* [PATCH 6.18 001/869] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 002/869] x86/mm/pat: Use pr_warn() for early W^X warnings Greg Kroah-Hartman
` (875 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Yan Zhao, Binbin Wu,
Rick Edgecombe, Sean Christopherson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit d85f7dc8cf3c91a131946dae4c3aa8d9c97322d7 ]
Add EXIT_REASON_UNDEFINED to track KVM's magic "0xdead" value that's used
to stuff the exit reason on a failed VM-Enter so that the magic can be
reused by TDX, and to make it more obvious that it's an arbitrary, KVM-
defined value (though the whole "dead" thing makes it pretty darn obvious).
Opportunistically add a compile-time assert to ensure the KVM-defined exit
reason never collides with a "real" exit reason.
No functional change intended.
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Yan Zhao <yan.y.zhao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260921235656.1107929-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/vmx.h | 8 ++++++++
arch/x86/kvm/vmx/vmx.c | 4 +++-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index c85c500195239..a9daddd84ad6c 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -20,6 +20,14 @@
#include <asm/trapnr.h>
#include <asm/vmxfeatures.h>
+/*
+ * UNDEFINED is a KVM-defined value used to indicate that the basic exit reason
+ * is undefined/invalid, e.g. on VM-Fail or if TDX never attempted VM-Enter.
+ * The value itself is arbitrary, it just needs to not collide with a real exit
+ * reason.
+ */
+#define EXIT_REASON_UNDEFINED 0xdead
+
#define VMCS_CONTROL_BIT(x) BIT(VMX_FEATURE_##x & 0x1f)
/*
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 8da96a6c61773..ced20415a14f0 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6151,6 +6151,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
static const int kvm_vmx_max_exit_handlers =
ARRAY_SIZE(kvm_vmx_exit_handlers);
+static_assert(EXIT_REASON_UNDEFINED >= ARRAY_SIZE(kvm_vmx_exit_handlers));
+
void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code)
{
@@ -7333,7 +7335,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,
vmx_enable_fb_clear(vmx);
if (unlikely(vmx->fail)) {
- vmx->vt.exit_reason.full = 0xdead;
+ vmx->vt.exit_reason.full = EXIT_REASON_UNDEFINED;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 002/869] x86/mm/pat: Use pr_warn() for early W^X warnings
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 001/869] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 003/869] inet: reject unhashed sockets during established lookups Greg Kroah-Hartman
` (874 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor,
Mike Rapoport (Microsoft), Dave Hansen, Ihor Solodrai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit ea6fd393cb9e6811a748c7551de0dd3090f9dcde ]
Nathan Chancellor reports the following warning:
CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
from its_alloc() doing set_memory_x() during early retpoline setup.
The warning is not factually wrong but it is unproductive. First, the RWX
permission is temporary and fixed up by execmem_restore_rox(). Second,
at the time of the warning, all kernel text is mapped RWX. So there is not
even a transient actual security issue.
The right way to fix this up is to relax RWX detection during boot but
make a final verification pass over all kernel page tables before running
userspace. There is code to do that today (debug_checkwx()) but it
must be enabled explicitly in Kconfig.
For now, retain the warning even if it's unproductive, but make it
scream less loudly: use pr_warn_once() rather than WARN_ONCE().
Remove the warning once debug_checkwx() behavior becomes unconditional.
Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://patch.msgid.link/20260913-fixes-verify-rwx-v3-1-5e1d6a08bd02@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/pat/set_memory.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 12b7de5f0957e..9fc18a091311f 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -718,6 +718,21 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
return new;
end = start + npg * PAGE_SIZE - 1;
+
+ /*
+ * If the kernel text is still RWX, gently complain, this could be a
+ * false positive.
+ * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
+ * the warning can be removed completely.
+ */
+ if (!kernel_set_to_readonly) {
+ pr_warn_once("CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
+ (unsigned long long)pgprot_val(old),
+ (unsigned long long)pgprot_val(new),
+ start, end, pfn);
+ return new;
+ }
+
WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
(unsigned long long)pgprot_val(old),
(unsigned long long)pgprot_val(new),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 003/869] inet: reject unhashed sockets during established lookups
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 001/869] KVM: VMX: Formally define KVMs "0xdead" exit reason used for failed VM-Enter Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 002/869] x86/mm/pat: Use pr_warn() for early W^X warnings Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 004/869] drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages Greg Kroah-Hartman
` (873 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 4e2b3ef19e0e04adca38442f07dd6bc93c712bf1 ]
TCP established ehash lookups are lockless. The socket caches involved
use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader
that retained its old address has finished.
After a tuple match, __inet_lookup_established() and
__inet6_lookup_established() acquire a reference and repeat the tuple
check. They do not check whether the new object is hashed. If the
address is reused for a socket with the same tuple, the lookup can
acquire a reference to the new object and return it while its nulls node
is unhashed.
A PoC that drives reuse with a SYN cookie request socket reproduced the
crash. The new request socket is unhashed and has a NULL rsk_listener.
A lookup that had loaded the address of the old request socket acquired
the reference published by tcp_get_cookie_sock() and returned the new
object. tcp_v4_rcv() then read sk_state through the NULL listener.
The resulting crash was:
BUG: kernel NULL pointer dereference, address: 0000000000000012
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
...
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)
...
RIP: 0010:tcp_v4_rcv+0x44e/0x1280
...
R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000
...
CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0
...
Call Trace:
<IRQ>
? raw_local_deliver+0xae/0x240
ip_protocol_deliver_rcu+0x2d/0x180
ip_local_deliver_finish+0x84/0x100
ip_sublist_rcv_finish+0x5f/0x70
ip_sublist_rcv+0x12a/0x1d0
ip_list_rcv+0xfd/0x130
__netif_receive_skb_list_core+0x223/0x250
netif_receive_skb_list_internal+0x1d2/0x2c0
? try_fill_recv+0x39/0x7b0
napi_complete_done+0x74/0x170
virtnet_poll+0x445/0x600
__napi_poll+0x27/0x1e0
net_rx_action+0x2fe/0x3b0
handle_softirqs+0xc2/0x2c0
__irq_exit_rcu+0x74/0xd0
common_interrupt+0x7f/0x90
</IRQ>
...
Kernel panic - not syncing: Fatal exception in interrupt
After taking a reference, check whether the nulls node is unhashed in
both IPv4 and IPv6 established lookups. If it is unhashed or the tuple
no longer matches, drop the reference and restart the lookup.
Lookups racing with the TIME_WAIT hashdance, or with a request being
replaced by its child, now restart and find the new socket instead of
returning the old one.
Request sockets that were never inserted into ehash can have a nonzero
refcount, and a stale lookup can hold a transient reference. Therefore,
when SYN cookie, Fast Open, and request migration paths fail after
setting a nonzero refcount, release the references held by those paths
with reqsk_put() instead of freeing the request directly.
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261029214219.1035176-2-imv4bel@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/inet_connection_sock.c | 10 +++++++---
net/ipv4/inet_hashtables.c | 5 +++--
net/ipv4/syncookies.c | 2 ++
net/ipv4/tcp_input.c | 4 +++-
net/ipv6/inet6_hashtables.c | 4 +++-
5 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 6b36652d6bb9d..3e9eaf9d341d1 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1154,10 +1154,14 @@ static void reqsk_timer_handler(struct timer_list *t)
*/
if (nreq) {
__NET_INC_STATS(net, LINUX_MIB_TCPMIGRATEREQFAILURE);
+ /* The timer was not armed, drop its reference here. */
+ reqsk_put(nreq);
no_ownership:
reqsk_migrate_reset(nreq);
reqsk_queue_removed(queue, nreq);
- __reqsk_free(nreq);
+ /* Drop the temporary reference and the one reserved for ehash. */
+ reqsk_put(nreq);
+ reqsk_put(nreq);
}
drop:
@@ -1460,7 +1464,7 @@ struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
reqsk_migrate_reset(nreq);
- __reqsk_free(nreq);
+ reqsk_put(nreq);
} else if (inet_csk_reqsk_queue_add(sk, req, child)) {
return child;
}
@@ -1515,7 +1519,7 @@ void inet_csk_listen_stop(struct sock *sk)
__NET_INC_STATS(sock_net(nsk),
LINUX_MIB_TCPMIGRATEREQFAILURE);
reqsk_migrate_reset(nreq);
- __reqsk_free(nreq);
+ reqsk_put(nreq);
}
rcu_read_unlock();
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index a57e33ff92d77..49c70d752a892 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -549,8 +549,9 @@ struct sock *__inet_lookup_established(const struct net *net,
if (likely(inet_match(net, sk, acookie, ports, dif, sdif))) {
if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
goto out;
- if (unlikely(!inet_match(net, sk, acookie,
- ports, dif, sdif))) {
+ if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+ !inet_match(net, sk, acookie, ports, dif,
+ sdif))) {
sock_gen_put(sk);
goto begin;
}
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b5f0a65c67864..8b3d4e8ee4556 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -218,6 +218,8 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
bh_unlock_sock(child);
sock_put(child);
+ reqsk_put(req);
+ return NULL;
}
__reqsk_free(req);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e1785140bf9b1..6a2c05dff4215 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7561,7 +7561,9 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
bh_unlock_sock(fastopen_sk);
sock_put(fastopen_sk);
- goto drop_and_free;
+ /* tcp_disconnect() already dropped one reqsk ref. */
+ reqsk_put(req);
+ goto drop;
}
READ_ONCE(sk->sk_data_ready)(sk);
bh_unlock_sock(fastopen_sk);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 182d38e6d6d8d..f4f39a20e9514 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -73,7 +73,9 @@ struct sock *__inet6_lookup_established(const struct net *net,
if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
goto out;
- if (unlikely(!inet6_match(net, sk, saddr, daddr, ports, dif, sdif))) {
+ if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+ !inet6_match(net, sk, saddr, daddr, ports, dif,
+ sdif))) {
sock_gen_put(sk);
goto begin;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 004/869] drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 003/869] inet: reject unhashed sockets during established lookups Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 005/869] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot Greg Kroah-Hartman
` (872 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Honglei Huang,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honglei Huang <honghuan@amd.com>
[ Upstream commit 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 ]
Since commit c08972f55594 ("drm/amdgpu: fix amdgpu_hmm_range_get_pages")
moved mmu_interval_read_begin() out of the per-chunk loop, the
captured notifier_seq is no longer refreshed across retries. As a
result, the existing -EBUSY retry path can never make progress:
hmm_range_fault() returns -EBUSY only when
mmu_interval_check_retry(notifier, notifier_seq) reports that the
sequence is stale. Once the sequence has advanced, the stored seq
will never match again, so every subsequent call within the same
invocation returns -EBUSY immediately.
The "goto retry" therefore degenerates into a busy spin that simply
burns CPU for the full HMM_RANGE_DEFAULT_TIMEOUT (~1s) window before
finally bailing out with -EAGAIN. This is pure latency with no chance
of recovery, and it actively hurts the KFD userptr stack: the caller
ends up blocked for a second while holding mmap_lock, only to return
-EAGAIN to the restore worker (or to userspace) which would have
re-driven the operation immediately anyway.
Drop the retry/timeout entirely and let -EBUSY propagate straight to
out_free_pfns, where it is already translated to -EAGAIN. Recovery is
handled at a higher level: the KFD restore_userptr_worker reschedules
itself, and the userptr ioctl path returns -EAGAIN to userspace.
No functional regression: the previous behaviour on -EBUSY was already
to fail with -EAGAIN after a 1s stall; we just skip the stall.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Honglei Huang <honghuan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ sashal: Adjusted the declaration context: this tree allocates hmm_range with kzalloc() as a plain pointer rather than embedding it, so only the timeout declaration was dropped. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
index db2bb5cb671d3..fa3676c5babcd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
@@ -173,7 +173,6 @@ int amdgpu_hmm_range_get_pages(struct mmu_interval_notifier *notifier,
const u64 max_bytes = SZ_2G;
struct hmm_range *hmm_range;
- unsigned long timeout;
unsigned long *pfns;
unsigned long end;
int r;
@@ -204,15 +203,9 @@ int amdgpu_hmm_range_get_pages(struct mmu_interval_notifier *notifier,
pr_debug("hmm range: start = 0x%lx, end = 0x%lx",
hmm_range->start, hmm_range->end);
- timeout = jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
-
-retry:
r = hmm_range_fault(hmm_range);
- if (unlikely(r)) {
- if (r == -EBUSY && !time_after(jiffies, timeout))
- goto retry;
+ if (unlikely(r))
goto out_free_pfns;
- }
if (hmm_range->end == end)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 005/869] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 004/869] drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 006/869] mm/truncate: look up the end-edge straddler by index Greg Kroah-Hartman
` (871 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Teodorescu, Dennis Tighe,
Sashiko Bot, David Hildenbrand (Arm), Ackerley Tng,
Sean Christopherson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit e6ecb88711d93b9e014532f17d3d29b57e80932c ]
If inserting a memslot into a guest_memfd's bindings xarray fails,
propagate the error back to the caller, i.e. fail memslot creation as well.
Signalling success and continuing on with memslot creation results in
use-after-free, as the guest_memfd instance will remain reachable via the
memslot after the file is freed (kvm_gmem_release() won't nullify the file
pointer due to lack of a valid binding).
Opportunistically WARN and reject binding if KVM_MEMSLOT_GMEM_ONLY is
already set, partly to guard against goofs elsewhere, but mostly so that
KVM doesn't need to worry about clobbering flags when unwinding on failure.
Regarding the unwind, the slot must be fully prepared before inserting it
into the bindings, at which point the slot becomes reachable. I.e. waiting
to update the slot in order to avoid the ugly unwind isn't an option. And
as part of the unwind, explicitly nullify the relevant bindings, as xarray
can store a subset of entries when populating a range.
Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Reported-by: Dennis Tighe <dtighe@google.com>
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260823135031.4F6DC1F000E9%40smtp.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Link: https://patch.msgid.link/20260922001332.1121266-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
[ sashal: Changed the two &f->bindings references to &gmem->bindings to match the existing variable name. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
virt/kvm/guest_memfd.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index a59a4446b8461..2ab7bb46a371e 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -576,6 +576,9 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
BUILD_BUG_ON(sizeof(gpa_t) != sizeof(offset));
BUILD_BUG_ON(sizeof(gfn_t) != sizeof(slot->gmem.pgoff));
+ if (WARN_ON_ONCE(slot->flags & KVM_MEMSLOT_GMEM_ONLY))
+ return -EINVAL;
+
file = fget(fd);
if (!file)
return -EBADF;
@@ -613,7 +616,13 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
if (kvm_gmem_supports_mmap(inode))
slot->flags |= KVM_MEMSLOT_GMEM_ONLY;
- xa_store_range(&gmem->bindings, start, end - 1, slot, GFP_KERNEL);
+ r = xa_err(xa_store_range(&gmem->bindings, start, end - 1, slot, GFP_KERNEL));
+ if (r) {
+ xa_store_range(&gmem->bindings, start, end - 1, NULL, GFP_KERNEL);
+ slot->gmem.file = NULL;
+ slot->gmem.pgoff = 0;
+ slot->flags &= ~KVM_MEMSLOT_GMEM_ONLY;
+ }
filemap_invalidate_unlock(inode->i_mapping);
/*
@@ -621,7 +630,6 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
* not the other way 'round. Active bindings are invalidated if the
* file is closed before memslots are destroyed.
*/
- r = 0;
err:
fput(file);
return r;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 006/869] mm/truncate: look up the end-edge straddler by index
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 005/869] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 007/869] staging: rtl8723bs: fix spacing around operators in rtw_recv.c Greg Kroah-Hartman
` (870 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Andrew Morton, Sashiko,
Jan Kara, Zi Yan, Brian Foster, David Hildenbrand,
Lorenzo Stoakes, Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Hugh Dickins, Baolin Wang,
Matthew Wilcox (Oracle), Joanne Koong, Darrick J. Wong,
yizhang089, Yang Erkun, Zhihao Cheng, Kefeng Wang, yukuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit f47dee903b9f0f1e4e7181e8a398a7678cabf0a5 ]
In truncate_inode_partial_folio(), after the first split at the start
edge, folio_split() unlocks and drops the refcount of the after-split
sub-folios. The sub-folio straddling the end of the truncation range is
therefore unlocked and only transiently ref'd in the page cache while the
code still derives it from a page pointer inside the original folio.
Between the first split finishing and page_folio() resolving split_at2,
that tail page can be reclaimed, freed and reallocated as a new large
folio in the same mapping at a different file offset. folio2 then points
at a folio that does not cover the end boundary, yet folio2->mapping ==
folio->mapping still holds, so the stale pointer passes the mapping check
and folio_split_or_unmap() splits a folio at a wrong position (or, with a
transient refcount, a use-after-free window opens between try_get and the
split). __folio_split()'s own folio != page_folio(split_at) check cannot
catch this either since split_at2 has been reallocated as part of the new
folio, so page_folio(split_at2) resolves back to folio2.
Look the straddler up by its page index instead. __filemap_get_folio()
returns the folio currently covering the boundary, ref'd and locked, with
the mapping validated under the lock, so the split target is always the
real folio at the end edge.
Link: https://lore.kernel.org/20260928120833.3440834-3-yi.zhang@huaweicloud.com
Link: https://lore.kernel.org/linux-mm/DLGXT0ERY79Z.3C5DYVJVX6S9Z@nvidia.com/
Fixes: 7460b470a131 ("mm/truncate: use folio_split() in truncate operation")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260916094500.C30061F00893%40smtp.kernel.org
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Joanne Koong <joannelkoong@gmail.com>
Cc: Darrick J. Wong <djwong@kernel.org>
Cc: <yizhang089@gmail.com>
Cc: Yang Erkun <yangerkun@huawei.com>
Cc: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: <yukuai@fnnas.com>
Cc: <stable@vger.kernel.org>
[ sashal: Retained try_folio_split_or_unmap() instead of folio_split_or_unmap() to preserve the uniform-split fallback. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/truncate.c | 30 ++++++++++++++++--------------
1 file changed, 16 insertions(+), 14 deletions(-)
diff --git a/mm/truncate.c b/mm/truncate.c
index 4bf64fd610c94..9b1baa688a104 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -259,30 +259,32 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
* for shmem truncate
*/
struct folio *folio2;
+ pgoff_t end_idx;
if (offset + length == size)
goto no_split;
- split_at2 = folio_page(folio,
- PAGE_ALIGN_DOWN(offset + length) / PAGE_SIZE);
- folio2 = page_folio(split_at2);
-
- if (!folio_try_get(folio2))
+ /*
+ * After the first split at the start edge, the folio at the
+ * end edge may be freed and reused concurrently.
+ * __filemap_get_folio() looks up the straddler at end_idx
+ * and returns it locked and ref'd with the mapping
+ * validated.
+ */
+ end_idx = (pos + offset + length) >> PAGE_SHIFT;
+ folio2 = __filemap_get_folio(folio->mapping, end_idx,
+ FGP_LOCK | FGP_NOWAIT, 0);
+ if (IS_ERR(folio2))
goto no_split;
+ /* make sure folio2 is large */
if (!folio_test_large(folio2))
goto out;
- if (!folio_trylock(folio2))
- goto out;
-
- /* make sure folio2 is large and does not change its mapping */
- if (folio_test_large(folio2) &&
- folio2->mapping == folio->mapping)
- try_folio_split_or_unmap(folio2, split_at2, min_order);
-
- folio_unlock(folio2);
+ split_at2 = folio_page(folio2, (end_idx - folio2->index));
+ try_folio_split_or_unmap(folio2, split_at2, min_order);
out:
+ folio_unlock(folio2);
folio_put(folio2);
no_split:
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 007/869] staging: rtl8723bs: fix spacing around operators in rtw_recv.c
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 006/869] mm/truncate: look up the end-edge straddler by index Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 008/869] staging: rtl8723bs: fix protected RX frame validation in decrypt path Greg Kroah-Hartman
` (869 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Khasar Munkh-Erdene, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khasar Munkh-Erdene <02khasar@gmail.com>
[ Upstream commit 393b267e6f04a11d4b18b7dc1423fa59f173f72b ]
Fix coding style issues by adding missing spaces around binary and
ternary operators, as reported by checkpatch.pl.
