_HP_HSMIC_VERB),
#if 0
/* Below is a quirk table taken from the old code.
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 648/713] ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 647/713] ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 649/713] ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Greg Kroah-Hartman
` (75 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Denis Batishchev, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Batishchev <ii343hbka@gmail.com>
commit e7da28b820d12927de30abf554c727a319f80359 upstream.
The HP EliteBook 6 G1a (SSID 103c:8e0d) uses a Realtek ALC236 codec.
Without a quirk no fixup is selected and the mic-mute LED stays off.
It needs the same ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk as the
already-supported 14" variant (SSID 103c:8dfb), so add it.
Signed-off-by: Denis Batishchev <ii343hbka@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260810151440.2306217-2-ii343hbka@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc269.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7442,6 +7442,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x103c, 0x8dfc, "HP EliteBook 645 G12", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8dfd, "HP EliteBook 6 G1a 16", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8dfe, "HP EliteBook 665 G12", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e0d, "HP EliteBook 6 G1a 14 (AD3Q9ET#UUG)", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8e11, "HP Trekker", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8e12, "HP Trekker", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8e13, "HP Trekker", ALC287_FIXUP_CS35L41_I2C_2),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 649/713] ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 648/713] ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 650/713] rust: num: reject Bounded::shr overshifts at build time Greg Kroah-Hartman
` (74 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Heng, Takashi Iwai
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <zhangheng@kylinos.cn>
commit 75dc2eda659f6be4a370734f11baf25df8a9fd80 upstream.
The Yoga Slim 7 14AKP10 has a PCI SSID of 17aa:38b4 but a codec SSID of
17aa:391a. The current quirk table contains a PCI quirk for 17aa:38b4
(for the Legion Slim 7 16IRH8) which matches first, so the codec-specific
quirk for 17aa:391a is never applied.
This results in the wrong fixup being used (CS35L41_I2C_2 instead of the
correct bass speaker fixup), leaving the internal speakers misconfigured
or silent.
Remove the 17aa:391a entry from its PCI-SSID-sorted position and add it as
an HDA_CODEC_QUIRK directly before the 17aa:38b4 entry, because it must
match on the codec subsystem ID rather than the PCI SSID and it has to win
over the colliding PCI quirk for the Legion Slim 7 16IRH8. A comment is
added to explain the out-of-order placement, following the same style
already used for the 17aa:38bb and 17aa:38f9 codec-SSID overrides.
With this change, the correct ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN is
applied, restoring speaker output and auto-mute functionality.
The original quirk added in commit e6c888202297 ("ALSA: hda/realtek: Add
quirk for Lenovo Yoga Slim 7 14AKP10") matched on the PCI SSID 17aa:391a,
but this model actually exposes PCI SSID 17aa:38b4 (shared with the Legion
Slim 7 16IRH8), so that quirk never matched and the bass speaker remained
silent. Fix it by matching on the codec SSID and placing the entry before
the colliding 17aa:38b4 PCI quirk.
Fixes: e6c888202297 ("ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10")
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221298
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260817094708.222154-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc269.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7950,6 +7950,10 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x17aa, 0x38a8, "Y780P AMD VECO dual", ALC287_FIXUP_TAS2781_I2C),
SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+ /* Lenovo Yoga Slim 7 14AKP10 shares PCI SSID 17aa:38b4 with Legion Slim 7
+ * 16IRH8; use codec SSID to distinguish them
+ */
+ HDA_CODEC_QUIRK(0x17aa, 0x391a, "Lenovo Yoga Slim 7 14AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
HDA_CODEC_QUIRK(0x17aa, 0x391c, "Lenovo Yoga 7 2-in-1 14AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
HDA_CODEC_QUIRK(0x17aa, 0x391d, "Lenovo Yoga 7 2-in-1 16AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
@@ -7990,7 +7994,6 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x17aa, 0x3911, "Lenovo Yoga Pro 7 14IAH10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
SND_PCI_QUIRK(0x17aa, 0x3912, "Lenovo Xiaoxin 14 GT", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC),
- SND_PCI_QUIRK(0x17aa, 0x391a, "Lenovo Yoga Slim 7 14AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TXNW2781_I2C),
SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TXNW2781_I2C),
SND_PCI_QUIRK(0x17aa, 0x3929, "Thinkbook 13x Gen 5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 650/713] rust: num: reject Bounded::shr overshifts at build time
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 649/713] ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 651/713] arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Greg Kroah-Hartman
` (73 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eliot Courtney, Alexandre Courbot,
Gary Guo, Danilo Krummrich, Miguel Ojeda, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliot Courtney <ecourtney@nvidia.com>
[ Upstream commit 223aa25aee82e188ddf043a8703b16e5fdfc37d8 ]
Make `shr` reject shifts of at least the type's bit width at build
time, instead of panicking or masking the shift amount at runtime.
[ This implies we can break the type invariant, which in turn means
we can trigger UB via `Deref`, e.g.:
rust_kernel: panicked at rust/kernel/num/bounded.rs:528:22:
unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached
- Miguel ]
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c59a2d14cd24 ("rust: num: add `shr` and `shl` methods to `Bounded`")
Link: https://patch.msgid.link/20260810-pramin-split-v2-2-65a00b3c7309@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/num/bounded.rs | 1 +
1 file changed, 1 insertion(+)
diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs
index 304ef04d86cd9..6d766c22e61b5 100644
--- a/rust/kernel/num/bounded.rs
+++ b/rust/kernel/num/bounded.rs
@@ -495,6 +495,7 @@ pub fn cast<U>(self) -> Bounded<U, N>
/// assert_eq!(v_shifted.get(), 0xff);
/// ```
pub fn shr<const SHIFT: u32, const RES: u32>(self) -> Bounded<T, RES> {
+ const_assert!(SHIFT < T::BITS);
const { assert!(RES + SHIFT >= N) }
// SAFETY: We shift the value right by `SHIFT`, reducing the number of bits needed to
--
2.53.0
^ permalink raw reply related [flat|nested] 727+ messages in thread
* [PATCH 7.2 651/713] arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 650/713] rust: num: reject Bounded::shr overshifts at build time Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 652/713] dm-stats: fix a crash if allocation of per-cpu data fails Greg Kroah-Hartman
` (72 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor,
Mike Rapoport (Microsoft), Kees Cook, Bill Wendling, Justin Stitt,
Nick Desaulniers, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit f2b1cb39d5ccab090d8353788f186f7e7a1fffd4 upstream.
When building ARCH=riscv using clang with CONFIG_FORTIFY_SOURCE and
CONFIG_UBSAN_BOUNDS enabled, CONFIG_NR_CPUS > 64, and the default value of
2 for CONFIG_NODES_SHIFT, there is a compiletime warning from the fortify
routines.
In file included from mm/arch_numa.c:11:
In file included from include/linux/acpi.h:14:
In file included from include/linux/resource_ext.h:11:
In file included from include/linux/slab.h:17:
In file included from include/linux/gfp.h:7:
In file included from include/linux/mmzone.h:8:
In file included from include/linux/spinlock.h:60:
In file included from include/linux/interrupt_rc.h:17:
In file included from include/linux/smp.h:13:
In file included from include/linux/cpumask.h:11:
In file included from include/linux/bitmap.h:13:
In file included from include/linux/string.h:383:
include/linux/fortify-string.h:430:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribue-warning]
430 | __write_overflow_field(p_size_field, size);
| ^
include/linux/fortify-string.h:430:4: note: called by function 'fortify_memset_chk(unsigned long, unsigned long, unsigned long)'
include/linux/bitmap.h:248:3: note: inlined by function 'setup_node_to_cpumask_map'
248 | memset(dst, 0, len);
| ^
include/linux/fortify-string.h:462:25: note: expanded from macro 'memset'
462 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \
| ^
include/linux/fortify-string.h:453:2: note: expanded from macro '__fortify_memset_chk'
453 | fortify_memset_chk(__fortify_size, p_size, p_size_field), \
| ^
include/linux/fortify-string.h:430:4: note: use '-gline-directives-only' (implied by '-g1') or higher for more accurate inlining chain locations
430 | __write_overflow_field(p_size_field, size);
| ^
1 warning generated.
In this configuration, MAX_NUMNODES is 4. clang unrolls the for loop in
setup_node_to_cpumask_map() past this, which triggers the fortify check
when accessing node_to_cpumask_map on the theoretical fifth loop iteration
because it would be an out of bounds write.
Make it clear to clang that nr_node_ids is bounded by MAX_NUMNODES due to
the logic in setup_nr_node_ids() by early returning in
setup_node_to_cpumask_map() should that condition be violated.
Link: https://lore.kernel.org/20260813-arch_numa-avoid-fortify-warning-v2-1-093ad97a78df@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2174
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/arch_numa.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/base/arch_numa.c
+++ b/drivers/base/arch_numa.c
@@ -105,6 +105,18 @@ static void __init setup_node_to_cpumask
if (nr_node_ids == MAX_NUMNODES)
setup_nr_node_ids();
+ /*
+ * This check should never be true but it makes it clear to compilers
+ * that node_to_cpumask_map is bound by nr_node_ids, avoiding false
+ * positive fortify warnings when accessing node_to_cpumask_map in the
+ * for loop below.
+ */
+ if (unlikely(nr_node_ids > MAX_NUMNODES)) {
+ pr_err("nr_node_ids (%u) is larger than MAX_NUMNODES (%u)\n",
+ nr_node_ids, MAX_NUMNODES);
+ return;
+ }
+
/* allocate and clear the mapping */
for (node = 0; node < nr_node_ids; node++) {
alloc_bootmem_cpumask_var(&node_to_cpumask_map[node]);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 652/713] dm-stats: fix a crash if allocation of per-cpu data fails
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 651/713] arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 653/713] dm-switch: use WRITE_ONCE() in switch_region_table_write() Greg Kroah-Hartman
` (71 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junzhe Yu, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit cc87e26d9cce22061dc21e51e11afef29dbbc36a upstream.
If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.
This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.
Reported-by: Junzhe Yu <junzheyu1@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: fd2ed4d25270 ("dm: add statistics support")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-stats.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head
kfree(s->program_id);
kfree(s->aux_data);
for_each_possible_cpu(cpu) {
- dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
- dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+ if (s->stat_percpu[cpu]) {
+ dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
+ dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+ }
}
dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size);
dm_kvfree(s, s->shared_alloc_size);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 653/713] dm-switch: use WRITE_ONCE() in switch_region_table_write()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 652/713] dm-stats: fix a crash if allocation of per-cpu data fails Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 654/713] dm-pcache: validate geometry fields from on-disk cache_info Greg Kroah-Hartman
` (70 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
commit c7391ebe33162c7962b313caea4d8e6b0bc2a671 upstream.
switch_region_table_read() accesses the region table with READ_ONCE()
and is called from the lockless switch_map() IO path. However,
switch_region_table_write() stores to the same array with a plain
assignment. This results in an inconsistent access pattern for a
lockless shared variable and may trigger data race reports.
Use WRITE_ONCE() to pair with the existing READ_ONCE() in
switch_region_table_read().
Cc: stable@vger.kernel.org
Fixes: 99eb1908e643 ("dm switch: factor out switch_region_table_read")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-switch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-switch.c
+++ b/drivers/md/dm-switch.c
@@ -184,7 +184,7 @@ static void switch_region_table_write(st
pte = sctx->region_table[region_index];
pte &= ~((((region_table_slot_t)1 << sctx->region_table_entry_bits) - 1) << bit);
pte |= (region_table_slot_t)value << bit;
- sctx->region_table[region_index] = pte;
+ WRITE_ONCE(sctx->region_table[region_index], pte);
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 654/713] dm-pcache: validate geometry fields from on-disk cache_info
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 653/713] dm-switch: use WRITE_ONCE() in switch_region_table_write() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 655/713] dm-pcache: validate kset key_num and intra-segment bounds Greg Kroah-Hartman
` (69 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 32d1809da31094ef76fd98dc1f1a8b55ca1295dd upstream.
cache_segs_init() iterates cache_info->n_segs times indexing
cache->segments[], which is sized to the cache device geometry, and
get_seg_id() takes each segment id from the on-media cache_info and the
per-segment next_seg link. Both come from cache device metadata that is
only CRC-protected with a fixed public seed, so whoever supplies the
cache device on a table load (CAP_SYS_ADMIN) controls them: an oversized
n_segs or an out-of-range id drives an out-of-bounds access of
cache->segments[] and a wild CACHE_DEV_SEGMENT() pointer into the device
mapping -- an out-of-bounds read and write from on-disk data.
Reject an n_segs that exceeds the device segment count and a segment id
that is out of range before either is used. Valid metadata is unaffected.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/md/dm-pcache/cache.c
+++ b/drivers/md/dm-pcache/cache.c
@@ -247,6 +247,13 @@ static int get_seg_id(struct pcache_cach
} else {
*seg_id = cache->cache_info.seg_id;
}
+
+ if (*seg_id >= cache_dev->seg_num) {
+ pcache_dev_err(pcache, "invalid segment id %u from cache device (seg_num %u)\n",
+ *seg_id, cache_dev->seg_num);
+ ret = -EIO;
+ goto err;
+ }
}
return 0;
err:
@@ -262,6 +269,13 @@ static int cache_segs_init(struct pcache
int ret;
u32 i;
+ if (cache_info->n_segs > cache->cache_dev->seg_num) {
+ pcache_dev_err(CACHE_TO_PCACHE(cache),
+ "cache_info n_segs %u exceeds cache device segments %u\n",
+ cache_info->n_segs, cache->cache_dev->seg_num);
+ return -EIO;
+ }
+
for (i = 0; i < cache_info->n_segs; i++) {
ret = get_seg_id(cache, prev_cache_seg, new_cache, &seg_id);
if (ret)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 655/713] dm-pcache: validate kset key_num and intra-segment bounds
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 654/713] dm-pcache: validate geometry fields from on-disk cache_info Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 656/713] dm-pcache: validate on-media seg_num against the cache device size Greg Kroah-Hartman
` (68 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit f11deb032fd84081e7831cffcba895d893054a22 upstream.
Two more fields decoded from the cache device go unbounded. The kset
key_num drives cache_kset_crc() and the replay loop in cache_replay(),
the writeback worker and the GC worker, but only the magic and a
fixed-seed CRC are checked first, so a non-last kset whose key_num exceeds
the PCACHE_KSET_KEYS_MAX buffer reads past its end before the CRC compare.
A key's intra-segment offset and length in cache_key_decode() are taken
verbatim, so a key running past its segment is replayed into the cache
tree and the data CRC check and every later read hit then copy adjacent
persistent memory into the caller's bio -- an out-of-bounds read that
leaks to user space. Both fields are controlled by whoever supplies the
cache device (CAP_SYS_ADMIN); the CRC seed is public.
Add kset_onmedia_valid() to bound key_num before any kset read, and
reject a key whose offset plus length, computed in 64 bits, exceeds the
segment data_size. Valid metadata is unaffected.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache.h | 21 +++++++++++++++++++++
drivers/md/dm-pcache/cache_gc.c | 8 ++++----
drivers/md/dm-pcache/cache_key.c | 10 +++++++++-
drivers/md/dm-pcache/cache_writeback.c | 8 ++++----
4 files changed, 38 insertions(+), 9 deletions(-)
--- a/drivers/md/dm-pcache/cache.h
+++ b/drivers/md/dm-pcache/cache.h
@@ -491,6 +491,27 @@ static inline u32 cache_key_data_crc(str
return crc32c(PCACHE_CRC_SEED, data, key->len);
}
+/**
+ * kset_onmedia_valid - Validate a kset header read from the cache device.
+ * @kset_onmedia: Pointer to the kset copied from on-media metadata.
+ *
+ * The magic and CRC are attacker-computable (fixed public seed). A non-last
+ * kset stores key_num keys inline, and cache_kset_crc() and the replay loop
+ * read struct_size(.., data, key_num) bytes from a buffer sized for
+ * PCACHE_KSET_KEYS_MAX keys, so key_num must be bounded before any such use.
+ */
+static inline bool kset_onmedia_valid(struct pcache_cache_kset_onmedia *kset_onmedia)
+{
+ if (kset_onmedia->magic != PCACHE_KSET_MAGIC)
+ return false;
+
+ if (!(kset_onmedia->flags & PCACHE_KSET_FLAGS_LAST) &&
+ kset_onmedia->key_num > PCACHE_KSET_KEYS_MAX)
+ return false;
+
+ return true;
+}
+
static inline u32 cache_kset_crc(struct pcache_cache_kset_onmedia *kset_onmedia)
{
u32 crc_size;
--- a/drivers/md/dm-pcache/cache_gc.c
+++ b/drivers/md/dm-pcache/cache_gc.c
@@ -44,11 +44,11 @@ static bool need_gc(struct pcache_cache
return false;
}
- /* Check if kset_onmedia is corrupted */
- if (kset_onmedia->magic != PCACHE_KSET_MAGIC) {
- pcache_dev_debug(pcache, "gc error: magic is not as expected. key_tail: %u:%u magic: %llx, expected: %llx\n",
+ /* Reject a corrupted or out-of-bounds kset before reading its keys */
+ if (!kset_onmedia_valid(kset_onmedia)) {
+ pcache_dev_debug(pcache, "gc error: invalid kset. key_tail: %u:%u magic: %llx, key_num: %u\n",
key_tail->cache_seg->cache_seg_id, key_tail->seg_off,
- kset_onmedia->magic, PCACHE_KSET_MAGIC);
+ kset_onmedia->magic, kset_onmedia->key_num);
return false;
}
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -97,6 +97,14 @@ int cache_key_decode(struct pcache_cache
key->cache_pos.cache_seg = &cache->segments[key_onmedia->cache_seg_id];
key->cache_pos.seg_off = key_onmedia->cache_seg_off;
+ if ((u64)key->cache_pos.seg_off + key->len >
+ key->cache_pos.cache_seg->segment.data_size) {
+ pcache_dev_err(pcache, "key seg_off %u + len %u exceeds segment data size %u\n",
+ key->cache_pos.seg_off, key->len,
+ key->cache_pos.cache_seg->segment.data_size);
+ return -EIO;
+ }
+
key->seg_gen = key_onmedia->seg_gen;
key->flags = key_onmedia->flags;
@@ -778,7 +786,7 @@ int cache_replay(struct pcache_cache *ca
goto out;
}
- if (kset_onmedia->magic != PCACHE_KSET_MAGIC ||
+ if (!kset_onmedia_valid(kset_onmedia) ||
kset_onmedia->crc != cache_kset_crc(kset_onmedia)) {
break;
}
--- a/drivers/md/dm-pcache/cache_writeback.c
+++ b/drivers/md/dm-pcache/cache_writeback.c
@@ -55,11 +55,11 @@ static inline bool is_cache_clean(struct
return true;
}
- /* Check if the magic number matches the expected value */
- if (kset_onmedia->magic != PCACHE_KSET_MAGIC) {
- pcache_dev_debug(pcache, "dirty_tail: %u:%u magic: %llx, not expected: %llx\n",
+ /* Reject a corrupted or out-of-bounds kset before reading its keys */
+ if (!kset_onmedia_valid(kset_onmedia)) {
+ pcache_dev_debug(pcache, "dirty_tail: %u:%u invalid kset magic: %llx, key_num: %u\n",
dirty_tail->cache_seg->cache_seg_id, dirty_tail->seg_off,
- kset_onmedia->magic, PCACHE_KSET_MAGIC);
+ kset_onmedia->magic, kset_onmedia->key_num);
return true;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 656/713] dm-pcache: validate on-media seg_num against the cache device size
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 655/713] dm-pcache: validate kset key_num and intra-segment bounds Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 657/713] dm-pcache: bound the persisted tail-position offset Greg Kroah-Hartman
` (67 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 62d92e45abe9e087370f9fc5d876b95673aced34 upstream.
seg_num is read from the crc32c-only superblock, so whoever supplies the
cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes
cache->segments[] and is the value every later on-media segment id is
bounded against, yet it is never checked against the device. Because
cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for
a segment id past the device resolves to ordinary kernel memory beyond
the mapping; a new-cache init reaching such an id has cache_seg_init() ->
cache_dev_zero_range() memset() 12 KiB over that memory -- an
out-of-bounds write into the kernel heap at table load. A zero seg_num
makes the segment allocations ZERO_SIZE_PTR.
Reject a seg_num that is zero, larger than the device can hold, or larger
than PCACHE_CACHE_SEGS_MAX before it is used.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache_dev.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-pcache/cache_dev.c
+++ b/drivers/md/dm-pcache/cache_dev.c
@@ -242,6 +242,8 @@ int cache_dev_start(struct dm_pcache *pc
struct pcache_cache_dev *cache_dev = &pcache->cache_dev;
struct pcache_sb sb;
bool format = false;
+ u32 seg_num;
+ u64 max_segs;
int ret;
mutex_init(&cache_dev->seg_lock);
@@ -269,7 +271,25 @@ int cache_dev_start(struct dm_pcache *pc
goto dax_release;
cache_dev->sb_flags = le32_to_cpu(sb.flags);
- ret = cache_dev_init(cache_dev, le32_to_cpu(sb.seg_num));
+
+ /*
+ * seg_num is read from the crc32c-only superblock, so whoever supplies
+ * the cache device controls it. It is the ceiling every later on-media
+ * segment id is validated against, so bound it against what the device
+ * physically holds before it is trusted, or a forged seg_num lets a
+ * segment id address past the DAX mapping.
+ */
+ seg_num = le32_to_cpu(sb.seg_num);
+ max_segs = (bdev_nr_bytes(cache_dev->dm_dev->bdev) - PCACHE_SEGMENTS_OFF) /
+ PCACHE_SEG_SIZE;
+ if (seg_num == 0 || seg_num > max_segs || seg_num > PCACHE_CACHE_SEGS_MAX) {
+ pcache_dev_err(pcache, "invalid seg_num %u from cache device (device holds %llu, max %u)\n",
+ seg_num, max_segs, (u32)PCACHE_CACHE_SEGS_MAX);
+ ret = -EIO;
+ goto dax_release;
+ }
+
+ ret = cache_dev_init(cache_dev, seg_num);
if (ret)
goto dax_release;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 657/713] dm-pcache: bound the persisted tail-position offset
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 656/713] dm-pcache: validate on-media seg_num against the cache device size Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 658/713] dm-pcache: clamp the tail kset read to the segment data region Greg Kroah-Hartman
` (66 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit d1898576090a10d2ac2715218a652e78fb65a6b0 upstream.
cache_pos_decode() takes the persisted key_tail and dirty_tail seg_off from
the cache device and addresses within the segment with it. A seg_off at or
past the segment data_size, controllable by whoever supplies the device
(CAP_SYS_ADMIN), reads past the segment data.
Reject a decoded seg_off that is not below the segment data_size.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/md/dm-pcache/cache.c
+++ b/drivers/md/dm-pcache/cache.c
@@ -119,6 +119,10 @@ int cache_pos_decode(struct pcache_cache
return -EIO;
pos->cache_seg = &cache->segments[latest.cache_seg_id];
+
+ if (latest.seg_off >= pos->cache_seg->segment.data_size)
+ return -EIO;
+
pos->seg_off = latest.seg_off;
*seq = latest.header.seq;
*index = (latest_addr - pos_onmedia);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 658/713] dm-pcache: clamp the tail kset read to the segment data region
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 657/713] dm-pcache: bound the persisted tail-position offset Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 659/713] dm-pcache: detect a cycle in the last-kset chain during replay Greg Kroah-Hartman
` (65 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit becf07e2b0053027495ecd671b1f82fb2e615f68 upstream.
The tail-kset read in cache_replay(), the writeback worker and the GC
worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment
size rather than the data region. A tail near the segment end reads past
the segment data into the following control area.