Signed-off-by: Khasar Munkh-Erdene <02khasar@gmail.com>
Link: https://patch.msgid.link/20260225032909.72799-1-02khasar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 495cb31c791b ("staging: rtl8723bs: fix protected RX frame validation in decrypt path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_recv.c | 84 +++++++++++------------
1 file changed, 42 insertions(+), 42 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
index 4727f94df4355..9f9d80e42e4db 100644
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -316,7 +316,7 @@ static void rtw_handle_tkip_mic_err(struct adapter *padapter, u8 bgroup)
} else {
cur_time = jiffies;
- if (cur_time - psecuritypriv->last_mic_err_time < 60*HZ) {
+ if (cur_time - psecuritypriv->last_mic_err_time < 60 * HZ) {
psecuritypriv->btkip_countermeasure = true;
psecuritypriv->last_mic_err_time = 0;
psecuritypriv->btkip_countermeasure_time = cur_time;
@@ -384,13 +384,13 @@ static signed int recvframe_chkmic(struct adapter *adapter, union recv_frame *p
mickey = &stainfo->dot11tkiprxmickey.skey[0];
}
- datalen = precvframe->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len-prxattrib->icv_len-8;/* icv_len included the mic code */
+ datalen = precvframe->u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len - prxattrib->icv_len - 8;/* icv_len included the mic code */
pframe = precvframe->u.hdr.rx_data;
- payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
+ payload = pframe + prxattrib->hdrlen + prxattrib->iv_len;
rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0], (unsigned char)prxattrib->priority); /* care the length of the data */
- pframemic = payload+datalen;
+ pframemic = payload + datalen;
bmic_err = false;
@@ -437,9 +437,9 @@ static union recv_frame *decryptor(struct adapter *padapter, union recv_frame *p
u32 res = _SUCCESS;
if (prxattrib->encrypt > 0) {
- u8 *iv = precv_frame->u.hdr.rx_data+prxattrib->hdrlen;
+ u8 *iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
- prxattrib->key_index = (((iv[3])>>6)&0x3);
+ prxattrib->key_index = (((iv[3]) >> 6) & 0x3);
if (prxattrib->key_index > WEP_KEYS) {
switch (prxattrib->encrypt) {
@@ -561,7 +561,7 @@ static signed int recv_decache(union recv_frame *precv_frame, u8 bretry, struct
{
signed int tid = precv_frame->u.hdr.attrib.priority;
- u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+ u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num & 0xffff) << 4) |
(precv_frame->u.hdr.attrib.frag_num & 0xf);
if (tid > 15)
@@ -625,29 +625,29 @@ static void process_wmmps_data(struct adapter *padapter, union recv_frame *precv
if (!psta->qos_option)
return;
- if (!(psta->qos_info&0xf))
+ if (!(psta->qos_info & 0xf))
return;
- if (psta->state&WIFI_SLEEP_STATE) {
+ if (psta->state & WIFI_SLEEP_STATE) {
u8 wmmps_ac = 0;
switch (pattrib->priority) {
case 1:
case 2:
- wmmps_ac = psta->uapsd_bk&BIT(1);
+ wmmps_ac = psta->uapsd_bk & BIT(1);
break;
case 4:
case 5:
- wmmps_ac = psta->uapsd_vi&BIT(1);
+ wmmps_ac = psta->uapsd_vi & BIT(1);
break;
case 6:
case 7:
- wmmps_ac = psta->uapsd_vo&BIT(1);
+ wmmps_ac = psta->uapsd_vo & BIT(1);
break;
case 0:
case 3:
default:
- wmmps_ac = psta->uapsd_be&BIT(1);
+ wmmps_ac = psta->uapsd_be & BIT(1);
break;
}
@@ -967,20 +967,20 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
switch (pattrib->priority) {
case 1:
case 2:
- wmmps_ac = psta->uapsd_bk&BIT(0);
+ wmmps_ac = psta->uapsd_bk & BIT(0);
break;
case 4:
case 5:
- wmmps_ac = psta->uapsd_vi&BIT(0);
+ wmmps_ac = psta->uapsd_vi & BIT(0);
break;
case 6:
case 7:
- wmmps_ac = psta->uapsd_vo&BIT(0);
+ wmmps_ac = psta->uapsd_vo & BIT(0);
break;
case 0:
case 3:
default:
- wmmps_ac = psta->uapsd_be&BIT(0);
+ wmmps_ac = psta->uapsd_be & BIT(0);
break;
}
@@ -992,7 +992,7 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
}
- if ((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid))) {
+ if ((psta->state & WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap & BIT(psta->aid))) {
struct list_head *xmitframe_plist, *xmitframe_phead;
struct xmit_frame *pxmitframe = NULL;
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -1036,7 +1036,7 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
/* spin_unlock_bh(&psta->sleep_q.lock); */
spin_unlock_bh(&pxmitpriv->lock);
- if (pstapriv->tim_bitmap&BIT(psta->aid)) {
+ if (pstapriv->tim_bitmap & BIT(psta->aid)) {
if (psta->sleepq_len == 0) {
/* issue nulldata with More data bit = 0 to indicate we have no buffered packets */
issue_nulldata_in_interrupt(padapter, psta->hwaddr);
@@ -1412,9 +1412,9 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
goto validate_80211w_fail;
precv_frame = decryptor(adapter, precv_frame);
/* save actual management data frame body */
- memcpy(mgmt_DATA, ptr+pattrib->hdrlen+pattrib->iv_len, data_len);
+ memcpy(mgmt_DATA, ptr + pattrib->hdrlen + pattrib->iv_len, data_len);
/* overwrite the iv field */
- memcpy(ptr+pattrib->hdrlen, mgmt_DATA, data_len);
+ memcpy(ptr + pattrib->hdrlen, mgmt_DATA, data_len);
/* remove the iv and icv length */
pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
kfree(mgmt_DATA);
@@ -1470,7 +1470,7 @@ static signed int validate_recv_frame(struct adapter *adapter, union recv_frame
struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
u8 *ptr = precv_frame->u.hdr.rx_data;
- u8 ver = (unsigned char) (*ptr)&0x3;
+ u8 ver = (unsigned char) (*ptr) & 0x3;
/* add version chk */
if (ver != 0) {
@@ -1508,7 +1508,7 @@ static signed int validate_recv_frame(struct adapter *adapter, union recv_frame
retval = _FAIL; /* only data frame return _SUCCESS */
break;
case WIFI_DATA_TYPE: /* data */
- pattrib->qos = (subtype & BIT(7)) ? 1:0;
+ pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
retval = validate_recv_data_frame(adapter, precv_frame);
if (retval == _FAIL) {
struct recv_priv *precvpriv = &adapter->recvpriv;
@@ -1553,8 +1553,8 @@ static signed int wlanhdr_to_ethhdr(union recv_frame *precvframe)
if (pattrib->encrypt)
recvframe_pull_tail(precvframe, pattrib->icv_len);
- psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
- psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+ psnap = (struct ieee80211_snap_hdr *)(ptr + pattrib->hdrlen + pattrib->iv_len);
+ psnap_type = ptr + pattrib->hdrlen + pattrib->iv_len + SNAP_SIZE;
/* convert hdr + possible LLC headers into Ethernet header */
/* eth_type = (psnap_type[0] << 8) | psnap_type[1]; */
if ((!memcmp(psnap, rfc1042_header, SNAP_SIZE) &&
@@ -1568,37 +1568,37 @@ static signed int wlanhdr_to_ethhdr(union recv_frame *precvframe)
/* Leave Ethernet header part of hdr and full payload */
bsnaphdr = false;
- rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr?SNAP_SIZE:0);
+ rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
len = precvframe->u.hdr.len - rmv_len;
- memcpy(&be_tmp, ptr+rmv_len, 2);
+ memcpy(&be_tmp, ptr + rmv_len, 2);
eth_type = ntohs(be_tmp); /* pattrib->ether_type */
pattrib->eth_type = eth_type;
if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == true)) {
ptr += rmv_len;
*ptr = 0x87;
- *(ptr+1) = 0x12;
+ *(ptr + 1) = 0x12;
eth_type = 0x8712;
/* append rx status for mp test packets */
- ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+ ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24);
if (!ptr)
return _FAIL;
memcpy(ptr, get_rxmem(precvframe), 24);
ptr += 24;
} else {
- ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr?2:0)));
+ ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
if (!ptr)
return _FAIL;
}
memcpy(ptr, pattrib->dst, ETH_ALEN);
- memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+ memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
if (!bsnaphdr) {
be_tmp = htons(len);
- memcpy(ptr+12, &be_tmp, 2);
+ memcpy(ptr + 12, &be_tmp, 2);
}
return _SUCCESS;
@@ -1736,7 +1736,7 @@ static int amsdu_to_msdu(struct adapter *padapter, union recv_frame *prframe)
pdata += nSubframe_Length;
a_len -= nSubframe_Length;
if (a_len != 0) {
- padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
+ padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4 - 1));
if (padding_len == 4)
padding_len = 0;
@@ -2002,7 +2002,7 @@ static int recv_indicatepkt_reorder(struct adapter *padapter, union recv_frame *
rtw_recv_indicatepkt(padapter, prframe);
- preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+ preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) % 4096;
return _SUCCESS;
}
@@ -2012,7 +2012,7 @@ static int recv_indicatepkt_reorder(struct adapter *padapter, union recv_frame *
retval = amsdu_to_msdu(padapter, prframe);
- preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+ preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) % 4096;
if (retval != _SUCCESS) {
}
@@ -2201,7 +2201,7 @@ static int recv_func(struct adapter *padapter, union recv_frame *rframe)
!psecuritypriv->busetkipkey) {
rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
- if (recvpriv->free_recvframe_cnt < NR_RECVFRAME/4) {
+ if (recvpriv->free_recvframe_cnt < NR_RECVFRAME / 4) {
/* to prevent from recvframe starvation, get recvframe from uc_swdec_pending_queue to free_recvframe_cnt */
rframe = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue);
if (rframe)
@@ -2289,19 +2289,19 @@ static void rtw_signal_stat_timer_hdl(struct timer_list *t)
}
/* update value of signal_strength, rssi, signal_qual */
- tmp_s = (avg_signal_strength+(_alpha-1)*recvpriv->signal_strength);
+ tmp_s = (avg_signal_strength + (_alpha - 1) * recvpriv->signal_strength);
if (tmp_s % _alpha)
- tmp_s = tmp_s/_alpha + 1;
+ tmp_s = tmp_s / _alpha + 1;
else
- tmp_s = tmp_s/_alpha;
+ tmp_s = tmp_s / _alpha;
if (tmp_s > 100)
tmp_s = 100;
- tmp_q = (avg_signal_qual+(_alpha-1)*recvpriv->signal_qual);
+ tmp_q = (avg_signal_qual + (_alpha - 1) * recvpriv->signal_qual);
if (tmp_q % _alpha)
- tmp_q = tmp_q/_alpha + 1;
+ tmp_q = tmp_q / _alpha + 1;
else
- tmp_q = tmp_q/_alpha;
+ tmp_q = tmp_q / _alpha;
if (tmp_q > 100)
tmp_q = 100;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 008/869] staging: rtl8723bs: fix protected RX frame validation in decrypt path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 007/869] staging: rtl8723bs: fix spacing around operators in rtw_recv.c Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 009/869] tcp: Remove timeout arg from reqsk_timeout() Greg Kroah-Hartman
` (868 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
[ Upstream commit 495cb31c791bdf3f9efef255a9587b05b0526c9d ]
The RX software decrypt path mishandles crafted protected frames from a
malicious AP in two ways:
1) decryptor() never checks that a protected frame is long enough to
hold the 802.11 header plus the per-cipher trailer. All of
rtw_wep_decrypt(), rtw_tkip_decrypt() and rtw_aes_decrypt() compute
length = hdr.len - hdrlen - iv_len;
and act on the result, and recvframe_chkmic() similarly computes
datalen = hdr.len - hdrlen - iv_len - icv_len - 8;
for TKIP (the 8-byte Michael MIC is not accounted for in icv_len).
A frame shorter than hdrlen + iv_len + icv_len (+ 8 for TKIP) underflows
these unsigned subtractions, turning into a ~4 GiB iteration count in
aes_decipher()/arc4_crypt()/rtw_seccalctkipmic() or a ~4 GiB crc32_le()
length, causing out-of-bounds reads/writes of up to ~4 GiB starting from
the rx skb. Reject such frames in decryptor() before touching the IV;
this covers all three ciphers and the TKIP MIC check, and also keeps the
unconditional iv[3] access within the frame.
2) validate_80211w_mgmt() keeps using the frame - two memcpys through
the stale rx_data pointer and a pkt_len update - before checking
whether decryptor() returned NULL. On decrypt failure (e.g. a unicast
protected deauth/disassoc/action frame with a bad MIC, which this path
always software-decrypts) the skb has already been freed, so this is a
use-after-free read/write, and the caller's error path frees the frame
a second time, drifting free_recvframe_cnt. Bail out immediately when
decryptor() fails, freeing the temporary mgmt_DATA buffer first.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8ee3bdd1c45034200cb1aa9a7e9b575b9584643a@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_recv.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
index 9f9d80e42e4db..f8ade0bea1da0 100644
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -437,8 +437,21 @@ static union recv_frame *decryptor(struct adapter *padapter, union recv_frame *p
u32 res = _SUCCESS;
if (prxattrib->encrypt > 0) {
- u8 *iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
+ u8 *iv;
+ u32 min_len = prxattrib->hdrlen + prxattrib->iv_len + prxattrib->icv_len;
+ /* TKIP appends an 8-byte Michael MIC that icv_len doesn't account for */
+ if (prxattrib->encrypt == _TKIP_)
+ min_len += 8;
+
+ /* a protected frame must be long enough to hold the IV and ICV/MIC */
+ if (precv_frame->u.hdr.len < min_len) {
+ rtw_free_recvframe(precv_frame,
+ &padapter->recvpriv.free_recv_queue);
+ return NULL;
+ }
+
+ iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
prxattrib->key_index = (((iv[3]) >> 6) & 0x3);
if (prxattrib->key_index > WEP_KEYS) {
@@ -1411,6 +1424,10 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
if (!mgmt_DATA)
goto validate_80211w_fail;
precv_frame = decryptor(adapter, precv_frame);
+ if (!precv_frame) {
+ kfree(mgmt_DATA);
+ goto validate_80211w_fail;
+ }
/* save actual management data frame body */
memcpy(mgmt_DATA, ptr + pattrib->hdrlen + pattrib->iv_len, data_len);
/* overwrite the iv field */
@@ -1418,8 +1435,6 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
/* remove the iv and icv length */
pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
kfree(mgmt_DATA);
- if (!precv_frame)
- goto validate_80211w_fail;
} else if (is_multicast_ether_addr(GetAddr1Ptr(ptr)) &&
(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC)) {
signed int BIP_ret = _SUCCESS;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 009/869] tcp: Remove timeout arg from reqsk_timeout().
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 008/869] staging: rtl8723bs: fix protected RX frame validation in decrypt path Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 010/869] tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion Greg Kroah-Hartman
` (867 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 207ce0f6bc131812c96cf4f6db328af5396cebac ]
reqsk_timeout() is always called with @timeout being TCP_RTO_MAX.
Let's remove the arg.
As a prep for the next patch, reqsk_timeout() is moved to tcp.h
and renamed to tcp_reqsk_timeout().
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251106003357.273403-5-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: c9c90cf437a9 ("mptcp: hold MP_JOIN msk ref when cloning reqsk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/inet_connection_sock.h | 8 --------
include/net/tcp.h | 7 +++++++
net/ipv4/inet_connection_sock.c | 2 +-
net/ipv4/tcp_minisocks.c | 5 +++--
4 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index d50e0afc3193f..39ccb785dd4c1 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -297,14 +297,6 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req);
-static inline unsigned long
-reqsk_timeout(struct request_sock *req, unsigned long max_timeout)
-{
- u64 timeout = (u64)req->timeout << req->num_timeout;
-
- return (unsigned long)min_t(u64, timeout, max_timeout);
-}
-
void inet_csk_destroy_sock(struct sock *sk);
void inet_csk_prepare_for_destroy_sock(struct sock *sk);
void inet_csk_prepare_forced_close(struct sock *sk);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e40bad5606486..f9bcfa8773a3a 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -838,6 +838,13 @@ static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
return usecs_to_jiffies((tp->srtt_us >> 3) + tp->rttvar_us);
}
+static inline unsigned long tcp_reqsk_timeout(struct request_sock *req)
+{
+ u64 timeout = (u64)req->timeout << req->num_timeout;
+
+ return (unsigned long)min_t(u64, timeout, TCP_RTO_MAX);
+}
+
u32 tcp_delack_max(const struct sock *sk);
/* Compute the actual rto_min value */
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 3e9eaf9d341d1..9a87ea6c63b46 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1128,7 +1128,7 @@ static void reqsk_timer_handler(struct timer_list *t)
inet_rsk(req)->acked)) {
if (req->num_timeout++ == 0)
atomic_dec(&queue->young);
- mod_timer(&req->rsk_timer, jiffies + reqsk_timeout(req, TCP_RTO_MAX));
+ mod_timer(&req->rsk_timer, jiffies + tcp_reqsk_timeout(req));
if (!nreq)
return;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d05009f985afc..2d78801866396 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -717,7 +717,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
* it can be estimated (approximately)
* from another data.
*/
- tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
+ tmp_opt.ts_recent_stamp = ktime_get_seconds() -
+ tcp_reqsk_timeout(req) / HZ;
paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
}
}
@@ -756,7 +757,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
!tcp_rtx_synack(sk, req)) {
unsigned long expires = jiffies;
- expires += reqsk_timeout(req, TCP_RTO_MAX);
+ expires += tcp_reqsk_timeout(req);
if (!fastopen)
mod_timer_pending(&req->rsk_timer, expires);
else
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 010/869] tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 009/869] tcp: Remove timeout arg from reqsk_timeout() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 011/869] mptcp: hold MP_JOIN msk ref when cloning reqsk Greg Kroah-Hartman
` (866 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chia-Yu Chang, Eric Dumazet,
Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
[ Upstream commit 4024081feb87fb11ac7bd36d8c397ccdd81ed302 ]
Based on specification:
https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt
Based on Section 3.1.5 of AccECN spec (RFC9768), a TCP Server in
AccECN mode MUST NOT set ECT on any packet for the rest of the connection,
if it has received or sent at least one valid SYN or Acceptable SYN/ACK
with (AE,CWR,ECE) = (0,0,0) during the handshake.
In addition, a host in AccECN mode that is feeding back the IP-ECN
field on a SYN or SYN/ACK MUST feed back the IP-ECN field on the
latest valid SYN or acceptable SYN/ACK to arrive.
Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260131222515.8485-11-chia-yu.chang@nokia-bell-labs.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: c9c90cf437a9 ("mptcp: hold MP_JOIN msk ref when cloning reqsk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/inet_connection_sock.c | 3 +++
net/ipv4/tcp_input.c | 2 ++
net/ipv4/tcp_minisocks.c | 36 ++++++++++++++++++++++++---------
net/ipv4/tcp_output.c | 5 ++++-
net/ipv4/tcp_timer.c | 3 +++
5 files changed, 38 insertions(+), 11 deletions(-)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 9a87ea6c63b46..15ad4414cbdb9 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -20,6 +20,7 @@
#include <net/tcp_states.h>
#include <net/xfrm.h>
#include <net/tcp.h>
+#include <net/tcp_ecn.h>
#include <net/sock_reuseport.h>
#include <net/addrconf.h>
@@ -1126,6 +1127,8 @@ static void reqsk_timer_handler(struct timer_list *t)
(!resend ||
!tcp_rtx_synack(sk_listener, req) ||
inet_rsk(req)->acked)) {
+ if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+ tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
if (req->num_timeout++ == 0)
atomic_dec(&queue->young);
mod_timer(&req->rsk_timer, jiffies + tcp_reqsk_timeout(req));
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6a2c05dff4215..28db1353445bf 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6236,6 +6236,8 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
if (th->syn) {
if (tcp_ecn_mode_accecn(tp)) {
accecn_reflector = true;
+ tp->syn_ect_rcv = TCP_SKB_CB(skb)->ip_dsfield &
+ INET_ECN_MASK;
if (tp->rx_opt.accecn &&
tp->saw_accecn_opt < TCP_ACCECN_OPT_COUNTER_SEEN) {
u8 saw_opt = tcp_accecn_option_init(skb, tp->rx_opt.accecn);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 2d78801866396..ebcd78ad13efa 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -484,6 +484,10 @@ static void tcp_ecn_openreq_child(struct sock *sk,
tp->syn_ect_snt = treq->syn_ect_snt;
tcp_accecn_third_ack(sk, skb, treq->syn_ect_snt);
tp->saw_accecn_opt = treq->saw_accecn_opt;
+ if (treq->accecn_fail_mode & TCP_ACCECN_ACE_FAIL_SEND)
+ tcp_accecn_fail_mode_set(tp, TCP_ACCECN_ACE_FAIL_SEND);
+ if (treq->accecn_fail_mode & TCP_ACCECN_ACE_FAIL_RECV)
+ tcp_accecn_fail_mode_set(tp, TCP_ACCECN_ACE_FAIL_RECV);
tp->prev_ecnfield = treq->syn_ect_rcv;
tp->accecn_opt_demand = 1;
tcp_ecn_received_counters_payload(sk, skb);
@@ -752,16 +756,28 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
*/
if (!tcp_oow_rate_limited(sock_net(sk), skb,
LINUX_MIB_TCPACKSKIPPEDSYNRECV,
- &tcp_rsk(req)->last_oow_ack_time) &&
-
- !tcp_rtx_synack(sk, req)) {
- unsigned long expires = jiffies;
-
- expires += tcp_reqsk_timeout(req);
- if (!fastopen)
- mod_timer_pending(&req->rsk_timer, expires);
- else
- req->rsk_timer.expires = expires;
+ &tcp_rsk(req)->last_oow_ack_time)) {
+ if (tcp_rsk(req)->accecn_ok) {
+ u8 ect_rcv = TCP_SKB_CB(skb)->ip_dsfield &
+ INET_ECN_MASK;
+
+ tcp_rsk(req)->syn_ect_rcv = ect_rcv;
+ if (tcp_accecn_ace(tcp_hdr(skb)) == 0x0)
+ tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_RECV;
+ }
+ if (!tcp_rtx_synack(sk, req)) {
+ unsigned long expires = jiffies;
+
+ if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+ tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
+
+ expires += tcp_reqsk_timeout(req);
+ if (!fastopen)
+ mod_timer_pending(&req->rsk_timer,
+ expires);
+ else
+ req->rsk_timer.expires = expires;
+ }
}
return NULL;
}
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ddcc7e53f2e34..f6210d4a3408f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -333,8 +333,11 @@ static void tcp_ecn_send(struct sock *sk, struct sk_buff *skb,
return;
if (tcp_ecn_mode_accecn(tp)) {
- if (!tcp_accecn_ace_fail_recv(tp))
+ if (!tcp_accecn_ace_fail_recv(tp) &&
+ !tcp_accecn_ace_fail_send(tp))
INET_ECN_xmit(sk);
+ else
+ INET_ECN_dontxmit(sk);
tcp_accecn_set_ace(tp, skb, th);
skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ACCECN;
} else {
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index eb549fea8fdd9..017a52022a1a2 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -22,6 +22,7 @@
#include <linux/module.h>
#include <linux/gfp.h>
#include <net/tcp.h>
+#include <net/tcp_ecn.h>
#include <net/rstreason.h>
static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
@@ -482,6 +483,8 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
* it's not good to give up too easily.
*/
tcp_rtx_synack(sk, req);
+ if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+ tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
req->num_timeout++;
tcp_update_rto_stats(sk);
if (!tp->retrans_stamp)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 011/869] mptcp: hold MP_JOIN msk ref when cloning reqsk
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 010/869] tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 012/869] virtio_net: atomically disable rx mode work Greg Kroah-Hartman
` (865 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Lee, Vega,
Ruide Cao, Ren Wei, Matthieu Baerts (NGI0), Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <caoruide123@gmail.com>
[ Upstream commit c9c90cf437a9e6597611b6d3aad6e255fad22867 ]
TCP request migration clones pending request sockets with
inet_reqsk_clone(). For MPTCP MP_JOIN requests this byte-copies
subflow_req->msk, but the clone does not own a reference.
The original and cloned requests can consequently drop the same msk
reference, leaving one request with a dangling pointer. This manifests as
a KASAN slab-use-after-free in subflow_req_destructor():
BUG: KASAN: slab-use-after-free in subflow_req_destructor (net/mptcp/subflow.c:45)
Write of size 4 at addr ff1100010e008d40 by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full)
Call Trace:
subflow_req_destructor (net/mptcp/subflow.c:45)
subflow_v4_req_destructor (net/mptcp/subflow.c:694)
__reqsk_free (net/ipv4/inet_connection_sock.c:906)
reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147)
Allocated by task 10014:
sk_prot_alloc (net/core/sock.c:2246)
sk_clone (net/core/sock.c:2488)
mptcp_sk_clone_init (include/net/sock.h:1848 net/mptcp/protocol.c:3564)
subflow_syn_recv_sock (net/mptcp/subflow.c:883)
tcp_check_req (net/ipv4/tcp_minisocks.c:934)
Freed by task 0:
slab_free_after_rcu_debug (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6439)
rcu_core (kernel/rcu/tree.c:2645 kernel/rcu/tree.c:2897)
Last potentially related work creation:
kmem_cache_free (mm/slub.c:2638 mm/slub.c:6377 mm/slub.c:6504)
__sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
sk_destruct (net/core/sock.c:2419)
__sk_free (net/core/sock.c:2430)
sk_free (net/core/sock.c:2441)
mptcp_close (include/net/sock.h:2020 net/mptcp/protocol.c:3399)
inet_release (net/ipv4/af_inet.c:442)
The buggy address belongs to the cache MPTCP of size 2968
The buggy address is 128 bytes inside a freed 2968-byte region
A non-NULL subflow_req->msk means that the request owns one reference. The
third ACK can concurrently transfer the original request reference to the
child and release it, so taking an unconditional hold on the copied pointer
is unsafe.
MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all current inet_reqsk_clone()
callers run in an RCU read-side critical section. Document and
lockdep-check that calling-context requirement. Read the pointer from the
original request and acquire a reference only if it is still live. Use
refcount_inc_not_zero_acquire() so the subsequent ownership validation
cannot be reordered before the try-get, then re-read the original request
to verify that it still owns the same msk. If either check fails, clear the
clone pointer; otherwise its normal destructor balances the new reference.
Mark the ownership-transfer store with WRITE_ONCE() to match the lockless
reads.
The following patch completes the clone fixup for MP_CAPABLE token
ownership. Both patches carry the same Fixes tag and are required for
stable backports.
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: David Lee <david.lee@trailofbits.com>
Reported-by: Vega <vega@nebusec.ai>
Closes: https://lore.kernel.org/all/20260804095051.715355-1-david.lee@trailofbits.com/
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-3-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/mptcp.h | 9 +++++++++
net/ipv4/inet_connection_sock.c | 4 ++++
net/mptcp/subflow.c | 35 ++++++++++++++++++++++++++++++++-
3 files changed, 47 insertions(+), 1 deletion(-)
diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index f7263fe2a2e40..a296f711e92f3 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -219,6 +219,9 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
struct request_sock *mptcp_subflow_reqsk_alloc(const struct request_sock_ops *ops,
struct sock *sk_listener,
bool attach_listener);
+/* Caller must hold an RCU read-side lock. */
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req);
__be32 mptcp_get_reset_option(const struct sk_buff *skb);
@@ -314,6 +317,12 @@ static inline struct request_sock *mptcp_subflow_reqsk_alloc(const struct reques
return NULL;
}
+/* Caller must hold an RCU read-side lock. */
+static inline void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req)
+{
+}
+
static inline __be32 mptcp_reset_option(const struct sk_buff *skb) { return htonl(0u); }
static inline void mptcp_active_detect_blackhole(struct sock *sk, bool expired) { }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 15ad4414cbdb9..dd14944ad3edd 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -21,6 +21,7 @@
#include <net/xfrm.h>
#include <net/tcp.h>
#include <net/tcp_ecn.h>
+#include <net/mptcp.h>
#include <net/sock_reuseport.h>
#include <net/addrconf.h>
@@ -983,6 +984,9 @@ static struct request_sock *inet_reqsk_clone(struct request_sock *req,
rcu_assign_pointer(tcp_sk(nreq->sk)->fastopen_rsk, nreq);
}
+ if (rsk_is_mptcp(req))
+ mptcp_subflow_reqsk_clone(req, nreq);
+
return nreq;
}
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 1932fcf9f9252..e020960f093e0 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -47,6 +47,39 @@ static void subflow_req_destructor(struct request_sock *req)
mptcp_token_destroy_request(req);
}
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+ struct request_sock *new_req)
+{
+ struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
+ struct mptcp_subflow_request_sock *new_subflow_req;
+ struct mptcp_sock *msk;
+
+ new_subflow_req = mptcp_subflow_rsk(new_req);
+ RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(),
+ "MPTCP reqsk clone called without RCU");
+
+ /* A non-NULL ->msk means the request owns one reference. The clone
+ * copied only the pointer, while the original request can concurrently
+ * transfer its reference to the child. Acquire a reference for the
+ * clone, then verify that the original request still owns the same msk.
+ * MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all clone callers run in
+ * an RCU read-side critical section, keeping the memory stable here.