Clamp the read to cache_seg_remain(), the data region.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache_gc.c | 2 +-
drivers/md/dm-pcache/cache_key.c | 2 +-
drivers/md/dm-pcache/cache_writeback.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/md/dm-pcache/cache_gc.c
+++ b/drivers/md/dm-pcache/cache_gc.c
@@ -37,7 +37,7 @@ static bool need_gc(struct pcache_cache
kset_onmedia = (struct pcache_cache_kset_onmedia *)cache->gc_kset_onmedia_buf;
- to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, PCACHE_SEG_SIZE - key_tail->seg_off);
+ to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, cache_seg_remain(key_tail));
ret = copy_mc_to_kernel(kset_onmedia, key_addr, to_copy);
if (ret) {
pcache_dev_err(pcache, "error to read kset: %d", ret);
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -779,7 +779,7 @@ int cache_replay(struct pcache_cache *ca
__set_bit(pos->cache_seg->cache_seg_id, cache->seg_map);
while (true) {
- to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, PCACHE_SEG_SIZE - pos->seg_off);
+ to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, cache_seg_remain(pos));
ret = copy_mc_to_kernel(kset_onmedia, cache_pos_addr(pos), to_copy);
if (ret) {
ret = -EIO;
--- a/drivers/md/dm-pcache/cache_writeback.c
+++ b/drivers/md/dm-pcache/cache_writeback.c
@@ -48,7 +48,7 @@ static inline bool is_cache_clean(struct
addr = cache_pos_addr(dirty_tail);
kset_onmedia = (struct pcache_cache_kset_onmedia *)cache->wb_kset_onmedia_buf;
- to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, PCACHE_SEG_SIZE - dirty_tail->seg_off);
+ to_copy = min(PCACHE_KSET_ONMEDIA_SIZE_MAX, cache_seg_remain(dirty_tail));
ret = copy_mc_to_kernel(kset_onmedia, addr, to_copy);
if (ret) {
pcache_dev_err(pcache, "error to read kset: %d", ret);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 659/713] dm-pcache: detect a cycle in the last-kset chain during replay
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 658/713] dm-pcache: clamp the tail kset read to the segment data region Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 660/713] dm-pcache: only hand out initialized cache segments Greg Kroah-Hartman
` (64 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 16c3b3a326e70f246a605b3dc27b7f83ba4743e3 upstream.
cache_replay() follows the on-media last-kset chain by next_cache_seg_id
with no cond_resched(). A forged chain that points back into a segment it
has already visited makes the replay loop follow it forever.
Cap the last-kset hops at cache->n_segs; a valid chain visits each segment
at most once.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache_key.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -762,7 +762,7 @@ int cache_replay(struct pcache_cache *ca
struct pcache_cache_pos pos_tail;
struct pcache_cache_pos *pos;
struct pcache_cache_kset_onmedia *kset_onmedia;
- u32 to_copy, count = 0;
+ u32 to_copy, count = 0, last_hops = 0;
int ret = 0;
kset_onmedia = kzalloc(PCACHE_KSET_ONMEDIA_SIZE_MAX, GFP_KERNEL);
@@ -797,6 +797,11 @@ int cache_replay(struct pcache_cache *ca
pcache_dev_debug(pcache, "last kset replay, next: %u\n", kset_onmedia->next_cache_seg_id);
+ if (++last_hops > cache->n_segs) {
+ ret = -EIO;
+ goto out;
+ }
+
next_seg = &cache->segments[kset_onmedia->next_cache_seg_id];
pos->cache_seg = next_seg;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 660/713] dm-pcache: only hand out initialized cache segments
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 659/713] dm-pcache: detect a cycle in the last-kset chain during replay Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 661/713] dm-pcache: fix implicit u8 truncation of gc_percent in message handler Greg Kroah-Hartman
` (63 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 2df0fc042e299bae3c0f60ea5cd2af9285658e9f upstream.
get_cache_segment() scans the segment map up to cache->n_segs, the
physical device segment count, but cache_segs_init() only initializes
the first cache_info->n_segs segments. A crafted image with
cache_info->n_segs smaller than the device count leaves the remaining
pcache_cache_segment structs zeroed (segment.data == NULL), and the
allocator can hand one to cache_kset_close(), which writes through the
returned segment's data pointer with no NULL check.
Bound the allocator's search to cache_info->n_segs so only initialized
segments are ever returned. A conforming cache sets n_segs equal to the
device segment count, so this rejects nothing legitimate.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache_segment.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-pcache/cache_segment.c
+++ b/drivers/md/dm-pcache/cache_segment.c
@@ -243,8 +243,16 @@ struct pcache_cache_segment *get_cache_s
spin_lock(&cache->seg_map_lock);
again:
- seg_id = find_next_zero_bit(cache->seg_map, cache->n_segs, cache->last_cache_seg);
- if (seg_id == cache->n_segs) {
+ /*
+ * Only allocate initialized segments. cache_segs_init() initializes
+ * cache_info.n_segs of the cache->n_segs device segments; a forged
+ * smaller cache_info.n_segs leaves the rest as zeroed structs whose data
+ * pointer is NULL. Bounding the search to cache_info.n_segs keeps such a
+ * segment from reaching cache_kset_close(), which writes through it.
+ */
+ seg_id = find_next_zero_bit(cache->seg_map, cache->cache_info.n_segs,
+ cache->last_cache_seg);
+ if (seg_id == cache->cache_info.n_segs) {
/* reset the hint of ->last_cache_seg and retry */
if (cache->last_cache_seg) {
cache->last_cache_seg = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 661/713] dm-pcache: fix implicit u8 truncation of gc_percent in message handler
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 660/713] dm-pcache: only hand out initialized cache segments Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 662/713] dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Greg Kroah-Hartman
` (62 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
commit fb9e17287a4ea1cbbcedc77e6866978ecc2a7b55 upstream.
When setting gc_percent via message, kstrtoul parses the input into an
unsigned long, which is then implicitly truncated to u8 when passed to
pcache_cache_set_gc_percent(). For example, value 266 (0x10A) silently
truncates to 10 (0x0A), successfully bypassing the > 90 upper bound
check in pcache_cache_set_gc_percent(), and setting a different value
than the user intended.
Use kstrtou8 directly instead of kstrtoul, so that overflow values are
properly rejected.
Cc: stable@vger.kernel.org
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/dm_pcache.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-pcache/dm_pcache.c
+++ b/drivers/md/dm-pcache/dm_pcache.c
@@ -439,13 +439,13 @@ static int dm_pcache_message(struct dm_t
char **argv, char *result, unsigned int maxlen)
{
struct dm_pcache *pcache = ti->private;
- unsigned long val;
+ u8 val;
if (argc != 2)
goto err;
if (!strcasecmp(argv[0], "gc_percent")) {
- if (kstrtoul(argv[1], 10, &val))
+ if (kstrtou8(argv[1], 10, &val))
goto err;
return pcache_cache_set_gc_percent(&pcache->cache, val);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 662/713] dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 661/713] dm-pcache: fix implicit u8 truncation of gc_percent in message handler Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 663/713] i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() Greg Kroah-Hartman
` (61 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Mikulas Patocka
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
commit c2e894eac398b258f12fdec73ed6ba081047f7b3 upstream.
In kset_replay, when key->seg_gen is stale (key->seg_gen <
key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then
key->cache_pos.cache_seg is accessed as the argument to cache_seg_get().
This is a use-after-free on the freed key memory. Although mempool
recycled memory is not immediately reclaimed or overwritten in practice,
this is still a potential UAF bug.
Additionally, for expired invalid keys, setting the cache->seg_map bit
and calling cache_seg_get() is unreasonable since the corresponding
segment data is no longer valid.
Fix both issues by moving cache_seg_get() and __set_bit() after the
gen check, so they only execute for valid keys, and using continue to
skip invalid keys.
Cc: stable@vger.kernel.org
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-pcache/cache_key.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -736,18 +736,17 @@ static int kset_replay(struct pcache_cac
goto err;
}
- __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
-
/* Check if the segment generation is valid for insertion. */
if (key->seg_gen < key->cache_pos.cache_seg->gen) {
cache_key_put(key);
- } else {
- cache_subtree = get_subtree(&cache->req_key_tree, key->off);
- spin_lock(&cache_subtree->tree_lock);
- cache_key_insert(&cache->req_key_tree, key, true);
- spin_unlock(&cache_subtree->tree_lock);
+ continue;
}
+ __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
+ cache_subtree = get_subtree(&cache->req_key_tree, key->off);
+ spin_lock(&cache_subtree->tree_lock);
+ cache_key_insert(&cache->req_key_tree, key, true);
+ spin_unlock(&cache_subtree->tree_lock);
cache_seg_get(key->cache_pos.cache_seg);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 663/713] i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 662/713] dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 664/713] i3c: master: adi: initialize the lock before enabling interrupts Greg Kroah-Hartman
` (60 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit 8bed7f4fa710914b7f05fd59998316bfb4d43385 upstream.
i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the
master controller. However, dev->desc must not be dereferenced unless
bus->lock is held, and this function does not take that lock.
The function only needs access to the master controller associated with
the device's bus. Use dev->bus instead, which is always valid for the
lifetime of the device and does not require dereferencing dev->desc.
Fixes: 256a21743d91 ("i3c: Add HDR API support")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/device.c | 2 +-
drivers/i3c/internals.h | 5 +++++
drivers/i3c/master.c | 6 ------
3 files changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/i3c/device.c
+++ b/drivers/i3c/device.c
@@ -309,7 +309,7 @@ EXPORT_SYMBOL_GPL(i3c_device_match_id);
*/
u32 i3c_device_get_supported_xfer_mode(struct i3c_device *dev)
{
- return i3c_dev_get_master(dev->desc)->this->info.hdr_cap | BIT(I3C_SDR);
+ return i3c_bus_to_i3c_master(dev->bus)->this->info.hdr_cap | BIT(I3C_SDR);
}
EXPORT_SYMBOL_GPL(i3c_device_get_supported_xfer_mode);
--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@@ -72,4 +72,9 @@ static inline void i3c_readl_fifo(const
}
}
+static inline struct i3c_master_controller *i3c_bus_to_i3c_master(struct i3c_bus *i3cbus)
+{
+ return container_of(i3cbus, struct i3c_master_controller, bus);
+}
+
#endif /* I3C_INTERNAL_H */
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -97,12 +97,6 @@ void i3c_bus_normaluse_unlock(struct i3c
up_read(&bus->lock);
}
-static struct i3c_master_controller *
-i3c_bus_to_i3c_master(struct i3c_bus *i3cbus)
-{
- return container_of(i3cbus, struct i3c_master_controller, bus);
-}
-
static struct i3c_master_controller *dev_to_i3cmaster(struct device *dev)
{
return container_of(dev, struct i3c_master_controller, dev);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 664/713] i3c: master: adi: initialize the lock before enabling interrupts
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 663/713] i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 665/713] i3c: master: Fix info leak and UAF in device unregister path Greg Kroah-Hartman
` (59 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Frank Li,
Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 8a53f9102a0d3eeb8784999f925028acf339c276 upstream.
adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR
before the controller's IBI state, transfer queue list and transfer
queue lock are initialized. A pending CMDR interrupt can therefore run
adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic
lock has been initialized.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the probe ordering and the IRQ path
adi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a
pending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.
Lockdep reported:
INFO: trying to register non-static key.
you didn't initialize this object before use?
lock_acquire+0xbb/0x290
_raw_spin_lock_irqsave+0x36/0x60
adi_i3c_master_irq+0x32/0x56 [vuln_msv]
adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]
Initialize the transfer queue and IBI state before requesting and
unmasking the IRQ.
Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260617150138.628578-1-runyu.xiao@seu.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/adi-i3c-master.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/drivers/i3c/master/adi-i3c-master.c
+++ b/drivers/i3c/master/adi-i3c-master.c
@@ -964,17 +964,9 @@ static int adi_i3c_master_probe(struct p
writel(0x00, master->regs + REG_ENABLE);
writel(0x00, master->regs + REG_IRQ_MASK);
- ret = devm_request_irq(&pdev->dev, irq, adi_i3c_master_irq, 0,
- dev_name(&pdev->dev), master);
- if (ret)
- return ret;
-
platform_set_drvdata(pdev, master);
master->free_rr_slots = GENMASK(ADI_MAX_DEVS, 1);
-
- writel(REG_IRQ_PENDING_CMDR, master->regs + REG_IRQ_MASK);
-
spin_lock_init(&master->ibi.lock);
master->ibi.num_slots = 15;
master->ibi.slots = devm_kcalloc(&pdev->dev, master->ibi.num_slots,
@@ -986,6 +978,13 @@ static int adi_i3c_master_probe(struct p
spin_lock_init(&master->xferqueue.lock);
INIT_LIST_HEAD(&master->xferqueue.list);
+ ret = devm_request_irq(&pdev->dev, irq, adi_i3c_master_irq, 0,
+ dev_name(&pdev->dev), master);
+ if (ret)
+ return ret;
+
+ writel(REG_IRQ_PENDING_CMDR, master->regs + REG_IRQ_MASK);
+
return i3c_master_register(&master->base, &pdev->dev,
&adi_i3c_master_ops, false);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 665/713] i3c: master: Fix info leak and UAF in device unregister path
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 664/713] i3c: master: adi: initialize the lock before enabling interrupts Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 666/713] i3c: master: svc: bound IBI payload to the requested max_payload_len Greg Kroah-Hartman
` (58 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter, Frank Li,
Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit d2c743efd2d1ee64e94324664808f623dd865872 upstream.
i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before
calling device_unregister(). During device_unregister(),
device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while
the device descriptor is still expected to be valid. As a result,
i3c_device_uevent() and a racing modalias_show() can observe a NULL
desc and fall back to an uninitialized stack struct i3c_device_info,
leaking kernel stack contents in the generated modalias. Driver
.remove() callbacks may also encounter an unexpected NULL desc during
unbind.
Keep desc valid until device_unregister() has completed. Since
device_unregister() drops the device reference and may free the device,
take an extra reference with get_device() before unregistering. Clear
desc afterwards and release the extra reference with put_device().
This preserves the release-time invariant that desc must be NULL while
avoiding both the information leak and a potential use-after-free from
writing desc after the device has been released.
Reported-by: sashiko-bot@kernel.org
Link: https://lore.kernel.org/linux-i3c/20260702190003.8BF741F000E9@smtp.kernel.org/
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260723075747.34049-1-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2971,11 +2971,12 @@ static void i3c_master_unregister_i3c_de
if (!i3cdev->dev)
continue;
- i3cdev->dev->desc = NULL;
- if (device_is_registered(&i3cdev->dev->dev))
+ if (device_is_registered(&i3cdev->dev->dev)) {
+ get_device(&i3cdev->dev->dev);
device_unregister(&i3cdev->dev->dev);
- else
- put_device(&i3cdev->dev->dev);
+ }
+ i3cdev->dev->desc = NULL;
+ put_device(&i3cdev->dev->dev);
i3cdev->dev = NULL;
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 666/713] i3c: master: svc: bound IBI payload to the requested max_payload_len
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 665/713] i3c: master: Fix info leak and UAF in device unregister path Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 667/713] i3c: master: Fix potential UAF in i3c_device_uevent() Greg Kroah-Hartman
` (57 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaixuan Li, Maoyi Xie, Frank Li,
Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit e2bda39d7f9f285ec803e200b5c1f17143d0b483 upstream.
svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into
the IBI slot. The loop is bounded by the hardware FIFO size
(SVC_I3C_FIFO_SIZE), not by the slot size.
slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool()
sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only
rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can
request a smaller one. mctp-i3c requests 1. Each readsb() then copies the
controller RXCOUNT bytes (up to 31) with no check against the slot size.
A device that sends more bytes than the slot holds writes past
slot->data, an out-of-bounds write into the IBI pool.
Bound the loop by dev->ibi->max_payload_len and clamp each read to the
space left in the slot, the same way dw-i3c does. A device can still send
more than the requested payload. Flush the leftover bytes from the RX FIFO
so they do not leak into the next transfer.
Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Cc: stable@vger.kernel.org
Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/178227747353.2931373.15868718612134648277@maoyixie.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/svc-i3c-master.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -455,14 +455,22 @@ static int svc_i3c_master_handle_ibi(str
buf = slot->data;
while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) &&
- slot->len < SVC_I3C_FIFO_SIZE) {
+ slot->len < dev->ibi->max_payload_len) {
mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL);
count = SVC_I3C_MDATACTRL_RXCOUNT(mdatactrl);
+ count = min(count, dev->ibi->max_payload_len - slot->len);
readsb(master->regs + SVC_I3C_MRDATAB, buf, count);
slot->len += count;
buf += count;
}
+ /*
+ * The device may have sent more than the requested payload. Drop the
+ * extra bytes so they do not leak into the next transfer.
+ */
+ if (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)))
+ writel(SVC_I3C_MDATACTRL_FLUSHRB, master->regs + SVC_I3C_MDATACTRL);
+
master->ibi.tbq_slot = slot;
return 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 667/713] i3c: master: Fix potential UAF in i3c_device_uevent()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 666/713] i3c: master: svc: bound IBI payload to the requested max_payload_len Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 668/713] i3c: renesas: Check that the transfer is valid before accessing it Greg Kroah-Hartman
` (56 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Mukesh Savaliya,
Frank Li, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit e5e8dd2e959f470524c16ca444d001c90d6bb3ad upstream.
i3c_device_uevent() dereferences i3cdev->desc without holding the bus
normal-use lock. Since the descriptor pointer can be replaced
concurrently, including when a uevent is generated from sysfs, this can
result in dereferencing a stale descriptor and lead to a use-after-free.
Use i3c_device_get_info() instead, which protects access to the
descriptor with the normal-use lock.
Commit 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling
i3c_device_get_info() to avoid deadlock") replaced the accessor with a
direct descriptor dereference because i3c_device_get_info() would
recursively acquire bus->lock during device registration.
This change depends on "i3c: master: Fix recursive locking during device
registration", which moves device registration out from under bus->lock
and removes the possibility of that deadlock. Without that change,
restoring the i3c_device_get_info() call would reintroduce the deadlock.
Fixes: 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock")
Cc: stable@vger.kernel.org # requires "i3c: master: Fix recursive locking during device registration"
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-7-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -311,8 +311,7 @@ static int i3c_device_uevent(const struc
struct i3c_device_info devinfo;
u16 manuf, part, ext;
- if (i3cdev->desc)
- devinfo = i3cdev->desc->info;
+ i3c_device_get_info(i3cdev, &devinfo);
manuf = I3C_PID_MANUF_ID(devinfo.pid);
part = I3C_PID_PART_ID(devinfo.pid);
ext = I3C_PID_EXTRA_INFO(devinfo.pid);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 668/713] i3c: renesas: Check that the transfer is valid before accessing it
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 667/713] i3c: master: Fix potential UAF in i3c_device_uevent() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 669/713] i3c: renesas: Clean DATBAS register on detach Greg Kroah-Hartman
` (55 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Frank Li,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 5f1a76ecfe90544a28d657306c9b3caa66ba0e63 upstream.
The Renesas I3C driver uses an asynchronous model to transfer data. It
prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion.
The interrupt handler dequeues the transfer, updates/uses it, and signals
the waiting thread.
If the completion times out, the waiting thread dequeues the transfer and
free it. If an interrupt fires after that, the handler may access freed
memory, leading to crashes.
Check that the transfer is still valid before accessing it in the
interrupt handler. With it clear any status flags and disable all
the interrupts to avoid triggering the same interrupts again.
Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-2-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 52 +++++++++++++++++++++++++++++++++------
1 file changed, 45 insertions(+), 7 deletions(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -433,6 +433,21 @@ static void renesas_i3c_enqueue_xfer(str
}
}
+static void renesas_i3c_irqs_mask_and_clear_locked(struct renesas_i3c *i3c)
+{
+ /* Disable all the interrupts. */
+ renesas_writel(i3c->regs, BIE, 0);
+ renesas_writel(i3c->regs, NTIE, 0);
+
+ /* Clear normal transfer status flags. */
+ renesas_writel(i3c->regs, NTST, 0);
+
+ /* Clear bus status flags. */
+ renesas_writel(i3c->regs, BST, 0);
+ /* Read back registers to confirm writes have fully propagated. */
+ renesas_readl(i3c->regs, BST);
+}
+
static void renesas_i3c_wait_xfer(struct renesas_i3c *i3c, struct renesas_i3c_xfer *xfer)
{
unsigned long time_left;
@@ -1018,6 +1033,11 @@ static irqreturn_t renesas_i3c_tx_isr(in
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
+ if (!xfer) {
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
+ return IRQ_HANDLED;
+ }
+
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1058,6 +1078,11 @@ static irqreturn_t renesas_i3c_resp_isr(
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
+ if (!xfer) {
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
+ return IRQ_HANDLED;
+ }
+
cmd = xfer->cmds;
/* Clear the Respone Queue Full status flag*/
@@ -1142,6 +1167,11 @@ static irqreturn_t renesas_i3c_tend_isr(
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
+ if (!xfer) {
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
+ return IRQ_HANDLED;
+ }
+
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1188,6 +1218,11 @@ static irqreturn_t renesas_i3c_rx_isr(in
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
+ if (!xfer) {
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
+ return IRQ_HANDLED;
+ }
+
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1238,15 +1273,13 @@ static irqreturn_t renesas_i3c_stop_isr(
struct renesas_i3c_xfer *xfer;
scoped_guard(spinlock, &i3c->xferqueue.lock) {
- xfer = i3c->xferqueue.cur;
-
- /* read back registers to confirm writes have fully propagated */
- renesas_writel(i3c->regs, BST, 0);
- renesas_readl(i3c->regs, BST);
- renesas_writel(i3c->regs, BIE, 0);
- renesas_clear_bit(i3c->regs, NTST, NTST_TDBEF0 | NTST_RDBFF0);
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
renesas_clear_bit(i3c->regs, SCSTRCTL, SCSTRCTL_RWE);
+ xfer = i3c->xferqueue.cur;
+ if (!xfer)
+ return IRQ_HANDLED;
+
xfer->ret = 0;
complete(&xfer->comp);
}
@@ -1263,6 +1296,11 @@ static irqreturn_t renesas_i3c_start_isr
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
+ if (!xfer) {
+ renesas_i3c_irqs_mask_and_clear_locked(i3c);
+ return IRQ_HANDLED;
+ }
+
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 669/713] i3c: renesas: Clean DATBAS register on detach
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 668/713] i3c: renesas: Check that the transfer is valid before accessing it Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 670/713] i3c: renesas: Follow the reset deassert order used in probe Greg Kroah-Hartman
` (54 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Claudiu Beznea,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 797ed83c0cd495be4b345750c59e0363bf4d6207 upstream.
The controller uses DATBAS registers on TX/RX logic. Clean the DATBAS
register for the detached I3C device to avoid issues.
Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-8-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -924,6 +924,8 @@ static void renesas_i3c_detach_i3c_dev(s
struct i3c_master_controller *m = i3c_dev_get_master(dev);
struct renesas_i3c *i3c = to_renesas_i3c(m);
+ renesas_writel(i3c->regs, DATBAS(data->index), 0);
+
i3c_dev_set_master_data(dev, NULL);
i3c->addrs[data->index] = 0;
i3c->free_pos |= BIT(data->index);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 670/713] i3c: renesas: Follow the reset deassert order used in probe
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 669/713] i3c: renesas: Clean DATBAS register on detach Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 671/713] i3c: renesas: Reconfigure the DATBAS register on re-attach Greg Kroah-Hartman
` (53 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Claudiu Beznea,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 7b15ca2615ec41fb428eb9af71bf3ebc95021201 upstream.
Use the same reset deassert order in the resume and probe paths to avoid
potential failures due to ordering differences.
Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-4-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -1461,17 +1461,17 @@ static int renesas_i3c_resume_noirq(stru
struct renesas_i3c *i3c = dev_get_drvdata(dev);
int i, ret;
- ret = reset_control_deassert(i3c->presetn);
+ ret = reset_control_deassert(i3c->tresetn);
if (ret)
return ret;
- ret = reset_control_deassert(i3c->tresetn);
+ ret = reset_control_deassert(i3c->presetn);
if (ret)
- goto err_presetn;
+ goto err_tresetn;
ret = clk_bulk_enable(i3c->num_clks, i3c->clks);
if (ret)
- goto err_tresetn;
+ goto err_presetn;
/* Re-store I3C registers value. */
renesas_writel(i3c->regs, REFCKCTL,
@@ -1490,10 +1490,10 @@ static int renesas_i3c_resume_noirq(stru
return 0;
-err_tresetn:
- reset_control_assert(i3c->tresetn);
err_presetn:
reset_control_assert(i3c->presetn);
+err_tresetn:
+ reset_control_assert(i3c->tresetn);
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 671/713] i3c: renesas: Reconfigure the DATBAS register on re-attach
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 670/713] i3c: renesas: Follow the reset deassert order used in probe Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 672/713] i3c: renesas: Reset the controller on resume Greg Kroah-Hartman
` (52 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Claudiu Beznea,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 1364afd3e2e76e007a2c07ec95704d56980226f0 upstream.