+ */
+ msk = READ_ONCE(subflow_req->msk);
+ if (msk) {
+ struct sock *sk = (struct sock *)msk;
+
+ if (!refcount_inc_not_zero_acquire(&sk->sk_refcnt)) {
+ msk = NULL;
+ } else if (READ_ONCE(subflow_req->msk) != msk) {
+ sock_put(sk);
+ msk = NULL;
+ }
+ }
+
+ new_subflow_req->msk = msk;
+}
+
static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
void *hmac)
{
@@ -925,7 +958,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
}
/* move the msk reference ownership to the subflow */
- subflow_req->msk = NULL;
+ WRITE_ONCE(subflow_req->msk, NULL);
ctx->conn = (struct sock *)owner;
if (subflow_use_different_sport(owner, sk)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 012/869] virtio_net: atomically disable rx mode work
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 011/869] mptcp: hold MP_JOIN msk ref when cloning reqsk Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 013/869] pps: generators: dont use the drivers info after unregister Greg Kroah-Hartman
` (864 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+d17c2bc750a9cbbb, Weiming Shi,
Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 1234707482053f1d1ac7c5756207d2c29057974c ]
virtio-net uses a boolean to gate rx_mode_work during device teardown.
The flag is changed under RTNL, but ndo_set_rx_mode checks it under the
address-list lock. A callback can therefore pass the check and enqueue work
after teardown has flushed it. The work is also enabled before late
probe operations that can fail, allowing probe unwind to free the netdev
with work still queued.
KASAN reports the worker using a virtqueue that probe unwind already freed:
BUG: KASAN: slab-use-after-free in virtqueue_add_split
Workqueue: events virtnet_rx_mode_work
Call Trace:
virtqueue_add_split (drivers/virtio/virtio_ring.c:706)
virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2839)
virtnet_send_command_reply (drivers/net/virtio_net.c:3565)
virtnet_rx_mode_work (drivers/net/virtio_net.c:3833)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405)
Freed by task 119:
kfree (mm/slub.c:6625)
vp_del_vq.isra.0 (drivers/virtio/virtio_pci_common.c:259)
vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)
virtnet_probe (drivers/net/virtio_net.c:7129)
Use the workqueue disable mechanism to atomically reject new queue attempts
and drain running work. Keep work disabled until probe succeeds or restore
has reattached the netdev, then enable it and replay receive-mode state for
a running interface. Disable it before resource teardown in freeze and
remove.
Fixes: b9f7425239a0 ("virtio-net: convert rx mode setting to use workqueue")
Cc: stable@vger.kernel.org
Reported-by: <co+d17c2bc750a9cbbb@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20261017114237.2786302-2-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ sashal: Adjusted context to preserve existing refill handling and restore error paths. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 25 +++++++++----------------
1 file changed, 9 insertions(+), 16 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b7ab57f4e277a..34390befdf8a8 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -458,9 +458,6 @@ struct virtnet_info {
/* Work struct for setting rx mode */
struct work_struct rx_mode_work;
- /* OK to queue work setting RX mode? */
- bool rx_mode_work_enabled;
-
/* Does the affinity hint is set for virtqueues? */
bool affinity_hint_set;
@@ -740,16 +737,13 @@ static void disable_delayed_refill(struct virtnet_info *vi)
static void enable_rx_mode_work(struct virtnet_info *vi)
{
- rtnl_lock();
- vi->rx_mode_work_enabled = true;
- rtnl_unlock();
+ if (enable_work(&vi->rx_mode_work) && netif_running(vi->dev))
+ schedule_work(&vi->rx_mode_work);
}
static void disable_rx_mode_work(struct virtnet_info *vi)
{
- rtnl_lock();
- vi->rx_mode_work_enabled = false;
- rtnl_unlock();
+ disable_work_sync(&vi->rx_mode_work);
}
static void virtqueue_napi_schedule(struct napi_struct *napi,
@@ -3996,8 +3990,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
{
struct virtnet_info *vi = netdev_priv(dev);
- if (vi->rx_mode_work_enabled)
- schedule_work(&vi->rx_mode_work);
+ schedule_work(&vi->rx_mode_work);
}
static int virtnet_vlan_rx_add_vid(struct net_device *dev,
@@ -5813,7 +5806,6 @@ static void virtnet_freeze_down(struct virtio_device *vdev)
/* Make sure no work handler is accessing the device */
flush_work(&vi->config_work);
disable_rx_mode_work(vi);
- flush_work(&vi->rx_mode_work);
if (netif_running(vi->dev)) {
rtnl_lock();
@@ -5840,7 +5832,6 @@ static int virtnet_restore_up(struct virtio_device *vdev)
virtio_device_ready(vdev);
enable_delayed_refill(vi);
- enable_rx_mode_work(vi);
if (netif_running(vi->dev)) {
rtnl_lock();
@@ -5853,6 +5844,8 @@ static int virtnet_restore_up(struct virtio_device *vdev)
netif_tx_lock_bh(vi->dev);
netif_device_attach(vi->dev);
netif_tx_unlock_bh(vi->dev);
+
+ enable_rx_mode_work(vi);
return err;
}
@@ -6952,6 +6945,7 @@ static int virtnet_probe(struct virtio_device *vdev)
INIT_WORK(&vi->config_work, virtnet_config_changed_work);
INIT_WORK(&vi->rx_mode_work, virtnet_rx_mode_work);
+ disable_work(&vi->rx_mode_work);
spin_lock_init(&vi->refill_lock);
if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) {
@@ -7103,8 +7097,6 @@ static int virtnet_probe(struct virtio_device *vdev)
if (vi->has_rss || vi->has_rss_hash_report)
virtnet_init_default_rss(vi);
- enable_rx_mode_work(vi);
-
/* serialize netdev register + virtio_device_ready() with ndo_open() */
rtnl_lock();
@@ -7204,6 +7196,8 @@ static int virtnet_probe(struct virtio_device *vdev)
goto free_unregister_netdev;
}
+ enable_rx_mode_work(vi);
+
pr_debug("virtnet: registered device %s with %d RX and TX vq's\n",
dev->name, max_queue_pairs);
@@ -7255,7 +7249,6 @@ static void virtnet_remove(struct virtio_device *vdev)
/* Make sure no work handler is accessing the device. */
flush_work(&vi->config_work);
disable_rx_mode_work(vi);
- flush_work(&vi->rx_mode_work);
virtnet_free_irq_moder(vi);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 013/869] pps: generators: dont use the drivers info after unregister
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 012/869] virtio_net: atomically disable rx mode work Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 014/869] nvmet: replace use of system_wq with system_percpu_wq Greg Kroah-Hartman
` (863 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danish Khateeb, Rodolfo Giometti,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
[ Upstream commit 4e8063cae337cb7328e6856235cf4de5d165516e ]
A file that was opened before pps_gen_unregister_source() keeps
pps_gen, and with it the pointer to the driver's pps_gen_source_info.
PPS_GEN_SETENABLE and PPS_GEN_USESYSTEMCLOCK keep using that pointer
after the driver has gone:
- pps_gen_tio allocates its info with devm_kzalloc(), so after an
unbind both ioctls read freed memory, and SETENABLE calls the
driver's enable() with its freed private data.
- pps_gen-dummy does not set info->owner, so it can be unloaded while
the file is open, and the ioctls then read the unloaded module's
data and call its code.
TIO can't probe in a VM, as it needs ART. A test driver that registers
its info in devm memory like TIO does, unbound while /dev/pps-gen0 is
open, gives:
BUG: KASAN: slab-use-after-free in pps_gen_cdev_ioctl+0x4c1/0x580
Read of size 1 at addr ffff88800e647f38 by task ppsgen64/145
...
Freed by task 146:
kfree+0x25a/0x6d0
release_nodes+0xd1/0x140
devres_release_all+0x10e/0x1a0
device_unbind_cleanup+0x71/0x250
device_release_driver_internal+0x41b/0x570
unbind_store+0xd9/0x100
and unloading pps_gen-dummy while its file is open oopses:
BUG: unable to handle page fault for address: ffffffffa0203040
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pps_gen_cdev_ioctl+0x372/0x580
Protect info in the ioctl handler with a mutex, and clear it under the
mutex on unregister, so that unregister waits for the ioctls using it
and later ones fail with -ENODEV. PPS_KC_BIND does the same for a
removed PPS device since commit 3649f9a6b897 ("pps: don't allow
PPS_KC_BIND on removed devices"). The sysfs attributes need nothing
new: they are removed, and their callbacks drained, before info is
cleared.
Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-3-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/generators/pps_gen.c | 31 ++++++++++++++++++++++++++-----
include/linux/pps_gen_kernel.h | 2 ++
2 files changed, 28 insertions(+), 5 deletions(-)
diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index 69a470fa164d6..630a8804d63e7 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -69,17 +69,28 @@ static long pps_gen_cdev_ioctl(struct file *file,
if (ret)
return -EFAULT;
- ret = pps_gen->info->enable(pps_gen, status);
- if (ret)
- return ret;
- pps_gen->enabled = status;
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (!pps_gen->info)
+ return -ENODEV;
+
+ ret = pps_gen->info->enable(pps_gen, status);
+ if (ret)
+ return ret;
+ pps_gen->enabled = status;
+ }
break;
case PPS_GEN_USESYSTEMCLOCK:
dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
- ret = put_user(pps_gen->info->use_system_clock, uiuarg);
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (!pps_gen->info)
+ return -ENODEV;
+ status = pps_gen->info->use_system_clock;
+ }
+
+ ret = put_user(status, uiuarg);
if (ret)
return -EFAULT;
@@ -212,6 +223,15 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
{
pr_debug("unregistering pps-gen%d\n", pps_gen->id);
cdev_device_del(&pps_gen->cdev, &pps_gen->dev);
+
+ /*
+ * An open file keeps pps_gen around, but the driver may free info as
+ * soon as we return. The sysfs files are gone now, so wait for the
+ * ioctls using info and make later ones fail.
+ */
+ scoped_guard(mutex, &pps_gen->info_lock)
+ pps_gen->info = NULL;
+
put_device(&pps_gen->dev);
}
@@ -243,6 +263,7 @@ struct pps_gen_device *pps_gen_register_source(const struct pps_gen_source_info
pps_gen->info = info;
pps_gen->enabled = false;
+ mutex_init(&pps_gen->info_lock);
init_waitqueue_head(&pps_gen->queue);
spin_lock_init(&pps_gen->lock);
diff --git a/include/linux/pps_gen_kernel.h b/include/linux/pps_gen_kernel.h
index f26f6aac000dc..c4d22b1af1186 100644
--- a/include/linux/pps_gen_kernel.h
+++ b/include/linux/pps_gen_kernel.h
@@ -11,6 +11,7 @@
#include <linux/pps_gen.h>
#include <linux/cdev.h>
#include <linux/device.h>
+#include <linux/mutex.h>
/*
* Global defines
@@ -44,6 +45,7 @@ struct pps_gen_source_info {
/* The main struct */
struct pps_gen_device {
const struct pps_gen_source_info *info; /* PSS generator info */
+ struct mutex info_lock; /* protects info */
bool enabled; /* PSS generator status */
unsigned int event;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 014/869] nvmet: replace use of system_wq with system_percpu_wq
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 013/869] pps: generators: dont use the drivers info after unregister Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 015/869] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF Greg Kroah-Hartman
` (862 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Christoph Hellwig,
Marco Crivellari, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Crivellari <marco.crivellari@suse.com>
[ Upstream commit 3d553be6d295b6cca8fd35cb673fd13934ac4cbc ]
This patch continues the effort to refactor workqueue APIs, which has begun
with the changes introducing new workqueues and a new alloc_workqueue flag:
commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
The point of the refactoring is to eventually alter the default behavior of
workqueues to become unbound by default so that their workload placement is
optimized by the scheduler.
Before that to happen, workqueue users must be converted to the better named
new workqueues with no intended behaviour changes:
system_wq -> system_percpu_wq
system_unbound_wq -> system_dfl_wq
This way the old obsolete workqueues (system_wq, system_unbound_wq) can be
removed in the future.
Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
Suggested-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 53f6efe00cea ("nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/admin-cmd.c | 2 +-
drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index fa9920787a8ff..623b5303de2aa 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -1606,7 +1606,7 @@ void nvmet_execute_keep_alive(struct nvmet_req *req)
pr_debug("ctrl %d update keep-alive timer for %d secs\n",
ctrl->cntlid, ctrl->kato);
- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+ mod_delayed_work(system_percpu_wq, &ctrl->ka_work, ctrl->kato * HZ);
out:
nvmet_req_complete(req, status);
}
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 5b010318286e4..af712c6624b36 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -410,7 +410,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
- mod_delayed_work(system_wq, &req->sq->auth_expired_work,
+ mod_delayed_work(system_percpu_wq, &req->sq->auth_expired_work,
auth_expire_secs * HZ);
goto complete;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 015/869] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 014/869] nvmet: replace use of system_wq with system_percpu_wq Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 016/869] rust: irq: declare cfi_encoding for irqreturn Greg Kroah-Hartman
` (861 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Jérémy Jean, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 53f6efe00cea0c0cf7bd99debe3cdac8567170b5 ]
A REPLY AUTH_SEND command can derive a dhchap_skey key while a
concurrent AUTH_RECEIVE command observing this REPLY state executes
the failure path and frees that key. The REPLY command then continues
and writes into freed memory, causing a use-after-free. KASAN reports
it as:
BUG: KASAN: slab-use-after-free in __sha256_final
Write of size 4 at addr ffff88800359c540
...
nvmet_auth_sq_free (drivers/nvme/target/auth.c:237)
nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:621)
Add a mutex to each submission queue to serialize authentication
commands and timeout handling. Unlock the mutex before completing
requests and ignore outdated timeout callbacks. Limit timeout delays
to prevent immediate expiry on 32-bit kernels.
Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/auth.c | 1 +
drivers/nvme/target/fabrics-cmd-auth.c | 32 ++++++++++++++++++++++----
drivers/nvme/target/nvmet.h | 2 ++
3 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 8230a0563616b..4c68225411be3 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -238,6 +238,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq, bool reset)
void nvmet_auth_sq_free(struct nvmet_sq *sq)
{
+ sq->auth_expiry_active = false;
cancel_delayed_work(&sq->auth_expired_work);
#ifdef CONFIG_NVME_TARGET_TCP_TLS
sq->tls_key = NULL;
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index af712c6624b36..20a2dfcbbc57f 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -6,6 +6,7 @@
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/blkdev.h>
+#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/nvme-auth.h>
#include <crypto/hash.h>
@@ -18,16 +19,27 @@ static void nvmet_auth_expired_work(struct work_struct *work)
struct nvmet_sq *sq = container_of(to_delayed_work(work),
struct nvmet_sq, auth_expired_work);
+ mutex_lock(&sq->auth_lock);
+ /* A command may have cancelled or rearmed this timeout. */
+ if (!sq->auth_expiry_active ||
+ delayed_work_pending(&sq->auth_expired_work))
+ goto out_unlock;
+ sq->auth_expiry_active = false;
+
pr_debug("%s: ctrl %d qid %d transaction %u expired, resetting\n",
__func__, sq->ctrl->cntlid, sq->qid, sq->dhchap_tid);
sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
sq->dhchap_tid = -1;
+out_unlock:
+ mutex_unlock(&sq->auth_lock);
}
void nvmet_auth_sq_init(struct nvmet_sq *sq)
{
/* Initialize in-band authentication */
+ mutex_init(&sq->auth_lock);
INIT_DELAYED_WORK(&sq->auth_expired_work, nvmet_auth_expired_work);
+ sq->auth_expiry_active = false;
sq->authenticated = false;
sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
}
@@ -258,6 +270,8 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
u16 status = 0;
u8 dhchap_status;
+ mutex_lock(&req->sq->auth_lock);
+
if (req->cmd->auth_send.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
req->error_loc =
@@ -283,8 +297,10 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
offsetof(struct nvmf_auth_send_command, tl);
goto done;
}
- if (!nvmet_check_transfer_len(req, tl)) {
+ if (unlikely(tl != req->transfer_len)) {
pr_debug("%s: transfer length mismatch (%u)\n", __func__, tl);
+ mutex_unlock(&req->sq->auth_lock);
+ nvmet_check_transfer_len(req, tl);
return;
}
@@ -408,10 +424,12 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
status, req->error_loc);
if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
- unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
+ unsigned long auth_expire = min_t(u64, MAX_JIFFY_OFFSET,
+ (u64)(ctrl->kato ? ctrl->kato : 120) * HZ);
+ req->sq->auth_expiry_active = true;
mod_delayed_work(system_percpu_wq, &req->sq->auth_expired_work,
- auth_expire_secs * HZ);
+ auth_expire);
goto complete;
}
/* Final states, clear up variables */
@@ -420,6 +438,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
nvmet_ctrl_fatal_error(ctrl);
complete:
+ mutex_unlock(&req->sq->auth_lock);
nvmet_req_complete(req, status);
}
@@ -538,6 +557,8 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
u32 al;
u16 status = 0;
+ mutex_lock(&req->sq->auth_lock);
+
if (req->cmd->auth_receive.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
req->error_loc =
@@ -563,8 +584,10 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
offsetof(struct nvmf_auth_receive_command, al);
goto done;
}
- if (!nvmet_check_transfer_len(req, al)) {
+ if (unlikely(al != req->transfer_len)) {
pr_debug("%s: transfer length mismatch (%u)\n", __func__, al);
+ mutex_unlock(&req->sq->auth_lock);
+ nvmet_check_transfer_len(req, al);
return;
}
@@ -623,5 +646,6 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
nvmet_auth_sq_free(req->sq);
nvmet_ctrl_fatal_error(ctrl);
}
+ mutex_unlock(&req->sq->auth_lock);
nvmet_req_complete(req, status);
}
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 87e2fdbd18656..45fc188412d28 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -156,8 +156,10 @@ struct nvmet_sq {
u32 sqhd;
bool sqhd_disabled;
#ifdef CONFIG_NVME_TARGET_AUTH
+ struct mutex auth_lock;
bool authenticated;
struct delayed_work auth_expired_work;
+ bool auth_expiry_active;
u16 dhchap_tid;
u8 sc_c;
u8 dhchap_status;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 016/869] rust: irq: declare cfi_encoding for irqreturn
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 015/869] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 6.18 017/869] rust: hrtimer: declare cfi_encoding for hrtimer_restart Greg Kroah-Hartman
` (860 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl, Gary Guo,
Danilo Krummrich, Miguel Ojeda, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit 01f3e6b4b1c8c1748e59ba53631ab1f5d9ad0ea4 ]
The IRQ callbacks return c_uint. C calls them through irq_handler_t,
which returns enum irqreturn. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.
Generate irqreturn as a newtype with a cfi_encoding, as is done for
lru_status, and return bindings::irqreturn_t from the callbacks.
Fixes: 0851d34a8cc3 ("rust: irq: add support for non-threaded IRQs and handlers")
Fixes: 135d40523244 ("rust: irq: add support for threaded IRQs and handlers")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-1-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ sashal: replaced bindgen's custom enum attribute option with sed post-processing to support older bindgen ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 3 ++-
rust/bindgen_parameters | 3 +++
rust/bindings/lib.rs | 1 +
rust/kernel/irq/request.rs | 22 +++++++++++-----------
4 files changed, 17 insertions(+), 12 deletions(-)
diff --git a/rust/Makefile b/rust/Makefile
index d4618f646b05b..3867ff14fbdec 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -367,7 +367,8 @@ quiet_cmd_bindgen = BINDGEN $@
$(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
$(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
$(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
- sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@
+ sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+ sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
$(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
$(src)/bindgen_parameters FORCE
$(call if_changed_dep,bindgen)
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index e13c6f9dd17b2..9e02500dc9792 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -23,6 +23,9 @@
# warning. We don't need to peek into it anyway.
--opaque-type spinlock
+# enums that appear in indirect function calls should specify a cfi type
+--newtype-enum irqreturn
+
# `seccomp`'s comment gets understood as a doctest
--no-doc-comments
diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index 8305adbdf8cbf..37f584727eba1 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -23,6 +23,7 @@
unreachable_pub,
unsafe_op_in_unsafe_fn
)]
+#![feature(cfi_encoding)]
#[allow(dead_code)]
#[allow(clippy::as_underscore)]
diff --git a/rust/kernel/irq/request.rs b/rust/kernel/irq/request.rs
index 70700f43ddd37..4f2b315856b9b 100644
--- a/rust/kernel/irq/request.rs
+++ b/rust/kernel/irq/request.rs
@@ -20,10 +20,10 @@
#[repr(u32)]
pub enum IrqReturn {
/// The interrupt was not from this device or was not handled.
- None = bindings::irqreturn_IRQ_NONE,
+ None = bindings::irqreturn::IRQ_NONE.0,
/// The interrupt was handled by this device.
- Handled = bindings::irqreturn_IRQ_HANDLED,
+ Handled = bindings::irqreturn::IRQ_HANDLED.0,
}
/// Callbacks for an IRQ handler.
@@ -275,7 +275,7 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
unsafe extern "C" fn handle_irq_callback<T: Handler + 'static>(
_irq: i32,
ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
// SAFETY: `ptr` is a pointer to `RegistrationInner` set in `Registration::new`
let inner = unsafe { &*(ptr as *const RegistrationInner) };
// SAFETY: `inner.handler` is a pointer to `T` set in `Registration::new`
@@ -284,20 +284,20 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
// callback is running implies that the device has not yet been unbound.
let device = unsafe { inner.dev.as_bound() };
- T::handle(handler, device) as c_uint
+ bindings::irqreturn_t(T::handle(handler, device) as c_uint)
}
/// The value that can be returned from [`ThreadedHandler::handle`].
#[repr(u32)]
pub enum ThreadedIrqReturn {
/// The interrupt was not from this device or was not handled.
- None = bindings::irqreturn_IRQ_NONE,
+ None = bindings::irqreturn::IRQ_NONE.0,
/// The interrupt was handled by this device.
- Handled = bindings::irqreturn_IRQ_HANDLED,
+ Handled = bindings::irqreturn::IRQ_HANDLED.0,
/// The handler wants the handler thread to wake up.
- WakeThread = bindings::irqreturn_IRQ_WAKE_THREAD,
+ WakeThread = bindings::irqreturn::IRQ_WAKE_THREAD.0,
}
/// Callbacks for a threaded IRQ handler.
@@ -501,7 +501,7 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler + 'static>(
_irq: i32,
ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
// SAFETY: `ptr` is a pointer to `RegistrationInner` set in `ThreadedRegistration::new`
let inner = unsafe { &*(ptr as *const RegistrationInner) };
// SAFETY: `inner.handler` is a pointer to `T` set in `ThreadedRegistration::new`
@@ -510,7 +510,7 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
// callback is running implies that the device has not yet been unbound.
let device = unsafe { inner.dev.as_bound() };
- T::handle(handler, device) as c_uint
+ bindings::irqreturn_t(T::handle(handler, device) as c_uint)
}
/// # Safety
@@ -519,7 +519,7 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler + 'static>(
_irq: i32,
ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
// SAFETY: `ptr` is a pointer to `RegistrationInner` set in `ThreadedRegistration::new`
let inner = unsafe { &*(ptr as *const RegistrationInner) };
// SAFETY: `inner.handler` is a pointer to `T` set in `ThreadedRegistration::new`
@@ -528,5 +528,5 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
// callback is running implies that the device has not yet been unbound.
let device = unsafe { inner.dev.as_bound() };
- T::handle_threaded(handler, device) as c_uint
+ bindings::irqreturn_t(T::handle_threaded(handler, device) as c_uint)
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 017/869] rust: hrtimer: declare cfi_encoding for hrtimer_restart
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 016/869] rust: irq: declare cfi_encoding for irqreturn Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 018/869] rust: dma: declare cfi_encoding for dma_data_direction Greg Kroah-Hartman
` (859 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl,
FUJITA Tomonori, Andreas Hindborg, Gary Guo, Danilo Krummrich,
Miguel Ojeda, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
commit 39fe6892fd52faed6325ff7f13a92da01ab35727 upstream.
The hrtimer callbacks return bindings::hrtimer_restart, which bindgen
generates as c_uint. C calls them through hrtimer->function, which
returns enum hrtimer_restart. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.
Generate hrtimer_restart as a newtype with a cfi_encoding, as is done
for lru_status, and adapt HrTimerRestart to the newtype.
Fixes: 8a8afe9349fb ("rust: hrtimer: introduce hrtimer support")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Tested-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-2-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Replaced bindgen's custom enum attribute option with sed
post-processing to support older bindgen. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 1 +
rust/bindgen_parameters | 1 +
rust/kernel/time/hrtimer.rs | 6 +++---
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/rust/Makefile b/rust/Makefile
index 3867ff14fbdec..3f1abad648e66 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -368,6 +368,7 @@ $(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
$(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
$(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+ sed -Ei 's/^pub struct hrtimer_restart\(/#[cfi_encoding="15hrtimer_restart"]\n&/' $@; \
sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
$(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
$(src)/bindgen_parameters FORCE
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 9e02500dc9792..6f76fdcffd58d 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -24,6 +24,7 @@
--opaque-type spinlock
# enums that appear in indirect function calls should specify a cfi type
+--newtype-enum hrtimer_restart
--newtype-enum irqreturn
# `seccomp`'s comment gets understood as a doctest
diff --git a/rust/kernel/time/hrtimer.rs b/rust/kernel/time/hrtimer.rs
index 856d2d929a008..35ff2ef7d9441 100644
--- a/rust/kernel/time/hrtimer.rs
+++ b/rust/kernel/time/hrtimer.rs
@@ -498,14 +498,14 @@ unsafe fn start(this: *const Self, expires: <Self::TimerMode as HrTimerMode>::Ex
#[repr(u32)]
pub enum HrTimerRestart {
/// Timer should not be restarted.