During re-attach, the device may change its position in the i3c->addrs[]
array. As a result, it may use a different Device Address Table Basic
Register (DATBAS), which needs to be reconfigured.
Reconfigure the DATBAS register on re-attach. Along with it update
software caches.
Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-5-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -911,10 +911,26 @@ static int renesas_i3c_reattach_i3c_dev(
struct i3c_master_controller *m = i3c_dev_get_master(dev);
struct renesas_i3c *i3c = to_renesas_i3c(m);
struct renesas_i3c_i2c_dev_data *data = i3c_dev_get_master_data(dev);
+ int pos;
+
+ pos = renesas_i3c_get_free_pos(i3c);
+
+ if (data->index > pos && pos >= 0) {
+ renesas_writel(i3c->regs, DATBAS(data->index), 0);
+ i3c->addrs[data->index] = 0;
+ i3c->free_pos |= BIT(data->index);
+
+ data->index = pos;
+ i3c->free_pos &= ~BIT(data->index);
+ }
i3c->addrs[data->index] = dev->info.dyn_addr ? dev->info.dyn_addr :
dev->info.static_addr;
+ renesas_writel(i3c->regs, DATBAS(data->index),
+ DATBAS_DVSTAD(dev->info.static_addr) |
+ datbas_dvdyad_with_parity(i3c->addrs[data->index]));
+
return 0;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 672/713] i3c: renesas: Reset the controller on resume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 671/713] i3c: renesas: Reconfigure the DATBAS register on re-attach Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 673/713] i3c: renesas: Restore STDBR and EXTBR registers " Greg Kroah-Hartman
` (51 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Claudiu Beznea,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 27cf0ad162f1a4526a86fc2ec24d84a4a98ac1dd upstream.
Reset the controller on resume after enabling the clocks to follow the
same sequence as in probe and avoid potential ordering related failures.
With it, renesas_i3c_reset() was updated to use read_poll_timeout_atomic(),
as the driver's resume callback is executed during the noirq phase of
resume, where interrupts are disabled.
Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-6-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -494,8 +494,8 @@ static int renesas_i3c_reset(struct rene
renesas_writel(i3c->regs, BCTL, 0);
renesas_set_bit(i3c->regs, RSTCTL, RSTCTL_RI3CRST);
- return read_poll_timeout(renesas_readl, val, !(val & RSTCTL_RI3CRST),
- 0, 1000, false, i3c->regs, RSTCTL);
+ return read_poll_timeout_atomic(renesas_readl, val, !(val & RSTCTL_RI3CRST),
+ 0, 1000, false, i3c->regs, RSTCTL);
}
static void renesas_i3c_hw_init(struct renesas_i3c *i3c)
@@ -1489,6 +1489,10 @@ static int renesas_i3c_resume_noirq(stru
if (ret)
goto err_presetn;
+ ret = renesas_i3c_reset(i3c);
+ if (ret)
+ goto err_clks_disable;
+
/* Re-store I3C registers value. */
renesas_writel(i3c->regs, REFCKCTL,
REFCKCTL_IREFCKS(i3c->refclk_div));
@@ -1506,6 +1510,8 @@ static int renesas_i3c_resume_noirq(stru
return 0;
+err_clks_disable:
+ clk_bulk_disable(i3c->num_clks, i3c->clks);
err_presetn:
reset_control_assert(i3c->presetn);
err_tresetn:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 673/713] i3c: renesas: Restore STDBR and EXTBR registers on resume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 672/713] i3c: renesas: Reset the controller on resume Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 674/713] i3c: renesas: Perform Dynamic Address Assignment " Greg Kroah-Hartman
` (50 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Claudiu Beznea,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 21cded44e69c630799e65baadb72ad123d1347c8 upstream.
The Renesas RZ/G3S supports a power saving state where power to the most
SoC componentes (including I3C) is lost.
The STDBR and EXTBR are configured in initialization phase though the
struct i3c_master_controller_ops::bus_init. Set them on resume function
as well to keep the same state of the controller after a suspend with
power loss and a similar initialization sequence as in bus_init.
Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-3-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -260,6 +260,7 @@ struct renesas_i3c {
u32 dyn_addr;
u32 i2c_STDBR;
u32 i3c_STDBR;
+ u32 extbr;
unsigned long rate;
u8 addrs[RENESAS_I3C_MAX_DEVS];
struct renesas_i3c_xferqueue xferqueue;
@@ -622,10 +623,9 @@ static int renesas_i3c_bus_init(struct i
renesas_writel(i3c->regs, STDBR, i3c->i3c_STDBR);
/* Extended Bit Rate setting */
- renesas_writel(i3c->regs, EXTBR, EXTBR_EBRLO(od_low_ticks) |
- EXTBR_EBRHO(od_high_ticks) |
- EXTBR_EBRLP(pp_low_ticks) |
- EXTBR_EBRHP(pp_high_ticks));
+ i3c->extbr = EXTBR_EBRLO(od_low_ticks) | EXTBR_EBRHO(od_high_ticks) |
+ EXTBR_EBRLP(pp_low_ticks) | EXTBR_EBRHP(pp_high_ticks);
+ renesas_writel(i3c->regs, EXTBR, i3c->extbr);
renesas_writel(i3c->regs, REFCKCTL, REFCKCTL_IREFCKS(cks));
i3c->refclk_div = cks;
@@ -1494,6 +1494,8 @@ static int renesas_i3c_resume_noirq(stru
goto err_clks_disable;
/* Re-store I3C registers value. */
+ renesas_writel(i3c->regs, STDBR, i3c->i3c_STDBR);
+ renesas_writel(i3c->regs, EXTBR, i3c->extbr);
renesas_writel(i3c->regs, REFCKCTL,
REFCKCTL_IREFCKS(i3c->refclk_div));
renesas_writel(i3c->regs, MSDVAD, MSDVAD_MDYADV |
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 674/713] i3c: renesas: Perform Dynamic Address Assignment on resume
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 673/713] i3c: renesas: Restore STDBR and EXTBR registers " Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 675/713] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Greg Kroah-Hartman
` (49 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Frank Li,
Tommaso Merciai, Alexandre Belloni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit fbf26154c47953d08c60fb402ab19c5c56c3779f upstream.
The Renesas RZ/G3S SoC supports a power saving mode where power to most
SoC components, including I3C, is turned off.
On systems where the I3C devices also loses power during suspend (e.g. NXP
P3T1085UK-ARD connected to the PMOD1_6A connector of the RZ SMARC Carrier
2 + Renesas RZ/G3S SMARC SOM), the devices becomes unreachable after
resume.
Running DAA in the controller resume path restores communication. However,
DAA relies on interrupts for TX/RX, which are not available in the noirq
suspend/resume phase (unless they are wakeup interrupts). For this, the
suspend/resume callbacks were moved out of the noirq phase. Currently,
there is no identified use case on either the Renesas RZ/G3S or Renesas
RZ/G3E SoCs that requires the controller suspend/resume hooks to be part of
the noirq suspend/resume phase.
Since renesas_i3c_reset() is not called anymore in atomic context
update it to use read_poll_timeout().
Along with this, struct renesas_i3c::DATBASn and its usage were removed,
as they are no longer needed.
Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-7-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/renesas-i3c.c | 38 +++++++++++++++-----------------------
1 file changed, 15 insertions(+), 23 deletions(-)
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -265,7 +265,6 @@ struct renesas_i3c {
u8 addrs[RENESAS_I3C_MAX_DEVS];
struct renesas_i3c_xferqueue xferqueue;
void __iomem *regs;
- u32 *DATBASn;
struct clk_bulk_data *clks;
struct reset_control *presetn;
struct reset_control *tresetn;
@@ -495,8 +494,8 @@ static int renesas_i3c_reset(struct rene
renesas_writel(i3c->regs, BCTL, 0);
renesas_set_bit(i3c->regs, RSTCTL, RSTCTL_RI3CRST);
- return read_poll_timeout_atomic(renesas_readl, val, !(val & RSTCTL_RI3CRST),
- 0, 1000, false, i3c->regs, RSTCTL);
+ return read_poll_timeout(renesas_readl, val, !(val & RSTCTL_RI3CRST),
+ 0, 1000, false, i3c->regs, RSTCTL);
}
static void renesas_i3c_hw_init(struct renesas_i3c *i3c)
@@ -1425,12 +1424,6 @@ static int renesas_i3c_probe(struct plat
i3c->maxdevs = RENESAS_I3C_MAX_DEVS;
i3c->free_pos = GENMASK(i3c->maxdevs - 1, 0);
- /* Allocate dynamic Device Address Table backup. */
- i3c->DATBASn = devm_kzalloc(&pdev->dev, sizeof(u32) * i3c->maxdevs,
- GFP_KERNEL);
- if (!i3c->DATBASn)
- return -ENOMEM;
-
return i3c_master_register(&i3c->base, &pdev->dev, &renesas_i3c_ops, false);
}
@@ -1441,17 +1434,13 @@ static void renesas_i3c_remove(struct pl
i3c_master_unregister(&i3c->base);
}
-static int renesas_i3c_suspend_noirq(struct device *dev)
+static int renesas_i3c_suspend(struct device *dev)
{
struct renesas_i3c *i3c = dev_get_drvdata(dev);
- int i, ret;
+ int ret;
i2c_mark_adapter_suspended(&i3c->base.i2c);
- /* Store Device Address Table values. */
- for (i = 0; i < i3c->maxdevs; i++)
- i3c->DATBASn[i] = renesas_readl(i3c->regs, DATBAS(i));
-
ret = reset_control_assert(i3c->presetn);
if (ret)
goto err_mark_resumed;
@@ -1472,10 +1461,10 @@ err_mark_resumed:
return ret;
}
-static int renesas_i3c_resume_noirq(struct device *dev)
+static int renesas_i3c_resume(struct device *dev)
{
struct renesas_i3c *i3c = dev_get_drvdata(dev);
- int i, ret;
+ int ret;
ret = reset_control_deassert(i3c->tresetn);
if (ret)
@@ -1501,15 +1490,19 @@ static int renesas_i3c_resume_noirq(stru
renesas_writel(i3c->regs, MSDVAD, MSDVAD_MDYADV |
MSDVAD_MDYAD(i3c->dyn_addr));
- /* Restore Device Address Table values. */
- for (i = 0; i < i3c->maxdevs; i++)
- renesas_writel(i3c->regs, DATBAS(i), i3c->DATBASn[i]);
-
/* I3C hw init. */
renesas_i3c_hw_init(i3c);
+ ret = i3c_master_do_daa_ext(&i3c->base, true);
+ if (ret)
+ dev_err(dev, "DAA failed on resume, ret=%d", ret);
+
i2c_mark_adapter_resumed(&i3c->base.i2c);
+ /*
+ * I3C devices may have retained their dynamic address anyway. Do not
+ * fail the resume because of DAA error.
+ */
return 0;
err_clks_disable:
@@ -1522,8 +1515,7 @@ err_tresetn:
}
static const struct dev_pm_ops renesas_i3c_pm_ops = {
- NOIRQ_SYSTEM_SLEEP_PM_OPS(renesas_i3c_suspend_noirq,
- renesas_i3c_resume_noirq)
+ SYSTEM_SLEEP_PM_OPS(renesas_i3c_suspend, renesas_i3c_resume)
};
static const struct of_device_id renesas_i3c_of_ids[] = {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 675/713] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 674/713] i3c: renesas: Perform Dynamic Address Assignment " Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 676/713] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Greg Kroah-Hartman
` (48 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Arend van Spriel,
Johannes Berg
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 0d10db8e94fcb23a799789aaa696b4d8f937e207 upstream.
The memory allocated for buf is not freed in some of the error paths in
brcmf_sdio_read_control(). Fix that by adding vfree() calls.
Cc: stable@vger.kernel.org
Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control frame buffer")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[arend: rework as suggested by Johannes]
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260803093506.1647790-1-arend.vanspriel@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1827,17 +1827,18 @@ gotpkt:
if (bus->rxctl) {
brcmf_err("last control frame is being processed.\n");
spin_unlock_bh(&bus->rxctl_lock);
- vfree(buf);
goto done;
}
bus->rxctl = buf + doff;
bus->rxctl_orig = buf;
bus->rxlen = len - doff;
spin_unlock_bh(&bus->rxctl_lock);
+ buf = NULL;
done:
/* Awake any waiters */
brcmf_sdio_dcmd_resp_wake(bus);
+ vfree(buf);
}
/* Pad read to blocksize for efficiency */
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 676/713] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 675/713] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 677/713] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Greg Kroah-Hartman
` (47 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dawei Feng, Miri Korenblit
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 67105abd6195a685a84dcb8a5daf54a1f4bfdb60 upstream.
In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses
the out_free_eeprom_blob label. Consequently, error paths triggered after
successfully parsing the EEPROM free priv->nvm_data but leak
priv->eeprom_blob.
Fix this memory leak by reordering the error handling labels so
that out_free_eeprom falls through to out_free_eeprom_blob.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc6.
An x86_64 allyesconfig build showed no new warnings. As we do not have
supported Intel DVM wireless hardware and firmware to test with, no
runtime testing was able to be performed.
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Link: https://patch.msgid.link/20260624084404.570703-1-dawei.feng@seu.edu.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
@@ -1511,10 +1511,10 @@ out_destroy_workqueue:
priv->workqueue = NULL;
out_uninit_drv:
iwl_uninit_drv(priv);
-out_free_eeprom_blob:
- kfree(priv->eeprom_blob);
out_free_eeprom:
kfree(priv->nvm_data);
+out_free_eeprom_blob:
+ kfree(priv->eeprom_blob);
out_leave_trans:
iwl_trans_op_mode_leave(priv->trans);
out_free_hw:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 677/713] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 676/713] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 678/713] fuse: decouple fuse_ring creation from ent registration Greg Kroah-Hartman
` (46 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Ping-Ke Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 6c080026ecc17eecb103f8927c64ea73a74bb818 upstream.
rtl8xxxu arms rx_urb_wq from the RX completion path:
rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which
queues it on rx_urb_pending_list and, once the list grows past
RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker
rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through
container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),
which anchors it on rx_anchor and dereferences priv->udev.
rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,
update_beacon_work) but never cancels rx_urb_wq, so a worker armed during
the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after
rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,
producing a use-after-free. The window opens under active RX traffic
(pending count above the watermark) followed by a disconnect.
There are two teardown races to close:
* rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock
but called schedule_work() after dropping the lock. A completion
that observed shutdown == false and released the lock could then call
schedule_work() after rtl8xxxu_stop() had set shutdown and
cancel_work_sync() had already returned, arming the worker to run
after the teardown. Move schedule_work() under the same !shutdown
branch so the arming decision is atomic with the shutdown check.
* rtl8xxxu_rx_urb_work() anchors every URB it drained back onto
rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running
when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a
URB that escaped the kill. In rtl8xxxu_stop(), call
cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is
drained first.
After priv->shutdown is set under rx_urb_lock, completions can no longer
queue rx_urb_wq. cancel_work_sync() then drains the last queued or running
worker, and the following usb_kill_anchored_urbs() kills the URBs it may
have submitted.
rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw()
guarantees .stop() runs for a live interface before ieee80211_free_hw()
frees priv. The probe error path needs no cancel: rx_urb_wq is
INIT_WORK()'d there but cannot have been scheduled, since no URB is
submitted before ieee80211_register_hw() succeeds.
This bug was found by static analysis.
Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260630033117.3377-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -5838,14 +5838,19 @@ static void rtl8xxxu_queue_rx_urb(struct
{
struct sk_buff *skb;
unsigned long flags;
- int pending = 0;
spin_lock_irqsave(&priv->rx_urb_lock, flags);
if (!priv->shutdown) {
list_add_tail(&rx_urb->list, &priv->rx_urb_pending_list);
priv->rx_urb_pending_count++;
- pending = priv->rx_urb_pending_count;
+ /*
+ * Arm the worker under rx_urb_lock so this is atomic with the
+ * shutdown check: moving it out of the lock would let a
+ * completion arm the work after rtl8xxxu_stop() canceled it.
+ */
+ if (priv->rx_urb_pending_count > RTL8XXXU_RX_URB_PENDING_WATER)
+ schedule_work(&priv->rx_urb_wq);
} else {
skb = (struct sk_buff *)rx_urb->urb.context;
dev_kfree_skb_irq(skb);
@@ -5853,9 +5858,6 @@ static void rtl8xxxu_queue_rx_urb(struct
}
spin_unlock_irqrestore(&priv->rx_urb_lock, flags);
-
- if (pending > RTL8XXXU_RX_URB_PENDING_WATER)
- schedule_work(&priv->rx_urb_wq);
}
static void rtl8xxxu_rx_urb_work(struct work_struct *work)
@@ -7507,6 +7509,13 @@ static void rtl8xxxu_stop(struct ieee802
priv->shutdown = true;
spin_unlock_irqrestore(&priv->rx_urb_lock, flags);
+ /*
+ * Cancel before killing rx_anchor: the worker re-anchors every URB
+ * it drained via rtl8xxxu_submit_rx_urb(), so a worker still running
+ * after the kill could submit a URB that escapes it.
+ */
+ cancel_work_sync(&priv->rx_urb_wq);
+
usb_kill_anchored_urbs(&priv->rx_anchor);
usb_kill_anchored_urbs(&priv->tx_anchor);
if (priv->usb_interrupts)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 678/713] fuse: decouple fuse_ring creation from ent registration
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 677/713] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 679/713] fuse: copy request headers via a stack buffer for io-uring Greg Kroah-Hartman
` (45 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bernd Schubert, Joanne Koong,
Miklos Szeredi, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit 6330b1f61ed1d17850fc61bdb8920ca1056e2cf9 ]
Currently, the connection's fuse_ring is created lazily on the first
FUSE_IO_URING_CMD_REGISTER command. A server registers entries from one
thread per queue (one per CPU) and those threads issue their first
REGISTER command concurrently. They then race to create the single
per-connection fuse_ring, which required open-coded handling in
fuse_uring_create() to detect and protect against concurrent creations.
Decouple fuse_ring creation from ent registration and move it to
FUSE_INIT reply processing after a server has negotiated and set
FUSE_OVER_IO_URING. The ring is published before the connection is
marked initialized. fuse_uring_register() no longer creates the ring and
it instead uses the ring set up at init time.
Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Stable-dep-of: fd10f40af314 ("fuse: copy request headers via a stack buffer for io-uring")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 8 +++-----
fs/fuse/dev.h | 2 +-
fs/fuse/dev_uring.c | 26 ++++++++++----------------
fs/fuse/dev_uring_i.h | 5 +++++
fs/fuse/inode.c | 4 +++-
5 files changed, 22 insertions(+), 23 deletions(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -75,6 +75,9 @@ void fuse_chan_set_initialized(struct fu
fch->minor = param->minor;
fch->max_write = param->max_write;
fch->max_pages = param->max_pages;
+
+ if (param->io_uring_enabled)
+ fuse_uring_conn_init(fch);
}
/* Make sure stores before this are seen on another CPU */
@@ -415,11 +418,6 @@ void fuse_chan_set_fc(struct fuse_chan *
fch->conn = fc;
}
-void fuse_chan_io_uring_enable(struct fuse_chan *fch)
-{
- fch->io_uring = 1;
-}
-
void fuse_pqueue_init(struct fuse_pqueue *fpq)
{
spin_lock_init(&fpq->lock);
--- a/fs/fuse/dev.h
+++ b/fs/fuse/dev.h
@@ -22,6 +22,7 @@ struct fuse_chan_param {
unsigned int minor;
unsigned int max_write;
unsigned int max_pages;
+ bool io_uring_enabled;
};
struct fuse_chan *fuse_chan_new(void);
@@ -34,7 +35,6 @@ void fuse_chan_max_background_set(struct
unsigned int fuse_chan_num_waiting(struct fuse_chan *fch);
void fuse_chan_set_fc(struct fuse_chan *fch, struct fuse_conn *fc);
void fuse_chan_set_initialized(struct fuse_chan *fch, struct fuse_chan_param *param);
-void fuse_chan_io_uring_enable(struct fuse_chan *fch);
ssize_t fuse_chan_send(struct fuse_chan *fch, struct fuse_args *args);
int fuse_chan_send_bg(struct fuse_chan *fch, struct fuse_args *args, gfp_t gfp_flags);
int fuse_chan_send_notify_reply(struct fuse_chan *fch, struct fuse_args *args, u64 unique);
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -238,7 +238,6 @@ static struct fuse_ring *fuse_uring_crea
{
struct fuse_ring *ring;
size_t nr_queues = num_possible_cpus();
- struct fuse_ring *res = NULL;
size_t max_payload_size;
ring = kzalloc_obj(*ring, GFP_KERNEL_ACCOUNT);
@@ -258,12 +257,6 @@ static struct fuse_ring *fuse_uring_crea
spin_unlock(&fch->lock);
goto out_err;
}
- if (fch->ring) {
- /* race, another thread created the ring in the meantime */
- spin_unlock(&fch->lock);
- res = fch->ring;
- goto out_err;
- }
init_waitqueue_head(&ring->stop_waitq);
@@ -278,7 +271,13 @@ static struct fuse_ring *fuse_uring_crea
out_err:
kfree(ring->queues);
kfree(ring);
- return res;
+ return NULL;
+}
+
+void fuse_uring_conn_init(struct fuse_chan *fch)
+{
+ if (fuse_uring_create(fch))
+ fch->io_uring = 1;
}
static struct fuse_ring_queue *fuse_uring_create_queue(struct fuse_ring *ring,
@@ -1178,15 +1177,10 @@ static int fuse_uring_register(struct io
struct fuse_ring *ring = smp_load_acquire(&fch->ring);
struct fuse_ring_queue *queue;
struct fuse_ring_ent *ent;
- int err;
unsigned int qid = READ_ONCE(cmd_req->qid);
- err = -ENOMEM;
- if (!ring) {
- ring = fuse_uring_create(fch);
- if (!ring)
- return err;
- }
+ if (!ring)
+ return -EINVAL;
if (qid >= ring->nr_queues) {
pr_info_ratelimited("fuse: Invalid ring qid %u\n", qid);
@@ -1197,7 +1191,7 @@ static int fuse_uring_register(struct io
if (!queue) {
queue = fuse_uring_create_queue(ring, qid);
if (!queue)
- return err;
+ return -ENOMEM;
}
/*
--- a/fs/fuse/dev_uring_i.h
+++ b/fs/fuse/dev_uring_i.h
@@ -135,6 +135,7 @@ struct fuse_ring {
bool ready;
};
+void fuse_uring_conn_init(struct fuse_chan *fch);
void fuse_uring_stop_queues(struct fuse_ring *ring);
void fuse_uring_abort_end_requests(struct fuse_ring *ring);
int fuse_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags);
@@ -174,6 +175,10 @@ static inline bool fuse_uring_ready(stru
#else /* CONFIG_FUSE_IO_URING */
+static inline void fuse_uring_conn_init(struct fuse_chan *fch)
+{
+}
+
static inline void fuse_uring_abort(struct fuse_chan *fch)
{
}
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1272,6 +1272,7 @@ static void process_init_reply(struct fu
struct fuse_mount *fm = ia->fm;
struct fuse_conn *fc = fm->fc;
struct fuse_init_out *arg = &ia->out;
+ bool io_uring_enabled = false;
bool ok = true;
if (error || arg->major != FUSE_KERNEL_VERSION)
@@ -1402,7 +1403,7 @@ static void process_init_reply(struct fu
ok = false;
}
if (flags & FUSE_OVER_IO_URING && fuse_uring_enabled())
- fuse_chan_io_uring_enable(fc->chan);
+ io_uring_enabled = true;
if (flags & FUSE_REQUEST_TIMEOUT)
timeout = arg->request_timeout;
@@ -1432,6 +1433,7 @@ static void process_init_reply(struct fu
.minor = fc->minor,
.max_write = fc->max_write,
.max_pages = fc->max_pages,
+ .io_uring_enabled = io_uring_enabled,
};
fuse_chan_set_initialized(fc->chan, &cp);
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 679/713] fuse: copy request headers via a stack buffer for io-uring
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 678/713] fuse: decouple fuse_ring creation from ent registration Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 680/713] crypto: iaa - unmap dst before software fallback on decompress Greg Kroah-Hartman
` (44 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Bernd Schubert, Joanne Koong, Miklos Szeredi, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit fd10f40af314f07b6d6e028b1ca25c8b49903aab ]
The fuse-io-uring transport copies req->in.h out to the ring in
fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit().
Both headers live inside the fuse_request slab object, whose cache
(fuse_req_cachep) is created without a usercopy whitelist, so copying
them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and
panics:
usercopy: Kernel memory exposure attempt detected from SLUB object
'fuse_request' (offset 56, size 40)!
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:usercopy_abort (mm/usercopy.c:90)
Call Trace:
__check_heap_object (mm/slub.c:8268)
__check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)
copy_header_to_ring (fs/fuse/dev_uring.c:618)
fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)
fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)
tctx_task_work_run (io_uring/tw.c:96)
task_work_run (kernel/task_work.c:233)
io_run_task_work (io_uring/tw.h:84)
io_cqring_wait (io_uring/wait.c:278)
__do_sys_io_uring_enter (io_uring/io_uring.c:2685)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Bounce both headers through an on-stack copy so the usercopy touches
stack memory, not the slab object.
Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
[ adapted context due to a pre-existing local `ring` local variable from an earlier already-backported commit shifting line numbers ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev_uring.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -745,6 +745,7 @@ static int fuse_uring_copy_to_ring(struc
{
struct fuse_ring_queue *queue = ent->queue;
struct fuse_ring *ring = queue->ring;
+ struct fuse_in_header in_header;
int err;
err = -EIO;
@@ -766,8 +767,9 @@ static int fuse_uring_copy_to_ring(struc
}
/* copy fuse_in_header */
- return copy_header_to_ring(ent, FUSE_URING_HEADER_IN_OUT, &req->in.h,
- sizeof(req->in.h));
+ in_header = req->in.h;
+ return copy_header_to_ring(ent, FUSE_URING_HEADER_IN_OUT, &in_header,
+ sizeof(in_header));
}
static int fuse_uring_prepare_send(struct fuse_ring_ent *ent,
@@ -872,11 +874,13 @@ static void fuse_uring_commit(struct fus
unsigned int issue_flags)
{
struct fuse_ring *ring = ent->queue->ring;
+ struct fuse_out_header out_header;
ssize_t err = -EFAULT;
- if (copy_header_from_ring(ent, FUSE_URING_HEADER_IN_OUT, &req->out.h,
- sizeof(req->out.h)))
+ if (copy_header_from_ring(ent, FUSE_URING_HEADER_IN_OUT, &out_header,
+ sizeof(out_header)))
goto out;
+ req->out.h = out_header;
err = fuse_uring_out_header_has_err(&req->out.h, req);
if (err) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 680/713] crypto: iaa - unmap dst before software fallback on decompress
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 679/713] fuse: copy request headers via a stack buffer for io-uring Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 681/713] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
` (43 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vinicius Costa Gomes, Herbert Xu,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
[ Upstream commit 94a25930477113730372e0fa2985da4c5ac95c9a ]
On a hardware analytics error, decompress retries through the software
fallback, which writes req->dst with the CPU while it is still mapped
DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the
stale bounce buffer over req->dst, corrupting the result.
Unmap before the fallback runs. The async path unmaps inline; the sync
path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the
fallback after unmapping.
Fixes: 2ec6761df889 ("crypto: iaa - Add support for deflate-iaa compression algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[ adapted unavailable iaa_unmap_src() calls to single-entry dma_unmap_sg() calls ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/intel/iaa/iaa_crypto_main.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c
+++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c
@@ -1058,13 +1058,17 @@ static void iaa_desc_complete(struct idx
pr_warn("%s: falling back to deflate-generic decompress, "
"analytics error code %x\n", __func__,
idxd_desc->iax_completion->error_code);
+ dma_unmap_sg(dev, ctx->req->dst, sg_nents(ctx->req->dst),
+ DMA_FROM_DEVICE);
+ dma_unmap_sg(dev, ctx->req->src, 1, DMA_TO_DEVICE);
+
ret = deflate_generic_decompress(ctx->req);
if (ret) {
dev_dbg(dev, "%s: deflate-generic failed ret=%d\n",
__func__, ret);
err = -EIO;
- goto err;
}
+ goto out;
} else {
err = -EIO;
goto err;
@@ -1447,19 +1451,9 @@ static int iaa_decompress(struct crypto_
ret = check_completion(dev, idxd_desc->iax_completion, false, false);
if (ret) {
dev_dbg(dev, "%s: check_completion failed ret=%d\n", __func__, ret);
- if (idxd_desc->iax_completion->status == IAA_ANALYTICS_ERROR) {
- pr_warn("%s: falling back to deflate-generic decompress, "
- "analytics error code %x\n", __func__,
- idxd_desc->iax_completion->error_code);
- ret = deflate_generic_decompress(req);
- if (ret) {
- dev_dbg(dev, "%s: deflate-generic failed ret=%d\n",
- __func__, ret);
- goto err;
- }
- } else {
- goto err;
- }
+ if (idxd_desc->iax_completion->status == IAA_ANALYTICS_ERROR)
+ ret = -EAGAIN;
+ goto err;
} else {
req->dlen = idxd_desc->iax_completion->output_size;
}
@@ -1647,13 +1641,16 @@ static int iaa_comp_adecompress(struct a
if (ret == -EINPROGRESS)
return ret;
- if (ret != 0)
+ if (ret != 0 && ret != -EAGAIN)
dev_dbg(dev, "asynchronous decompress failed ret=%d\n", ret);
dma_unmap_sg(dev, req->dst, 1, DMA_FROM_DEVICE);
dma_unmap_sg(dev, req->src, 1, DMA_TO_DEVICE);
iaa_wq_put(wq);
+ if (ret == -EAGAIN)
+ ret = deflate_generic_decompress(req);
+
return ret;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 681/713] crypto: atmel-ecc - clean up and improve ECDH comments
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 680/713] crypto: iaa - unmap dst before software fallback on decompress Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 682/713] crypto: atmel-ecc - avoid stale fallback key after set_secret failure Greg Kroah-Hartman
` (42 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 3e84fb698abada239d3e35ed3d52a24dbfda5f6a ]
Improve the kerneldoc for struct atmel_ecdh_ctx by removing the stale
"unsupported curves" wording, since the device only supports a single
curve (P-256), and move the set_secret() constraint to the description.
In atmel_ecdh_set_secret(), clarify that the device generates the
private key, and drop the redundant "only supports NIST P256" comment.
In atmel_ecdh_done() and atmel_ecdh_generate_public_key(), clarify the
truncation comments. Also note that a P-256 public key consists of two
32-byte coordinates in atmel_ecdh_compute_shared_secret(), and remove
the unnecessary fall-through comment and other redundant comments.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: f07a0d251db7 ("crypto: atmel-ecc - avoid stale fallback key after set_secret failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-ecc.c | 38 ++++++++++++++------------------------
1 file changed, 14 insertions(+), 24 deletions(-)
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -27,15 +27,14 @@ static struct atmel_ecc_driver_data driv
/**
* struct atmel_ecdh_ctx - transformation context
- * @client : pointer to i2c client device
- * @fallback : used for unsupported curves or when user wants to use its own
- * private key.
- * @public_key : generated when calling set_secret(). It's the responsibility
- * of the user to not call set_secret() while
- * generate_public_key() or compute_shared_secret() are in flight.
- * @curve_id : elliptic curve id
- * @do_fallback: true when the device doesn't support the curve or when the user
- * wants to use its own private key.
+ * @client: I2C client device
+ * @fallback: ECDH fallback used for caller-provided private keys
+ * @public_key: cached public key for the device-generated private key
+ * @curve_id: elliptic curve id
+ * @do_fallback: true when ECDH operations should use @fallback
+ *
+ * The caller must not invoke set_secret() while generate_public_key()
+ * or compute_shared_secret() are in flight.
*/
struct atmel_ecdh_ctx {
struct i2c_client *client;
@@ -55,7 +54,7 @@ static void atmel_ecdh_done(struct atmel
if (status)
goto free_work_data;
- /* might want less than we've got */
+ /* copy only as much as requested, capped at 32 bytes */
n_sz = min(ATMEL_ECC_NIST_P256_N_SIZE, req->dst_len);
/* copy the shared secret */
@@ -64,15 +63,15 @@ static void atmel_ecdh_done(struct atmel
if (copied != n_sz)
status = -EINVAL;
- /* fall through */
free_work_data:
kfree_sensitive(work_data);
kpp_request_complete(req, status);
}
/*
- * A random private key is generated and stored in the device. The device
- * returns the pair public key.
+ * If no private key is provided, generate one in the device and cache
+ * the corresponding public key. The generated private key never leaves
+ * the device.
*/
static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
unsigned int len)
@@ -83,9 +82,7 @@ static int atmel_ecdh_set_secret(struct
struct ecdh params;
int ret = -ENOMEM;
- /* free the old public key, if any */
kfree(ctx->public_key);
- /* make sure you don't free the old public key twice */
ctx->public_key = NULL;
if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0) {
@@ -94,7 +91,6 @@ static int atmel_ecdh_set_secret(struct
}
if (params.key_size) {
- /* fallback to ecdh software implementation */
ctx->do_fallback = true;
return crypto_kpp_set_secret(ctx->fallback, buf, len);
}
@@ -103,11 +99,6 @@ static int atmel_ecdh_set_secret(struct
if (!cmd)
return -ENOMEM;
- /*
- * The device only supports NIST P256 ECC keys. The public key size will
- * always be the same. Use a macro for the key size to avoid unnecessary
- * computations.
- */
public_key = kmalloc(ATMEL_ECC_PUBKEY_SIZE, GFP_KERNEL);
if (!public_key)
goto free_cmd;
@@ -120,7 +111,6 @@ static int atmel_ecdh_set_secret(struct
if (ret)
goto free_public_key;
- /* save the public key */
memcpy(public_key, &cmd->data[RSP_DATA_IDX], ATMEL_ECC_PUBKEY_SIZE);
ctx->public_key = public_key;
@@ -149,7 +139,7 @@ static int atmel_ecdh_generate_public_ke
if (!ctx->public_key)
return -EINVAL;
- /* might want less than we've got */
+ /* copy only as much as requested, capped at 64 bytes */
nbytes = min(ATMEL_ECC_PUBKEY_SIZE, req->dst_len);
/* public key was saved at private key generation */
@@ -175,7 +165,7 @@ static int atmel_ecdh_compute_shared_sec
return crypto_kpp_compute_shared_secret(req);
}
- /* must have exactly two points to be on the curve */
+ /* A P-256 public key must contain two 32-byte coordinates */
if (req->src_len != ATMEL_ECC_PUBKEY_SIZE)
return -EINVAL;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 682/713] crypto: atmel-ecc - avoid stale fallback key after set_secret failure
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 681/713] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 683/713] mm/kmemleak: stop the task stack scan early when interrupted Greg Kroah-Hartman
` (41 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit f07a0d251db7606e4792d2610788fbcc7b2c0d12 ]
Clear ->do_fallback before decoding a new ECDH secret and enable it only
after the software fallback accepts a caller-provided private key. This
avoids using a stale fallback key should crypto_kpp_set_secret() fail.
Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-ecc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -84,6 +84,7 @@ static int atmel_ecdh_set_secret(struct
kfree(ctx->public_key);
ctx->public_key = NULL;
+ ctx->do_fallback = false;
if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0) {
dev_err(&ctx->client->dev, "crypto_ecdh_decode_key failed\n");
@@ -91,8 +92,9 @@ static int atmel_ecdh_set_secret(struct
}
if (params.key_size) {
- ctx->do_fallback = true;
- return crypto_kpp_set_secret(ctx->fallback, buf, len);
+ ret = crypto_kpp_set_secret(ctx->fallback, buf, len);
+ ctx->do_fallback = !ret;
+ return ret;
}
cmd = kmalloc_obj(*cmd);
@@ -103,8 +105,6 @@ static int atmel_ecdh_set_secret(struct
if (!public_key)
goto free_cmd;
- ctx->do_fallback = false;
-
atmel_i2c_init_genkey_cmd(cmd, DATA_SLOT_2);
ret = atmel_i2c_send_receive(ctx->client, cmd);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 683/713] mm/kmemleak: stop the task stack scan early when interrupted
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 682/713] crypto: atmel-ecc - avoid stale fallback key after set_secret failure Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 684/713] mm/kmemleak: report RCU-tasks quiescent states during the scan Greg Kroah-Hartman
` (40 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Catalin Marinas,
Oleg Nesterov, Davidlohr Bueso, Lance Yang, Qian Cai,
SeongJae Park, Andrew Morton, Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit eb11f56eeca56069613d00bf623607e305b271d9 ]
scan_block() already checks scan_should_stop() for every pointer and bails
out of the current block, but the task stack walk cannot tell and keeps
issuing a separate scan_should_stop() between every task.
Return that status from scan_block() and use it as the task stack loop
condition, so the walk stops as soon as a scan is interrupted.
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-2-acecd7d7fd92@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Qian Cai <cai@lca.pw>
Cc: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 3541a2b06ecd ("mm/kmemleak: report RCU-tasks quiescent states during the scan")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmemleak.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1525,22 +1525,25 @@ static int scan_should_stop(void)
/*
* Scan a memory block (exclusive range) for valid pointers and add those
- * found to the gray list.
+ * found to the gray list. Return non-zero if the scan was interrupted.
*/
-static void scan_block(void *_start, void *_end,
- struct kmemleak_object *scanned)
+static int scan_block(void *_start, void *_end,
+ struct kmemleak_object *scanned)
{
unsigned long *ptr;
unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
unsigned long *end = _end - (BYTES_PER_POINTER - 1);
unsigned long flags;
+ int stop = 0;
raw_spin_lock_irqsave(&kmemleak_lock, flags);
for (ptr = start; ptr < end; ptr++) {
unsigned long pointer;
- if (scan_should_stop())
+ if (scan_should_stop()) {
+ stop = 1;
break;
+ }
kasan_disable_current();
pointer = *(unsigned long *)kasan_reset_tag((void *)ptr);
@@ -1550,6 +1553,8 @@ static void scan_block(void *_start, voi
pointer_update_refs(scanned, pointer, OBJECT_PERCPU);
}
raw_spin_unlock_irqrestore(&kmemleak_lock, flags);
+
+ return stop;
}
/*
@@ -1705,6 +1710,7 @@ static void kmemleak_scan_task_stacks(vo
{
struct pid *pid;
int nr = 1;
+ int stop = 0;
do {
struct task_struct *p = NULL;
@@ -1723,13 +1729,13 @@ static void kmemleak_scan_task_stacks(vo
void *stack = try_get_task_stack(p);
if (stack) {
- scan_block(stack, stack + THREAD_SIZE, NULL);
+ stop = scan_block(stack, stack + THREAD_SIZE, NULL);
put_task_stack(p);
}
put_task_struct(p);
}
cond_resched();
- } while (pid && !scan_should_stop());
+ } while (pid && !stop);
}
/*
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 684/713] mm/kmemleak: report RCU-tasks quiescent states during the scan
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 683/713] mm/kmemleak: stop the task stack scan early when interrupted Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 685/713] wifi: mwifiex: Detach sync cmd buffer on interrupted wait Greg Kroah-Hartman
` (39 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
SJ Park, Catalin Marinas, Puranjay Mohan, Andrew Morton,
Sasha Levin
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 3541a2b06ecd78ba333188df04368dcf97273d6a ]
kmemleak_scan() can run for ages on large debug kernels. It was
causing some soft-lockups which I got fixed with commit
3175fcfec8b16baeb ("mm/kmemleak: avoid soft lockup when scanning task
stacks") with our beloved cond_resched().
I've got the fix above deployed in the Meta fleet, and now I am seeing:
INFO: rcu_tasks detected stalls on tasks:
task:kmemleak state:R ... nvcsw: 274/274 holdout: 1 idle_cpu: -1/3
scan_block
scan_gray_list
kmemleak_scan
and, worse, blocks the callers waiting on that grace period. Here a BPF
struct_ops map free, which waits via synchronize_rcu_mult(call_rcu,
call_rcu_tasks), is stuck long enough to also trip the hung task check:
INFO: task kworker/...:bpf_map_free_deferred blocked for 122 seconds
__wait_rcu_gp
bpf_struct_ops_map_free
Then I've learned that cond_resched() is not an RCU-tasks quiescent
state, so, we need to use stronger primitives.
Use cond_resched_tasks_rcu_qs() at the scan reschedule points so the scan
reports an RCU-tasks quiescent state as it proceeds.
Inspired by commit b96285e10aad ("tracing: Have osnoise_main() add a
quiescent state for task rcu").
Link: https://lore.kernel.org/20260720-kmemleak_rcu_task-v1-1-5b460ade777d@debian.org
Fixes: c4b28963fd79 ("mm/kmemleak: rely on rcu for task stack scanning")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Puranjay Mohan <puranjay@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ adapted scan_large_block() to the branch’s existing void implementation without interruption propagation. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmemleak.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1569,7 +1569,7 @@ static void scan_large_block(void *start
next = min(start + MAX_SCAN_SIZE, end);
scan_block(start, next, NULL);
start = next;
- cond_resched();
+ cond_resched_tasks_rcu_qs();
}
}
#endif
@@ -1604,7 +1604,7 @@ static void scan_object(struct kmemleak_
scan_block(start, end, object);
raw_spin_unlock_irqrestore(&object->lock, flags);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
raw_spin_lock_irqsave(&object->lock, flags);
if (!(object->flags & OBJECT_ALLOCATED))
break;
@@ -1626,7 +1626,7 @@ static void scan_object(struct kmemleak_
break;
raw_spin_unlock_irqrestore(&object->lock, flags);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
raw_spin_lock_irqsave(&object->lock, flags);
} while (object->flags & OBJECT_ALLOCATED);
} else {
@@ -1654,7 +1654,7 @@ static void scan_gray_list(void)
*/
object = list_entry(gray_list.next, typeof(*object), gray_list);
while (&object->gray_list != &gray_list) {
- cond_resched();
+ cond_resched_tasks_rcu_qs();
/* may add new objects to the list */
if (!scan_should_stop())
@@ -1689,7 +1689,7 @@ static void kmemleak_cond_resched(struct
raw_spin_unlock_irq(&kmemleak_lock);
rcu_read_unlock();
- cond_resched();
+ cond_resched_tasks_rcu_qs();
rcu_read_lock();
raw_spin_lock_irq(&kmemleak_lock);
@@ -1734,7 +1734,7 @@ static void kmemleak_scan_task_stacks(vo
}
put_task_struct(p);
}
- cond_resched();
+ cond_resched_tasks_rcu_qs();
} while (pid && !stop);
}
@@ -1908,7 +1908,7 @@ static void kmemleak_scan(void)
struct page *page = pfn_to_online_page(pfn);
if (!(pfn & 63))
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (!page)
continue;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 685/713] wifi: mwifiex: Detach sync cmd buffer on interrupted wait
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 684/713] mm/kmemleak: report RCU-tasks quiescent states during the scan Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 686/713] wifi: rtl818x: initialize eeprom_93cx6 struct to zero Greg Kroah-Hartman
` (38 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Johannes Berg
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@nabladev.com>
commit ef06882c7d8a7400b67d0d003b1008093dd589ed upstream.
mwifiex synchronous commands keep the caller-provided data buffer in
cmd_node->data_buf. Several callers pass stack-allocated objects there.
If wait_event_interruptible_timeout() is interrupted, the caller can
return and release that stack object while the firmware command is still
the current command. A late firmware response then reaches the normal
response handler, which can copy data through cmd_node->data_buf into the
stale stack address.
This fixes a stack corruption observed during repeated association and
disassociation cycles. The panic trace showed the command wait being
interrupted immediately before a bad pointer dereference:
cmd_wait_q terminated: -512
Unable to handle kernel paging request at virtual address 002c583837384662
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
...
Tainted: [M]=MACHINE_CHECK
The fault address decodes as little-endian ASCII:
0x002c583837384662 -> "bF878X,\0"
which is a fragment of the VERSION_EXT firmware string exposed as
debugfs "verext":
w8997o-V4, RF878X, FP92, 16.92.21.p153.7
The same runs also showed corrupted control data containing:
0x2400372e333531 -> "153.7\0$"
which is the tail of the same VERSION_EXT string. This points at a late
VERSION_EXT response writing through a stale stack-backed data_buf after
the interrupted wait returned.
After cancelling pending commands on an interrupted or timed-out wait,
detach the caller-owned data buffer from the still-current command. This
preserves the existing command cancellation behaviour while preventing a
late response from writing through a pointer whose lifetime ended with the
waiting caller.
Tested on an i.MX8MP board using an 88W8997.
Cc: stable@vger.kernel.org
Fixes: 3d026d09b28d ("mwifiex: cancel pending commands for signal")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260724203320.78793-1-festevam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -57,6 +57,18 @@ int mwifiex_wait_queue_complete(struct m
mwifiex_dbg(adapter, ERROR, "cmd_wait_q terminated: %d\n",
status);
mwifiex_cancel_all_pending_cmd(adapter);
+
+ /* The command response path writes through cmd_node->data_buf.
+ * On an interrupted wait, the caller can return and release a
+ * stack-allocated data_buf before a late firmware response is
+ * processed. Detach the caller-owned buffer from the current
+ * command so a late response cannot corrupt freed stack memory.
+ */
+ spin_lock_bh(&adapter->mwifiex_cmd_lock);
+ if (adapter->curr_cmd == cmd_queued)
+ adapter->curr_cmd->data_buf = NULL;
+ spin_unlock_bh(&adapter->mwifiex_cmd_lock);
+
return status;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 686/713] wifi: rtl818x: initialize eeprom_93cx6 struct to zero
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 685/713] wifi: mwifiex: Detach sync cmd buffer on interrupted wait Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 687/713] wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Greg Kroah-Hartman
` (37 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stanislaw Gruszka, Ping-Ke Shih,
stable
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <stf_xl@wp.pl>
commit 799b5f45cb8194ebd06c9c89e0afdad5bedd2cc5 upstream.
Commit 7738a7ab9d12 ("misc: eeprom: eeprom_93cx6: Add quirk for extra
read clock cycle") added extra 'quirk' field to struct eeprom_93cx6.
Many existing users of eeprom_93cx6, including rtl818x drivers, allocate
the structure on the stack without initializing all fields. As a result,
the added quirk field has an undefined value and can randomly cause
reading wrong data from the EEPROM.
Fix by initializing the structures with {}.
Fixes: 7738a7ab9d12 ("misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle")
Cc: stable@kernel.org # v6.13+
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260723110640.8588-1-stf_xl@wp.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +-
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
@@ -1652,7 +1652,7 @@ static void rtl8180_eeprom_register_writ
static void rtl8180_eeprom_read(struct rtl8180_priv *priv)
{
- struct eeprom_93cx6 eeprom;
+ struct eeprom_93cx6 eeprom = {};
int eeprom_cck_table_adr;
u16 eeprom_val;
int i;
--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
@@ -1445,7 +1445,7 @@ static int rtl8187_probe(struct usb_inte
struct usb_device *udev = interface_to_usbdev(intf);
struct ieee80211_hw *dev;
struct rtl8187_priv *priv;
- struct eeprom_93cx6 eeprom;
+ struct eeprom_93cx6 eeprom = {};
struct ieee80211_channel *channel;
const char *chip_name;
u16 txpwr, reg;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 687/713] wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 686/713] wifi: rtl818x: initialize eeprom_93cx6 struct to zero Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 688/713] wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Greg Kroah-Hartman
` (36 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Ping-Ke Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit ed4f05d9f2f42fd866f55108db8123eefcc5fb33 upstream.
rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID
from the 802.11 header and then uses it as an index into
sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID
value, so the result can be in the range 0..15.
rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and
MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the
aggregation state array. Keep the default RTL_AGG_STOP state for
out-of-range TIDs, matching rtl92cu_tx_fill_desc().
This issue was detected by our static analysis tool and confirmed by
manual audit. UBSAN validation for the same bug pattern reports an
array-index-out-of-bounds access with index 10 for type
'rtl_tid_data [9]'.