- NoRestart = bindings::hrtimer_restart_HRTIMER_NORESTART,
+ NoRestart = bindings::hrtimer_restart::HRTIMER_NORESTART.0,
/// Timer should be restarted.
- Restart = bindings::hrtimer_restart_HRTIMER_RESTART,
+ Restart = bindings::hrtimer_restart::HRTIMER_RESTART.0,
}
impl HrTimerRestart {
fn into_c(self) -> bindings::hrtimer_restart {
- self as bindings::hrtimer_restart
+ bindings::hrtimer_restart(self as c_uint)
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 018/869] rust: dma: declare cfi_encoding for dma_data_direction
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 6.18 017/869] rust: hrtimer: declare cfi_encoding for hrtimer_restart Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 019/869] mm: khugepaged: fix swap entry value to folio_pfn() Greg Kroah-Hartman
` (858 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl, Gary Guo,
Danilo Krummrich, Miguel Ojeda, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
commit 7d109178cd644268326cd31702ed46c7ac8bb300 upstream.
bindgen generates bindings::dma_data_direction as an integer by default,
while C callback tables such as dma_buf_ops declare the parameter as
enum dma_data_direction. kCFI encodes enum types by name even with
integer normalization, so the type ids would not match when C calls into
a Rust callback taking bindings::dma_data_direction.
Generate dma_data_direction as a newtype with a cfi_encoding, as is done
for lru_status, and convert DataDirection through the newtype's
constants.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c2437c43cfb1 ("rust: dma: implement DataDirection")
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-3-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Replaced bindgen's custom enum attribute option with sed
post-processing to support older bindgen. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 1 +
rust/bindgen_parameters | 1 +
rust/kernel/dma.rs | 21 +++++++++++----------
3 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/rust/Makefile b/rust/Makefile
index 3f1abad648e66..d6429e68949fe 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -368,6 +368,7 @@ $(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
$(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
$(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+ sed -Ei 's/^pub struct dma_data_direction\(/#[cfi_encoding="18dma_data_direction"]\n&/' $@; \
sed -Ei 's/^pub struct hrtimer_restart\(/#[cfi_encoding="15hrtimer_restart"]\n&/' $@; \
sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
$(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 6f76fdcffd58d..a5d547dc8e8ea 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -24,6 +24,7 @@
--opaque-type spinlock
# enums that appear in indirect function calls should specify a cfi type
+--newtype-enum dma_data_direction
--newtype-enum hrtimer_restart
--newtype-enum irqreturn
diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
index 4ce9e5d7f3dd0..b6c73db358ced 100644
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -267,25 +267,25 @@ pub enum DataDirection {
///
/// This is used when the buffer can be both read from and written to by the device.
/// The cache for the corresponding memory region is both flushed and invalidated.
- Bidirectional = Self::const_cast(bindings::dma_data_direction_DMA_BIDIRECTIONAL),
+ Bidirectional = Self::const_cast(bindings::dma_data_direction::DMA_BIDIRECTIONAL),
/// The DMA mapping is for data transfer from memory to the device (write).
///
/// The CPU has prepared data in the buffer, and the device will read it.
/// The cache for the corresponding memory region is flushed before device access.
- ToDevice = Self::const_cast(bindings::dma_data_direction_DMA_TO_DEVICE),
+ ToDevice = Self::const_cast(bindings::dma_data_direction::DMA_TO_DEVICE),
/// The DMA mapping is for data transfer from the device to memory (read).
///
/// The device will write data into the buffer for the CPU to read.
/// The cache for the corresponding memory region is invalidated before CPU access.
- FromDevice = Self::const_cast(bindings::dma_data_direction_DMA_FROM_DEVICE),
+ FromDevice = Self::const_cast(bindings::dma_data_direction::DMA_FROM_DEVICE),
/// The DMA mapping is not for data transfer.
///
/// This is primarily for debugging purposes. With this direction, the DMA mapping API
/// will not perform any cache coherency operations.
- None = Self::const_cast(bindings::dma_data_direction_DMA_NONE),
+ None = Self::const_cast(bindings::dma_data_direction::DMA_NONE),
}
impl DataDirection {
@@ -297,7 +297,7 @@ const fn const_cast(val: bindings::dma_data_direction) -> u32 {
// CAST: The C standard allows compilers to choose different integer types for enums.
// To safely check the value, we cast it to a wide signed integer type (`i128`)
// which can hold any standard C integer enum type without truncation.
- let wide_val = val as i128;
+ let wide_val = val.0 as i128;
// Check if the value is outside the valid range for the target type `u32`.
// CAST: `u32::MAX` is cast to `i128` to match the type of `wide_val` for the comparison.
@@ -315,11 +315,12 @@ const fn const_cast(val: bindings::dma_data_direction) -> u32 {
impl From<DataDirection> for bindings::dma_data_direction {
/// Returns the raw representation of [`enum dma_data_direction`].
fn from(direction: DataDirection) -> Self {
- // CAST: `direction as u32` gets the underlying representation of our `#[repr(u32)]` enum.
- // The subsequent cast to `Self` (the bindgen type) assumes the C enum is compatible
- // with the enum variants of `DataDirection`, which is a valid assumption given our
- // compile-time checks.
- direction as u32 as Self
+ match direction {
+ DataDirection::Bidirectional => Self::DMA_BIDIRECTIONAL,
+ DataDirection::ToDevice => Self::DMA_TO_DEVICE,
+ DataDirection::FromDevice => Self::DMA_FROM_DEVICE,
+ DataDirection::None => Self::DMA_NONE,
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 019/869] mm: khugepaged: fix swap entry value to folio_pfn()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 018/869] rust: dma: declare cfi_encoding for dma_data_direction Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 020/869] rust: bitmap: fix intra-doc link Greg Kroah-Hartman
` (857 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vernon Yang, Andrew Morton,
David Hildenbrand (Arm), Barry Song, Dev Jain, Lance Yang,
Lorenzo Stoakes, Ryan Roberts, Zach OKeefe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vernon Yang <yanglincheng@kylinos.cn>
[ Upstream commit 942c8ec27aa4ffc587511650718349964e1696e6 ]
Patch series "mm: khugepaged: fix tracepoint UAF", v5.
The khugepaged tracepoints take a folio pointer and call folio_pfn(), but
by then the folio may no longer be valid: freed after folio_put(),
folio_unlock() or pte_unmap_unlock(), or not a folio at all but an
xarray-encoded swap entry. On classic SPARSEMEM, dereferencing it oopses
khugepaged as soon as the trace event is enabled; on other memory models
it merely prints a bogus pfn.
Pass the pfn to the tracepoints directly, captured while the folio is
still pinned, closing the use-after-free windows in
mm_khugepaged_scan_file(), mm_khugepaged_scan_pmd() and
mm_khugepaged_collapse_file().
This patch (of 3):
When the swap entries found exceed max_ptes_swap, the loop is left via
break with folio still holding the xarray value that encodes the swap
entry, not valid folio pointer.
That value is passed to trace_mm_khugepaged_scan_file(), which feeds it to
folio_pfn(). On FLATMEM and SPARSEMEM_VMEMMAP, the page_to_pfn() is plain
pointer arithmetic, so the trace event merely prints bogus scan_pfn. On
classic SPARSEMEM, the page_to_pfn() reads page->flags, dereferencing the
tiny encoded integer and oopsing khugepaged whenever the trace event is
enabled.
So when folio is the swap entry value, simply set pfn to -1, just like
exhausted scan naturally.
And the folio_put() has maybe dropped the last reference of folio. The
trace_mm_khugepaged_scan_file() is left with a dangling folio pointer. so
using the folio_pfn() before dropping the reference, closing
use-after-free window.
Link: https://lore.kernel.org/20260909025804.3233645-1-vernon2gm@gmail.com
Link: https://lore.kernel.org/20260909025804.3233645-2-vernon2gm@gmail.com
Fixes: d41fd2016ed0 ("mm/khugepaged: add tracepoint to hpage_collapse_scan_file()")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
[ sashal: Retained int result instead of enum scan_result in hpage_collapse_scan_file(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/huge_memory.h | 6 +++---
mm/khugepaged.c | 7 ++++++-
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
index 2276614691dfd..1464d45c90abf 100644
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -167,10 +167,10 @@ TRACE_EVENT(mm_collapse_huge_page_swapin,
TRACE_EVENT(mm_khugepaged_scan_file,
- TP_PROTO(struct mm_struct *mm, struct folio *folio, struct file *file,
+ TP_PROTO(struct mm_struct *mm, unsigned long pfn, struct file *file,
int present, int swap, int result),
- TP_ARGS(mm, folio, file, present, swap, result),
+ TP_ARGS(mm, pfn, file, present, swap, result),
TP_STRUCT__entry(
__field(struct mm_struct *, mm)
@@ -183,7 +183,7 @@ TRACE_EVENT(mm_khugepaged_scan_file,
TP_fast_assign(
__entry->mm = mm;
- __entry->pfn = folio ? folio_pfn(folio) : -1;
+ __entry->pfn = pfn;
__assign_str(filename);
__entry->present = present;
__entry->swap = swap;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index e2ac26c05064f..cc3a09a0c2596 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2308,6 +2308,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
int present, swap;
int node = NUMA_NO_NODE;
int result = SCAN_SUCCEED;
+ unsigned long failed_pfn = -1;
present = 0;
swap = 0;
@@ -2344,6 +2345,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
folio->index == start) {
/* Maybe PMD-mapped */
result = SCAN_PTE_MAPPED_HUGEPAGE;
+ failed_pfn = folio_pfn(folio);
/*
* For SCAN_PTE_MAPPED_HUGEPAGE, further processing
* by the caller won't touch the page cache, and so
@@ -2357,6 +2359,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
node = folio_nid(folio);
if (hpage_collapse_scan_abort(node, cc)) {
result = SCAN_SCAN_ABORT;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
@@ -2364,12 +2367,14 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
if (!folio_test_lru(folio)) {
result = SCAN_PAGE_LRU;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) {
result = SCAN_PAGE_COUNT;
+ failed_pfn = folio_pfn(folio);
folio_put(folio);
break;
}
@@ -2401,7 +2406,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
}
}
- trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result);
+ trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present, swap, result);
return result;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 020/869] rust: bitmap: fix intra-doc link
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 019/869] mm: khugepaged: fix swap entry value to folio_pfn() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 021/869] drm/nouveau: reject zero-size notifier object allocation Greg Kroah-Hartman
` (856 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
`BitmapVec::MAX_LEN` does not exist in 6.18.y, so `rustdoc` warns:
warning: unresolved link to `BitmapVec::MAX_LEN`
--> rust/kernel/bitmap.rs:24:25
|
24 | /// This also matches [`BitmapVec::MAX_LEN`].
| ^^^^^^^^^^^^^^^^^^ the struct `BitmapVec` has no field or associated item named `MAX_LEN`
|
= note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default
Thus link to `BitmapVec::new()` instead.
Fixes: 37f45fe068e0 ("rust: bitmap: restrict bitmap length to at most i32::MAX")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/bitmap.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs
index 0e5e825aefb6c..a00988bc8191a 100644
--- a/rust/kernel/bitmap.rs
+++ b/rust/kernel/bitmap.rs
@@ -19,7 +19,7 @@
/// Must reference a `[c_ulong]` long enough to fit `data.len()` bits.
/// Must not be longer than [`i32::MAX`] bits, so offsets and lengths used with
/// [`Bitmap`] functions fit in the `int` and `unsigned int` arguments of the C bitmap API.
-/// This also matches [`BitmapVec::MAX_LEN`].
+/// This also matches the maximum length accepted by [`BitmapVec::new`].
#[cfg_attr(CONFIG_64BIT, repr(align(8)))]
#[cfg_attr(not(CONFIG_64BIT), repr(align(4)))]
pub struct Bitmap {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 021/869] drm/nouveau: reject zero-size notifier object allocation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 020/869] rust: bitmap: fix intra-doc link Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 022/869] drm/nouveau/svm: drain fault handler before freeing svmm Greg Kroah-Hartman
` (855 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
[ Upstream commit 38125d38d850bd2fdd5d7840c3bd52d9d208995b ]
nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled
info->size to nvkm_mm_head() as both size_max and size_min without a lower
bound. A zero size satisfies the allocator's "e - s < size_min" gate
(size_min == 0 makes the unsigned comparison inert) and yields a
zero-length node, after which
args.limit = ntfy->node->offset + ntfy->node->length - 1;
underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA
window. The dma object constructor only rejects start > limit, so the
validly ordered [base, base + 0xffffffff] range passes and is programmed
into the GPU DMA context. The ioctl is DRM_RENDER_ALLOW, so any render
node client can trigger this on pre-Fermi hardware.
Reject a zero-size request before allocating anything.
Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module format")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260813-nouveau-abi16-notifierobj-zero-size-v1-1-20dee38077cb@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index a3ba07fc48a08..a067c7244e7ec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -631,6 +631,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
if (unlikely(device->info.family >= NV_DEVICE_INFO_V0_FERMI))
return nouveau_abi16_put(abi16, -EINVAL);
+ /* zero size yields a zero-length node, underflowing args.limit */
+ if (unlikely(!info->size))
+ return nouveau_abi16_put(abi16, -EINVAL);
+
chan = nouveau_abi16_chan(abi16, info->channel);
if (!chan)
return nouveau_abi16_put(abi16, -ENOENT);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 022/869] drm/nouveau/svm: drain fault handler before freeing svmm
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 021/869] drm/nouveau: reject zero-size notifier object allocation Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 023/869] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC) Greg Kroah-Hartman
` (854 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
[ Upstream commit b46ddaf0823405f81e681eb26ec98508f3eb9a07 ]
The SVM fault handler nouveau_svm_fault() looks up each fault's
nouveau_svmm under svm->mutex, caches it in the fault array, then drops
svm->mutex and dereferences the svmm across blocking faults
(mmu_interval_notifier_insert(), hmm_range_fault()).
nouveau_svmm is not refcounted. On DRM file close nouveau_svmm_fini() ->
mmu_notifier_put() frees it asynchronously via call_srcu() without
waiting for the handler, and mmget_not_zero() pins the mm, not the svmm.
flush_work() on the fault buffer otherwise runs only at device removal
and suspend, never on close, so a fault handled concurrently with a close
can dereference a freed svmm.
The instance is already unlinked by nouveau_svmm_part() earlier in the
same close, so no new fault can resolve to it. Drain the handler in
nouveau_svmm_fini() before the free, guarding the flush with a NULL check
on drm->svm: on device teardown nouveau_svm_fini() runs first and frees
drm->svm (NULL) after blocking the notify and flushing the buffer, so the
handler is already drained; on per-client close drm->svm is alive and the
flush runs.
Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared virtual memory")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260814-nouveau-svm-svmm-uaf-v2-1-8e6590519f07@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_svm.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 6fa387da06371..dc6c79f57a56d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -304,6 +304,19 @@ nouveau_svmm_fini(struct nouveau_svmm **psvmm)
{
struct nouveau_svmm *svmm = *psvmm;
if (svmm) {
+ struct nouveau_svm *svm = svmm->vmm->cli->drm->svm;
+
+ /* The fault handler caches svmm pointers under svm->mutex and
+ * dereferences them after dropping it, across blocking faults.
+ * The instance is already unlinked (nouveau_svmm_part), so drain
+ * the handler before the free to release any in-flight reference.
+ *
+ * On device teardown nouveau_svm_fini() ran first and freed
+ * drm->svm (NULL) after draining the buffer; nothing to flush.
+ */
+ if (svm)
+ flush_work(&svm->buffer[0].work);
+
mutex_lock(&svmm->mutex);
svmm->vmm = NULL;
mutex_unlock(&svmm->mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 023/869] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC)
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 022/869] drm/nouveau/svm: drain fault handler before freeing svmm Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 024/869] drm/nouveau: disable the fence uevent work instead of just cancelling it Greg Kroah-Hartman
` (853 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fab Stz, Marek Czernohous,
Lyude Paul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 354d47fb3f35461b7f942831c1b2a7105e92b57f ]
NVAC (MCP79/MCP7A) uses g94_pci_func, whose .msi_rearm is
nv40_pci_msi_rearm(): a re-arm write through the MMIO mirror of PCI
config space. On this IGP that path is unreliable; when a re-arm is
missed the interrupt line stays dead, command submission times out and
the GPU appears hung until reboot. On an Apple Mac mini (early 2009,
MCP79, boot0 0x0ac080b1) this showed as sporadic fifo timeouts and GPU
hangs under load unless MSI was disabled via config=NvMSI=0.
Give NVAC its own pci func that re-arms through real PCI config space
(nv46_pci_msi_rearm) instead. This follows existing precedent: nv46.c
documents the MMIO-mirror re-arm as broken on several related parts,
and commit 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm") fixed g92
the same way while moving the remaining chipsets, NVAC included, into
the newly added shared g94 table, where NVAC stayed on the MMIO path.
This change completes that fix for NVAC. The sibling IGP NVAA
(MCP77/MCP78) has MSI disabled entirely as "reported broken" in
nvkm_pci_new_(); NVAC works correctly once the re-arm goes through
config space, so disabling MSI is not necessary.
Only NVAC is switched: that is the hardware this has been validated
on. The other users of g94_pci_func (G94/G96/G98/GT2xx and the
MCP77/MCP89 IGPs) keep their current behavior; MCP77 and MCP89
plausibly want the same treatment but were not tested.
Tested on the Mac mini as a daily driver for two months with MSI
enabled and zero fifo timeouts. Independently confirmed stable on an
iMac9,1 (MCP79) running 6.12.90 with the v1 form of this change (the
same one-line functional switch, applied to that kernel's g94
implementation).
Fixes: 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm")
Cc: <stable@vger.kernel.org> # v6.16+
Tested-by: Fab Stz <fabstz-it@yahoo.fr>
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688574401.522643.12812428444459119913@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/nouveau/include/nvkm/subdev/pci.h | 1 +
.../gpu/drm/nouveau/nvkm/engine/device/base.c | 2 +-
.../gpu/drm/nouveau/nvkm/subdev/pci/Kbuild | 1 +
.../gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c | 35 +++++++++++++++++++
4 files changed, 38 insertions(+), 1 deletion(-)
create mode 100644 drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
index 112b674ed9c8a..0172e0d200f81 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
@@ -46,6 +46,7 @@ int nv4c_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct n
int g84_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int g92_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int g94_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
+int mcp79_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gf100_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gf106_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gk104_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 3738c4664fb6a..305b16d9bcc7a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1237,7 +1237,7 @@ nvac_chipset = {
.mc = { 0x00000001, g98_mc_new },
.mmu = { 0x00000001, mcp77_mmu_new },
.mxm = { 0x00000001, nv50_mxm_new },
- .pci = { 0x00000001, g94_pci_new },
+ .pci = { 0x00000001, mcp79_pci_new },
.therm = { 0x00000001, g84_therm_new },
.timer = { 0x00000001, nv41_timer_new },
.volt = { 0x00000001, nv40_volt_new },
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
index a14ea0f7b1c87..90f03baeb22ac 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
@@ -9,6 +9,7 @@ nvkm-y += nvkm/subdev/pci/nv4c.o
nvkm-y += nvkm/subdev/pci/g84.o
nvkm-y += nvkm/subdev/pci/g92.o
nvkm-y += nvkm/subdev/pci/g94.o
+nvkm-y += nvkm/subdev/pci/mcp79.o
nvkm-y += nvkm/subdev/pci/gf100.o
nvkm-y += nvkm/subdev/pci/gf106.o
nvkm-y += nvkm/subdev/pci/gk104.o
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
new file mode 100644
index 0000000000000..e2ae242f1aa77
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright 2026 Marek Czernohous
+ *
+ * MCP79/MCP7A (NVAC): like g94, but MSI re-arm goes through real PCI
+ * config space. The MMIO-mirror re-arm is unreliable on this IGP and a
+ * missed re-arm kills the interrupt line (see the nv46 comment; g92
+ * already re-arms through config space for the same reason).
+ */
+#include "priv.h"
+
+static const struct nvkm_pci_func
+mcp79_pci_func = {
+ .cfg = { .addr = 0x088000, .size = 0x1000 },
+
+ .init = g84_pci_init,
+ .msi_rearm = nv46_pci_msi_rearm,
+
+ .pcie.init = g84_pcie_init,
+ .pcie.set_link = g84_pcie_set_link,
+
+ .pcie.max_speed = g84_pcie_max_speed,
+ .pcie.cur_speed = g84_pcie_cur_speed,
+
+ .pcie.set_version = g84_pcie_set_version,
+ .pcie.version = g84_pcie_version,
+ .pcie.version_supported = g92_pcie_version_supported,
+};
+
+int
+mcp79_pci_new(struct nvkm_device *device, enum nvkm_subdev_type type, int inst,
+ struct nvkm_pci **ppci)
+{
+ return nvkm_pci_new_(&mcp79_pci_func, device, type, inst, ppci);
+}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 024/869] drm/nouveau: disable the fence uevent work instead of just cancelling it
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 023/869] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC) Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 025/869] drm/nouveau: cancel the DP IRQ work before freeing the connector Greg Kroah-Hartman
` (852 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Marek Czernohous,
Lyude Paul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 827eb9328eaed831d7cc426ac2705038a40835b6 ]
nouveau_fence_context_del() drains the uevent work while the event that
feeds it is still armed:
cancel_work_sync(&fctx->uevent_work);
nouveau_fence_context_kill(fctx, 0);
nvif_event_dtor(&fctx->event);
nouveau_fence_wait_uevent_handler() queues the work unconditionally:
schedule_work(&fctx->uevent_work);
return NVIF_EVENT_KEEP;
so a non-stall interrupt arriving after cancel_work_sync() has returned
re-arms the work that was just drained. The window closes in two steps,
neither of which is the drain. The kill blocks the event when the last
fence holding a notify_ref is signalled, which reaches
atomic_xchg(&ntfy->allowed, 0) (nvkm/core/event.c:104), and
nvkm_event_ntfy() skips a ntfy that is not allowed (:183). That stops
further handlers from starting, but not one that is already inside
nvkm_event_ntfy(): the event is created with wait = false
(nouveau_fence.c:201), so nvkm_event_ntfy_block_() leaves it on the list
and never takes event->list_lock. Only nvif_event_dtor() waits that one
out: nvkm_event_ntfy_del() (:141) goes through nvkm_event_ntfy_remove(),
which takes write_lock_irq() on that same list_lock (:84).
Either way the re-arm happens after the drain, and the caller drops its
reference immediately afterwards, for example nv84_fence_context_del():
nouveau_fence_context_del(&fctx->base);
chan->fence = NULL;
nouveau_fence_context_free(&fctx->base);
That is a kref_put() on fctx->fence_ref, so the context outlives the
teardown only while emitted fences still hold a reference of their own.
That is no safety net: whenever none do, the count reaches zero right
there and nouveau_fence_context_put() kfree()s fctx while the work is
still queued. &fctx->uevent_work is embedded in that allocation, so the
workqueue already dereferences freed memory when it picks the item up,
and nouveau_fence_uevent_work() can then take fctx->lock on it. With
CONFIG_DEBUG_OBJECTS_WORK and CONFIG_DEBUG_OBJECTS_FREE, kfree() of a
still-queued work item is reported as the free of an active object.
On live memory the re-armed work has nothing left to do:
nouveau_fence_context_kill() empties fctx->pending and sets fctx->killed
under fctx->lock, nouveau_fence_emit() then returns -ENODEV rather than
queueing anything new, and nouveau_fence_update() only reaches
nvif_event_block() if it signalled something off that list. The defect
is the access to freed memory, not what the work would have found.
Only chips from G84 on can reach this at all: nouveau_fence_context_new()
returns before nvif_event_ctor() when priv->uevent is clear, and
nv84_fence_create() is the only place that sets it.
nv84_fence_context_del() is the context_del for all of those, because
nvc0_fence_create() and gv100_fence_create() build on nv84_fence_create()
and override only context_new.
Use disable_work_sync() instead. It drains the work exactly like
cancel_work_sync() does, and additionally increments the work item's
disable count, after which "any attempt to queue @work will fail and
return %false" (kernel/workqueue.c, disable_work()). The handler's
schedule_work() then has nothing to re-arm, and the teardown order stays
as it is.
Draining a second time after nvif_event_dtor() would close the window as
well, and without the newer API: once nvkm_event_ntfy_remove() has
returned, no handler can start or still be running, so nothing re-arms
the work past that point. disable_work_sync() is preferred here because
it needs one synchronisation point instead of two, it keeps the work
from being queued at all rather than cleaning up after it, and it is
what drm has settled on for this (drm/xe, drm/panthor, drm_pagemap).
Blocking the event rather than the work is not an option: fctx->event is
created with wait = false, so a handler already inside nvkm_event_ntfy()
can still queue the work.