Fixes: 8321424134a4 ("wifi: rtlwifi: Add rtl8192du/trx.{c,h}")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260620025632.46206-1-runyu.xiao@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c
@@ -106,7 +106,8 @@ void rtl92du_tx_fill_desc(struct ieee802
if (sta) {
sta_entry = (struct rtl_sta_info *)sta->drv_priv;
tid = ieee80211_get_tid(hdr);
- agg_state = sta_entry->tids[tid].agg.agg_state;
+ if (tid < MAX_TID_COUNT)
+ agg_state = sta_entry->tids[tid].agg.agg_state;
ampdu_density = sta->deflink.ht_cap.ampdu_density;
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 688/713] wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 687/713] wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 689/713] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Greg Kroah-Hartman
` (35 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Ping-Ke Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 6496ce90845df2d22fb8e8ed235cd2936fad41c8 upstream.
The memory allocated inside rtl92du_init_shared_data() is not freed in
any of the subsequent error paths in rtl92du_init_sw_vars().
Fix that by adding a call to rtl92du_deinit_shared_data() in the error
path.
Fixes: b5dc8873b6ff ("wifi: rtlwifi: Add rtl8192du/sw.c")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260723114539.136986-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
@@ -145,8 +145,10 @@ static int rtl92du_init_sw_vars(struct i
/* for firmware buf */
rtlpriv->rtlhal.pfirmware = kmalloc(0x8000, GFP_KERNEL);
- if (!rtlpriv->rtlhal.pfirmware)
- return -ENOMEM;
+ if (!rtlpriv->rtlhal.pfirmware) {
+ err = -ENOMEM;
+ goto error;
+ }
rtlpriv->max_fw_size = 0x8000;
pr_info("Driver for Realtek RTL8192DU WLAN interface\n");
@@ -160,10 +162,14 @@ static int rtl92du_init_sw_vars(struct i
pr_err("Failed to request firmware!\n");
kfree(rtlpriv->rtlhal.pfirmware);
rtlpriv->rtlhal.pfirmware = NULL;
- return err;
+ goto error;
}
return 0;
+
+error:
+ rtl92du_deinit_shared_data(hw);
+ return err;
}
static void rtl92du_deinit_sw_vars(struct ieee80211_hw *hw)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 689/713] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 688/713] wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 690/713] wifi: rtw88: pci: fix resource leak on failed NAPI setup Greg Kroah-Hartman
` (34 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Ping-Ke Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 9f2948010764d708bda27369d09ce6f194abe8e3 upstream.
The skb passed to the rtw_hci_tx_write() is expected to be freed when
the function fails, but the error path in rtw_txq_push_skb() does not
free the skb before returning. This can lead to a memory leak in
rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260727064223.61836-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/realtek/rtw88/tx.c
+++ b/drivers/net/wireless/realtek/rtw88/tx.c
@@ -619,6 +619,7 @@ static int rtw_txq_push_skb(struct rtw_d
ret = rtw_hci_tx_write(rtwdev, &pkt_info, skb);
if (ret) {
rtw_err(rtwdev, "failed to write TX skb to HCI\n");
+ ieee80211_free_txskb(rtwdev->hw, skb);
return ret;
}
return 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 690/713] wifi: rtw88: pci: fix resource leak on failed NAPI setup
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 689/713] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 691/713] wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Greg Kroah-Hartman
` (33 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dawei Feng, Ping-Ke Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit e779df4806cd29cbcca5c9dc0a1073662c76b889 upstream.
rtw_pci_probe() allocates PCI resources through
rtw_pci_setup_resource() before it sets up NAPI. If
rtw_pci_napi_init() fails, the error path jumps straight to
err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI
resources allocated by rtw_pci_setup_resource() behind.
Add a dedicated cleanup label for the NAPI setup failure path so probe
destroys the PCI resources.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing current
mainline kernels. The tool is still under development and is not yet
publicly available. Manual inspection confirms that the bug is still
present in v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have a
suitable rtw88 PCI board to test with, no runtime testing was able to be
performed.
Fixes: d0bcb10e7b94 ("wifi: rtw88: Un-embed dummy device")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260617013502.114057-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw88/pci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -1834,7 +1834,7 @@ int rtw_pci_probe(struct pci_dev *pdev,
ret = rtw_pci_napi_init(rtwdev);
if (ret) {
rtw_err(rtwdev, "failed to setup NAPI\n");
- goto err_pci_declaim;
+ goto err_destroy_rsrc;
}
ret = rtw_chip_info_setup(rtwdev);
@@ -1866,6 +1866,8 @@ int rtw_pci_probe(struct pci_dev *pdev,
err_destroy_pci:
rtw_pci_napi_deinit(rtwdev);
+
+err_destroy_rsrc:
rtw_pci_destroy(rtwdev, pdev);
err_pci_declaim:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 691/713] wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 690/713] wifi: rtw88: pci: fix resource leak on failed NAPI setup Greg Kroah-Hartman
@ 2026-09-04 5:00 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 692/713] wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Greg Kroah-Hartman
` (32 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Yuhang.chen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhang.chen <yhchen312@gmail.com>
commit 667c12782aaf8dd3cb2213e528fe63a73cb63345 upstream.
Since the hardware rfkill polling was introduced, arm64 platforms can
panic with an asynchronous SError during warm reboot:
SError Interrupt on CPU8, code 0x00000000be000011 -- SError
Workqueue: events_power_efficient rfkill_poll [rfkill]
rtw89_pci_ops_read8+0x94/0x160 [rtw89_pci]
rtw89_core_rfkill_poll+0x50/0x1e0 [rtw89_core]
rtw89_ops_rfkill_poll+0x40/0x68 [rtw89_core]
ieee80211_rfkill_poll+0x3c/0x70 [mac80211]
cfg80211_rfkill_poll+0x40/0x2a0 [cfg80211]
rfkill_poll+0x30/0x88 [rfkill]
Kernel panic - not syncing: Asynchronous SError Interrupt
On the reboot path the kernel only runs device_shutdown(), which calls
each driver's .shutdown callback; .remove is not invoked. The rtw89 PCI
driver had no .shutdown callback, so nothing stopped the rfkill polling
work while the platform was tearing the PCIe link down. Once the link
is gone, the next MMIO read from the poll handler targets a
non-responding device and is reported as a fatal asynchronous SError on
arm64.
Add rtw89_pci_shutdown(), wired to all rtw89 PCI device drivers, which
sets a new RTW89_FLAG_SHUTDOWN flag (mirroring the USB
RTW89_FLAG_UNPLUGGED pattern). When the flag is set,
rtw89_ops_rfkill_poll() returns early, so no MMIO read is issued to the
chip after shutdown begins and the SError no longer occurs.
This does not call the full .remove path from .shutdown, to keep the
shutdown handler minimal and avoid running the non-idempotent teardown
twice.
Fixes: 0b38e6277aed ("wifi: rtw89: add support for hardware rfkill")
Cc: stable@vger.kernel.org
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Yuhang.chen <yhchen312@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260729014142.2746777-1-yhchen312@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw89/core.h | 1 +
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++-
drivers/net/wireless/realtek/rtw89/pci.c | 13 +++++++++++++
drivers/net/wireless/realtek/rtw89/pci.h | 1 +
drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922de.c | 1 +
11 files changed, 24 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -5373,6 +5373,7 @@ enum rtw89_flags {
RTW89_FLAG_CHANGING_INTERFACE,
RTW89_FLAG_HW_RFKILL_STATE,
RTW89_FLAG_UNPLUGGED,
+ RTW89_FLAG_SHUTDOWN,
NUM_OF_RTW89_FLAGS,
};
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -1979,7 +1979,8 @@ static void rtw89_ops_rfkill_poll(struct
lockdep_assert_wiphy(hw->wiphy);
/* wl_disable GPIO get floating when entering LPS */
- if (test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
+ if (test_bit(RTW89_FLAG_RUNNING, rtwdev->flags) ||
+ test_bit(RTW89_FLAG_SHUTDOWN, rtwdev->flags))
return;
rtw89_core_rfkill_poll(rtwdev, false);
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -4874,6 +4874,19 @@ void rtw89_pci_remove(struct pci_dev *pd
}
EXPORT_SYMBOL(rtw89_pci_remove);
+void rtw89_pci_shutdown(struct pci_dev *pdev)
+{
+ struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+ struct rtw89_dev *rtwdev;
+
+ if (!hw)
+ return;
+
+ rtwdev = hw->priv;
+ set_bit(RTW89_FLAG_SHUTDOWN, rtwdev->flags);
+}
+EXPORT_SYMBOL(rtw89_pci_shutdown);
+
MODULE_AUTHOR("Realtek Corporation");
MODULE_DESCRIPTION("Realtek PCI 802.11ax wireless driver");
MODULE_LICENSE("Dual BSD/GPL");
--- a/drivers/net/wireless/realtek/rtw89/pci.h
+++ b/drivers/net/wireless/realtek/rtw89/pci.h
@@ -1751,6 +1751,7 @@ struct pci_device_id;
int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id);
void rtw89_pci_remove(struct pci_dev *pdev);
+void rtw89_pci_shutdown(struct pci_dev *pdev);
void rtw89_pci_basic_cfg(struct rtw89_dev *rtwdev, bool resume);
void rtw89_pci_ops_reset(struct rtw89_dev *rtwdev);
int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en);
--- a/drivers/net/wireless/realtek/rtw89/rtw8851be.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851be.c
@@ -93,6 +93,7 @@ static struct pci_driver rtw89_8851be_dr
.id_table = rtw89_8851be_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
@@ -95,6 +95,7 @@ static struct pci_driver rtw89_8852ae_dr
.id_table = rtw89_8852ae_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8852be.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852be.c
@@ -97,6 +97,7 @@ static struct pci_driver rtw89_8852be_dr
.id_table = rtw89_8852be_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8852bte.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852bte.c
@@ -99,6 +99,7 @@ static struct pci_driver rtw89_8852bte_d
.id_table = rtw89_8852bte_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
@@ -122,6 +122,7 @@ static struct pci_driver rtw89_8852ce_dr
.id_table = rtw89_8852ce_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8922ae.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922ae.c
@@ -111,6 +111,7 @@ static struct pci_driver rtw89_8922ae_dr
.id_table = rtw89_8922ae_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops_be,
.err_handler = &rtw89_pci_err_handler,
};
--- a/drivers/net/wireless/realtek/rtw89/rtw8922de.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922de.c
@@ -111,6 +111,7 @@ static struct pci_driver rtw89_8922de_dr
.id_table = rtw89_8922de_id_table,
.probe = rtw89_pci_probe,
.remove = rtw89_pci_remove,
+ .shutdown = rtw89_pci_shutdown,
.driver.pm = &rtw89_pm_ops_be,
.err_handler = &rtw89_pci_err_handler,
};
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 692/713] wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-09-04 5:00 ` [PATCH 7.2 691/713] wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 693/713] wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
` (31 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit bda8324270b1ac91bfba1df8928e0570e29759e8 upstream.
mt7615_suspend() acquired the mt76 mutex and then called
cancel_delayed_work_sync() on mac_work. mt7615_mac_work() acquires the
same mutex via mt7615_mutex_acquire() at the top of the worker, so if
mac_work is already running and blocked on the mutex, the suspend path
deadlocks waiting for the work it holds the mutex against.
Flush scan_work and mac_work before taking the mutex, matching the
suspend paths in mt7921 and mt7925. scan_work only takes the mt76
spinlock, but moving it keeps the sequence consistent. This also keeps
mac_work from running over an already suspended HIF, which the previous
split (async cancel under the lock, sync cancel after release) would
have allowed.
Fixes: c6bf20109a3f ("mt76: mt7615: add WoW support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260612041331.2596331-1-runyu.xiao@seu.edu.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -1239,11 +1239,12 @@ static int mt7615_suspend(struct ieee802
cancel_delayed_work_sync(&dev->pm.ps_work);
mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
+ cancel_delayed_work_sync(&phy->scan_work);
+ cancel_delayed_work_sync(&phy->mt76->mac_work);
+
mt7615_mutex_acquire(dev);
clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- cancel_delayed_work_sync(&phy->scan_work);
- cancel_delayed_work_sync(&phy->mt76->mac_work);
set_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
ieee80211_iterate_active_interfaces(hw,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 693/713] wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 692/713] wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 694/713] wifi: mt76: mt7925: cancel mlo_pm_work on stop Greg Kroah-Hartman
` (30 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 44b5adfe49499f53002737f5fe81d608c08122fc upstream.
mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
dev->mt76.eeprom.data buffer at the offset reported by the MCU response
(res->addr, a device-controlled __le32) without checking it against the
buffer size. A malicious or malfunctioning device can report an arbitrary
address and drive a 16-byte out-of-bounds write past eeprom.data.
Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260625-b4-disp-16f99062-v1-1-aee52ecf61b9@proton.me
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -2917,8 +2917,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_
return ret;
res = (struct mt7915_mcu_eeprom_info *)skb->data;
- if (!buf)
- buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
+ if (!buf) {
+ u32 addr = le32_to_cpu(res->addr);
+
+ if (addr > dev->mt76.eeprom.size - MT7915_EEPROM_BLOCK_SIZE) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
+ buf = dev->mt76.eeprom.data + addr;
+ }
memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
dev_kfree_skb(skb);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 694/713] wifi: mt76: mt7925: cancel mlo_pm_work on stop
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 693/713] wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 695/713] wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
` (29 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Traockl, Devin Wittmayer,
Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
commit 81faf578320df2dfc682a96baa6e85851dd68b6f upstream.
mt7925 queues mlo_pm_work with a 5 second delay during multi-link
power-save setup and never cancels it on the stop path. If the device is
torn down inside that window, the work outlives the teardown and its timer
fires afterwards, trying to queue onto the workqueue that is already gone:
workqueue: cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0
WARNING: kernel/workqueue.c:2283 at __queue_work+0x59/0xa0, CPU#1: swapper/1/0
call_timer_fn+0x2a/0x140
__run_timers+0x203/0x330
run_timer_softirq+0x86/0xf0
mt7921 already has its own stop callback, so add one for mt7925 that
cancels the work before calling mt792x_stop(). mt7925_ops backs both the
PCIe and USB drivers, so this covers both.
Fixes: 276a56883257 ("wifi: mt76: mt7925: update the power-saving flow")
Cc: stable@vger.kernel.org
Tested-by: Traockl <281473483+Traockl@users.noreply.github.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260627202946.25598-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2485,10 +2485,19 @@ static void mt7925_channel_switch_rx_bea
}
}
+static void mt7925_stop(struct ieee80211_hw *hw, bool suspend)
+{
+ struct mt792x_dev *dev = mt792x_hw_dev(hw);
+
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
+
+ mt792x_stop(hw, suspend);
+}
+
const struct ieee80211_ops mt7925_ops = {
.tx = mt792x_tx,
.start = mt7925_start,
- .stop = mt792x_stop,
+ .stop = mt7925_stop,
.add_interface = mt7925_add_interface,
.remove_interface = mt792x_remove_interface,
.config = mt7925_config,
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 695/713] wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 694/713] wifi: mt76: mt7925: cancel mlo_pm_work on stop Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 696/713] wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Greg Kroah-Hartman
` (28 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 13b3c29a782033ce4a230be9e5618032813dbcd4 upstream.
mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block
copy from the address reported by the MCU response (event->addr, a
device-controlled __le32) and clamps only the copy length, never the
destination offset into dev->mt76.eeprom.data. A malicious or
malfunctioning device can report an arbitrary address and drive an
out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past
eeprom.data.
Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260625-b4-disp-16f99062-v1-2-aee52ecf61b9@proton.me
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -4352,11 +4352,18 @@ int mt7996_mcu_get_eeprom(struct mt7996_
event = (struct mt7996_mcu_eeprom_access_event *)skb->data;
if (event->valid) {
u32 ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
+ u32 block = mode == EEPROM_MODE_EXT ? MT7996_EXT_EEPROM_BLOCK_SIZE :
+ MT7996_EEPROM_BLOCK_SIZE;
addr = le32_to_cpu(event->addr);
- if (!buf)
+ if (!buf) {
+ if (addr > dev->mt76.eeprom.size - block) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
buf = (u8 *)dev->mt76.eeprom.data + addr;
+ }
switch (mode) {
case EEPROM_MODE_EFUSE:
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 696/713] wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 695/713] wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 697/713] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
` (27 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
commit deaa2e3656937fbbe312f0ee2616c756c6e2511f upstream.
mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames
(MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise
FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes
the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the
fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is
always zero, so the unmap loop runs zero times and the skb DMA mapping in
buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the
generic DMA-ring cleanup skips it as well.
Each AddBA req therefore leaks one TX DMA mapping, roughly one per
(re)association. With WED enabled these mappings are bounced through the
WED swiotlb pool, so under continuous client reconnect churn the pool is
exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi
MCU and other on-SoC consumers.
Keep the deferred (token release) unmap that the design relies on, and add
an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps
buf[1] from the MAC-TXP layout for those frames, delegating to
mt76_connac_txp_skb_unmap() otherwise.
Cc: stable@vger.kernel.org
Fixes: cb6ebbdffef2 ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request")
Link: https://patch.msgid.link/20260722082610.2699628-13-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 +++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1240,6 +1240,30 @@ mt7996_tx_check_aggr(struct ieee80211_li
}
static void
+mt7996_txp_skb_unmap(struct mt76_dev *mdev, struct mt76_txwi_cache *t)
+{
+ u8 *txwi_ptr = mt76_get_txwi_ptr(mdev, t);
+ __le32 *txwi = (__le32 *)txwi_ptr;
+ __le32 *txp;
+ dma_addr_t addr;
+ u32 val;
+
+ if (!(le32_to_cpu(txwi[7]) & MT_TXD7_MAC_TXD)) {
+ mt76_connac_txp_skb_unmap(mdev, t);
+ return;
+ }
+
+ txp = (__le32 *)(txwi_ptr + MT_TXD_SIZE);
+ val = le32_to_cpu(txp[3]);
+ addr = le32_to_cpu(txp[2]);
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ addr |= (dma_addr_t)FIELD_GET(MT_TXP3_DMA_ADDR_H, val) << 32;
+#endif
+ dma_unmap_single(mdev->dma_dev, addr, FIELD_GET(MT_TXP_BUF_LEN, val),
+ DMA_TO_DEVICE);
+}
+
+static void
mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
struct ieee80211_link_sta *link_sta,
struct mt76_wcid *wcid, struct list_head *free_list)
@@ -1248,7 +1272,7 @@ mt7996_txwi_free(struct mt7996_dev *dev,
__le32 *txwi;
u16 wcid_idx;
- mt76_connac_txp_skb_unmap(mdev, t);
+ mt7996_txp_skb_unmap(mdev, t);
if (!t->skb)
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 697/713] wifi: mt76: mt7996: validate default EEPROM firmware size
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 696/713] wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 698/713] vsock/virtio: flush works in dependency order Greg Kroah-Hartman
` (26 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Felix Fietkau
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f upstream.
The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.
Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
@@ -150,6 +150,12 @@ mt7996_eeprom_check_or_use_default(struc
goto out;
}
+ if (fw->size < MT7996_EEPROM_SIZE) {
+ dev_err(dev->mt76.dev, "Invalid default bin size\n");
+ ret = -EINVAL;
+ goto out;
+ }
+
if (!use_default && mt7996_eeprom_variant_valid(dev, fw->data))
goto out;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 698/713] vsock/virtio: flush works in dependency order
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 697/713] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 699/713] w1: ds28e17: reject an oversize length on an I2C block read Greg Kroah-Hartman
` (25 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Paolo Abeni
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit 728836ebca239810f164262b10211ef59182f811 upstream.
virtio_vsock_remove() stops the virtqueues and then flushes each work
item before freeing the enclosing virtio_vsock. The current order does
not account for dependencies between those items: tx_work may queue
send_pkt_work, and send_pkt_work may queue rx_work.
In particular, send_pkt_work can set restart_rx and release tx_lock.
The remove path can then stop the queues and flush rx_work before
send_pkt_work queues it. Although the later send_pkt_work flush waits
for that producer to finish, nothing waits for the newly queued rx_work,
so kfree(vsock) can race with it.
KASAN reported:
BUG: KASAN: slab-use-after-free in
virtio_transport_rx_work+0x487/0x4b0
Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47
Workqueue: virtio_vsock virtio_transport_rx_work
Call Trace:
virtio_transport_rx_work+0x487/0x4b0
process_one_work+0x688/0x1120
worker_thread+0x45b/0xd10
Allocated by task 1:
virtio_vsock_probe+0xef/0x6b0
Freed by task 84:
kfree+0x131/0x3c0
virtio_vsock_remove+0xd1/0x100
Flush the works in producer-to-consumer order. virtio_vsock_vqs_del()
has already disabled the queue callbacks and cleared the run flags, so
after tx_work and send_pkt_work are drained, no source remains that can
queue rx_work after its flush.
Fixes: 0ea9e1d3a9e3 ("VSOCK: Introduce virtio_transport.ko")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://patch.msgid.link/20260822164556.3750959-1-nicoyip.dev@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -872,10 +872,10 @@ static void virtio_vsock_remove(struct v
/* Other works can be queued before 'config->del_vqs()', so we flush
* all works before to free the vsock object to avoid use after free.
*/
- flush_work(&vsock->rx_work);
flush_work(&vsock->tx_work);
flush_work(&vsock->event_work);
flush_work(&vsock->send_pkt_work);
+ flush_work(&vsock->rx_work);
mutex_unlock(&the_virtio_vsock_mutex);
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 699/713] w1: ds28e17: reject an oversize length on an I2C block read
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 698/713] vsock/virtio: flush works in dependency order Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 700/713] xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Greg Kroah-Hartman
` (24 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Andi Shyti,
Krzysztof Kozlowski
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 169ae5e65e5aaf213b6a578f6478a9fd2e523606 upstream.
w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire
to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the
device. The downstream slave puts a length byte in buf[0]. The driver
then reads that many bytes into buf[1] with w1_f19_i2c_read().
buf[0] is controlled by the device and can be 0 to 255.
w1_f19_i2c_read() only rejects a zero count. The caller buffer is
I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read
run past it, up to about 222 bytes out of bounds.
The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That
check runs after master_xfer returns. By then the write is already
done. i2c-algo-bit rejects an oversize length before it copies, and
returns -EPROTO.
Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the
same way i2c-algo-bit does.
Fixes: ebc4768ac497 ("add w1_ds28e17 driver for the DS28E17 Onewire to I2C master bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260629121043.199487-1-maoyixie.tju@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/w1/slaves/w1_ds28e17.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/w1/slaves/w1_ds28e17.c
+++ b/drivers/w1/slaves/w1_ds28e17.c
@@ -389,6 +389,10 @@ static int w1_f19_i2c_master_transfer(st
* another simple read in that case.
*/
if (msgs[i+1].flags & I2C_M_RECV_LEN) {
+ if (msgs[i+1].buf[0] > I2C_SMBUS_BLOCK_MAX) {
+ i = -EPROTO;
+ goto error;
+ }
result = w1_f19_i2c_read(sl, msgs[i+1].addr,
&(msgs[i+1].buf[1]), msgs[i+1].buf[0]);
if (result < 0) {
@@ -415,6 +419,10 @@ static int w1_f19_i2c_master_transfer(st
* another simple read in that case.
*/
if (msgs[i].flags & I2C_M_RECV_LEN) {
+ if (msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX) {
+ i = -EPROTO;
+ goto error;
+ }
result = w1_f19_i2c_read(sl,
msgs[i].addr,
&(msgs[i].buf[1]),
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 700/713] xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 699/713] w1: ds28e17: reject an oversize length on an I2C block read Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 701/713] zloop: truncate finished zones to zone capacity Greg Kroah-Hartman
` (23 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zi Yan, Lorenzo Stoakes (ARM),
Johannes Weiner, Baolin Wang, Barry Song, David Hildenbrand,
Dev Jain, Lance Yang, Liam R. Howlett, Matthew Wilcox (Oracle),
Ryan Roberts, William Kucharski, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <ziy@nvidia.com>
commit 789763523fb43cdc328de5cb5dcd19240ccf90d8 upstream.
XArray operations that allocate xa_nodes, such as xas_nomem() and
xas_alloc(), add __GFP_ACCOUNT when the array has XA_FLAGS_ACCOUNT set.
This charges the allocated memory and avoids the workingset convergence
issue described by commit 7b785645e8f13 ("mm: fix page cache convergence
regression").
xas_split_alloc() does not add _GFP_ACCOUNT when XA_FLAGS_ACCOUNT is
present. Fix it.
Link: https://lore.kernel.org/20260804-add-gfp_account-to-xas_split_alloc-v3-2-38cb3ff325c5@nvidia.com
Fixes: 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/xarray.c | 3 +++
1 file changed, 3 insertions(+)
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -1053,6 +1053,9 @@ void xas_split_alloc(struct xa_state *xa
if (xas->xa_shift + XA_CHUNK_SHIFT > order)
return;
+ if (xas->xa->xa_flags & XA_FLAGS_ACCOUNT)
+ gfp |= __GFP_ACCOUNT;
+
do {
struct xa_node *node;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 701/713] zloop: truncate finished zones to zone capacity
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 700/713] xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 702/713] tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Greg Kroah-Hartman
` (22 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Xu Rao,
Christoph Hellwig, Jens Axboe
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 72e67c118642634c25465db0c8bcfa54c4ce086c upstream.
The size of a sequential zone backing file records the amount of data
written and is used to restore the zone state. A backing file whose size
is equal to the zone capacity is restored as a full zone, while a file
larger than the zone capacity is rejected as invalid.
However, zloop_finish_zone() currently truncates the backing file to the
zone size. For devices with a reduced zone capacity, finishing a zone
therefore creates a backing file larger than the zone capacity. After the
device is removed and later re-added, that zone file is rejected instead
of being restored as a full zone.
Truncate finished sequential zones to the zone capacity, matching the
persistent representation accepted by zloop_update_seq_zone() for a full
zone.
Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Fixes: eb0570c7df23 ("block: new zoned loop block device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://patch.msgid.link/B39E5FD81D1A07F4+20260804023403.939767-1-raoxu@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/blockdev/zoned_loop.rst | 9 ++++-----
drivers/block/zloop.c | 3 ++-
2 files changed, 6 insertions(+), 6 deletions(-)
--- a/Documentation/admin-guide/blockdev/zoned_loop.rst
+++ b/Documentation/admin-guide/blockdev/zoned_loop.rst
@@ -30,11 +30,10 @@ indicates the position of the write poin
When resetting a sequential zone, its backing file size is truncated to zero.
Conversely, for a zone finish operation, the backing file is truncated to the
-zone size. With this, the maximum capacity of a zloop zoned block device created
-can be larger configured to be larger than the storage space available on the
-backing file system. Of course, for such configuration, writing more data than
-the storage space available on the backing file system will result in write
-errors.
+zone capacity. With this, a zloop zoned block device can be configured with a
+larger capacity than the storage space available on the backing file system. Of
+course, for such configuration, writing more data than the storage space
+available on the backing file system will result in write errors.
The zoned loop block device driver implements a complete zone transition state
machine. That is, zones can be empty, implicitly opened, explicitly opened,
--- a/drivers/block/zloop.c
+++ b/drivers/block/zloop.c
@@ -478,7 +478,8 @@ static int zloop_finish_zone(struct zloo
zone->cond == BLK_ZONE_COND_FULL)
goto unlock;
- if (vfs_truncate(&zone->file->f_path, zlo->zone_size << SECTOR_SHIFT)) {
+ if (vfs_truncate(&zone->file->f_path,
+ zlo->zone_capacity << SECTOR_SHIFT)) {
set_bit(ZLOOP_ZONE_SEQ_ERROR, &zone->flags);
ret = -EIO;
goto unlock;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 702/713] tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 701/713] zloop: truncate finished zones to zone capacity Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 703/713] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Greg Kroah-Hartman
` (21 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Jarkko Sakkinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 705c4ed0643366963547b2616d53165f2519c81f upstream.
i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the
interrupt handler to report a status change. If the wait times out, or is
interrupted before the handler runs, the function returns without
balancing the enable_irq() call.
Disable the IRQ before leaving the failed wait path. Also preserve an
interrupted wait's original error code instead of converting it to
-ETIMEDOUT inside the helper.
Cc: stable@vger.kernel.org # v5.10+
Fixes: 4c336e4b1556 ("tpm: Add support for the Nuvoton NPCT501 I2C TPM")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260626091653.54929-1-mhun512@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_i2c_nuvoton.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
@@ -182,8 +182,10 @@ static int i2c_nuvoton_wait_for_stat(str
timeout);
if (rc > 0)
return 0;
- /* At this point we know that the SINT pin is asserted, so we
- * do not need to do i2c_nuvoton_check_status */
+
+ disable_irq(priv->irq);
+ if (rc < 0)
+ return rc;
} else {
unsigned long ten_msec, stop;
bool status_valid;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 703/713] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 702/713] tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 704/713] sticon/parisc: Detect default STI graphics card for console output Greg Kroah-Hartman
` (20 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov, Alexey Gladkov,
Bradley Morgan, Pavel Tikhomirov, Joel Granados
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 7170ca01623b399c97f2ae9d3e228badc1f25ea3 upstream.
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare
pid/user namespaces and modify it from the child namespace. This makes no
sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures
that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around
the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always
set when kern_reboot_table[] is compiled.
Cc: stable@vger.kernel.org
Fixes: e054bcbe7e7a ("sysctl: move cad_pid into kernel/pid.c")
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Alexey Gladkov <legion@kernel.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/pid.c | 31 -------------------------------
kernel/reboot.c | 29 +++++++++++++++++++++++++++++
2 files changed, 29 insertions(+), 31 deletions(-)
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -766,29 +766,6 @@ static struct ctl_table_root pid_table_r
.set_ownership = pid_table_root_set_ownership,
};
-static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer,
- size_t *lenp, loff_t *ppos)
-{
- struct pid *new_pid;
- pid_t tmp_pid;
- int r;
- struct ctl_table tmp_table = *table;
-
- tmp_pid = pid_vnr(cad_pid);
- tmp_table.data = &tmp_pid;
-
- r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
- if (r || !write)
- return r;
-
- new_pid = find_get_pid(tmp_pid);
- if (!new_pid)
- return -ESRCH;
-
- put_pid(xchg(&cad_pid, new_pid));
- return 0;
-}
-
static const struct ctl_table pid_table[] = {
{
.procname = "pid_max",
@@ -799,14 +776,6 @@ static const struct ctl_table pid_table[
.extra1 = &pid_max_min,
.extra2 = &pid_max_max,
},
-#ifdef CONFIG_PROC_SYSCTL
- {
- .procname = "cad_pid",
- .maxlen = sizeof(int),
- .mode = 0600,
- .proc_handler = proc_do_cad_pid,
- },
-#endif
};
#endif
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -1366,6 +1366,29 @@ static struct attribute *reboot_attrs[]
};
#ifdef CONFIG_SYSCTL
+static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer,
+ size_t *lenp, loff_t *ppos)
+{
+ struct ctl_table tmp_table = *table;
+ struct pid *new_pid;
+ pid_t tmp_pid;
+ int r;
+
+ tmp_pid = pid_vnr(cad_pid);
+ tmp_table.data = &tmp_pid;
+
+ r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
+ if (r || !write)
+ return r;
+
+ new_pid = find_get_pid(tmp_pid);
+ if (!new_pid)
+ return -ESRCH;
+
+ put_pid(xchg(&cad_pid, new_pid));
+ return 0;
+}
+
static const struct ctl_table kern_reboot_table[] = {
{
.procname = "poweroff_cmd",
@@ -1381,6 +1404,12 @@ static const struct ctl_table kern_reboo
.mode = 0644,
.proc_handler = proc_dointvec,
},
+ {
+ .procname = "cad_pid",
+ .maxlen = sizeof(int),
+ .mode = 0600,
+ .proc_handler = proc_do_cad_pid,
+ },
};
static void __init kernel_reboot_sysctls_init(void)
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 704/713] sticon/parisc: Detect default STI graphics card for console output
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (702 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 703/713] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 705/713] signal: avoid shared siginfo namespace rewrites Greg Kroah-Hartman
` (19 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit de508ece1d37cdbbbfa52f074954310f9b066b13 upstream.
If a machine has multiple graphic cards, detect the graphic card which is used
to display firmware messages and use that one as the default graphic card for
sticon and fbcon.
On parisc machines the default graphic card used for BCH (boot console
handler, aka BIOS menu) is stored in the stable storage (equivalent to CMOS
storage on x86) or in the console path in page zero. Extract that path and
store it as default STI path for later comparism. Take care that the graphic
card can be a GSC or a PCI card which use different path strings.
Increase max string size for default_sti_path to 32 chars as the
print_pa_hwpath() function formats a hardware path using unbounded sprintf
calls for up to 6 bus converter components and 1 module component (e.g.,
255/255/...), which can produce a string up to 28 bytes long.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/sticore.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/video/sticore.c
+++ b/drivers/video/sticore.c
@@ -325,7 +325,7 @@ static void sti_rom_copy(unsigned long b
-static char default_sti_path[21] __read_mostly;
+static char default_sti_path[32] __read_mostly;
#ifndef MODULE
static int __init sti_setup(char *str)
@@ -1148,6 +1148,26 @@ static void sti_init_roms(void)
pr_info("STI GSC/PCI core graphics driver "
STI_DRIVERVERSION "\n");
+ /*
+ * Find default console by hardware path which is either stored in
+ * console entry in stable storage or alternatively from console path
+ * in PAGE0 used by BCH and PDC.
+ */
+ if (!default_sti_path[0]) {
+ struct pdc_module_path conspath;
+ struct device *dev = NULL;
+
+ if (pdc_stable_read(0x60, &conspath, sizeof(conspath)) == PDC_OK)
+ dev = hwpath_to_device(&conspath.path);
+ if (!dev)
+ dev = hwpath_to_device(&PAGE0->mem_cons.dp.path);
+ if (dev && dev_is_pci(dev))
+ print_pci_hwpath(to_pci_dev(dev), default_sti_path);
+ else if (dev && !dev_is_pci(dev))
+ print_pa_hwpath(to_parisc_device(dev), default_sti_path);
+ pr_debug("default graphic card: %s\n", default_sti_path);
+ }
+
/* Register drivers for native & PCI cards */
register_parisc_driver(&pa_sti_driver);
WARN_ON(pci_register_driver(&pci_sti_driver));
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 705/713] signal: avoid shared siginfo namespace rewrites
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (703 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 704/713] sticon/parisc: Detect default STI graphics card for console output Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 706/713] smack: fix cred UAF in smack_file_send_sigiotask() Greg Kroah-Hartman
` (18 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Oleg Nesterov,
Eric W. Biederman, Adrian Huang, Aleksandr Nogikh,
Christian Brauner, Marco Elver, Masami Hiramatsu (Google),
Mathieu Desnoyers, Peter Zijlstra, Steven Rostedt, Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
commit d19cdc167e696714509e87d3f7ae765b6e164589 upstream.
send_signal_locked() rewrites sender ids for the target namespace. Group
sends reuse the same siginfo, so one recipient can affect the next.
Copy the siginfo before changing it.
Link: https://lore.kernel.org/86a8857d58d43ee26a8b365b837fd24830343494.1782159692.git.include@grrlz.net
Fixes: 7a0cf094944e ("signal: Correct namespace fixups of si_pid and si_uid")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Adrian Huang <adrianhuang0701@gmail.com>
Cc: Aleksandr Nogikh <nogikh@google.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1181,6 +1181,7 @@ static inline bool has_si_pid_and_uid(st
int send_signal_locked(int sig, struct kernel_siginfo *info,
struct task_struct *t, enum pid_type type)
{
+ struct kernel_siginfo rewritten;
/* Should SIGKILL or SIGSTOP be received by a pid namespace init? */
bool force = false;
@@ -1194,6 +1195,9 @@ int send_signal_locked(int sig, struct k
/* SIGKILL and SIGSTOP is special or has ids */
struct user_namespace *t_user_ns;
+ rewritten = *info;
+ info = &rewritten;
+
rcu_read_lock();
t_user_ns = task_cred_xxx(t, user_ns);
if (current_user_ns() != t_user_ns) {
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 706/713] smack: fix cred UAF in smack_file_send_sigiotask()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (704 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 705/713] signal: avoid shared siginfo namespace rewrites Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 707/713] taskstats: fix cpumask parsing cutting off the last character Greg Kroah-Hartman
` (17 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jann Horn, Casey Schaufler
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit fedc88e38ce979a720cd2de042578cb5df3dc8de upstream.
When inspecting the credentials of another task, objective credentials
(->real_cred, accessed with __task_cred()) must always be used.
Accessing ->cred on a non-current task is forbidden unless that task is
being created or destroyed; a task is allowed to change its own ->cred
pointer with no synchronization, and changing ->cred should only affect the
current syscall.
smack_file_send_sigiotask() was accessing both sets of credentials: First
tsk->cred, then __task_cred(tsk).
Fix it, always access the objective credentials here.
I have tested that this bug can lead to a KASAN-reported UAF of struct cred
in smack_file_send_sigiotask(), and that this fix prevents the race.
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/smack/smack_lsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1964,7 +1964,7 @@ static int smack_file_send_sigiotask(str
{
struct smack_known **blob;
struct smack_known *skp;
- struct smack_known *tkp = smk_of_task(smack_cred(tsk->cred));
+ struct smack_known *tkp = smk_of_task_struct_obj(tsk);
const struct cred *tcred;
struct file *file;
int rc;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 707/713] taskstats: fix cpumask parsing cutting off the last character
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (705 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 706/713] smack: fix cred UAF in smack_file_send_sigiotask() Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 708/713] timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Greg Kroah-Hartman
` (16 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Oleg Deomi,
Andrew Morton, Balbir Singh
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
commit 1f58a5335cdd14b3fb5f2a5d3763dee1f5cba1d3 upstream.
parse() hands nla_strscpy() len as dstsize, and nla_strscpy() copies at
most dstsize - 1 bytes. When the attr payload comes in without a trailing
NUL, srclen == len >= dstsize and the last character of the cpumask string
gets cut off. Register "0-15" and you are silently listening on "0-1",
exit data for the rest never shows up.
The bug only bites when the sender doesn't NUL terminate the payload;
senders that include the NUL were always fine (srclen gets decremented for
the trailing NUL, so srclen < dstsize). Thats probably why this survived
20 years. And the policy is NLA_STRING, not NLA_NUL_STRING, so a payload
without the trailing NUL is legit input here.
Skip the kmalloc/nla_strscpy dance entirely and use nla_strdup(), which
already allocates srclen + 1 and terminates. The nla_len() bounds checks
stay as they were.
Link: https://lore.kernel.org/EC49FE41-7F5F-41E0-A07A-ABEB8ECA514D@grrlz.net
Fixes: f9fd8914c1ac ("[PATCH] per-task delay accounting taskstats interface: control exit data through cpumasks")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Reported-by: Oleg Deomi <oleg.deomi@gmail.com>
Closes: https://lore.kernel.org/CAByWkfZ6b1=3H9pwkz-dDQOs9cZaF-HYQ6b9Yb0=Hq2r1Vv_Pw@mail.gmail.com
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Balbir Singh <bsingharora@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/taskstats.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -368,10 +368,9 @@ static int parse(struct nlattr *na, stru
return -E2BIG;
if (len < 1)
return -EINVAL;
- data = kmalloc(len, GFP_KERNEL);
+ data = nla_strdup(na, GFP_KERNEL);
if (!data)
return -ENOMEM;
- nla_strscpy(data, na, len);
ret = cpulist_parse(data, mask);
kfree(data);
return ret;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 708/713] timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (706 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 707/713] taskstats: fix cpumask parsing cutting off the last character Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 709/713] timer: Keep debugobjects state consistent in migrate_timer_list() Greg Kroah-Hartman
` (15 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh ,
Thomas Gleixner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
commit 4b61084b11bcecce86d03804ff30f8d7b465593c upstream.
If the auxiliary clock is disabled during tk_get_aux_ts64() but is enabled
before tks->clock_valid is checked, then uninitialized stackdata will be
used in the calculations and indirectly leaked to userspace.
The same race window also exists after this change and also for the core
timekeeper. But in these cases the only effect would be incorrect
adjustments and this is userspace's responsibility to avoid this.
Fixes: 4eca49d0b621 ("timekeeping: Prepare do_adtimex() for auxiliary clocks")
Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260731-timekeeping-aux-adjtimex-return-v1-1-b7fea4692886@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timekeeping.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -2943,10 +2943,12 @@ static int __do_adjtimex(struct tk_data
return ret;
add_device_randomness(txc, sizeof(*txc));
- if (!aux_clock)
+ if (!aux_clock) {
ktime_get_real_ts64(&ts);
- else
- tk_get_aux_ts64(tkd->timekeeper.id, &ts);
+ } else {
+ if (!tk_get_aux_ts64(tkd->timekeeper.id, &ts))
+ return -ENODEV;
+ }
add_device_randomness(&ts, sizeof(ts));
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 709/713] timer: Keep debugobjects state consistent in migrate_timer_list()
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (707 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 708/713] timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 710/713] udf: Fix i_lenExtents truncation on 32-bit kernels Greg Kroah-Hartman
` (14 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Gleixner
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@kernel.org>
commit c793bbfc4a0a9f5a66978fc91559e9681748dbeb upstream.
When timers are migrated away from an offline CPU the debugobjects state
gets corrupted. The timer is accounted as inactive on deletion, but the
enqueue on the alive CPU lacks the activation call.
That used to work, but got broken when the trace point and the debug
objects call got separated. That change missed to fixup
migrate_timer_list().
Add the missing debug_timer_activate() invocation to fix it.
Fixes: dc1e7dc5ac62 ("timer: Move trace point to get proper index")
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/87bjb0l7ha.ffs@fw13
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -2492,6 +2492,7 @@ static void migrate_timer_list(struct ti
timer = hlist_entry(head->first, struct timer_list, entry);
detach_timer(timer, false);
timer->flags = (timer->flags & ~TIMER_BASEMASK) | cpu;
+ debug_timer_activate(timer);
internal_add_timer(new_base, timer);
}
}
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 710/713] udf: Fix i_lenExtents truncation on 32-bit kernels
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (708 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 709/713] timer: Keep debugobjects state consistent in migrate_timer_list() Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 711/713] selftests/mm: fix on-fault-limit false failure under sudo-rs Greg Kroah-Hartman
` (13 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Jan Kara
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit a5a5ed23b1340ff0f32a14a7ca8585f7c4e9b2e2 upstream.
In udf_do_extend_file() the total extent length is rounded up to a block
boundary with:
iinfo->i_lenExtents = (iinfo->i_lenExtents + sb->s_blocksize - 1) &
~(sb->s_blocksize - 1);
i_lenExtents is a __u64, but sb->s_blocksize is unsigned long. On 32-bit
kernels unsigned long is 32-bit, so ~(sb->s_blocksize - 1) is a 32-bit
value (e.g. 0xfffff800 for a 2 KiB block) that is zero-extended in the AND,
clearing the upper 32 bits of i_lenExtents. For UDF files whose total
extent length exceeds 4 GiB this truncates i_lenExtents when the file is
extended, corrupting the tracked extent length.
Cast the block size to 64-bit before forming the mask. 64-bit kernels are
unaffected.
Fixes: 48d6d8ff7dca ("udf: cache struct udf_inode_info")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Link: https://patch.msgid.link/20260722082425.213311-1-zhanxusheng@xiaomi.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -531,7 +531,7 @@ static int udf_do_extend_file(struct ino
sb->s_blocksize - 1) & ~(sb->s_blocksize - 1));
iinfo->i_lenExtents =
(iinfo->i_lenExtents + sb->s_blocksize - 1) &
- ~(sb->s_blocksize - 1);
+ ~((u64)sb->s_blocksize - 1);
}
add = 0;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 711/713] selftests/mm: fix on-fault-limit false failure under sudo-rs
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (709 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 710/713] udf: Fix i_lenExtents truncation on 32-bit kernels Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 712/713] ACPI: scan: Do not combine resources that overlap completely Greg Kroah-Hartman
` (12 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Injae Ryou, Brendan Jackman,
Brendan Jackman, David Hildenbrand, Lorenzo Stoakes,
Andrew Morton
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Injae Ryou <injaeryou@gmail.com>
commit 98df164036bed307a16e7c124ad023c2c13c4b76 upstream.
run_vmtests.sh runs on-fault-limit as the nobody user via "sudo -u nobody
./on-fault-limit", guarded by a check that nobody can access the binary
("sudo -u nobody ls ./on-fault-limit").
The guard resolves the relative path from the inherited working directory,
which only requires search permission on the test directory itself.
Classic sudo passes the relative path through to execve() the same way, so
the two agree. However, sudo-rs (the default sudo implementation since
Ubuntu 25.10) canonicalizes the command to an absolute path before
executing it, which requires search permission on every ancestor
directory. When the kernel tree lives under a private home directory
(mode 0750, the Ubuntu default for new users since 21.04), the guard
passes but the execution fails with "command not found", and the test is
reported as a false FAIL:
# running sudo -u nobody ./on-fault-limit
sudo: './on-fault-limit': command not found
# [FAIL]
Wrap the command in "sh -c" so that sudo only resolves the shell binary,
and the relative path is resolved by nobody's shell from the inherited
working directory, matching what the guard checks. This is the only "sudo
-u nobody" invocation in the script; uid, cwd, rlimits (including
RLIMIT_MEMLOCK, which this test exercises) and the exit status are
unchanged through sh.
Verified on Ubuntu 26.04 (sudo-rs 0.2.13): the test now runs and passes
instead of failing. Verified on Ubuntu 24.04 (sudo 1.9.15p5): behavior is
unchanged.
Link: https://lore.kernel.org/20260713092700.464376-1-injaeryou@gmail.com
Fixes: 5d2146a3354f ("selftests/mm: skip mlock tests if nobody user can't read it")
Signed-off-by: Injae Ryou <injaeryou@gmail.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/mm/run_vmtests.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/mm/run_vmtests.sh
+++ b/tools/testing/selftests/mm/run_vmtests.sh
@@ -303,7 +303,7 @@ CATEGORY="compaction" run_test ./compact
if command -v sudo &> /dev/null && sudo -u nobody ls ./on-fault-limit >/dev/null;
then
- CATEGORY="mlock" run_test sudo -u nobody ./on-fault-limit
+ CATEGORY="mlock" run_test sudo -u nobody sh -c ./on-fault-limit
else
echo "# SKIP ./on-fault-limit"
fi
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 712/713] ACPI: scan: Do not combine resources that overlap completely
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (710 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 711/713] selftests/mm: fix on-fault-limit false failure under sudo-rs Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 713/713] platform/chrome: sensorhub: Fix dropped timestamp events and log spam Greg Kroah-Hartman
` (11 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Rafael J. Wysocki,
Jarkko Sakkinen
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit 7617cc05df28dcae967cca109de74084321eaa62 upstream.
Commit f234fdaae1ca ("ACPI: scan: Avoid registering platform devices
with resource overlaps") attempted to avoid platform device registration
errors due to overlaps of resources of the same type returned by the
same _CRS object in the ACPI tables. It did that by combining two or
more overlapping resources into one, but it went too far and also
caused resources that overlap completely to be combined which broke
the arm-cmn driver that expects two MMIO resources to be present for
each device it binds to and it expects those two resources to overlap
completely.
Address this issue by adding checks for completely overlapping
resources to acpi_platform_adjust_resources() and add a comment
explaining what is done there.
Fixes: f234fdaae1ca ("ACPI: scan: Avoid registering platform devices with resource overlaps")
Reported-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-acpi/20260819003752.GA3063251@ax162/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://patch.msgid.link/12955564.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_platform.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -85,7 +85,13 @@ static unsigned int acpi_platform_adjust
for (i = 0; i < count; ) {
struct resource *res = &resources[i];
- if (resource_type(new_res) != resource_type(res) ||
+ /*
+ * Look for overlaps of resources of the same type that would
+ * cause resource insertion to fail down the road.
+ */
+ if (__resource_contains_unbound(res, new_res) ||
+ __resource_contains_unbound(new_res, res) ||
+ resource_type(new_res) != resource_type(res) ||
!resource_union(new_res, res, new_res)) {
i++;
continue;
^ permalink raw reply [flat|nested] 727+ messages in thread
* [PATCH 7.2 713/713] platform/chrome: sensorhub: Fix dropped timestamp events and log spam
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (711 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 712/713] ACPI: scan: Do not combine resources that overlap completely Greg Kroah-Hartman
@ 2026-09-04 5:01 ` Greg Kroah-Hartman
2026-09-04 8:48 ` [PATCH 7.2 000/713] 7.2.4-rc1 review Takeshi Ogasawara
` (10 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-04 5:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomasz Figa, Tzung-Bi Shih
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <tzungbi@kernel.org>
commit 9a3f43b30373c61477d0d3ab52946c05f9492bf9 upstream.