Note for backports: disable_work_sync() arrived in v6.10 with
commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed)
work items"), while the fix being corrected here reached 6.6.18 and
6.7.6. linux-6.6.y therefore carries this bug without the API, and this
patch would apply there and then fail to build. A 6.6.y backport wants
the second drain described above instead, as its own patch.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260812233022.159301F000E9@smtp.kernel.org/
Fixes: 39126abc5e20 ("nouveau: offload fence uevents work to workqueue")
Cc: <stable@vger.kernel.org> # 6.10.x
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688513268.513871.3468844663561639695@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 4a193b7d6d9e4..7acf241c4daf3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -95,7 +95,7 @@ nouveau_fence_context_kill(struct nouveau_fence_chan *fctx, int error)
void
nouveau_fence_context_del(struct nouveau_fence_chan *fctx)
{
- cancel_work_sync(&fctx->uevent_work);
+ disable_work_sync(&fctx->uevent_work);
nouveau_fence_context_kill(fctx, 0);
nvif_event_dtor(&fctx->event);
fctx->dead = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 025/869] drm/nouveau: cancel the DP IRQ work before freeing the connector
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 024/869] drm/nouveau: disable the fence uevent work instead of just cancelling it Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 026/869] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq Greg Kroah-Hartman
` (851 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Marek Czernohous,
Lyude Paul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit f60849975a886d70883bcb6b3658c0fa83c6971f ]
nouveau_connector_destroy() tears the two nvif events down and then
frees the connector, but never cancels the work the IRQ event queues:
nvif_event_dtor(&nv_connector->irq);
nvif_event_dtor(&nv_connector->hpd);
kfree(nv_connector->edid);
...
kfree(connector);
nouveau_connector_irq() queues that work unconditionally:
schedule_work(&nv_connector->irq_work);
return NVIF_EVENT_KEEP;
A DP IRQ arriving just before nvif_event_dtor() therefore leaves
nv_connector->irq_work on the system queue past the kfree(). When it
runs, nouveau_dp_irq() derives both nv_connector and connector from the
work_struct and dereferences them, and goes on to take
outp->dp.hpd_irq_lock.
There is no cancel_work_sync() for irq_work anywhere in the driver, so
nothing else covers this. Add it after the event teardown, where no
further work can be queued, and before anything is freed.
Reported by the Sashiko review bot as a pre-existing issue, in its review
of an earlier nv04 FIFO series of mine, and confirmed against the source.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260812231330.705425-1-mczernohous@gmail.com?part=1
Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366002.3748010.4096452389040554615@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 7c6d91ee2722d..f9662e067c56c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -397,6 +397,7 @@ nouveau_connector_destroy(struct drm_connector *connector)
struct nouveau_connector *nv_connector = nouveau_connector(connector);
nvif_event_dtor(&nv_connector->irq);
nvif_event_dtor(&nv_connector->hpd);
+ cancel_work_sync(&nv_connector->irq_work);
kfree(nv_connector->edid);
drm_connector_unregister(connector);
drm_connector_cleanup(connector);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 026/869] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 025/869] drm/nouveau: cancel the DP IRQ work before freeing the connector Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 027/869] drm/amdgpu: recompute the dw estimate after allocating a new VM update job Greg Kroah-Hartman
` (850 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Czernohous, Lyude Paul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 843bc34db94bff0612c8294861b156489958897b ]
nouveau_dp_irq() looks the encoder up and dereferences it in the same
breath, five lines before testing it:
struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
...
if (!outp)
return;
find_encoder() walks the connector's possible encoders and returns NULL
when none of them matches the requested type, so the NULL test is not
decoration: it is the author saying this can happen. The initialiser
above it dereferences the same pointer regardless.
The NULL test predates the dereference. commit 773eb04d14a1
("drm/nouveau/disp: expose conn event class") turned nouveau_dp_irq()
into a work callback, and since the drm pointer was no longer passed in
as an argument it was recovered from the encoder in the declaration
block, which put the dereference above the existing test.
Move the drm lookup below the test. No functional change when outp is
non-NULL.
Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366004.3748010.14933649768375463967@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_dp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index 55691ec44abaa..738802358d85c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -486,7 +486,7 @@ nouveau_dp_irq(struct work_struct *work)
container_of(work, typeof(*nv_connector), irq_work);
struct drm_connector *connector = &nv_connector->base;
struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
- struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
+ struct nouveau_drm *drm;
struct nv50_mstm *mstm;
u64 hpd = 0;
int ret;
@@ -494,6 +494,8 @@ nouveau_dp_irq(struct work_struct *work)
if (!outp)
return;
+ drm = nouveau_drm(outp->base.base.dev);
+
mstm = outp->dp.mstm;
NV_DEBUG(drm, "service %s\n", connector->name);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 027/869] drm/amdgpu: recompute the dw estimate after allocating a new VM update job
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 026/869] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 028/869] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG Greg Kroah-Hartman
` (849 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YuBiao Wang, Christian König,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: YuBiao Wang <YuBiao.Wang@amd.com>
[ Upstream commit a74c7832b11827907de560169c7d4ac94505fd87 ]
amdgpu_vm_sdma_update() keeps the number of free dwords of the current
job in a local variable. When the job runs out of room it is committed
and a new one is allocated, but that local variable is not refreshed and
still describes the job which was just submitted.
The stale value is then used to decide how many PTEs fit into the new
job. If it happens to be copy_pte_num_dw + 7, or one more than that, the
result is zero. copy_pte() encodes the transfer size as count * 8 - 1,
so a count of zero asks the engine for a 1GB copy starting inside the IB
pool. That runs off the end of the pool, faults on the first unmapped
GART page above it and hangs the ring.
Re-initialize the estimate from the newly allocated job, which is empty
and therefore has its full budget available.
Cc: stable@vger.kernel.org
Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
index 36805dcfa1598..902d0a538e419 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
@@ -254,6 +254,11 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,
AMDGPU_KERNEL_JOB_ID_VM_UPDATE);
if (r)
return r;
+
+ /* The estimate above describes the job which was just
+ * submitted, take the budget of the newly allocated one.
+ */
+ ndw = p->num_dw_left;
}
if (!p->pages_addr) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 028/869] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 027/869] drm/amdgpu: recompute the dw estimate after allocating a new VM update job Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 029/869] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode Greg Kroah-Hartman
` (848 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Alex Hung,
Robert Mader, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <harry.wentland@amd.com>
[ Upstream commit 2ffaa7c4050605cb27756f5336f778d1b21268b9 ]
The ROM early-return checks for PQ, Gamma 2.2, and HLG in
mod_color_calculate_degamma_params() do not consider the map_user_ramp
parameter. When map_user_ramp is true (indicating a subsampled surface
that requires post-scaler degamma via GAMCOR), the function still takes
the ROM path, programming PRE_DEGAM instead.
For subsampled formats the chroma channels must be upsampled by the
scaler before degamma is applied. PRE_DEGAM sits before the scaler in
the pipeline (CNVC domain), while GAMCOR sits after it (CM domain).
Using the ROM for subsampled surfaces means degamma is applied to
subsampled chroma before upsampling, producing incorrect results.
Fix by gating the dcn_arch ROM capability checks on !map_user_ramp,
forcing PQ/Gamma22/HLG through the GAMCOR LUT path when the surface
is subsampled.
Fixes: a8bf71649088 ("drm/amd/display: Internal refactoring to abstract color caps")
Cc: stable@vger.kernel.org
Assisted-by: Copilot:claude-opus-4.6
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Tested-by: Robert Mader <robert.mader@collabora.com>
Link: https://patch.msgid.link/20260814211816.1219597-11-harry.wentland@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index a71df052cf252..7103d8cfb4799 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1694,7 +1694,8 @@ bool mod_color_calculate_degamma_params(struct dc_color_caps *dc_caps,
return true;
if (dc_caps != NULL &&
- dc_caps->dpp.dcn_arch == 1) {
+ dc_caps->dpp.dcn_arch == 1 &&
+ !map_user_ramp) {
if (input_tf->tf == TRANSFER_FUNCTION_PQ &&
dc_caps->dpp.dgam_rom_caps.pq == 1)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 029/869] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 028/869] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 030/869] cpufreq: airoha: fix probe failure with correct error check Greg Kroah-Hartman
` (847 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Szczudlo, Andy Shevchenko,
Stable, Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Szczudlo <jakubszczudlo40@gmail.com>
[ Upstream commit 38dbf24dfbd0a73b89fa2871a7148429aef05531 ]
When device is suspended and it is in single mode then changing
datarate doesn't make it actually wait for new measurement, so to
be sure that read after change is correct, functions that changes
datarate and gain will wait for a new data.
Fixes: 541880542f2b ("iio: adc: Add TI ADS1100 and ADS1000")
Signed-off-by: Jakub Szczudlo <jakubszczudlo40@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-ads1100.c | 107 +++++++++++++++++++++++++++++++++--
1 file changed, 103 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/ti-ads1100.c b/drivers/iio/adc/ti-ads1100.c
index aa8946063c7d6..5c08bed48018c 100644
--- a/drivers/iio/adc/ti-ads1100.c
+++ b/drivers/iio/adc/ti-ads1100.c
@@ -15,10 +15,12 @@
#include <linux/module.h>
#include <linux/init.h>
#include <linux/i2c.h>
+#include <linux/iopoll.h>
#include <linux/mutex.h>
#include <linux/property.h>
#include <linux/pm_runtime.h>
#include <linux/regulator/consumer.h>
+#include <linux/time.h>
#include <linux/units.h>
#include <linux/iio/iio.h>
@@ -43,6 +45,9 @@
static const int ads1100_data_rate[] = { 128, 32, 16, 8 };
static const int ads1100_data_rate_bits[] = { 12, 14, 15, 16 };
+/* Timeout based on the minimum sample rate of 8 SPS (7500ms) */
+#define ADS1100_MAX_DRDY_TIMEOUT_US (7500 * USEC_PER_MSEC)
+
struct ads1100_data {
struct i2c_client *client;
struct regulator *reg_vdd;
@@ -123,10 +128,86 @@ static int ads1100_get_adc_result(struct ads1100_data *data, int chan, int *val)
return 0;
}
+static int ads1100_conversion_busy(struct ads1100_data *data)
+{
+ u8 buffer[3];
+ int ret;
+
+ ret = i2c_master_recv(data->client, (char *)&buffer, sizeof(buffer));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C read fail: %d\n", ret);
+ return ret;
+ }
+
+ return FIELD_GET(ADS1100_CFG_ST_BSY, buffer[2]);
+}
+
+static int ads1100_wait_single_conversion(struct ads1100_data *data)
+{
+ int data_rate_index = FIELD_GET(ADS1100_DR_MASK, data->config);
+ int data_rate_Hz = ads1100_data_rate[data_rate_index];
+ unsigned long poll_us = DIV_ROUND_CLOSEST(USEC_PER_SEC, data_rate_Hz) / 4;
+ int busy;
+ int ret;
+
+ ret = readx_poll_timeout(ads1100_conversion_busy, data,
+ busy, busy <= 0,
+ poll_us, ADS1100_MAX_DRDY_TIMEOUT_US);
+ if (busy < 0)
+ return busy;
+
+ return ret;
+}
+
+static int ads1100_start_single_conversion(struct ads1100_data *data)
+{
+ u8 config = data->config | ADS1100_CFG_SC;
+ int ret;
+
+ ret = i2c_master_send(data->client, &config, sizeof(config));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+ return ret;
+ }
+ /* Need to wait because of change from continuous to single mode */
+ ret = ads1100_wait_single_conversion(data);
+ if (ret)
+ return ret;
+
+ config |= ADS1100_CFG_ST_BSY;
+
+ ret = i2c_master_send(data->client, &config, sizeof(config));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+ return ret;
+ }
+
+ /* No need to cache it, it's status bit */
+ data->config = config & ~ADS1100_CFG_ST_BSY;
+
+ return 0;
+}
+
+static int ads1100_poll_data_ready(struct ads1100_data *data)
+{
+ int ret;
+
+ ret = ads1100_start_single_conversion(data);
+ if (ret)
+ return ret;
+
+ ret = ads1100_wait_single_conversion(data);
+ if (ret)
+ return ret;
+
+ return ads1100_set_config_bits(data, ADS1100_CFG_SC, ADS1100_CONTINUOUS);
+}
+
static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
{
int microvolts;
int gain;
+ int ret;
/* With Vdd between 2.7 and 5V, the scale is always below 1 */
if (val)
@@ -135,6 +216,11 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
if (!val2)
return -EINVAL;
+ PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
+ return ret;
+
microvolts = regulator_get_voltage(data->reg_vdd);
/*
* val2 is in 'micro' units, n = val2 / 1000000
@@ -149,22 +235,35 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
ads1100_set_config_bits(data, ADS1100_PGA_MASK, ffs(gain) - 1);
- return 0;
+ return ads1100_poll_data_ready(data);
}
static int ads1100_set_data_rate(struct ads1100_data *data, int chan, int rate)
{
unsigned int i;
unsigned int size;
+ int ret;
size = data->supports_data_rate ? ARRAY_SIZE(ads1100_data_rate) : 1;
for (i = 0; i < size; i++) {
if (ads1100_data_rate[i] == rate)
- return ads1100_set_config_bits(data, ADS1100_DR_MASK,
- FIELD_PREP(ADS1100_DR_MASK, i));
+ break;
}
- return -EINVAL;
+ if (i == size)
+ return -EINVAL;
+
+ PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
+ return ret;
+
+ ret = ads1100_set_config_bits(data, ADS1100_DR_MASK,
+ FIELD_PREP(ADS1100_DR_MASK, i));
+ if (ret)
+ return ret;
+
+ return ads1100_poll_data_ready(data);
}
static int ads1100_get_vdd_millivolts(struct ads1100_data *data)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 030/869] cpufreq: airoha: fix probe failure with correct error check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 029/869] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 031/869] media: streamzap: Add missing rc_unregister_device() Greg Kroah-Hartman
` (846 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Schwierzeck,
Christian Marangi, Zhongqiu Han, Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
[ Upstream commit 801ade22c4fc078ea9b11e1f3fe3aae8b8bef886 ]
dev_pm_domain_attach_list() returns the number of attached PM domains
on success (a positive count), or a negative error code on failure.
The driver checks "if (ret)" which treats a successful attachment of
one or more PM domains as an error, causing the probe to fail with
return code 1.
Fix by checking "if (ret < 0)" like all other users of this API.
Cc: stable@vger.kernel.org
Fixes: 84cf9e541ccc ("cpufreq: airoha: Add EN7581 CPUFreq SMCCC driver")
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/airoha-cpufreq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/airoha-cpufreq.c b/drivers/cpufreq/airoha-cpufreq.c
index b6b1cdc4d11d6..ec9b2fc00f5e0 100644
--- a/drivers/cpufreq/airoha-cpufreq.c
+++ b/drivers/cpufreq/airoha-cpufreq.c
@@ -64,7 +64,7 @@ static int airoha_cpufreq_probe(struct platform_device *pdev)
/* Attach PM for OPP */
ret = dev_pm_domain_attach_list(cpu_dev, &attach_data,
&priv->pd_list);
- if (ret)
+ if (ret < 0)
goto clear_opp_config;
cpufreq_dt = platform_device_register_simple("cpufreq-dt", -1, NULL, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 031/869] media: streamzap: Add missing rc_unregister_device()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 030/869] cpufreq: airoha: fix probe failure with correct error check Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 032/869] media: redrat3: Ensure we dont read beyond the end of the packet Greg Kroah-Hartman
` (845 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 3982d2eeb1bdf7a9c14e4ff69015cb456f11da51 ]
If usb_submit_urb() fails during probe, then the error path is missing a
call to rc_unregister_device(), which will leak various things like the
input device.
Fixes: 42844992664f ("media: rc: streamzap: Error handling in probe")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/streamzap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 8c85b9f30a3a9..e91cf2ffbc876 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -365,6 +365,7 @@ static int streamzap_probe(struct usb_interface *intf,
return 0;
rc_submit_fail:
+ rc_unregister_device(sz->rdev);
rc_free_device(sz->rdev);
usb_set_intfdata(intf, NULL);
rc_dev_fail:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 032/869] media: redrat3: Ensure we dont read beyond the end of the packet
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 031/869] media: streamzap: Add missing rc_unregister_device() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 033/869] media: redrat3: Ensure all urbs are suspended Greg Kroah-Hartman
` (844 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit cd49f62f4161c7340d9c9f53b67757575900c0bc ]
The length and offset is provided by the usb device, so it should be
validated.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3170bd72a8e6f..4cbbe16a8ac47 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -358,8 +358,24 @@ static void redrat3_process_ir_data(struct redrat3_dev *rr3)
/* process each rr3 encoded byte into an int */
sig_size = be16_to_cpu(rr3->irdata.sig_size);
+
+ /*
+ * Note we are not checking if we are reading beyond the end of the
+ * packet which was sent, and reading stale data. If the device
+ * sends a packet which is short then we get garbage IR, but no
+ * out of bounds read.
+ */
+ if (sig_size > RR3_MAX_SIG_SIZE) {
+ dev_err(dev, "length %u is incorrect\n", sig_size);
+ return;
+ }
+
for (i = 0; i < sig_size; i++) {
offset = rr3->irdata.sigdata[i];
+ if (offset >= RR3_DRIVER_MAXLENS) {
+ dev_err(dev, "offset %u is incorrect\n", offset);
+ return;
+ }
val = get_unaligned_be16(&rr3->irdata.lens[offset]);
/* we should always get pulse/space/pulse/space samples */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 033/869] media: redrat3: Ensure all urbs are suspended
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 032/869] media: redrat3: Ensure we dont read beyond the end of the packet Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 034/869] media: sunxi-cir: Ensure no more interrupts can occur before free Greg Kroah-Hartman
` (843 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 1582f545273f2aa4eb4ee6f3a89b433f5c85c68f ]
Ensure that the learn urb is stopped before suspend.
Fixes: c49fcdde38cb ("[media] redrat3: enable carrier reports using wideband receiver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 4cbbe16a8ac47..c9a5c030f7726 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1170,6 +1170,7 @@ static int redrat3_dev_suspend(struct usb_interface *intf, pm_message_t message)
usb_kill_urb(rr3->narrow_urb);
usb_kill_urb(rr3->wide_urb);
usb_kill_urb(rr3->flash_urb);
+ usb_kill_urb(rr3->learn_urb);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 034/869] media: sunxi-cir: Ensure no more interrupts can occur before free
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 033/869] media: redrat3: Ensure all urbs are suspended Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 035/869] media: meson-ir-tx: Ensure clock is disabled on unbind Greg Kroah-Hartman
` (842 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit f9b33ec404200c03dd490ec133b8f9bf599c5444 ]
Only call rc_free_device() once the hardware has been stopped.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/sunxi-cir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
index 28e840a7e5b8c..af1ee08ffdbec 100644
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
struct sunxi_ir *ir = platform_get_drvdata(pdev);
rc_unregister_device(ir->rc);
- rc_free_device(ir->rc);
sunxi_ir_hw_exit(&pdev->dev);
+ rc_free_device(ir->rc);
}
static void sunxi_ir_shutdown(struct platform_device *pdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 035/869] media: meson-ir-tx: Ensure clock is disabled on unbind
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 034/869] media: sunxi-cir: Ensure no more interrupts can occur before free Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 036/869] media: meson-ir-tx: Ensure rc_free_device() is called " Greg Kroah-Hartman
` (841 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 1517326fcc9dfdb9acb24f42472366ac1b4b8237 ]
clk_prepare_enable() needs a call to clk_disable_unprepare() on
driver unbind. Make it devm managed.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index fded2c256f2a6..6beb9e97453dd 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -288,11 +288,12 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
if (!np)
return -ENODEV;
- clock = devm_clk_get(ir->dev, "xtal");
- if (IS_ERR(clock) || clk_prepare_enable(clock))
+ *clk_nr = IRB_MOD_XTAL3_CLK;
+
+ clock = devm_clk_get_enabled(ir->dev, "xtal");
+ if (IS_ERR(clock))
return -ENODEV;
- *clk_nr = IRB_MOD_XTAL3_CLK;
ir->clk_rate = clk_get_rate(clock) / 3;
if (ir->clk_rate < IRB_MOD_1US_CLK_RATE) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 036/869] media: meson-ir-tx: Ensure rc_free_device() is called on unbind
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 035/869] media: meson-ir-tx: Ensure clock is disabled on unbind Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 037/869] media: meson-ir-tx: Ensure probe error is propagated Greg Kroah-Hartman
` (840 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Neil Armstrong, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 32999b8a9d5c4f497c9739e70ac4ee390cd650a7 ]
Make rc_dev devm managed.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 6beb9e97453dd..e8e3c1a303279 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -346,7 +346,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
if (ret)
return dev_err_probe(dev, ret, "irq request failed\n");
- rc = rc_allocate_device(RC_DRIVER_IR_RAW_TX);
+ rc = devm_rc_allocate_device(dev, RC_DRIVER_IR_RAW_TX);
if (!rc)
return -ENOMEM;
@@ -359,10 +359,8 @@ static int meson_irtx_probe(struct platform_device *pdev)
rc->s_tx_duty_cycle = meson_irtx_set_duty_cycle;
ret = devm_rc_register_device(dev, rc);
- if (ret < 0) {
- rc_free_device(rc);
+ if (ret < 0)
return dev_err_probe(dev, ret, "rc_dev registration failed\n");
- }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 037/869] media: meson-ir-tx: Ensure probe error is propagated
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 036/869] media: meson-ir-tx: Ensure rc_free_device() is called " Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 038/869] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Greg Kroah-Hartman
` (839 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Neil Armstrong, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 2eb8a4cba70f521a8217021e227cfa28ba17724b ]
devm_clk_get_enabled() may return -EPROBE_DEFER which needs to be
propagated else the probe will not be deferred, it will fail instead.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index e8e3c1a303279..1ab898069e67f 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -292,7 +292,7 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
clock = devm_clk_get_enabled(ir->dev, "xtal");
if (IS_ERR(clock))
- return -ENODEV;
+ return PTR_ERR(clock);
ir->clk_rate = clk_get_rate(clock) / 3;
@@ -325,7 +325,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
ir->dev = dev;
ir->carrier = MIRTX_DEFAULT_CARRIER;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 038/869] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 037/869] media: meson-ir-tx: Ensure probe error is propagated Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 039/869] media: imx-jpeg: finish the job on device_run() error paths Greg Kroah-Hartman
` (838 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit f7509d2567cf92eeccc31c363a2e2ae43188930c ]
Once the interrupt handler is enabled, priv->rdev can be used. Ensure
it is setup correctly so there is no race condition.
Fixes: a84fcdaa9058 ("[media] rc: Introduce hix5hd2 IR transmitter driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ir-hix5hd2.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index bb0f95833df57..04982ffde68f9 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -316,6 +316,9 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
if (ret < 0)
goto clkerr;
+ priv->rdev = rdev;
+ priv->dev = dev;
+
if (devm_request_irq(dev, priv->irq, hix5hd2_ir_rx_interrupt,
0, pdev->name, priv) < 0) {
dev_err(dev, "IRQ %d register failed\n", priv->irq);
@@ -323,8 +326,6 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
goto regerr;
}
- priv->rdev = rdev;
- priv->dev = dev;
platform_set_drvdata(pdev, priv);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 039/869] media: imx-jpeg: finish the job on device_run() error paths
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 038/869] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 040/869] microblaze: Fix MB_MANAGER build with older binutils Greg Kroah-Hartman
` (837 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Wu, Ming Qian, Frank Li,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 30b35fd2b999e1b8c26f8191d974d20c8848d2d6 ]
mxc_jpeg_device_run() returns early through a shared "end" label on several
error paths (no free slot, mxc_jpeg_alloc_slot_data() failure, or missing
buffers or queue data), and none of them calls v4l2_m2m_job_finish().
Since the delayed work is queued only after the hardware is started, those
paths neither finish the job directly nor queue timeout work that could
finish it later. The job is left with TRANS_RUNNING set, so the
wait_event() in v4l2_m2m_cancel_job() (reached from v4l2_m2m_ctx_release()
at close) waits indefinitely and the close hangs.
mxc_jpeg_alloc_slot_data() uses dma_alloc_coherent(), so the failure path
is reachable under memory pressure.
Return the src/dst buffers with VB2_BUF_STATE_ERROR and call
v4l2_m2m_job_finish() on those paths: paths that have buffers use a
"buf_finish" label; the no-buffer path uses "job_finish" directly. This
mirrors the existing jpeg_parse_error path.
This bug was found by static analysis.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 21 +++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index 4ac4f576fdd10..9f0794dd5c544 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1525,15 +1525,15 @@ static void mxc_jpeg_device_run(void *priv)
dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
if (!src_buf || !dst_buf) {
dev_err(dev, "Null src or dst buf\n");
- goto end;
+ goto job_finish;
}
q_data_cap = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
if (!q_data_cap)
- goto end;
+ goto buf_finish;
q_data_out = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
if (!q_data_out)
- goto end;
+ goto buf_finish;
src_buf->sequence = q_data_out->sequence++;
dst_buf->sequence = q_data_cap->sequence++;
@@ -1571,11 +1571,11 @@ static void mxc_jpeg_device_run(void *priv)
ctx->slot = mxc_get_free_slot(&jpeg->slot_data);
if (ctx->slot < 0) {
dev_err(dev, "No more free slots\n");
- goto end;
+ goto buf_finish;
}
if (!mxc_jpeg_alloc_slot_data(jpeg)) {
dev_err(dev, "Cannot allocate slot data\n");
- goto end;
+ goto buf_finish;
}
mxc_jpeg_enable_slot(reg, ctx->slot);
@@ -1597,8 +1597,17 @@ static void mxc_jpeg_device_run(void *priv)
mxc_jpeg_dec_mode_go(dev, reg);
}
schedule_delayed_work(&ctx->task_timer, msecs_to_jiffies(hw_timeout));
-end:
+
spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+ return;
+buf_finish:
+ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+ v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
+ v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
+job_finish:
+ spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
}
static int mxc_jpeg_decoder_cmd(struct file *file, void *priv,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 040/869] microblaze: Fix MB_MANAGER build with older binutils
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 039/869] media: imx-jpeg: finish the job on device_run() error paths Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 041/869] udf: Make sure theres enough space for LVID implementation use field Greg Kroah-Hartman
` (836 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Michal Simek,
Karl Mehltretter, Michal Simek, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 79c8aa4da3d5453dd956d2170d1c9c716311ea06 ]
Commit 88707ebe77e2 ("microblaze: Add custom break vector handler for mb
manager") added the suspend mnemonic to the MB Manager break handler.
GNU as only learned this mnemonic in binutils 2.42. Linux supports
binutils 2.30, where enabling CONFIG_MB_MANAGER fails:
arch/microblaze/kernel/entry.S:946: Error: unknown opcode "suspend"
The suspend mnemonic is an alias for mbar 24, and both encode as
0xbb020004. Use the underlying instruction, which GNU as 2.30 already
supports.
Fixes: 88707ebe77e2 ("microblaze: Add custom break vector handler for mb manager")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310310151.UhB396Qs-lkp@intel.com/
Suggested-by: Michal Simek <monstr@monstr.eu>
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260813024026.5402-1-kmehltretter@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 582d7256d8154..ad44341a5dbc7 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -943,7 +943,7 @@ ret_from_break:
mbar 1
mbar 2
bri 4
- suspend
+ mbar 24 /* suspend */
nop
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 041/869] udf: Make sure theres enough space for LVID implementation use field
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 040/869] microblaze: Fix MB_MANAGER build with older binutils Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 042/869] aio: prevent eventfd/epoll recursion on poll Greg Kroah-Hartman
` (835 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunpeng Tian, Gongming Wang,
Mingda Zhang, Qinrun Dai, Jan Kara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
[ Upstream commit a61fb39759d719a4f4966742b4d28387e33d81c4 ]
udf_lvid_valid() verifies that the LVID has enough space for all the
tables and the reported length of ImplementationUse field. However it
doesn't make sure the reported length is large enough to contain
logicalVolIntegrityDescImpUse structure which OSTA specification
requires. This can thus lead to accesses beyond the end of LVID buffer
for suitably corrupted UDF filesystem. Add the length check.
Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 781d2a9a2fc7 ("udf: Check LVID earlier")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index f91b231b7d7bd..556540f2797ae 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1611,7 +1611,10 @@ static bool udf_lvid_valid(struct super_block *sb,
parts = le32_to_cpu(lvid->numOfPartitions);
impuselen = le32_to_cpu(lvid->lengthOfImpUse);
- if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+ if (sizeof(struct logicalVolIntegrityDescImpUse) > impuselen ||
+ impuselen >= sb->s_blocksize)
+ return false;
+ if (parts >= sb->s_blocksize ||
sizeof(struct logicalVolIntegrityDesc) + impuselen +
2 * parts * sizeof(u32) > sb->s_blocksize)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 042/869] aio: prevent eventfd/epoll recursion on poll
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 041/869] udf: Make sure theres enough space for LVID implementation use field Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 043/869] ipc/mqueue: release notification resources during inode eviction Greg Kroah-Hartman
` (834 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 398e3fa789aa5ffddc8689d8cbc7b31e1824130c ]
aio_poll_wake() can complete a keyed poll request inline while the
provider waitqueue lock is held. If the polled file is an epoll instance
and the AIO result eventfd is watched by that same instance, signaling the
result can feed back into epoll and try to take the provider waitqueue lock
again.
For example, a timerfd wake can follow this path:
timerfd -> ep_poll_callback -> aio_poll_wake -> aio_complete
-> eventfd_signal -> ep_poll_callback -> ep_poll_safewake
The second ep_poll_safewake() recursively acquires ep->poll_wait.lock.
eventfd_signal_allowed() does not prevent this because the wake chain did
not begin in eventfd, so the task's eventfd recursion bit is still clear
when aio_poll_wake() decides to complete inline.
An unprivileged process can construct this graph and make a CPU spin on the
recursive lock. DEBUG_SPINLOCK reports "BUG: spinlock recursion", and
lockdep reports the same epoll waitqueue lock as both held and requested.
Always defer eventfd-backed poll completions through the existing
aio_poll_put_work() path. At this point the request has already been
detached from the waitqueue and active request list, so the work item can
publish the completion after the provider callback releases its lock.
Poll completions without a result eventfd remain inline.
Fixes: e8693bcfa0b4 ("aio: allow direct aio poll comletions for keyed wakeups")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260813133843.2933127-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/aio.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/aio.c b/fs/aio.c
index 5bc1333864078..bd92bd3e13408 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1816,7 +1816,12 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
list_del_init(&req->wait.entry);
list_del(&iocb->ki_list);
iocb->ki_res.res = mangle_poll(mask);
- if (iocb->ki_eventfd && !eventfd_signal_allowed()) {
+ /*
+ * We hold an arbitrary provider waitqueue lock here. Signaling a
+ * result eventfd can feed back through epoll and try to take the same
+ * lock again. Defer all eventfd-backed poll completions.
+ */
+ if (iocb->ki_eventfd) {
iocb = NULL;
INIT_WORK(&req->work, aio_poll_put_work);
schedule_work(&req->work);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 043/869] ipc/mqueue: release notification resources during inode eviction
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 042/869] aio: prevent eventfd/epoll recursion on poll Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 044/869] remoteproc: elf_loader: Bound the section header table Greg Kroah-Hartman
` (833 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit eb85469f0dd69ca145d63117450e14c31f67f698 ]
mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.
A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table.
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.
The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference. An
unprivileged process can repeat the sequence with new queues and sockets.
No inode users remain during eviction. Remove any stale registration there
after dropping info->lock, since netlink_sendskb() may release the final
socket reference.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260824042359.925145-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
ipc/mqueue.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 093551fe66a7e..11eaf5df3645f 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -529,6 +529,13 @@ static void mqueue_evict_inode(struct inode *inode)
list_add_tail(&msg->m_list, &tmp_msg);
kfree(info->node_cache);
spin_unlock(&info->lock);
+ /*
+ * A shared file table can let the notification owner exit without
+ * running ->flush(). No users of the inode remain during eviction, so
+ * tear down any stale notification after dropping info->lock because
+ * netlink_sendskb() may release the final socket reference.
+ */
+ remove_notification(info);
list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
list_del(&msg->m_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 044/869] remoteproc: elf_loader: Bound the section header table
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 043/869] ipc/mqueue: release notification resources during inode eviction Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 045/869] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison Greg Kroah-Hartman
` (832 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mathieu Poirier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit b32177ead5f8925aa66ceed2bd533a85196f4f0c ]
The rproc_elf_sanity_check() only checks the image is big enough to hold
one section header. But find_table() walks e_shnum of them, and first
dereferences the header at e_shstrndx to locate the section name table.
Both fields are u16 and both come from the image, so an e_shstrndx of
65535 reads about 4 MB past the buffer.
The commit 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read
past the ELF header") added the same check to the MDT loader, and says
the header "is sanitized beforehand" under remoteproc. That is what this
patch makes true.
Check e_shoff against the image size first, so the two bounds can use
size_add() without an e_shoff above SIZE_MAX wrapping on 32-bit. The
bounds are separate because e_shnum may be zero while find_table() still
reads the e_shstrndx header.
Fixes: 400e64df6b23 ("remoteproc: add framework for controlling remote processors")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260724025322.2341205-1-sammiee5311@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_elf_loader.c | 23 ++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_elf_loader.c b/drivers/remoteproc/remoteproc_elf_loader.c
index 94177e4160473..da3cddbe7d4cb 100644
--- a/drivers/remoteproc/remoteproc_elf_loader.c
+++ b/drivers/remoteproc/remoteproc_elf_loader.c
@@ -46,8 +46,9 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
struct elf32_hdr *ehdr;
u32 elf_shdr_get_size;
u64 phoff, shoff;
+ size_t shend;
char class;
- u16 phnum;
+ u16 phnum, shnum, shstrndx;
if (!fw) {
dev_err(dev, "failed to load %s\n", name);
@@ -90,9 +91,27 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
phoff = elf_hdr_get_e_phoff(class, fw->data);
shoff = elf_hdr_get_e_shoff(class, fw->data);
phnum = elf_hdr_get_e_phnum(class, fw->data);
+ shnum = elf_hdr_get_e_shnum(class, fw->data);
+ shstrndx = elf_hdr_get_e_shstrndx(class, fw->data);
elf_shdr_get_size = elf_size_of_shdr(class);
- if (fw->size < shoff + elf_shdr_get_size) {
+ /* keeps shoff in size_t range for the two bounds below */
+ if (shoff > fw->size) {
+ dev_err(dev, "Section header table is out of bounds\n");
+ return -EINVAL;
+ }
+
+ if (shnum) {
+ shend = size_add(size_mul(elf_shdr_get_size, shnum), shoff);
+ if (shend > fw->size) {
+ dev_err(dev, "Section headers are out of bounds\n");
+ return -EINVAL;
+ }
+ }
+
+ /* find_table() reads the header at shstrndx even with no sections */
+ shend = size_add(size_mul(elf_shdr_get_size, (size_t)shstrndx + 1), shoff);
+ if (shend > fw->size) {
dev_err(dev, "Image is too small\n");
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 045/869] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 044/869] remoteproc: elf_loader: Bound the section header table Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 046/869] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around Greg Kroah-Hartman
` (831 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit 0231382f070df26a8b267f9e68c5440928b87c89 ]
serial_protocol is declared as __le16 in struct se_fw_hdr, but was
decoded with le32_to_cpu(). On big-endian systems the extra byte swap
causes the field to always compare unequal to the protocol argument,
so no firmware segment is ever selected.
Use le16_to_cpu() to match the field width.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-1-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 2fa6a45904e97..53e53736766fc 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1059,7 +1059,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
continue;
- if (le32_to_cpu(sefw->serial_protocol) != protocol)
+ if (le16_to_cpu(sefw->serial_protocol) != protocol)
continue;
if (fw_size % 2 != 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 046/869] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 045/869] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 047/869] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Greg Kroah-Hartman
` (830 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit e976c865bf31b562ab3908f0f1e2160da77fa156 ]
fw_size is read from the 16-bit fw_size_in_items field and incremented
when the count is odd. If fw_size_in_items == 0xffff the increment
wraps to 0 as a u16, making the bounds check below pass for a firmware
segment whose actual size was not validated. Widen fw_size to u32 so
the increment never wraps.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-2-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 53e53736766fc..f73ac13e90014 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1009,7 +1009,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
struct se_fw_hdr *sefw;
u32 fw_end, cfg_idx_end, cfg_val_end;
u32 prog_ram_depth;
- u16 fw_size;
+ u32 fw_size;
int i;
if (!fw || fw->size < sizeof(struct elf32_hdr))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 047/869] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 046/869] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 048/869] soc: qcom: geni-se: Fix write to read-only firmware buffer Greg Kroah-Hartman
` (829 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit d1750c530e9b9b75c8d1b29d3c76e052a049f51f ]
fw_end was computed from the raw fw_size_in_items, before the odd-word
round-up. A segment with an odd word count could pass the bounds check
at the unrounded value but then be copied one word past the validated
limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after
the round-up so they always reflect the true copy extent.
The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the
memcpy_toio() length, bypassing the validated and rounded value
established by geni_find_protocol_fw(). Add a fw_size_out output
parameter and use it in the caller.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-3-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index f73ac13e90014..917f43192e950 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -991,6 +991,8 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
* @se: Pointer to the serial engine structure.
* @fw: Pointer to the firmware image.
* @protocol: Expected serial engine protocol type.
+ * @fw_size_out: Non-NULL output parameter; receives the rounded, validated
+ * firmware word count on success.
*
* Identifies the appropriate firmware image or configuration required for a
* specific communication protocol instance running on a Qualcomm GENI
@@ -1000,7 +1002,8 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
* Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
*/
static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
- enum geni_se_protocol_type protocol)
+ enum geni_se_protocol_type protocol,
+ u32 *fw_size_out)
{
struct device *dev = se->dev;
const struct elf32_hdr *ehdr;
@@ -1050,11 +1053,6 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
fw_size = le16_to_cpu(sefw->fw_size_in_items);
- fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
- cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
- le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
- cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
- le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
continue;
@@ -1067,6 +1065,12 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
sefw->fw_size_in_items = cpu_to_le16(fw_size);
}
+ fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
+ cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
+ le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
+ cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
+ le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
+
prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK,
readl_relaxed(se->base + SE_HW_PARAM_2));
if (fw_size >= prog_ram_depth) {
@@ -1081,6 +1085,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
continue;
}
+ *fw_size_out = fw_size;
return sefw;
}
@@ -1191,11 +1196,11 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
{
const u32 *fw_data, *cfg_val_arr;
const u8 *cfg_idx_arr;
- u32 i, reg_value;
+ u32 i, reg_value, fw_size_in_items;
int ret;
struct se_fw_hdr *hdr;
- hdr = geni_find_protocol_fw(se, fw, protocol);
+ hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
if (!hdr)
return -EINVAL;
@@ -1272,7 +1277,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
/* Program RAM address space. */
memcpy_toio(se->base + SE_GENI_CFG_RAMN, fw_data,
- le16_to_cpu(hdr->fw_size_in_items) * sizeof(u32));
+ fw_size_in_items * sizeof(u32));
/* Put default values on GENI's output pads. */
writel_relaxed(0x1, se->base + GENI_FORCE_DEFAULT_REG);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 048/869] soc: qcom: geni-se: Fix write to read-only firmware buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 047/869] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 049/869] microblaze: reserve the ABI argument-home area in the signal frame Greg Kroah-Hartman
` (828 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit 28b9c15f1829fff7b26db0dbbbde1c6b466cb156 ]
geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
pointer and writes back the rounded-up fw_size value:
sefw->fw_size_in_items = cpu_to_le16(fw_size);
The firmware subsystem maps the firmware blob read-only. Writing through
the cast pointer causes a level-3 permission fault on AArch64 and
crashes the kernel during driver probe.
The write-back is no longer necessary: geni_find_protocol_fw() now
propagates the rounded size to the caller via fw_size_out. Remove the
write-back and make sefw (and the hdr pointer in the caller)
const-correct.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-4-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 917f43192e950..f85cac34c7260 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -999,17 +999,17 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
* controller. Validates the firmware size against the hardware PROG_RAM_DEPTH
* read from SE_HW_PARAM_2.
*
- * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
+ * Return: pointer to a valid 'const struct se_fw_hdr' if found, or NULL otherwise.
*/
-static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
- enum geni_se_protocol_type protocol,
- u32 *fw_size_out)
+static const struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
+ enum geni_se_protocol_type protocol,
+ u32 *fw_size_out)
{
struct device *dev = se->dev;
const struct elf32_hdr *ehdr;
const struct elf32_phdr *phdrs;
const struct elf32_phdr *phdr;
- struct se_fw_hdr *sefw;
+ const struct se_fw_hdr *sefw;
u32 fw_end, cfg_idx_end, cfg_val_end;
u32 prog_ram_depth;
u32 fw_size;
@@ -1051,7 +1051,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (phdr->p_filesz < sizeof(struct se_fw_hdr))
continue;
- sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
+ sefw = (const struct se_fw_hdr *)(fw->data + phdr->p_offset);
fw_size = le16_to_cpu(sefw->fw_size_in_items);
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
@@ -1060,10 +1060,8 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (le16_to_cpu(sefw->serial_protocol) != protocol)
continue;
- if (fw_size % 2 != 0) {
+ if (fw_size % 2 != 0)
fw_size++;
- sefw->fw_size_in_items = cpu_to_le16(fw_size);
- }
fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
@@ -1198,15 +1196,15 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
const u8 *cfg_idx_arr;
u32 i, reg_value, fw_size_in_items;
int ret;
- struct se_fw_hdr *hdr;
+ const struct se_fw_hdr *hdr;
hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
if (!hdr)
return -EINVAL;
- fw_data = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->fw_offset));
+ fw_data = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->fw_offset));
cfg_idx_arr = (const u8 *)hdr + le16_to_cpu(hdr->cfg_idx_offset);
- cfg_val_arr = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
+ cfg_val_arr = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
ret = geni_icc_set_bw(se);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 049/869] microblaze: reserve the ABI argument-home area in the signal frame
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 048/869] soc: qcom: geni-se: Fix write to read-only firmware buffer Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 050/869] microblaze: dont clobber r3/r4 restored by rt_sigreturn Greg Kroah-Hartman
` (827 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit c5947d28c20955de897eeb98430f96db0494f7d7 ]
The MicroBlaze procedure call standard reserves [r1+0] for the return
address and lets a callee store its incoming register arguments r5..r10
into the caller-provided home slots at [r1+4]..[r1+24]. When the kernel
enters a signal handler it sets r1 to point at struct rt_sigframe, whose
leading member is the siginfo prepared for the handler. A handler that
homes its arguments - which an unoptimised (-O0) build always does -
therefore overwrites the first 24 bytes of that siginfo, so an
SA_SIGINFO handler reads corrupted values. The stores stay within
siginfo (128 bytes) and do not reach the ucontext behind it.
Reserve the home area by making a seven-word gap -- the return-address
slot plus the six argument slots, 28 bytes -- the first member of struct
rt_sigframe, so the handler's argument stores land in scratch space
instead of clobbering siginfo.
Tested on qemu-system-microblazeel (petalogix-s3adsp1800) with the
uClibc-ng NPTL test suite: tst-timer4, tst-timer5, tst-mqueue5 and
tst-signal6 pass; before this change they failed because the handler
clobbered the signal frame.
Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-3-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/signal.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index c78a0ff480660..4956014a99379 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -49,6 +49,14 @@ struct sigframe {
};
struct rt_sigframe {
+ /*
+ * Home area for the handler's register arguments: the MicroBlaze
+ * ABI reserves [r1+0] for the return address and lets the callee
+ * store r5..r10 at [r1+4]..[r1+24], and r1 points at this frame
+ * when the handler is entered. Without the gap those stores
+ * corrupt frame->info.
+ */
+ unsigned long abi_gap[7];
struct siginfo info;
struct ucontext uc;
unsigned long tramp[2]; /* signal trampoline */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 050/869] microblaze: dont clobber r3/r4 restored by rt_sigreturn
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 049/869] microblaze: reserve the ABI argument-home area in the signal frame Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 051/869] microblaze: restore the ABI argument home area below pt_regs (PTO) Greg Kroah-Hartman
` (826 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit da6829138a39fa3b9ec318ca54ff89af9d94d350 ]
ret_from_trap begins by storing the system call return values r3 and r4
back into the saved user pt_regs. That is right for an ordinary system
call, but sys_rt_sigreturn() returns through the same path and has to be
transparent: restore_sigcontext() has just filled pt_regs from the signal
frame, and every register must reach userspace exactly as saved. The two
stores overwrite the restored r3/r4 with whatever the C function left in
those registers.
Only r4 is actually lost, and that follows from how sigreturn is written
everywhere rather than from chance. Architectures have sys_rt_sigreturn()
return the restored return-value register precisely so that this writeback
stores the restored value -- arm returns regs->ARM_r0, riscv and csky
regs->a0, arc regs->r0 -- and microblaze does the same through
*rval_p = regs->r3 in restore_sigcontext(). But the entry macros treat r3
and r4 as a pair, so ret_from_trap writes back two registers while a C
function has only one return value; nothing carries the restored r4.
Commit 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper") introduced
this in v2.6.37. The old wrapper saved r3/r4 before the call and reloaded
them from pt_regs afterwards; switching brlid to brid removed the only
point where they were reloaded, and the stores have been overwriting them
ever since.
Fix it the way the sibling paths already behave: ret_from_irq and
ret_from_exc restore the full register set and do not perform these stores
at all. Label the instruction after the stores ret_from_trap_no_rval and
enter there, biasing r15 by -8 so that the ABI return "rtsd r15, 8" lands
on it; naming the entry rather than computing ret_from_trap + 8 keeps it
correct if the number of stores ever changes. Restoring the old
save/reload would work too, but costs four memory accesses and a branch to
undo damage that is better not done.
Any value the compiler keeps in r4 across a signal is lost. The tightest
windows are the lwx/swx compare-and-swap retry loops gcc emits for atomics:
in uClibc-ng's libc.so alone, 50 of 364 such loops hold the address in r4.
This is not specific to one libc -- musl passes the address as "r"(p), and
glibc has no microblaze atomic-machine.h and so uses gcc's __atomic
builtins, which expand the same way. Triggering it needs threads plus a
signal storm, which is why it survived 15 years.
Reproduced on qemu-system-microblazeel (petalogix-s3adsp1800) by running
the uClibc-ng NPTL test tst-eintr1 40 times against an unchanged userspace:
on v7.2 built with gcc 16.2.0, 23 of 40 iterations died with SIGSEGV
without this patch and 0 of 40 with it; on v7.0 built with gcc 12.5.0 the
same comparison gave 6 of 40 against 0 of 40. The register dump of a
failing iteration shows the signature: a zero r4 and a fault at address 0,
while r3 came back intact.
Fixes: 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-4-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/entry.S | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index ad44341a5dbc7..efa4ab056fb5f 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -434,7 +434,13 @@ C_ENTRY(_user_exception):
C_ENTRY(ret_from_trap):
swi r3, r1, PT_R3
swi r4, r1, PT_R4
-
+/*
+ * Entry point for returns that must not store r3/r4 back into pt_regs,
+ * i.e. rt_sigreturn, which has already restored them from the signal
+ * context. Reached as "rtsd r15, 8" with r15 set to this label minus 8,
+ * so it stays correct if the number of stores above ever changes.
+ */
+ret_from_trap_no_rval:
lwi r11, r1, PT_MODE;
/* See if returning to kernel mode, if so, skip resched &c. */
bnei r11, 2f;
@@ -518,6 +524,15 @@ C_ENTRY(ret_from_kernel_thread):
C_ENTRY(sys_rt_sigreturn_wrapper):
addik r30, r0, 0 /* no restarts */
+ /*
+ * rt_sigreturn restores the full register set from the signal
+ * context, so it must skip the r3/r4 syscall-return stores at the
+ * head of ret_from_trap which would otherwise overwrite the
+ * just-restored r3/r4. Every C function returns with "rtsd r15, 8"
+ * -- the ABI return, where the 8 skips the caller's branch and its
+ * delay slot -- so bias r15 by -8 to land on ret_from_trap_no_rval.
+ */
+ addik r15, r0, ret_from_trap_no_rval - 8
brid sys_rt_sigreturn /* Do real work */
addik r5, r1, 0; /* add user context as 1st arg */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 051/869] microblaze: restore the ABI argument home area below pt_regs (PTO)
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 050/869] microblaze: dont clobber r3/r4 restored by rt_sigreturn Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 052/869] microblaze: preserve the MSR carry flags across signals Greg Kroah-Hartman
` (825 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit c35d40a3efd2e575ef51a761e983f2bf7113be6c ]
The MicroBlaze ABI has the caller reserve stack space for the arguments
it passes in registers: REG_PARM_STACK_SPACE is 24 and
OUTGOING_REG_PARM_STACK_SPACE is 1 in the gcc backend, so a callee may
write to [caller_sp + 4, caller_sp + 28). The kernel calls C functions
from entry.S with r1 pointing at pt_regs, handing the callee license to
spill its incoming arguments over the saved registers -- the syscall
dispatch is the worst case, where the first argument slot is PT_R1, the
saved user stack pointer.
This was latent until GCC 15: since 3b9b8d6cfdf5 ("ira: Scale
save/restore costs of callee save registers with block frequency") the
allocator prefers spilling incoming arguments over copying them into
callee-saved registers, and a kernel built with gcc >= 15 (without the
TARGET_CALLEE_SAVE_COST workaround some distributions carry) corrupts
PT_R1 on the first syscall: init takes SIGSEGV and the kernel panics.
The kernel had exactly this reservation until 2011:
commit 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
removed STATE_SAVE_ARG_SPACE and with it the PTO offset, as part of
cleaning up what was thought to be copied-from-v850 leftovers. Restore
it: the frame is STATE_SAVE_SIZE = PT_SIZE + PTO, r1 stays at the frame
base through every asm-to-C call, and the saved registers are reached
at r1 + PTO + PT_*. PTO is 28 rather than the historic 24, which was
one word short: FIRST_PARM_OFFSET is 4 and REG_PARM_STACK_SPACE is 24,
so the area spans [sp+4, sp+28) and needs 28 bytes. With 24 the last
argument slot overlapped pt_regs' r0 -- harmless only because r0 is the
constant-zero register. STACK_BOUNDARY is 32 bits, so 28 needs no
further rounding.