Commit 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported
sensor number") evaluated the `sensor_num` against the bounds limit even
for timestamp events. A timestamp event typically has a `sensor_num` of
0xff [1], causing the driver to flag it as invalid and skip to the next
event.
As a result, we'd see a flooding of "Invalid sensor number 255 from EC"
warning logs and these timestamp events were being dropped.
Move the bounds-check into cros_ec_sensor_ring_process_event() and
evaluate it only after standalone timestamp events have already been
processed and returned early.
[1] https://crrev.com/219ca6ef82ba266da788b673ee4ad50bd3ea1285/common/motion_sense_fifo.c#427
Fixes: 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported sensor number")
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Link: https://lore.kernel.org/r/20260715024454.4127571-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 27 ++++++++++++-----------
1 file changed, 15 insertions(+), 12 deletions(-)
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -475,6 +475,21 @@ cros_ec_sensor_ring_process_event(struct
fifo_timestamp,
*current_timestamp,
now);
+
+ /*
+ * A standalone timestamp event typically has a sensor_num of
+ * 0xff. Return early here to prevent it from hitting the
+ * bounds check below and spamming the logs.
+ */
+ return false;
+ }
+
+ /* Skip event if sensor_num from EC is out of bounds. */
+ if (in->sensor_num >= sensorhub->sensor_num) {
+ dev_warn_ratelimited(sensorhub->dev,
+ "Invalid sensor number %u from EC\n",
+ in->sensor_num);
+ return false;
}
if (in->flags & MOTIONSENSE_SENSOR_FLAG_ODR) {
@@ -502,10 +517,6 @@ cros_ec_sensor_ring_process_event(struct
return true;
}
- if (in->flags & MOTIONSENSE_SENSOR_FLAG_TIMESTAMP)
- /* If we just have a timestamp, skip this entry. */
- return false;
-
/* Regular sample */
out->sensor_id = in->sensor_num;
trace_cros_ec_sensorhub_data(in->sensor_num,
@@ -890,14 +901,6 @@ static void cros_ec_sensorhub_ring_handl
for (in = sensorhub->resp->fifo_read.data, j = 0;
j < number_data; j++, in++) {
- /* Skip event if sensor_num from EC is out of bounds. */
- if (in->sensor_num >= sensorhub->sensor_num) {
- dev_warn_ratelimited(sensorhub->dev,
- "Invalid sensor number %u from EC\n",
- in->sensor_num);
- continue;
- }
-
if (cros_ec_sensor_ring_process_event(
sensorhub, fifo_info,
fifo_timestamp,
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (712 preceding siblings ...)
2026-09-04 5:01 ` [PATCH 7.2 713/713] platform/chrome: sensorhub: Fix dropped timestamp events and log spam Greg Kroah-Hartman
@ 2026-09-04 8:48 ` Takeshi Ogasawara
2026-09-04 9:31 ` Ronald Warsow
` (9 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Takeshi Ogasawara @ 2026-09-04 8:48 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Greg
On Fri, Sep 4, 2026 at 2:09 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Linux version 7.2.4-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 7.2.4-rc1rv-ga5fdedcba898
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 16.2.1 20260810, GNU ld (GNU
Binutils) 2.47) #1 SMP PREEMPT_DYNAMIC Fri Sep 4 17:16:05 JST 2026
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER
2026-09-04 4:58 ` [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Greg Kroah-Hartman
@ 2026-09-04 9:02 ` Lukas Wunner
2026-09-04 14:12 ` Sasha Levin
0 siblings, 1 reply; 727+ messages in thread
From: Lukas Wunner @ 2026-09-04 9:02 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Darshit Shah, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan, Guixin Liu
On Fri, Sep 04, 2026 at 06:58:20AM +0200, Greg Kroah-Hartman wrote:
> 7.2-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Darshit Shah <darnshah@amazon.de>
>
> commit 97ca178c899d0049210d325b123ed024eb5ac000 upstream.
Guixin Liu has found a problem with this upstream commit:
https://lore.kernel.org/all/20260901064554.2178688-1-kanie@linux.alibaba.com/
There's no fix in Linus' tree yet, so it might be best to hold off
for now on backporting the offending commit to stable kernels.
Thanks,
Lukas
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (713 preceding siblings ...)
2026-09-04 8:48 ` [PATCH 7.2 000/713] 7.2.4-rc1 review Takeshi Ogasawara
@ 2026-09-04 9:31 ` Ronald Warsow
2026-09-04 12:52 ` Brett A C Sheffield
` (8 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Ronald Warsow @ 2026-09-04 9:31 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Hi
kernel build / boot test on x86_64 (Intel).
No regressions here.
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (714 preceding siblings ...)
2026-09-04 9:31 ` Ronald Warsow
@ 2026-09-04 12:52 ` Brett A C Sheffield
2026-09-04 16:08 ` Markus Reichelt
` (7 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Brett A C Sheffield @ 2026-09-04 12:52 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 7.2.4-rc1-ga5fdedcba898 #2 SMP PREEMPT_DYNAMIC Fri Sep 4 12:50:10 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER
2026-09-04 9:02 ` Lukas Wunner
@ 2026-09-04 14:12 ` Sasha Levin
0 siblings, 0 replies; 727+ messages in thread
From: Sasha Levin @ 2026-09-04 14:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Sasha Levin, stable, patches, Darshit Shah, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan, Guixin Liu, Lukas Wunner
On Fri, Sep 04, 2026 at 11:02:13AM +0200, Lukas Wunner wrote:
> Guixin Liu has found a problem with this upstream commit:
>
> https://lore.kernel.org/all/20260901064554.2178688-1-kanie@linux.alibaba.com/
>
> There's no fix in Linus' tree yet, so it might be best to hold off
> for now on backporting the offending commit to stable kernels.
Dropped from the 7.2, 6.18, 6.12 and 6.6 queues, thanks.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (715 preceding siblings ...)
2026-09-04 12:52 ` Brett A C Sheffield
@ 2026-09-04 16:08 ` Markus Reichelt
2026-09-04 21:08 ` Shuah Khan
` (6 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Markus Reichelt @ 2026-09-04 16:08 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
* Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
7.2.4-rc1 compiles on x86_64 (Xeon E5-1620 v2, Slackware64-15.0),
and boots & runs on x86_64 (AMD Ryzen 5 7520U, Slackware64-current).
No regressions observed during boot & my custom tests.
Tested-by: Markus Reichelt <lkt+2023@mareichelt.com>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (716 preceding siblings ...)
2026-09-04 16:08 ` Markus Reichelt
@ 2026-09-04 21:08 ` Shuah Khan
2026-09-05 11:45 ` Miguel Ojeda
` (5 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Shuah Khan @ 2026-09-04 21:08 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr, Shuah Khan
On 9/3/26 22:49, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (717 preceding siblings ...)
2026-09-04 21:08 ` Shuah Khan
@ 2026-09-05 11:45 ` Miguel Ojeda
2026-09-05 13:00 ` Barry K. Nathan
` (4 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Miguel Ojeda @ 2026-09-05 11:45 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda
On Fri, 04 Sep 2026 06:49:28 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64 and arm32:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (718 preceding siblings ...)
2026-09-05 11:45 ` Miguel Ojeda
@ 2026-09-05 13:00 ` Barry K. Nathan
2026-09-05 18:07 ` Peter Schneider
` (3 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Barry K. Nathan @ 2026-09-05 13:00 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 9/3/26 9:49 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested on 3 amd64 systems (my DIY home NAS, my Lenovo ThinkPad T14 Gen
1, and an Apple MacBook Air 13" 2017). Working well, no regressions
observed.
Tested-by: Barry K. Nathan <barryn@pobox.com>
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (719 preceding siblings ...)
2026-09-05 13:00 ` Barry K. Nathan
@ 2026-09-05 18:07 ` Peter Schneider
2026-09-05 18:33 ` Ron Economos
` (2 subsequent siblings)
723 siblings, 0 replies; 727+ messages in thread
From: Peter Schneider @ 2026-09-05 18:07 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 04.09.2026 um 06:49 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (720 preceding siblings ...)
2026-09-05 18:07 ` Peter Schneider
@ 2026-09-05 18:33 ` Ron Economos
2026-09-05 20:27 ` Benjamin Boortz
2026-09-06 14:46 ` Jeffrin Thalakkottoor
723 siblings, 0 replies; 727+ messages in thread
From: Ron Economos @ 2026-09-05 18:33 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 9/3/26 21:49, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 7.2.4 release.
> There are 713 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (721 preceding siblings ...)
2026-09-05 18:33 ` Ron Economos
@ 2026-09-05 20:27 ` Benjamin Boortz
2026-09-06 14:46 ` Jeffrin Thalakkottoor
723 siblings, 0 replies; 727+ messages in thread
From: Benjamin Boortz @ 2026-09-05 20:27 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Fri, Sep 04, 2026 at 06:49:28AM +0200, Greg Kroah-Hartman wrote:
>This is the start of the stable review cycle for the 7.2.4 release.
>There are 713 patches in this series, all will be posted as a response
>to this one. If anyone has any issues with these being applied, please
>let me know.
Build and boot tested with QEMU for x86_64, i386, arm64, and riscv
across multiple configurations, and boots on AMD Ryzen 7 5800H.
No regressions observed.
Tested-by: Benjamin Boortz <bennib@mailbox.org>
^ permalink raw reply [flat|nested] 727+ messages in thread
* Re: [PATCH 7.2 000/713] 7.2.4-rc1 review
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
` (722 preceding siblings ...)
2026-09-05 20:27 ` Benjamin Boortz
@ 2026-09-06 14:46 ` Jeffrin Thalakkottoor
723 siblings, 0 replies; 727+ messages in thread
From: Jeffrin Thalakkottoor @ 2026-09-06 14:46 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
hello,
Compiled and booted 7.2.4-rc1 (using qemu-system-x86_64)
No new typical dmesg regressions .
Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
--
software engineer
rajagiri school of engineering and technology
^ permalink raw reply [flat|nested] 727+ messages in thread
end of thread, other threads:[~2026-09-06 14:47 UTC | newest]
Thread overview: 727+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04 4:49 [PATCH 7.2 000/713] 7.2.4-rc1 review Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 001/713] drm/amd/display: Skip Update HDCP Config In Transition State Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 002/713] ASoC: tegra210_i2s: sort the register default table Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 003/713] ASoC: tegra210_i2s: sort the Tegra264 " Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 004/713] ASoC: tegra210_mixer: sort the " Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 005/713] ASoC: tegra: Fix the I2S enable default value Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 006/713] ASoC: tegra: Fix the MIXER " Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 007/713] ASoC: tegra: Sort ADMAIF register defaults Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 008/713] ASoC: tegra: Sort MBDRC " Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 009/713] btrfs: write-protect folios during data writeback Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 010/713] ring-buffer: Fix subbuf resize race with ring buffer readers Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 011/713] drm/amd/display: hide Apple Studio Display secondary tile Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 012/713] drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 013/713] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 014/713] iomap: dont free integrity payload that doesnt exist Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 015/713] rust: time: fix as_micros_ceil() rounding near i64::MAX Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 016/713] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 017/713] clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 018/713] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 019/713] fs: fix user path of nested backing files Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 020/713] ovl: fix double end_creating() on the casefold-mismatch path Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 021/713] pidfd: hold exec_update_lock around namespace ioctl Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 022/713] powerpc/pseries/iommu: switch to Default DMA window during kdump Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 023/713] rust: fmt: fix {:p} printing stack addresses Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 024/713] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 025/713] objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 026/713] rust: kbuild: disambiguate `zerocopy` for `rusttest` Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 027/713] rust: bug: skip arch-specific asm in `testlib` builds Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 028/713] rust: bug: fix warn_on macro build error on UML Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 029/713] rust: bug: prevent dead_code warning from warn_on!s flags constant Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 030/713] rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Greg Kroah-Hartman
2026-09-04 4:49 ` [PATCH 7.2 031/713] rust: dma: return zero for Coherent reads past EOF Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 032/713] rust: devres: fix race between concurrent revokers Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 033/713] rust: devres: ensure revocation is complete before device finishes unbinding Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 034/713] rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 035/713] rust: kernel: list: fix incorrect pop_back example comment Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 036/713] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 037/713] rust: num: restrict bool conversion to unsigned Bounded Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 038/713] rust: cfi: disable function merging if CFI is enabled Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 039/713] kbuild: rust: preserve unreachable traps with inline helpers Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 040/713] kbuild: rust: keep Rust objects out of Clang LTO " Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 041/713] KEYS: trusted: Fix TPM teardown ordering Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 042/713] apparmor: fix cred UAF caused by begin_current_label_crit_section() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 043/713] apparmor: fix out-of-bounds write when null terminating a label vec Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 044/713] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 045/713] mm, swap: dont free a hibernation slot that is in the swap cache Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 046/713] mm, swap: ratelimit bad swap entry reports Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 047/713] mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 048/713] mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 049/713] mm/huge_memory: use folios memcg inside __folio_split() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 050/713] mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 051/713] mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 052/713] mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 053/713] mm/kmemleak: avoid soft lockup when scanning task stacks Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 054/713] mm/madvise: skip device-private PMDs in cold and pageout walks Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 055/713] mm/mempolicy: skip non-present PMDs when queueing folios Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 056/713] mm/mglru: fix and remove redundant unevictable folio handling Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 057/713] mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 058/713] mm/migrate: use huge_ptep_get() in remove_migration_pte() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 059/713] mm/migrate_device: clear stale mapping after freeing swapcache Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 060/713] mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 061/713] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 062/713] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 063/713] mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 064/713] mm/rmap: use huge_ptep_get() in try_to_unmap_one() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 065/713] mm/rmap: use huge_ptep_get() in try_to_migrate_one() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 066/713] mm/slub: fix missing debugfs entries for caches created before sysfs init Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 067/713] mm/slub: prevent pfmemalloc objects from entering the barn Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 068/713] mm/vmalloc: make vm_struct.nr_pages an unsigned long Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 069/713] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 070/713] mm/zswap: fix global shrinker when memory cgroup is disabled Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 071/713] mm: compaction: support non-movable compaction for pageblock requests Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 072/713] mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 073/713] mm: memcg-v1: fix memsw and TCP failcnt accounting Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 074/713] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 075/713] mm: memcontrol: update state_local when flushing NMI stats Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 076/713] mm: mempolicy: fix automatic numa balancing for shmem Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 077/713] mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 078/713] mm: page_alloc: move capture_control to the page allocator Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 079/713] mm: page_alloc: fix non-movable reclaim storm in defrag_mode Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 080/713] mm: vmscan: fix node reclaim ignoring swappiness parameter Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 081/713] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 082/713] x86/locking: Use sfence for wmb() if SSE is available Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 083/713] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 084/713] x86/tdx: Fix off-by-one in port I/O handling Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 085/713] x86/tdx: Fix zero-extension for 32-bit port I/O Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 086/713] x86/xen: fix init of balloon stats again Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 087/713] hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 088/713] tracing/user_events: Clear copied tracing state before fork duplication Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 089/713] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 090/713] tracing: Fix logged instance name on creation failure Greg Kroah-Hartman
2026-09-04 4:50 ` [PATCH 7.2 091/713] tracing: Fix retry exhaustion in simple ring buffer reader swap Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 092/713] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 093/713] tracing: Fix use-after-free with same-name named triggers Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 094/713] cdx: Fix double free when sysfs file creation fails Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 095/713] debugfs: Fix lockdown check for mmap_prepare Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 096/713] device property: fix infinite loop in fwnode_for_each_child_node() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 097/713] misc: nsm: bound the device-reported response length Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 098/713] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 099/713] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 100/713] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 101/713] serial: imx: serialize imx_uart_ports[] lifetime Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 102/713] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 103/713] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 104/713] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 105/713] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 106/713] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 107/713] usb: typec: hd3ss3220: fix VBUS regulator error message Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 108/713] usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 109/713] usb: typec: thunderbolt: Disable work before freeing tbt on remove Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 110/713] usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 111/713] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 112/713] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 113/713] usb: gadget: midi2: remove default configfs groups on teardown Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 114/713] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 115/713] usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 116/713] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 117/713] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 118/713] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 119/713] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 120/713] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 121/713] i3c: renesas: Fix out-of-bounds access for newdevs mask Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 122/713] KVM: arm64: GICv2: Dont WARN on out-of-range GICV_DIR INTID Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 123/713] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 124/713] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 125/713] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 126/713] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 127/713] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 128/713] PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 129/713] phy: rockchip-samsung-dcphy: fix out-of-range max_register Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 130/713] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 131/713] zram: fix out-of-bounds access in read_block_state() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 132/713] zram: fix out-of-bounds access in writeback_store() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 133/713] zram: set default primary compressor in zram_destroy_comps() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 134/713] zram: validate deflate params Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 135/713] zsmalloc: account for handle size in class lookup Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 136/713] NFS/localio: fix ref leak on nfs_uuid_add_file failure Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 137/713] NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 138/713] NFSD: check truncate permission under inode lock Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 139/713] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 140/713] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 141/713] NFSD: fix up error returned by write_threads() Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 142/713] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 143/713] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 144/713] nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 145/713] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 146/713] pNFS: Fix EBUSY check in pnfs_layout_need_return Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 147/713] lockd, nfsd: RCU-protect nlmsvc_ops dispatch Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 148/713] nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 149/713] nfsd: release path refs on follow_down() error Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 150/713] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
2026-09-04 4:51 ` [PATCH 7.2 151/713] nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 152/713] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 153/713] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 154/713] nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 155/713] nfsd: size fh_verify server sockaddr slot by xpt_locallen Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 156/713] nfsd: validate nseconds in TIME_DELEG decode paths Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 157/713] nfsd: validate sockaddr length per family in listener_set Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 158/713] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 159/713] nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 160/713] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 161/713] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 162/713] nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 163/713] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 164/713] nfsd: cap decoded POSIX ACL count to bound sort cost Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 165/713] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 166/713] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 167/713] nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 168/713] nfsd: clear opcnt on compound arg release to prevent OOB read Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 169/713] nfsd: convert nfsd_net boolean flags to unsigned long flags word Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 170/713] nfsd: dedup nfs4_client_to_reclaim inserts Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 171/713] nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 172/713] nfsd: defer vfree of compound ops to fix rpc_status UAF Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 173/713] nfsd: dont free session slots that are still in use Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 174/713] nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 175/713] nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 176/713] nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 177/713] nfsd: fix clock domain mismatch in clients_still_reclaiming() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 178/713] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 179/713] nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 180/713] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 181/713] nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 182/713] nfsd: fix layout fence worker double-reference race Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 183/713] nfsd: fix netlink dumpit error handling for rpc_status_get Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 184/713] nfsd: fix nfsd_file leak on inter-server COPY setup failure Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 185/713] nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 186/713] nfsd: fix partial-write detection in nfsd_direct_write Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 187/713] nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 188/713] nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 189/713] nfsd: fix reply size estimate for GET_DIR_DELEGATION Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 190/713] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 191/713] nfsd: fix UAF in async copy cancel and shutdown Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 192/713] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 193/713] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 194/713] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 195/713] nfsd: gate nfs2 setacl by argp->mask Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 196/713] nfsd: gate nfs3 " Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 197/713] nfsd: hold rcu across localio cmpxchg retry Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 198/713] nfsd: initialize copy-notify stateid before publishing it Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 199/713] nfsd: initialize DRC hash table before registering shrinker Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 200/713] nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 201/713] nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 202/713] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 203/713] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 204/713] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 205/713] nfsd: release OPEN-decoded posix ACLs via op_release Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 206/713] nfsd: revoke copy-notify stateids before dropping their reference Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 207/713] NFSD: Prevent lock owner use-after-free during client teardown Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 208/713] NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 209/713] NFSD: Prevent client use-after-free during admin state revocation Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 210/713] NFSD: Prevent client use-after-free during delegation revoke Greg Kroah-Hartman
2026-09-04 4:52 ` [PATCH 7.2 211/713] NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 212/713] nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 213/713] libceph: validate OSD extent maps before cursor advance Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 214/713] libceph: reject buckets with mismatched CRUSH ids Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 215/713] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 216/713] ceph: fix UAF in check_new_map() on session " Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 217/713] ceph: force a cap message when a deferred revoke cant be acked immediately Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 218/713] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 219/713] ceph: bound copied dentry name length in NFS export get_name Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 220/713] ceph: bound MDSCapAuth path and fs_name decode in handle_session() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 221/713] ceph: bound num_export_targets array for mds info v2/v3 Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 222/713] ceph: bound xattr value length in __build_xattrs() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 223/713] ceph: cap delegated inode count in ceph_parse_deleg_inos() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 224/713] ceph: do not repeat ceph_trim_dentries() if no progress possible Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 225/713] ceph: fix leaked inode reference on writeback abort at umount Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 226/713] btrfs: drop recovered reloc root refs on recovery failure Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 227/713] btrfs: fix extent map leak in NOCOW direct I/O write Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 228/713] btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 229/713] audit: avoid dropping live tree ref on fsnotify rule autoremove Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 230/713] cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 231/713] cifs: call pagecache_isize_extended() in cifs_setsize() when extending Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 232/713] cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 233/713] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 234/713] cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 235/713] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 236/713] smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 237/713] smb: client: clear ce->tgthint in free_tgts() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 238/713] ksmbd: only rebind the reopened files own oplock on durable reconnect Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 239/713] smb: client: fix ALIGN() overflow in symlink_data() error context loop Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 240/713] smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 241/713] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 242/713] smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 243/713] smb: client: harden DFS cache against invalid target hints Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 244/713] smb: client: reject a tree connect response whose byte count is too small Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 245/713] smb: client: restore the data_offset bound in is_valid_oplock_break() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 246/713] HID: apple: preserve keyboard backlight across T2 resume Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 247/713] HID: corsair-void: Check size of status and firmware events before reading them Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 248/713] HID: picolcd: clamp eeprom debugfs read to bytes actually received Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 249/713] HID: roccat: free buffered reports when destroying device Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 250/713] HID: sensor: custom: Fix field sysfs group cleanup on failure Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 251/713] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 252/713] HID: universal-pidff: stop the device when force-feedback init fails Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 253/713] HID: mcp2221: stop device IO before hid_hw_stop Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 254/713] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 255/713] HID: mcp2221: validate report size in mcp2221_raw_event() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 256/713] HID: intel-thc-hid: intel-quickspi: validate report size before copy Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 257/713] HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 258/713] HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 259/713] HID: intel-thc-hid: intel-quickspi: " Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 260/713] eventfs: Initialize ei->children and ei->list in init_ei() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 261/713] fs/ntfs3: validate dirty page table on log replay Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 262/713] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 263/713] fs/ntfs3: bound page_lcns[] index by the log record Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 264/713] ntfs: bound the free-cluster bitmap scan to the volume Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 265/713] ntfs: reject invalid empty mapping pairs Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 266/713] ntfs: reject invalid MFT LCNs from boot sector Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 267/713] ntfs: validate non-resident attribute offsets Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 268/713] ntfs: verify run length exceeding volume boundary Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 269/713] eCryptfs: bound the packet-length peek to the user buffer Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 270/713] ecryptfs: fix tag 11 packet exact-fit size check Greg Kroah-Hartman
2026-09-04 4:53 ` [PATCH 7.2 271/713] ecryptfs: hold msg ctx list lock when cleaning daemon queue Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 272/713] ecryptfs: pass packet set buffer size to parser Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 273/713] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 274/713] ecryptfs: reject too-small tag 70 packets Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 275/713] ecryptfs: release message context on send failure Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 276/713] ecryptfs: show filename encryption options Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 277/713] efivarfs: Rate limit statfs() handler Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 278/713] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 279/713] erofs: skip sufficiently large global buffers when resizing Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 280/713] ext2: Fix lost inode updates for IS_SYNC inodes Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 281/713] fanotify: fix use-after-free of file range info Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 282/713] fat: restore original value when fat_ent_write failed Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 283/713] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 284/713] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 285/713] fbdev: ssd1307fb: defer I2C transfers from damage callbacks Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 286/713] fbdev: uvesafb: unregister connector callback on init failure Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 287/713] fonts: fixup font.h kernel-doc warnings Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 288/713] forcedeth: fix off-by-one when saving/restoring non-PCI config space Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 289/713] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 290/713] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 291/713] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 292/713] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 293/713] accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 294/713] accel/rocket: initialize job domain before cleanup paths Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 295/713] accel/rocket: Fix error path handling in rocket_job_run() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 296/713] acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 297/713] ACPI: APEI: Fix ERST timeout unit conversion Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 298/713] ACPI: APEI: GHES: fix ARM section length accounting after header Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 299/713] ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 300/713] ACPI: CPPC: Skip desired_perf read in cppc_get_perf() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 301/713] ACPI: pfr_update: fix stack buffer overflow in query_capability() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 302/713] ACPI: scan: Avoid registering platform devices with resource overlaps Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 303/713] ACPI: TAD: Add locking around AML evaluations Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 304/713] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 305/713] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 306/713] alpha: marvel: Fix lock ordering in init_io7_irqs() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 307/713] ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 308/713] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 309/713] auxdisplay: charlcd: cancel backlight work on registration failure Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 310/713] backlight: aw99706: Fix DT property names to match binding Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 311/713] backlight: aw99706: Honor the core blank state in update_status() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 312/713] block: validate user space vectors during extraction Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 313/713] block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 314/713] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 315/713] Bluetooth: btusb: Add ASUS USB-BT600 " Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 316/713] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 317/713] Bluetooth: eir: Fix OOB read in eir_get_service_data() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 318/713] bnx2x: fix double free in bnx2x_init_firmware() error path Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 319/713] bnxt_en: Write doorbell when linearizing skb fails Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 320/713] bpf, x86: Fix per-CPU address resolution into an extended register Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 321/713] bpf: Disable preemption in __bpf_get_stack Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 322/713] buffer: avoid tail commit walk for uptodate folios Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 323/713] bpf: Harden bloom filter sizing and indexing on 32-bit kernels Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 324/713] dm-io: clone the source bio instead of copying its biovec Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 325/713] dm-io: report non-retryable errors separatedly Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 326/713] dm-era: fix shadowed superblock leak on take-snap failure Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 327/713] dm raid1: reserve space for NUL-terminator in build_constructor_string() Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 328/713] dm array: validate array block headers on read Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 329/713] dm array: reject an array block whose value size is not the callers Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 330/713] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Greg Kroah-Hartman