Two places deliberately keep their mainline addressing.
hw_exception_handler.S needs no offset change: its real-mode handler
saves into the standalone pt_pool_space buffer rather than a stack
frame, and _unaligned_data_exception works through a pointer to pt_regs
in r7, where plain PT_* offsets are already right. And the user-SP
reload after popping the frame keeps PT_R1 - PT_SIZE because PTO
cancels there: (PTO + PT_R1) - (PT_SIZE + PTO) = PT_R1 - PT_SIZE. Both
are exactly as the pre-2011 code had them.
The instruction count is unchanged -- the same instructions with
different immediates, no per-call reservation and no trampolines. The
cost is 28 bytes more kernel stack per saved frame.
Fixes: 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-5-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/include/asm/entry.h | 13 +
arch/microblaze/include/asm/processor.h | 2 +-
arch/microblaze/kernel/entry.S | 329 +++++++++---------
arch/microblaze/kernel/hw_exception_handler.S | 5 +
arch/microblaze/kernel/process.c | 5 +-
5 files changed, 189 insertions(+), 165 deletions(-)
diff --git a/arch/microblaze/include/asm/entry.h b/arch/microblaze/include/asm/entry.h
index 9efadf12397ca..05acf4d7bc4b1 100644
--- a/arch/microblaze/include/asm/entry.h
+++ b/arch/microblaze/include/asm/entry.h
@@ -21,6 +21,19 @@
#define PER_CPU(var) var
+/*
+ * The MicroBlaze ABI has the caller reserve an argument home area:
+ * REG_PARM_STACK_SPACE is 24 and OUTGOING_REG_PARM_STACK_SPACE is 1, so a
+ * callee may write to [caller_sp + 4, caller_sp + 28). The kernel calls C
+ * with r1 at the frame base, so reserve that area below pt_regs and reach
+ * the saved registers through PTO. This restores what 6e83557c38b4
+ * ("microblaze: Remove r0_ram pointer and PTO alignment") removed; the old
+ * value of 24 was one word short and left the last argument slot
+ * overlapping pt_regs' r0.
+ */
+#define PTO 28
+#define STATE_SAVE_SIZE (PT_SIZE + PTO)
+
# ifndef __ASSEMBLER__
DECLARE_PER_CPU(unsigned int, KSP); /* Saved kernel stack pointer */
DECLARE_PER_CPU(unsigned int, KM); /* Kernel/user mode */
diff --git a/arch/microblaze/include/asm/processor.h b/arch/microblaze/include/asm/processor.h
index d59bdfffca7cc..595c24db27283 100644
--- a/arch/microblaze/include/asm/processor.h
+++ b/arch/microblaze/include/asm/processor.h
@@ -73,7 +73,7 @@ unsigned long __get_wchan(struct task_struct *p);
# define task_regs(task) ((struct pt_regs *)task_tos(task) - 1)
# define task_pt_regs_plus_args(tsk) \
- ((void *)task_pt_regs(tsk))
+ (((void *)task_pt_regs(tsk)) - PTO)
# define task_sp(task) (task_regs(task)->r1)
# define task_pc(task) (task_regs(task)->pc)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index efa4ab056fb5f..ebc8bcb98c522 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -177,78 +177,78 @@ syscall_debug_table:
1:
#define SAVE_REGS \
- swi r2, r1, PT_R2; /* Save SDA */ \
- swi r3, r1, PT_R3; \
- swi r4, r1, PT_R4; \
- swi r5, r1, PT_R5; \
- swi r6, r1, PT_R6; \
- swi r7, r1, PT_R7; \
- swi r8, r1, PT_R8; \
- swi r9, r1, PT_R9; \
- swi r10, r1, PT_R10; \
- swi r11, r1, PT_R11; /* save clobbered regs after rval */\
- swi r12, r1, PT_R12; \
- swi r13, r1, PT_R13; /* Save SDA2 */ \
- swi r14, r1, PT_PC; /* PC, before IRQ/trap */ \
- swi r15, r1, PT_R15; /* Save LP */ \
- swi r16, r1, PT_R16; \
- swi r17, r1, PT_R17; \
- swi r18, r1, PT_R18; /* Save asm scratch reg */ \
- swi r19, r1, PT_R19; \
- swi r20, r1, PT_R20; \
- swi r21, r1, PT_R21; \
- swi r22, r1, PT_R22; \
- swi r23, r1, PT_R23; \
- swi r24, r1, PT_R24; \
- swi r25, r1, PT_R25; \
- swi r26, r1, PT_R26; \
- swi r27, r1, PT_R27; \
- swi r28, r1, PT_R28; \
- swi r29, r1, PT_R29; \
- swi r30, r1, PT_R30; \
- swi r31, r1, PT_R31; /* Save current task reg */ \
+ swi r2, r1, PTO+PT_R2; /* Save SDA */ \
+ swi r3, r1, PTO+PT_R3; \
+ swi r4, r1, PTO+PT_R4; \
+ swi r5, r1, PTO+PT_R5; \
+ swi r6, r1, PTO+PT_R6; \
+ swi r7, r1, PTO+PT_R7; \
+ swi r8, r1, PTO+PT_R8; \
+ swi r9, r1, PTO+PT_R9; \
+ swi r10, r1, PTO+PT_R10; \
+ swi r11, r1, PTO+PT_R11; /* save clobbered regs after rval */\
+ swi r12, r1, PTO+PT_R12; \
+ swi r13, r1, PTO+PT_R13; /* Save SDA2 */ \
+ swi r14, r1, PTO+PT_PC; /* PC, before IRQ/trap */ \
+ swi r15, r1, PTO+PT_R15; /* Save LP */ \
+ swi r16, r1, PTO+PT_R16; \
+ swi r17, r1, PTO+PT_R17; \
+ swi r18, r1, PTO+PT_R18; /* Save asm scratch reg */ \
+ swi r19, r1, PTO+PT_R19; \
+ swi r20, r1, PTO+PT_R20; \
+ swi r21, r1, PTO+PT_R21; \
+ swi r22, r1, PTO+PT_R22; \
+ swi r23, r1, PTO+PT_R23; \
+ swi r24, r1, PTO+PT_R24; \
+ swi r25, r1, PTO+PT_R25; \
+ swi r26, r1, PTO+PT_R26; \
+ swi r27, r1, PTO+PT_R27; \
+ swi r28, r1, PTO+PT_R28; \
+ swi r29, r1, PTO+PT_R29; \
+ swi r30, r1, PTO+PT_R30; \
+ swi r31, r1, PTO+PT_R31; /* Save current task reg */ \
mfs r11, rmsr; /* save MSR */ \
- swi r11, r1, PT_MSR;
+ swi r11, r1, PTO+PT_MSR;
#define RESTORE_REGS_GP \
- lwi r2, r1, PT_R2; /* restore SDA */ \
- lwi r3, r1, PT_R3; \
- lwi r4, r1, PT_R4; \
- lwi r5, r1, PT_R5; \
- lwi r6, r1, PT_R6; \
- lwi r7, r1, PT_R7; \
- lwi r8, r1, PT_R8; \
- lwi r9, r1, PT_R9; \
- lwi r10, r1, PT_R10; \
- lwi r11, r1, PT_R11; /* restore clobbered regs after rval */\
- lwi r12, r1, PT_R12; \
- lwi r13, r1, PT_R13; /* restore SDA2 */ \
- lwi r14, r1, PT_PC; /* RESTORE_LINK PC, before IRQ/trap */\
- lwi r15, r1, PT_R15; /* restore LP */ \
- lwi r16, r1, PT_R16; \
- lwi r17, r1, PT_R17; \
- lwi r18, r1, PT_R18; /* restore asm scratch reg */ \
- lwi r19, r1, PT_R19; \
- lwi r20, r1, PT_R20; \
- lwi r21, r1, PT_R21; \
- lwi r22, r1, PT_R22; \
- lwi r23, r1, PT_R23; \
- lwi r24, r1, PT_R24; \
- lwi r25, r1, PT_R25; \
- lwi r26, r1, PT_R26; \
- lwi r27, r1, PT_R27; \
- lwi r28, r1, PT_R28; \
- lwi r29, r1, PT_R29; \
- lwi r30, r1, PT_R30; \
- lwi r31, r1, PT_R31; /* Restore cur task reg */
+ lwi r2, r1, PTO+PT_R2; /* restore SDA */ \
+ lwi r3, r1, PTO+PT_R3; \
+ lwi r4, r1, PTO+PT_R4; \
+ lwi r5, r1, PTO+PT_R5; \
+ lwi r6, r1, PTO+PT_R6; \
+ lwi r7, r1, PTO+PT_R7; \
+ lwi r8, r1, PTO+PT_R8; \
+ lwi r9, r1, PTO+PT_R9; \
+ lwi r10, r1, PTO+PT_R10; \
+ lwi r11, r1, PTO+PT_R11; /* restore clobbered regs after rval */\
+ lwi r12, r1, PTO+PT_R12; \
+ lwi r13, r1, PTO+PT_R13; /* restore SDA2 */ \
+ lwi r14, r1, PTO+PT_PC; /* RESTORE_LINK PC, before IRQ/trap */\
+ lwi r15, r1, PTO+PT_R15; /* restore LP */ \
+ lwi r16, r1, PTO+PT_R16; \
+ lwi r17, r1, PTO+PT_R17; \
+ lwi r18, r1, PTO+PT_R18; /* restore asm scratch reg */ \
+ lwi r19, r1, PTO+PT_R19; \
+ lwi r20, r1, PTO+PT_R20; \
+ lwi r21, r1, PTO+PT_R21; \
+ lwi r22, r1, PTO+PT_R22; \
+ lwi r23, r1, PTO+PT_R23; \
+ lwi r24, r1, PTO+PT_R24; \
+ lwi r25, r1, PTO+PT_R25; \
+ lwi r26, r1, PTO+PT_R26; \
+ lwi r27, r1, PTO+PT_R27; \
+ lwi r28, r1, PTO+PT_R28; \
+ lwi r29, r1, PTO+PT_R29; \
+ lwi r30, r1, PTO+PT_R30; \
+ lwi r31, r1, PTO+PT_R31; /* Restore cur task reg */
#define RESTORE_REGS \
- lwi r11, r1, PT_MSR; \
+ lwi r11, r1, PTO+PT_MSR; \
mts rmsr , r11; \
RESTORE_REGS_GP
#define RESTORE_REGS_RTBD \
- lwi r11, r1, PT_MSR; \
+ lwi r11, r1, PTO+PT_MSR; \
andni r11, r11, MSR_EIP; /* clear EIP */ \
ori r11, r11, MSR_EE | MSR_BIP; /* set EE and BIP */ \
mts rmsr , r11; \
@@ -265,11 +265,11 @@ syscall_debug_table:
lwi r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); \
/* FIXME: I can add these two lines to one */ \
/* tophys(r1,r1); */ \
- /* addik r1, r1, -PT_SIZE; */ \
- addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+ /* addik r1, r1, -STATE_SAVE_SIZE; */ \
+ addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE; \
SAVE_REGS \
brid 2f; \
- swi r1, r1, PT_MODE; \
+ swi r1, r1, PTO+PT_MODE; \
1: /* User-mode state save. */ \
lwi r1, r0, TOPHYS(PER_CPU(CURRENT_SAVE)); /* get saved current */\
tophys(r1,r1); \
@@ -277,12 +277,13 @@ syscall_debug_table:
/* MS these three instructions can be added to one */ \
/* addik r1, r1, THREAD_SIZE; */ \
/* tophys(r1,r1); */ \
- /* addik r1, r1, -PT_SIZE; */ \
- addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+ /* addik r1, r1, -STATE_SAVE_SIZE; */ \
+ addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR \
+ - CONFIG_KERNEL_START - STATE_SAVE_SIZE; \
SAVE_REGS \
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP)); \
- swi r11, r1, PT_R1; /* Store user SP. */ \
- swi r0, r1, PT_MODE; /* Was in user-mode. */ \
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */ \
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */ \
/* MS: I am clearing UMS even in case when I come from kernel space */ \
clear_ums; \
2: lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
@@ -292,7 +293,7 @@ syscall_debug_table:
.extern cpuinfo
C_ENTRY(mb_flush_dcache):
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
addik r3, r0, cpuinfo
@@ -305,12 +306,12 @@ C_ENTRY(mb_flush_dcache):
addk r9, r9, r8
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8
nop
C_ENTRY(mb_invalidate_icache):
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
addik r3, r0, cpuinfo
@@ -323,7 +324,7 @@ C_ENTRY(mb_invalidate_icache):
addk r9, r9, r8
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8
nop
@@ -350,18 +351,18 @@ C_ENTRY(_user_exception):
addik r1, r1, THREAD_SIZE;
tophys(r1,r1);
- addik r1, r1, -PT_SIZE; /* Make room on the stack. */
+ addik r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack. */
SAVE_REGS
- swi r0, r1, PT_R3
- swi r0, r1, PT_R4
+ swi r0, r1, PTO+PT_R3
+ swi r0, r1, PTO+PT_R4
- swi r0, r1, PT_MODE; /* Was in user-mode. */
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1; /* Store user SP. */
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */
clear_ums;
2: lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
/* Save away the syscall number. */
- swi r12, r1, PT_R0;
+ swi r12, r1, PTO+PT_R0;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8*/
@@ -380,18 +381,18 @@ C_ENTRY(_user_exception):
beqi r11, 4f
addik r3, r0, -ENOSYS
- swi r3, r1, PT_R3
+ swi r3, r1, PTO+PT_R3
brlid r15, do_syscall_trace_enter
- addik r5, r1, PT_R0
+ addik r5, r1, PTO+PT_R0
# do_syscall_trace_enter returns the new syscall nr.
addk r12, r0, r3
- lwi r5, r1, PT_R5;
- lwi r6, r1, PT_R6;
- lwi r7, r1, PT_R7;
- lwi r8, r1, PT_R8;
- lwi r9, r1, PT_R9;
- lwi r10, r1, PT_R10;
+ lwi r5, r1, PTO+PT_R5;
+ lwi r6, r1, PTO+PT_R6;
+ lwi r7, r1, PTO+PT_R7;
+ lwi r8, r1, PTO+PT_R8;
+ lwi r9, r1, PTO+PT_R9;
+ lwi r10, r1, PTO+PT_R10;
4:
/* Jump to the appropriate function for the system call number in r12
* (r12 is not preserved), or return an error if r12 is not valid.
@@ -432,8 +433,8 @@ C_ENTRY(_user_exception):
/* Entry point used to return from a syscall/trap */
/* We re-enable BIP bit before state restore */
C_ENTRY(ret_from_trap):
- swi r3, r1, PT_R3
- swi r4, r1, PT_R4
+ swi r3, r1, PTO+PT_R3
+ swi r4, r1, PTO+PT_R4
/*
* Entry point for returns that must not store r3/r4 back into pt_regs,
* i.e. rt_sigreturn, which has already restored them from the signal
@@ -441,7 +442,7 @@ C_ENTRY(ret_from_trap):
* so it stays correct if the number of stores above ever changes.
*/
ret_from_trap_no_rval:
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
/* See if returning to kernel mode, if so, skip resched &c. */
bnei r11, 2f;
/* We're returning to user mode, so check for various conditions that
@@ -453,7 +454,7 @@ ret_from_trap_no_rval:
beqi r11, 1f
brlid r15, do_syscall_trace_leave
- addik r5, r1, PT_R0
+ addik r5, r1, PTO+PT_R0
1:
/* We're returning to user mode, so check for various conditions that
* trigger rescheduling. */
@@ -472,7 +473,7 @@ ret_from_trap_no_rval:
andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqi r11, 4f; /* Signals to handle, handle them */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
add r6, r30, r0; /* Arg 2: int in_syscall */
add r30, r0, r0 /* no more restarts */
@@ -484,7 +485,11 @@ ret_from_trap_no_rval:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
+ /*
+ * Deliberately PT_SIZE, not STATE_SAVE_SIZE: r1 is back at the stack
+ * top, so PTO cancels and the saved SP sits at PT_R1 - PT_SIZE.
+ */
lwi r1, r1, PT_R1 - PT_SIZE;/* Restore user stack pointer. */
bri 6f;
@@ -493,7 +498,7 @@ ret_from_trap_no_rval:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
tovirt(r1,r1);
6:
TRAP_return: /* Make global symbol for debugging */
@@ -534,7 +539,7 @@ C_ENTRY(sys_rt_sigreturn_wrapper):
*/
addik r15, r0, ret_from_trap_no_rval - 8
brid sys_rt_sigreturn /* Do real work */
- addik r5, r1, 0; /* add user context as 1st arg */
+ addik r5, r1, PTO; /* add user context as 1st arg */
/*
* HW EXCEPTION rutine start
@@ -545,7 +550,7 @@ C_ENTRY(full_exception_trap):
addik r17, r17, -4
SAVE_STATE /* Save registers */
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* FIXME this can be store directly in PT_ESR reg.
* I tested it but there is a fault */
@@ -555,7 +560,7 @@ C_ENTRY(full_exception_trap):
mfs r7, rfsr; /* save FSR */
mts rfsr, r0; /* Clear sticky fsr */
rted r0, full_exception
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
/*
* Unaligned data trap.
@@ -581,14 +586,14 @@ C_ENTRY(unaligned_data_trap):
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r3, resr /* ESR */
mfs r4, rear /* EAR */
rtbd r0, _unaligned_data_exception
- addik r7, r1, 0 /* parameter struct pt_regs * regs */
+ addik r7, r1, PTO /* parameter struct pt_regs * regs */
/*
* Page fault traps.
@@ -611,30 +616,30 @@ C_ENTRY(unaligned_data_trap):
C_ENTRY(page_fault_data_trap):
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r6, rear /* parameter unsigned long address */
mfs r7, resr /* parameter unsigned long error_code */
rted r0, do_page_fault
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
C_ENTRY(page_fault_instr_trap):
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r6, rear /* parameter unsigned long address */
ori r7, r0, 0 /* parameter unsigned long error_code */
rted r0, do_page_fault
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
/* Entry point used to return from an exception. */
C_ENTRY(ret_from_exc):
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f; /* See if returning to kernel mode, */
/* ... if so, skip resched &c. */
@@ -666,7 +671,7 @@ C_ENTRY(ret_from_exc):
* complete register state. Here we save anything not saved by
* the normal entry sequence, so that it may be safely restored
* (in a possibly modified form) after do_notify_resume returns. */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -678,7 +683,7 @@ C_ENTRY(ret_from_exc):
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
lwi r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer. */
bri 6f;
@@ -687,7 +692,7 @@ C_ENTRY(ret_from_exc):
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
tovirt(r1,r1);
6:
@@ -720,10 +725,10 @@ C_ENTRY(_interrupt):
tophys(r1,r1); /* MS: I have in r1 physical address where stack is */
/* save registers */
/* MS: Make room on the stack -> activation record */
- addik r1, r1, -PT_SIZE;
+ addik r1, r1, -STATE_SAVE_SIZE;
SAVE_REGS
brid 2f;
- swi r1, r1, PT_MODE; /* 0 - user mode, 1 - kernel mode */
+ swi r1, r1, PTO+PT_MODE; /* 0 - user mode, 1 - kernel mode */
1:
/* User-mode state save. */
/* MS: get the saved current */
@@ -733,23 +738,23 @@ C_ENTRY(_interrupt):
addik r1, r1, THREAD_SIZE;
tophys(r1,r1);
/* save registers */
- addik r1, r1, -PT_SIZE;
+ addik r1, r1, -STATE_SAVE_SIZE;
SAVE_REGS
/* calculate mode */
- swi r0, r1, PT_MODE;
+ swi r0, r1, PTO+PT_MODE;
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1;
+ swi r11, r1, PTO+PT_R1;
clear_ums;
2:
lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
tovirt(r1,r1)
addik r15, r0, irq_call;
irq_call:rtbd r0, do_IRQ;
- addik r5, r1, 0;
+ addik r5, r1, PTO;
/* MS: we are in virtual mode */
ret_from_irq:
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f;
1:
@@ -765,7 +770,7 @@ ret_from_irq:
5: andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqid r11, no_intr_resched
/* Handle a signal return; Pending signals should be in r18. */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -778,7 +783,7 @@ no_intr_resched:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS
- addik r1, r1, PT_SIZE /* MS: Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* MS: Clean up stack space. */
lwi r1, r1, PT_R1 - PT_SIZE;
bri 6f;
/* MS: Return to kernel state. */
@@ -801,7 +806,7 @@ restore:
VM_OFF /* MS: turn off MMU */
tophys(r1,r1)
RESTORE_REGS
- addik r1, r1, PT_SIZE /* MS: Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* MS: Clean up stack space. */
tovirt(r1,r1);
6:
IRQ_return: /* MS: Make global symbol for debugging */
@@ -820,29 +825,29 @@ C_ENTRY(_xtmr_manager_reset):
lwi r1, r0, xmb_manager_stackpointer
/* Restore MSR */
- lwi r2, r1, PT_MSR
+ lwi r2, r1, PTO+PT_MSR
mts rmsr, r2
bri 4
/* restore Special purpose registers */
- lwi r2, r1, PT_PID
+ lwi r2, r1, PTO+PT_PID
mts rpid, r2
- lwi r2, r1, PT_TLBI
+ lwi r2, r1, PTO+PT_TLBI
mts rtlbx, r2
- lwi r2, r1, PT_ZPR
+ lwi r2, r1, PTO+PT_ZPR
mts rzpr, r2
#if CONFIG_XILINX_MICROBLAZE0_USE_FPU
- lwi r2, r1, PT_FSR
+ lwi r2, r1, PTO+PT_FSR
mts rfsr, r2
#endif
/* restore all the tlb's */
addik r3, r0, TOPHYS(tlb_skip)
- addik r6, r0, PT_TLBL0
- addik r7, r0, PT_TLBH0
+ addik r6, r0, PTO+PT_TLBL0
+ addik r7, r0, PTO+PT_TLBH0
restore_tlb:
add r6, r6, r1
add r7, r7, r1
@@ -868,9 +873,9 @@ ret_from_reset:
VM_OFF
/* MS: Restore all regs */
RESTORE_REGS
- lwi r14, r1, PT_R14
- lwi r16, r1, PT_PC
- addik r1, r1, PT_SIZE + 36
+ lwi r14, r1, PTO+PT_R14
+ lwi r16, r1, PTO+PT_PC
+ addik r1, r1, STATE_SAVE_SIZE + 36
rtbd r16, 0
nop
@@ -885,11 +890,11 @@ C_ENTRY(_xmb_manager_break):
* Reserve memory in the stack for context store/restore
* (which includes memory for storing tlbs (max two tlbs))
*/
- addik r1, r1, -PT_SIZE - 36
+ addik r1, r1, -STATE_SAVE_SIZE - 36
swi r1, r0, xmb_manager_stackpointer
SAVE_REGS
- swi r14, r1, PT_R14 /* rewrite saved R14 value */
- swi r16, r1, PT_PC; /* PC and r16 are the same */
+ swi r14, r1, PTO+PT_R14 /* rewrite saved R14 value */
+ swi r16, r1, PTO+PT_PC; /* PC and r16 are the same */
lwi r6, r0, TOPHYS(xmb_manager_baseaddr)
lwi r7, r0, TOPHYS(xmb_manager_crval)
@@ -903,25 +908,25 @@ C_ENTRY(_xmb_manager_break):
/* Save the special purpose registers */
mfs r2, rpid
- swi r2, r1, PT_PID
+ swi r2, r1, PTO+PT_PID
mfs r2, rtlbx
- swi r2, r1, PT_TLBI
+ swi r2, r1, PTO+PT_TLBI
mfs r2, rzpr
- swi r2, r1, PT_ZPR
+ swi r2, r1, PTO+PT_ZPR
#if CONFIG_XILINX_MICROBLAZE0_USE_FPU
mfs r2, rfsr
- swi r2, r1, PT_FSR
+ swi r2, r1, PTO+PT_FSR
#endif
mfs r2, rmsr
- swi r2, r1, PT_MSR
+ swi r2, r1, PTO+PT_MSR
/* Save all the tlb's */
addik r3, r0, TOPHYS(tlb_skip)
- addik r6, r0, PT_TLBL0
- addik r7, r0, PT_TLBH0
+ addik r6, r0, PTO+PT_TLBL0
+ addik r7, r0, PTO+PT_TLBH0
save_tlb:
add r6, r6, r1
add r7, r7, r1
@@ -978,28 +983,28 @@ C_ENTRY(_debug_exception):
lwi r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); /* Reload kernel stack-ptr*/
/* BIP bit is set on entry, no interrupts can occur */
- addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE;
+ addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE;
SAVE_REGS;
/* save all regs to pt_reg structure */
- swi r0, r1, PT_R0; /* R0 must be saved too */
- swi r14, r1, PT_R14 /* rewrite saved R14 value */
- swi r16, r1, PT_PC; /* PC and r16 are the same */
+ swi r0, r1, PTO+PT_R0; /* R0 must be saved too */
+ swi r14, r1, PTO+PT_R14 /* rewrite saved R14 value */
+ swi r16, r1, PTO+PT_PC; /* PC and r16 are the same */
/* save special purpose registers to pt_regs */
mfs r11, rear;
- swi r11, r1, PT_EAR;
+ swi r11, r1, PTO+PT_EAR;
mfs r11, resr;
- swi r11, r1, PT_ESR;
+ swi r11, r1, PTO+PT_ESR;
mfs r11, rfsr;
- swi r11, r1, PT_FSR;
+ swi r11, r1, PTO+PT_FSR;
/* stack pointer is in physical address at it is decrease
- * by PT_SIZE but we need to get correct R1 value */
- addik r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + PT_SIZE;
- swi r11, r1, PT_R1
+ * by STATE_SAVE_SIZE but we need to get correct R1 value */
+ addik r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + STATE_SAVE_SIZE;
+ swi r11, r1, PTO+PT_R1
/* MS: r31 - current pointer isn't changed */
tovirt(r1,r1)
#ifdef CONFIG_KGDB
- addi r5, r1, 0 /* pass pt_reg address as the first arg */
+ addi r5, r1, PTO /* pass pt_reg address as the first arg */
addik r15, r0, dbtrap_call; /* return address */
rtbd r0, microblaze_kgdb_break
nop;
@@ -1015,16 +1020,16 @@ C_ENTRY(_debug_exception):
addik r1, r1, THREAD_SIZE; /* calculate kernel stack pointer */
tophys(r1,r1);
- addik r1, r1, -PT_SIZE; /* Make room on the stack. */
+ addik r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack. */
SAVE_REGS;
- swi r16, r1, PT_PC; /* Save LP */
- swi r0, r1, PT_MODE; /* Was in user-mode. */
+ swi r16, r1, PTO+PT_PC; /* Save LP */
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1; /* Store user SP. */
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */
lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
tovirt(r1,r1)
set_vms;
- addik r5, r1, 0;
+ addik r5, r1, PTO;
addik r15, r0, dbtrap_call;
dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
rtbd r0, sw_exception
@@ -1032,7 +1037,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
/* MS: The first instruction for the second part of the gdb/kgdb */
set_bip; /* Ints masked for state restore */
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f;
/* MS: Return to user space - gdb */
1:
@@ -1051,7 +1056,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
5: andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqi r11, 4f; /* Signals to handle, handle them */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -1062,7 +1067,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
tophys(r1,r1);
/* MS: Restore all regs */
RESTORE_REGS_RTBD
- addik r1, r1, PT_SIZE /* Clean up stack space */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space */
lwi r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer */
DBTRAP_return_user: /* MS: Make global symbol for debugging */
rtbd r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1073,9 +1078,9 @@ DBTRAP_return_user: /* MS: Make global symbol for debugging */
tophys(r1,r1);
/* MS: Restore all regs */
RESTORE_REGS_RTBD
- lwi r14, r1, PT_R14;
- lwi r16, r1, PT_PC;
- addik r1, r1, PT_SIZE; /* MS: Clean up stack space */
+ lwi r14, r1, PTO+PT_R14;
+ lwi r16, r1, PTO+PT_PC;
+ addik r1, r1, STATE_SAVE_SIZE; /* MS: Clean up stack space */
tovirt(r1,r1);
DBTRAP_return_kernel: /* MS: Make global symbol for debugging */
rtbd r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1173,7 +1178,7 @@ ENTRY(_switch_to)
.ent xmb_inject_err
.type xmb_inject_err, @function
xmb_inject_err:
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
/* Switch to real mode */
@@ -1197,7 +1202,7 @@ xmb_inject_err:
nop;
1:
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8;
nop;
.end xmb_inject_err
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 07ea23965f817..4693916be5267 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -313,6 +313,11 @@ _MB_HW_ExceptionVectorTable:
.align 4
.ent _hw_exception_handler
_hw_exception_handler:
+ /*
+ * This handler saves into the static pt_pool_space buffer, not into a
+ * stack frame, so the plain PT_* offsets are right here -- do not add
+ * the PTO of entry.S's frames.
+ */
swi r1, r0, TOPHYS(pt_pool_space + PT_R1); /* GET_SP */
/* Save date to kernel memory. Here is the problem
* when you came from user space */
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 6cbf642d7b801..090e1697ea7ae 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -19,6 +19,7 @@
#include <linux/bitops.h>
#include <linux/ptrace.h>
#include <asm/cacheflush.h>
+#include <asm/entry.h>
void show_regs(struct pt_regs *regs)
{
@@ -65,7 +66,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
* the registers. That's OK for a brand new thread.*/
memset(childregs, 0, sizeof(struct pt_regs));
memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
- ti->cpu_context.r1 = (unsigned long)childregs;
+ ti->cpu_context.r1 = (unsigned long)childregs - PTO;
ti->cpu_context.r20 = (unsigned long)args->fn;
ti->cpu_context.r19 = (unsigned long)args->fn_arg;
childregs->pt_mode = 1;
@@ -79,7 +80,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
childregs->r1 = usp;
memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
- ti->cpu_context.r1 = (unsigned long)childregs;
+ ti->cpu_context.r1 = (unsigned long)childregs - PTO;
childregs->msr |= MSR_UMS;
/* we should consider the fact that childregs is a copy of the parent
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 052/869] microblaze: preserve the MSR carry flags across signals
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 051/869] microblaze: restore the ABI argument home area below pt_regs (PTO) Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 053/869] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset Greg Kroah-Hartman
` (824 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Price, Ramin Moussavi,
Waldemar Brodkorb, Michal Simek, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Price <thesamprice@gmail.com>
[ Upstream commit ca35dd21a5f8343f47a23e4e5b3f0ffccf76a4ae ]
setup_sigcontext() and restore_sigcontext() copy r0-r31, pc, ear, esr and
fsr to and from the signal frame but never touch MSR. The interrupted
MSR is therefore dropped from the signal context entirely: the handler's
ucontext does not expose it, a handler cannot adjust the resumed
arithmetic flags through uc_mcontext.regs.msr, and -- because
restore_sigcontext() leaves regs->msr as whatever the rt_sigreturn trap
left in it -- the interrupted context resumes with the carry produced by
the syscall entry path (_user_exception does "addi r14, r14, 4", which
writes carry), not with its own.
Other architectures round-trip the user-visible flags through the signal
frame (arm's cpsr, csky's carry, x86's eflags), so a handler can both read
and adjust the resumed flags; purely privileged status registers such as
riscv's sstatus are left out. MicroBlaze should do the same for the
user-writable bits.
Concretely, MSR[C] (carry) is lost across signal delivery. Code that
keeps a live carry across a point where a signal can be delivered -- for
example an lwx/swx compare-and-swap retry loop, between the swx and the
carry test -- resumes with the handler's carry and mis-evaluates the
result; the same failure class as the rt_sigreturn r3/r4 clobber, reached
through a different register. Demonstrated under qemu-system-microblazeel
(machine petalogix-s3adsp1800): a handler that sets MSR_C in
uc_mcontext.regs.msr has no effect before this change (0 of 132 in-window
signals propagated) and takes effect after (130 of 132).
Save MSR in setup_sigcontext() so the handler's ucontext exposes it. The
signal frame is user-writable, so restore_sigcontext() must not restore it
verbatim: MicroBlaze packs the user-writable carry (MSR_C, MSR_CC) and the
privileged control bits (MSR_UM, MSR_VM, MSR_IE, MSR_EE, ...) into the one
register, and a verbatim restore would let userspace alter privileged
return state -- rtbd derives the resumed mode from MSR_UMS/MSR_VMS.
Restore only MSR_C | MSR_CC from the frame and keep the rest from the
current regs->msr. This mirrors x86's
restore_sigcontext(), which masks the restored EFLAGS to FIX_EFLAGS for
the same reason; arches whose status register is purely privileged (e.g.
riscv sstatus) simply do not restore it at all.
Comment on the exposed MSR reworded: it is not read-only,
restore_sigcontext() applies MSR_C|MSR_CC from the frame. Author's
Signed-off-by kept; he agreed to comment and changelog cleanups.
Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Signed-off-by: Sam Price <thesamprice@gmail.com>
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-6-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/signal.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index 4956014a99379..6bbc16f98d5eb 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -33,6 +33,7 @@
#include <linux/linkage.h>
#include <linux/resume_user_mode.h>
#include <asm/entry.h>
+#include <asm/registers.h>
#include <asm/ucontext.h>
#include <linux/uaccess.h>
#include <linux/syscalls.h>
@@ -81,6 +82,22 @@ static int restore_sigcontext(struct pt_regs *regs,
COPY(pc); COPY(ear); COPY(esr); COPY(fsr);
#undef COPY
+ /*
+ * The frame is user-writable, so restore only the user-writable
+ * status flags (carry) and keep the kernel-controlled MSR bits
+ * (UMS/VMS/IE/EE/...) from regs->msr: rtbd derives the resumed mode
+ * from UMS/VMS, so a verbatim restore would hand userspace the
+ * privileged return state. Same idea as x86 masking the restored
+ * EFLAGS to FIX_EFLAGS.
+ */
+ {
+ unsigned long msr;
+
+ err |= __get_user(msr, &sc->regs.msr);
+ regs->msr = (regs->msr & ~(MSR_C | MSR_CC)) |
+ (msr & (MSR_C | MSR_CC));
+ }
+
*rval_p = regs->r3;
return err;
@@ -140,6 +157,7 @@ setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
COPY(r26); COPY(r27); COPY(r28); COPY(r29);
COPY(r30); COPY(r31);
COPY(pc); COPY(ear); COPY(esr); COPY(fsr);
+ COPY(msr); /* restore_sigcontext() accepts only carry state */
#undef COPY
err |= __put_user(mask, &sc->oldmask);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 053/869] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 052/869] microblaze: preserve the MSR carry flags across signals Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 054/869] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT Greg Kroah-Hartman
` (823 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Danesh Petigara,
Florian Fainelli, Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 7c0b82d087908765c6c7daeb06943e21b78d523e ]
On API v1/v2 boards, the DCPU coprocessor can steer kernel readl_relaxed()
and writel_relaxed() to any address within 256 MB of the ioremapped DPFE
dmem or regs base. The DCPU firmware provides a 28-bit offset which the
driver adds to the ioremap base without any bounds checking in
get_msg_ptr().
This allows a compromised DCPU firmware to trick the host kernel into
reading or writing arbitrary memory-mapped I/O registers in vmalloc
space. When combined with a root-writable sysfs file like dpfe_refresh,
it provides an arbitrary MMIO write primitive. Similarly, world-readable
sysfs files can be used to leak other devices' register contents.
Fix this by recording the resource_size() of the dmem and regs ioremaps
at probe time, and rejecting any offset that, along with the largest
field accessed (DRAM_VENDOR_ERROR + sizeof(u32)), exceeds the recorded
mapping size.
Fixes: fee5f1ef6cf7 ("memory: brcmstb: dpfe: support new way of passing data from the DCPU")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-2-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/brcmstb_dpfe.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 08d9e05b1b338..66343205f585b 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -182,6 +182,8 @@ struct brcmstb_dpfe_priv {
void __iomem *regs;
void __iomem *dmem;
void __iomem *imem;
+ resource_size_t regs_size;
+ resource_size_t dmem_size;
struct device *dev;
const struct dpfe_api *dpfe_api;
struct mutex lock;
@@ -401,9 +403,14 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
*/
switch (msg_type) {
case 1:
+ if (DCPU_MSG_RAM_START + offset + DRAM_VENDOR_ERROR +
+ sizeof(u32) > priv->regs_size)
+ goto bad_offset;
ptr = priv->regs + DCPU_MSG_RAM_START + offset;
break;
case 0:
+ if (offset + DRAM_VENDOR_ERROR + sizeof(u32) > priv->dmem_size)
+ goto bad_offset;
ptr = priv->dmem + offset;
break;
default:
@@ -415,6 +422,12 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
}
return ptr;
+
+bad_offset:
+ dev_err(priv->dev, "DCPU returned out-of-range offset %#x\n", offset);
+ if (buf && size)
+ *size = sprintf(buf, "ERROR: DCPU offset out of range\n");
+ return NULL;
}
static void __finalize_command(struct brcmstb_dpfe_priv *priv)
@@ -858,6 +871,7 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct brcmstb_dpfe_priv *priv;
+ struct resource *res;
int ret;
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -869,17 +883,21 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
mutex_init(&priv->lock);
platform_set_drvdata(pdev, priv);
- priv->regs = devm_platform_ioremap_resource_byname(pdev, "dpfe-cpu");
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-cpu");
+ priv->regs = devm_ioremap_resource(dev, res);
if (IS_ERR(priv->regs)) {
dev_err(dev, "couldn't map DCPU registers\n");
return -ENODEV;
}
+ priv->regs_size = resource_size(res);
- priv->dmem = devm_platform_ioremap_resource_byname(pdev, "dpfe-dmem");
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-dmem");
+ priv->dmem = devm_ioremap_resource(dev, res);
if (IS_ERR(priv->dmem)) {
dev_err(dev, "Couldn't map DCPU data memory\n");
return -ENOENT;
}
+ priv->dmem_size = resource_size(res);
priv->imem = devm_platform_ioremap_resource_byname(pdev, "dpfe-imem");
if (IS_ERR(priv->imem)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 054/869] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 053/869] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 055/869] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile Greg Kroah-Hartman
` (822 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Danesh Petigara,
Florian Fainelli, Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 6b07f8c06caca015a0db69e3f323b5186469bc66 ]
A compromised or buggy DCPU coprocessor can make any user who reads
world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
stack out-of-bounds read of arbitrary extent. This bounds checks
chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
message RAM.
Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-3-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/brcmstb_dpfe.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 66343205f585b..7b02c36c7fca7 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -503,6 +503,8 @@ static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd,
for (i = 0; i < MSG_FIELD_MAX; i++)
result[i] = readl_relaxed(regs + DCPU_MSG_RAM(i));
chksum_idx = result[MSG_ARG_COUNT] + MSG_ARG_COUNT + 1;
+ if (chksum_idx >= MSG_FIELD_MAX)
+ ret = -EINVAL;
}
/* Tell DCPU we are done */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 055/869] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 054/869] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 056/869] wifi: rtw88: fix out-of-bounds CAM write when key table is full Greg Kroah-Hartman
` (821 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Krzysztof Kozlowski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 3db1fb5e1bb4c9eefc554f985f6f3316fa1292e5 ]
Add XSPI_CDD1BUF0 to the xSPI regmap volatile register table.
XSPI_CDD1BUF0 is a data buffer register used during manual transfers and,
like XSPI_CDD0BUF0, its contents are transient and should not be cached
by regmap. Mark it as volatile so reads always access the hardware
register.
Fixes: 687cac9559d8 ("memory: renesas-rpc-if: Add RZ/G3E xSPI support")
Cc: stable@vger.kernel.org
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20260727103449.3188105-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/renesas-rpc-if.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 4a417b6930805..7f75052b6ae34 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -34,6 +34,7 @@ static const struct regmap_access_table rpcif_volatile_table = {
static const struct regmap_range xspi_volatile_ranges[] = {
regmap_reg_range(XSPI_CDD0BUF0, XSPI_CDD0BUF0),
+ regmap_reg_range(XSPI_CDD1BUF0, XSPI_CDD1BUF0),
};
static const struct regmap_access_table xspi_volatile_table = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 056/869] wifi: rtw88: fix out-of-bounds CAM write when key table is full
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 055/869] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 057/869] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields Greg Kroah-Hartman
` (820 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
イムティヤズ, Ping-Ke Shih,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: イムティヤズ <reza1234khan1234@gmail.com>
[ Upstream commit 10d58823cb44681466c022054030b8e68d94ce2f ]
In rtw_ops_set_key(), when the CAM table is full,
rtw_sec_get_free_cam() returns RTW_MAX_SEC_CAM_NUM (32) because
find_next_zero_bit()/find_first_zero_bit() return the bitmap size
when no free slot exists. The bounds check compares the returned
index with ">" against total_cam_num (32), so the invalid index 32
passes the check.
rtw_sec_write_cam() then indexes cam_table[32], an array declared
with RTW_MAX_SEC_CAM_NUM (32) entries, causing an out-of-bounds
write that corrupts the cam_map allocation bitmap. The write also
sets bit 32 of cam_map, which overruns the bitmap as well.
Fix the off-by-one by rejecting indices >= total_cam_num.
Tested on: RTL8821CE (PCIe) on kernel
7.2.0-rc6-rtw88test-00059-g0d8395707651. The patched module loaded
and associated to a WPA2 network; ping traffic passed with 0% packet
loss. Reassociation and disconnect/reconnect cycles completed
without errors, and the CAM table (debugfs dump_cam) showed valid
key entries. The CAM-full boundary (28+ pairwise keys) requires an
access point with 28+ clients and is not reachable in a
single-client setup, so that path was verified by code inspection.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Cc: stable@vger.kernel.org
Tested-by: イムティヤズ <reza1234khan1234@gmail.com>
Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260805210941.75136-1-reza1234khan1234@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
index 766f22d31079e..3b6302f14de03 100644
--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
@@ -597,7 +597,7 @@ static int rtw_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
hw_key_idx = key->keyidx;
}
- if (hw_key_idx > sec->total_cam_num) {
+ if (hw_key_idx >= sec->total_cam_num) {
ret = -ENOSPC;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 057/869] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 056/869] wifi: rtw88: fix out-of-bounds CAM write when key table is full Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 058/869] wifi: rtw89: cap firmware section_num before parsing Greg Kroah-Hartman
` (819 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Cong, Ping-Ke Shih, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <yicong@kylinos.cn>
[ Upstream commit 7e080e17ca38b72f6cf01e3bc750c243573e69a7 ]
The .ch and .bw backup fields are swapped; .ch should store the channel
and .bw the bandwidth, matching all other chips.
Fixes: 0194a95cbe721a ("wifi: rtw89: 8851b: rfk: add DPK")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260807081006.240450-1-cong.yi@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
index 84c46d2f4d85e..6d2382cb5cd8c 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
@@ -1895,8 +1895,8 @@ static void _dpk_information(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy,
u8 kidx = dpk->cur_idx[path];
dpk->bp[path][kidx].band = chan->band_type;
- dpk->bp[path][kidx].ch = chan->band_width;
- dpk->bp[path][kidx].bw = chan->channel;
+ dpk->bp[path][kidx].ch = chan->channel;
+ dpk->bp[path][kidx].bw = chan->band_width;
rtw89_debug(rtwdev, RTW89_DBG_RFK,
"[DPK] S%d[%d] (PHY%d): TSSI %s/ DBCC %s/ %s/ CH%d/ %s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 058/869] wifi: rtw89: cap firmware section_num before parsing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 057/869] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 059/869] platform/x86: int3472: Fix uninitialised variable warning Greg Kroah-Hartman
` (818 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Laxman Acharya Padhya,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit 273b0a8be083df6d0319ce62caa870e927f94a31 ]
rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
The v0/v1 header parsers take section_num from an 8-bit firmware field
(0..255) and write info->section_info[i] with no cap.
rtw89_fw_download_suit() keeps that object on the stack, so a crafted
firmware blob overflows the stack.
Reject a truncated header and a section table that does not fit in the
firmware image before reading fw_hdr->sections[i].
Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260825174438.63168-1-acharyalaxman8848@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/fw.c | 32 +++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 299526220380f..c4fb9c226faeb 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -156,8 +156,24 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
if (!info)
return -EINVAL;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
@@ -449,9 +465,25 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
int ret;
u32 i;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 059/869] platform/x86: int3472: Fix uninitialised variable warning
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 058/869] wifi: rtw89: cap firmware section_num before parsing Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 060/869] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation Greg Kroah-Hartman
` (817 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Ricardo Ribalda,
Rafael J. Wysocki (Intel), Daniel Scally, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 70e6384fe0f4cf9768944f81924f6c1478b0ce43 ]
Fix a compiler warning about an uninitialised err_msg variable by printing
the error where it is handled:
drivers/platform/x86/intel/int3472/discrete.c:440:24: warning: ‘err_msg’ may be used uninitialized [-Wmaybe-uninitialized]
440 | return dev_err_probe(int3472->dev, ret, err_msg);
Fixes: 5de691bffe57 ("platform/x86: Add intel_skl_int3472 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/int3472/discrete.c | 25 +++++++++++--------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index 1505fc3ef7a85..96c33ba80002f 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -280,7 +280,6 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
unsigned long gpio_flags;
union acpi_object *obj;
struct gpio_desc *gpio;
- const char *err_msg;
const char *con_id;
int ret;
@@ -326,7 +325,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
case INT3472_GPIO_TYPE_HOTPLUG_DETECT:
ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, con_id, gpio_flags);
if (ret)
- err_msg = "Failed to map GPIO pin to sensor\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to map GPIO pin to sensor\n");
break;
case INT3472_GPIO_TYPE_CLK_ENABLE:
@@ -336,7 +336,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
gpio = skl_int3472_gpiod_get_from_temp_lookup(int3472, agpio, con_id, gpio_flags);
if (IS_ERR(gpio)) {
ret = PTR_ERR(gpio);
- err_msg = "Failed to get GPIO\n";
+ dev_err_probe(int3472->dev, ret, "Failed to get GPIO\n");
break;
}
@@ -344,13 +344,15 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
case INT3472_GPIO_TYPE_CLK_ENABLE:
ret = skl_int3472_register_gpio_clock(int3472, gpio);
if (ret)
- err_msg = "Failed to register clock\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register clock\n");
break;
case INT3472_GPIO_TYPE_PRIVACY_LED:
ret = skl_int3472_register_pled(int3472, gpio);
if (ret)
- err_msg = "Failed to register LED\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register LED\n");
break;
case INT3472_GPIO_TYPE_POWER_ENABLE:
@@ -360,7 +362,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
ret = skl_int3472_register_regulator(int3472, gpio, enable_time_us,
con_id, second_sensor);
if (ret)
- err_msg = "Failed to register regulator\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register regulator\n");
break;
default: /* Never reached */
@@ -383,11 +386,11 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
int3472->ngpios++;
ACPI_FREE(obj);
- if (ret < 0)
- return dev_err_probe(int3472->dev, ret, err_msg);
-
- /* Tell acpi_dev_get_resources() to not make a copy of the resource */
- return 1;
+ /*
+ * Either return an error or tell acpi_dev_get_resources() to not make a
+ * copy of the resource.
+ */
+ return ret < 0 ? ret : 1;
}
int int3472_discrete_parse_crs(struct int3472_discrete_device *int3472)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 060/869] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 059/869] platform/x86: int3472: Fix uninitialised variable warning Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 061/869] ARM: imx: Fix suspend/resume crash with Clang CFI Greg Kroah-Hartman
` (816 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, hanzhijian, Brian Masney,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: hanzhijian <hanzhijian1991@gmail.com>
[ Upstream commit 712b75152c00a8ab0c56dbfe34caf88e3870ddde ]
The hws array of mpll->clk_data is allocated with struct_size() using
ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
But the probe function stores the MPLL clock at hws[0] and one
fixed-factor clock for each output divider at hws[i + 1] for i in
[0, ARRAY_SIZE(output_dividers)), writing 8 elements in total. The
final write to hws[7] is past the end of the allocation.
clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
reads hws[0..7], again accessing hws[7] out of bounds.
Use NUMOUTPUTS as the element count so the allocation matches the
number of clocks actually stored and exposed.
Found by smatch:
drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
error: buffer overflow 'mpll->clk_data->hws' 7 <= 7
Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
Cc: stable@vger.kernel.org
Signed-off-by: hanzhijian <hanzhijian1991@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mstar/clk-msc313-mpll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/mstar/clk-msc313-mpll.c b/drivers/clk/mstar/clk-msc313-mpll.c
index 61beb4e875250..bd45aa0aec011 100644
--- a/drivers/clk/mstar/clk-msc313-mpll.c
+++ b/drivers/clk/mstar/clk-msc313-mpll.c
@@ -105,7 +105,7 @@ static int msc313_mpll_probe(struct platform_device *pdev)
return PTR_ERR(mpll->loop_div_second);
mpll->clk_data = devm_kzalloc(dev, struct_size(mpll->clk_data, hws,
- ARRAY_SIZE(output_dividers)), GFP_KERNEL);
+ NUMOUTPUTS), GFP_KERNEL);
if (!mpll->clk_data)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 061/869] ARM: imx: Fix suspend/resume crash with Clang CFI
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 060/869] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 062/869] bpf: Fix queue/stack map u32 index overflow Greg Kroah-Hartman
` (815 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Desaulniers, Yoav Moshe,
Sami Tolvanen, Frank Li, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yo'av Moshe <linux@yoavmoshe.com>
[ Upstream commit 242757d109bd5c9b8fb7194fb4d44625be0b859a ]
The suspend code that runs from OCRAM is copied there with fncpy(),
which does not copy the kCFI type hash preceding the function. With
CONFIG_CFI=y the indirect call through imx6_suspend_in_ocram_fn