2026-09-04 4:54 ` [PATCH 7.2 331/713] cpufreq: apple-soc: Fix OPP table cleanup Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 332/713] cpufreq: schedutil: Fix rate limit overflow Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 333/713] cxl/features: bound fwctl command payload to the input buffer Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 334/713] cxl/mce: Make the MCE notifier per-region Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 335/713] cxl/pmem: Format the nvdimm serial number as unsigned decimal Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 336/713] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 337/713] Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 338/713] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 339/713] Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 340/713] Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 341/713] Bluetooth: RFCOMM: serialize security confirmation handling Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 342/713] Bluetooth: hci_conn: re-enable advertising only for peripheral role Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 343/713] Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 344/713] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 345/713] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 346/713] Bluetooth: hci_intel: " Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 347/713] Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 348/713] kasan: fix cache shrink race with CPU hotplug Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 349/713] kho: fix size calculation in kho_preserved_memory_reserve() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 350/713] jbd2: bound shrinker scans by examined checkpoint buffers Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 351/713] jbd2: check need_resched() when skipping busy " Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 352/713] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 353/713] ip: orphan prefetched skbs before multicast forwarding Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 354/713] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 355/713] ip6_gre: fix hardware header length for NBMA tunnels Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 356/713] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 357/713] ipv6: use RCU iterator to dump route exceptions Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 358/713] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 359/713] libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 360/713] mailbox: qcom-ipcc: fix duplicate channel allocation across holes Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 361/713] md/raid10: fix still_degraded being inverted in raid10_sync_request() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 362/713] md: do overflow check for sb->bblog_shift in super_1_load() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 363/713] module: validate string table section types Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 364/713] mpls: reload header after pskb_may_pull() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 365/713] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 366/713] module/kallsyms: fix nextval for data symbol lookup Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 367/713] nouveau/gem: reserve the bo in the info ioctl around the vma lookup Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 368/713] params: fix charp corruption on allocation failure Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 369/713] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 370/713] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 371/713] SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 372/713] SUNRPC: svcauth_gss: enforce krb5 token minimum length Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 373/713] sunrpc: route to a populated pool in svc_pool_for_cpu() Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 374/713] SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 375/713] SUNRPC: always drain cache_cleaner before destroying a cache_detail Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 376/713] SUNRPC: Check svc pool percpu counter allocation Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 377/713] SUNRPC: close backchannel before destroying callback service Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 378/713] sunrpc: defer rq_argp and rq_resp free until after RCU grace period Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 379/713] SUNRPC: fix gssx_dec_option_array error path bugs Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 380/713] sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 381/713] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 382/713] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 383/713] SUNRPC: harden gss_unwrap_resp_priv length checks Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 384/713] sunrpc: init gssp_lock before publishing proc entry Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 385/713] SUNRPC: reject duplicate CREDS_VALUE options Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 386/713] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 387/713] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 388/713] SUNRPC: wait for in-flight client TLS handshake callback Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 389/713] svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 390/713] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails Greg Kroah-Hartman
2026-09-04 4:55 ` [PATCH 7.2 391/713] svcrdma: Fix offset arithmetic in read_chunk_range Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 392/713] svcrdma: Fix pcl_for_each_segment for empty chunks Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 393/713] svcrdma: Fix unmatched rn_unregister on failed accept Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 394/713] svcrdma: Reject connection when transport allocation fails Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 395/713] svcrdma: Reject inline replies that overflow the pull-up buffer Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 396/713] svcrdma: Reject oversized Read segments at decode time Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 397/713] svcrdma: Reject Read lists that exceed the page budget Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 398/713] svcrdma: Reject Write/Reply chunks with segcount 0 Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 399/713] svcrdma: Use svc_xprt_put to free listener on create failure Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 400/713] svcrdma: Validate Read chunk positions before reconstruction Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 401/713] udf: reject VAT indexes equal to the entry count Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 402/713] wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 403/713] wifi: mt76: mt7925: cancel pending mlo_pm_work Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 404/713] staging: media: tegra-video: fix of_node_put() on VIP parse errors Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 405/713] staging: media: tegra-video: vi: fix probe failure on skipped last port Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 406/713] media: staging/ipu7: fix async notifier UAF on probe error path Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 407/713] sched/core: Handle pick_task() releasing the rq lock Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 408/713] sched/core: Make core-sched flips wait for in-flight selections Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 409/713] sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 410/713] sched_ext: Fix this_rq() assumptions in dispatch kfuncs Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 411/713] sched_ext: Fix rq->core_pick corruption under core scheduling Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 412/713] sched_ext: Count rq lock releases in rq->scx.lock_drop_seq Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 413/713] sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 414/713] sched_ext: Fix exit_task leak on fork failure during enable Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 415/713] sched_ext: Fix inverted ops.core_sched_before() invocation Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 416/713] sched_ext: Dont BUG_ON a destroyed DSQ in process_deferred_reenq_users Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 417/713] sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 418/713] sched_ext: Keep kick_sync waiting on the rqs own CPU Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 419/713] scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 420/713] scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 421/713] rpmsg: glink: smem: order FIFO read after availability check Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 422/713] Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 423/713] arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 424/713] arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 425/713] arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 426/713] arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 427/713] arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 428/713] arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 429/713] arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 430/713] arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 431/713] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 432/713] riscv: dts: spacemit: k1-milkv-jupiter: " Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 433/713] riscv: dts: spacemit: k1-musepi-pro: " Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 434/713] riscv: dts: spacemit: k1-orangepi-r2s: " Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 435/713] riscv: dts: spacemit: k1-orangepi-rv2: " Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 436/713] RISC-V: KVM: Fix PMU event info array size overflow Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 437/713] riscv: acpi: Handle LPI architectural context loss flags Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 438/713] riscv: unaligned: stop using kthread for check_vector_unaligned_access() Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 439/713] remoteproc: scp: Fix device reference leak on failed lookup Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 440/713] ptp: vmclock: prevent read-only mappings from becoming writable Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 441/713] qede: Fix NULL pointer dereference in TPA fragment processing Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 442/713] RDMA/cxgb4: Cancel reg_work before freeing device on remove Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 443/713] RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budget Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 444/713] RDMA/ionic: Embed counter driver data in rdma_counter allocation Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 445/713] RDMA/ucma: Lock the handler in ucma_set_ib_path() Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 446/713] RDMA/ucma: Lock the handler in ucma_write_cm_event() Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 447/713] RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 448/713] RDMA/uverbs: Guard legacy bundles without method_elm Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 449/713] regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 450/713] regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata Greg Kroah-Hartman
2026-09-04 4:56 ` [PATCH 7.2 451/713] regulator: qcom-refgen: correct the regulator type to CURRENT Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 452/713] ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 453/713] ring-buffer: Free cpu_buffer::free_page with subbuf_order Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 454/713] ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 455/713] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 456/713] ring-buffer: Stop remote reader update when page swap fails Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 457/713] PM: sleep: Unblock runtime PM when device prepare fails Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 458/713] orangefs: fix double-free of trailer_buf on readdir copy failure Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 459/713] orangefs: skip leading spaces before parsing client debug masks Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 460/713] ocfs2: always run deallocs on copy-on-write completion Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 461/713] ocfs2: bound namelen in dlm_migrate_request_handler Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 462/713] ocfs2: validate lengths in dlm_mig_lockres_handler Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 463/713] ocfs2: validate rl_used against rl_count in refcount block validator Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 464/713] ocfs2: validate directory-index entry counts when reading metadata Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 465/713] ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin() Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 466/713] ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 467/713] ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 468/713] ocfs2: fix cached cluster count after suballocator reclaim Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 469/713] ocfs2: fix readdir position truncation on 32-bit kernels Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 470/713] openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 471/713] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 472/713] openvswitch: only skb_tx_error() a packet we are about to drop Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 473/713] ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 474/713] arm64: compat: Fix decrementing LDM/STM alignment emulation Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 475/713] arm64: proton-pack: Restore the nospectre_bhb command-line option Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 476/713] ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 477/713] ASoC: codecs: aw88261: only check PLL and clock state at power-up Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 478/713] dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 479/713] hwmon: (max6621) fix negative temperature offset and crit readings Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 480/713] hwmon: (max6621) fix temperature clamp range Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 481/713] i2c: mxs: fix DMA channel leak on probe error Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 482/713] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 483/713] lockd: pin next file across nlm_inspect_file lock-drop Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 484/713] lockd: fix NLMv4 GRANTED_MSG handling Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 485/713] lockd: fix NULL dereference on lockowner allocation failure Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 486/713] lockd: fix swapped arguments in nlmsvc_match_ip() Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 487/713] nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 488/713] nvme: zero the discard fallback page Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 489/713] nvme-pci: disable controller on admin queue IRQ setup failure Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 490/713] nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 491/713] nvme-tcp: fix host memory disclosure on R2T for a read command Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 492/713] nvme-tcp: reject a read that transferred too few bytes Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 493/713] sctp: stop processing a packet once its association is deleted Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 494/713] sctp: drop a chunk if its transport was removed Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 495/713] sctp: fix NULL deref on untransmitted RECONF completion Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 496/713] sctp: distinguish sequence zero from wildcard in reconf lookup Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 497/713] sctp: fix stream->outcnt underflow on duplicate RECONF responses Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 498/713] power: supply: bq24257: fix use-after-free on remove Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 499/713] power: supply: bq256xx: drain usb_work before freeing the charger Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 500/713] power: supply: bq25890: Fix power_supply reference leak Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 501/713] power: supply: charger-manager: register regulators before exposing sysfs Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 502/713] power: supply: cros_usbpd-charger: bound the EC-reported port count Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 503/713] power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 504/713] power: supply: lp8727: fix use-after-free in lp8727_release_irq() Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 505/713] power: supply: lp8788-charger: fix use-after-free on remove Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 506/713] power: supply: pf1550: enable charging when battery profile exists Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 507/713] power: supply: qcom_battmgr: fix use-after-free Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 508/713] power: supply: qcom_battmgr: terminate the strings from firmware Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 509/713] power: supply: rt9455: quiesce delayed work before teardown Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 510/713] power: supply: twl4030_charger: cancel workers via devm Greg Kroah-Hartman
2026-09-04 4:57 ` [PATCH 7.2 511/713] power: supply: ucs1002: fix use-after-free on remove Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 512/713] power: supply: max17040: propagate register read errors Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 513/713] power: supply: max17040: drop incorrect I2C functionality check Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 514/713] power: supply: max17040: synchronize work cancellation on suspend Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 515/713] s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 516/713] s390/percpu: Fix MVIY_PERCPU() with older binutils Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 517/713] s390/dasd: Do not complete a failed ESE read as successful Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 518/713] s390/dasd: Guard sysfs discipline callbacks against unallocated private data Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 519/713] s390/dasd: Propagate partial completion length across ERP recovery Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 520/713] PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 521/713] PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 522/713] PCI: meson: Fix GPIO state while requesting PERST# Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 523/713] PCI: starfive: Fix resource leaks on error paths in host_init() Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 524/713] PCI: plda: Fix use-after-free of event IRQs during teardown Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 525/713] PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 526/713] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 527/713] PCI/sysfs: Fix read byte order in pci_read_legacy_io() Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 528/713] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 529/713] PCI/AER: Emit TLP Log only for unmasked errors Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 530/713] PCI/AER: Fix mapping of errors to agent & layer Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 531/713] PCI/ASPM: Avoid L0s for Realtek RTS525A Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 532/713] PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Greg Kroah-Hartman
2026-09-04 9:02 ` Lukas Wunner
2026-09-04 14:12 ` Sasha Levin
2026-09-04 4:58 ` [PATCH 7.2 533/713] PCI/MSI: Enable memory decoding before restoring MSI-X messages Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 534/713] PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 535/713] PCI/proc: Use file_ns_capable() when checking config space read access Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 536/713] PCI/proc: Warn on writes to kernel-exclusive config space regions Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 537/713] iommu/amd: Put PCI device after handling PPR faults Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 538/713] iommu/msm: Unwind probe state on registration failure Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 539/713] iommu/sva: Set handle->dev before the SVA handle is visible Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 540/713] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 541/713] iommu/arm-smmu-v3: Add HAFT support for SVA Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 542/713] iommu/arm-smmu-v3: Manage teardown with devm Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 543/713] iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 544/713] iommu/vt-d: Fix no_iommu to disable platform opt-in Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 545/713] iommu/vt-d: Force requesting ACS when tboot is enabled Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 546/713] iommupt: Return zero for invalid iova_to_phys() ranges Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 547/713] iommufd: Avoid locking internal accesses during unmap Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 548/713] iommufd: Release current IOAS on xa_store() failure Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 549/713] iommufd: Fix UAF in selftest IOPF reporting Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 550/713] platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 551/713] platform/x86: ISST: Validate level in perf mask ioctls Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 552/713] platform/x86: ISST: Validate socket ID in clos_assoc ioctl Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 553/713] mmc: via-sdmmc: cancel card-detect work on remove Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 554/713] mmc: via-sdmmc: stop card-detect handling on probe failure Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 555/713] platform/x86: ISST: Add a NULL check for sst_inst[] Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 556/713] platform/x86: ISST: Just allow 2 bits for SST feature enable Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 557/713] platform/x86: ISST: Use PP level enable mask Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 558/713] platform/x86: ISST: Validate logical CPU id and clos id Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 559/713] platform/x86: ISST: Validate max level for set feature Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 560/713] platform/x86: ISST: Validate parameter for core power state Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 561/713] platform/x86: ISST: Validate parameter for frequency and priority Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 562/713] platform/x86: ISST: Return error during profile addition Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 563/713] platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 564/713] platform/x86: int1092: Fix potential memory leak in sar_probe() Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 565/713] platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 566/713] platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 567/713] platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 568/713] platform/x86: think-lmi: Fix certificate thumbprint sysfs output Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 569/713] platform/x86: think-lmi: Free system certificate signatures Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 570/713] platform/x86: think-lmi: Fix current password length check Greg Kroah-Hartman
2026-09-04 4:58 ` [PATCH 7.2 571/713] platform/chrome: sensorhub: Bound the EC-reported sensor number Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 572/713] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 573/713] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 574/713] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 575/713] platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 576/713] platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 577/713] platform/x86: hp-bioscfg: advance elem past consumed array elements Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 578/713] platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 579/713] platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 580/713] platform/x86: hp-bioscfg: fix heap OOB read on empty password write Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 581/713] platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 582/713] platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 583/713] platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 584/713] platform/x86: hp-bioscfg: pass validated element count to package parsers Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 585/713] platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 586/713] io_uring/waitid: honor task_work cancellation Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 587/713] io_uring/waitid: avoid siginfo copy during ring teardown Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 588/713] io_uring/query: cap user size passed to copy_struct_to_user Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 589/713] interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 590/713] ipmi: ipmb: validate write message length Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 591/713] ipmi: Remove all sysfs files on registration failure Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 592/713] ipmi: si: Fix NULL pointer dereference after failed registration Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 593/713] ipmi:msghandler: Cancel work cleanly on an error Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 594/713] net/iucv: filter frames in afiucv_hs_rcv() by ingress device Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 595/713] xdp: fix zero-copy frame layout Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 596/713] slip: fix use-after-free in sl_sync() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 597/713] net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 598/713] net: tun: bound receive headroom Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 599/713] net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 600/713] net: bnxt: ring the doorbell when SW USO exits early Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 601/713] net: ibm: emac: mal: fix NAPI locking Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 602/713] net: ipa: fix stalled modem TX queue after runtime resume Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 603/713] net: l2tp: do not propagate multicast notification errors Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 604/713] net: mctp: hold a reference to the route device in mctp_route_lookup() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 605/713] net: openvswitch: fix flow mask use-after-free on flow deletion Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 606/713] net: openvswitch: fix nf_connlabels leak in ovs_ct_init Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 607/713] net: phylink: correctly validate returned PCS in phylink_inband_caps Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 608/713] net: ravb: avoid dereferencing an invalid PTP clock Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 609/713] net: ravb: serialize PTP clock teardown Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 610/713] net: thunderbolt: Release the Rx HopID that was handed out on mismatch Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 611/713] net: thunderbolt: Mark the connection down when bringing it up fails Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 612/713] NTB: ntb_transport: Recycle TX entries before client callbacks Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 613/713] NTB: ntb_transport: Fail TX enqueue when the QP link is down Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 614/713] NTB: ntb_transport: Reject oversized TX buffers Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 615/713] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 616/713] net: ntb_netdev: Avoid double-accounting netif_rx() drops Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 617/713] net: ntb_netdev: Count packets dropped on RX refill failure Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 618/713] net/mlx5e: do not HW-GRO coalesce small frames Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 619/713] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 620/713] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 621/713] net/smc: do not dereference an unset send buffer on the SMC-D teardown path Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 622/713] net/smc: fix socket refcount leak in smc_switch_conns() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 623/713] net/smc: fix use-after-free in smc_rx_pipe_buf_release() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 624/713] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 625/713] net/smc: stop killed, freed and out_of_sync sharing a byte Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 626/713] net/smc: unregister the connection before draining the rx tasklet Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 627/713] net: cap advertised IP tunnel headroom Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 628/713] net: fix spurious TX timeout after dev_activate() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 629/713] net: skbuff: dont touch shared zerocopy state in skb_tx_error() Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 630/713] seg6: reset IP6CB after IPv6 decapsulation Greg Kroah-Hartman
2026-09-04 4:59 ` [PATCH 7.2 631/713] hwrng: stm32 - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 632/713] mfd: cgbc: Fix teardown ordering in cgbc_remove() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 633/713] mfd: qnap-mcu: keep the reply buffer alive past a command timeout Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 634/713] mfd: sm501: Fix potential memory leaks during remove Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 635/713] ALSA: 6fire: bound the MIDI event length from the device Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 636/713] ALSA: aloop: Check card index validity at probe Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 637/713] ALSA: bcd2000: clear the URB pointers on disconnect Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 638/713] ALSA: FCP: do not copy out an uninitialised init response Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 639/713] ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 640/713] ALSA: mpu401: Check card index validity at probe Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 641/713] ALSA: mts64: " Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 642/713] ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 643/713] ALSA: portman2x4: Check card index validity at probe Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 644/713] ALSA: serial-u16550: " Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 645/713] ALSA: virmidi: " Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 646/713] ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 647/713] ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 648/713] ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 649/713] ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 650/713] rust: num: reject Bounded::shr overshifts at build time Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 651/713] arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 652/713] dm-stats: fix a crash if allocation of per-cpu data fails Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 653/713] dm-switch: use WRITE_ONCE() in switch_region_table_write() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 654/713] dm-pcache: validate geometry fields from on-disk cache_info Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 655/713] dm-pcache: validate kset key_num and intra-segment bounds Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 656/713] dm-pcache: validate on-media seg_num against the cache device size Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 657/713] dm-pcache: bound the persisted tail-position offset Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 658/713] dm-pcache: clamp the tail kset read to the segment data region Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 659/713] dm-pcache: detect a cycle in the last-kset chain during replay Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 660/713] dm-pcache: only hand out initialized cache segments Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 661/713] dm-pcache: fix implicit u8 truncation of gc_percent in message handler Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 662/713] dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 663/713] i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 664/713] i3c: master: adi: initialize the lock before enabling interrupts Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 665/713] i3c: master: Fix info leak and UAF in device unregister path Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 666/713] i3c: master: svc: bound IBI payload to the requested max_payload_len Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 667/713] i3c: master: Fix potential UAF in i3c_device_uevent() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 668/713] i3c: renesas: Check that the transfer is valid before accessing it Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 669/713] i3c: renesas: Clean DATBAS register on detach Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 670/713] i3c: renesas: Follow the reset deassert order used in probe Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 671/713] i3c: renesas: Reconfigure the DATBAS register on re-attach Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 672/713] i3c: renesas: Reset the controller on resume Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 673/713] i3c: renesas: Restore STDBR and EXTBR registers " Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 674/713] i3c: renesas: Perform Dynamic Address Assignment " Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 675/713] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 676/713] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 677/713] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 678/713] fuse: decouple fuse_ring creation from ent registration Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 679/713] fuse: copy request headers via a stack buffer for io-uring Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 680/713] crypto: iaa - unmap dst before software fallback on decompress Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 681/713] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 682/713] crypto: atmel-ecc - avoid stale fallback key after set_secret failure Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 683/713] mm/kmemleak: stop the task stack scan early when interrupted Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 684/713] mm/kmemleak: report RCU-tasks quiescent states during the scan Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 685/713] wifi: mwifiex: Detach sync cmd buffer on interrupted wait Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 686/713] wifi: rtl818x: initialize eeprom_93cx6 struct to zero Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 687/713] wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 688/713] wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 689/713] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 690/713] wifi: rtw88: pci: fix resource leak on failed NAPI setup Greg Kroah-Hartman
2026-09-04 5:00 ` [PATCH 7.2 691/713] wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 692/713] wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 693/713] wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 694/713] wifi: mt76: mt7925: cancel mlo_pm_work on stop Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 695/713] wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 696/713] wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 697/713] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 698/713] vsock/virtio: flush works in dependency order Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 699/713] w1: ds28e17: reject an oversize length on an I2C block read Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 700/713] xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 701/713] zloop: truncate finished zones to zone capacity Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 702/713] tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 703/713] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 704/713] sticon/parisc: Detect default STI graphics card for console output Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 705/713] signal: avoid shared siginfo namespace rewrites Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 706/713] smack: fix cred UAF in smack_file_send_sigiotask() Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 707/713] taskstats: fix cpumask parsing cutting off the last character Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 708/713] timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 709/713] timer: Keep debugobjects state consistent in migrate_timer_list() Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 710/713] udf: Fix i_lenExtents truncation on 32-bit kernels Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 711/713] selftests/mm: fix on-fault-limit false failure under sudo-rs Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 712/713] ACPI: scan: Do not combine resources that overlap completely Greg Kroah-Hartman
2026-09-04 5:01 ` [PATCH 7.2 713/713] platform/chrome: sensorhub: Fix dropped timestamp events and log spam Greg Kroah-Hartman
2026-09-04 8:48 ` [PATCH 7.2 000/713] 7.2.4-rc1 review Takeshi Ogasawara
2026-09-04 9:31 ` Ronald Warsow
2026-09-04 12:52 ` Brett A C Sheffield
2026-09-04 16:08 ` Markus Reichelt
2026-09-04 21:08 ` Shuah Khan
2026-09-05 11:45 ` Miguel Ojeda
2026-09-05 13:00 ` Barry K. Nathan
2026-09-05 18:07 ` Peter Schneider
2026-09-05 18:33 ` Ron Economos
2026-09-05 20:27 ` Benjamin Boortz
2026-09-06 14:46 ` Jeffrin Thalakkottoor
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox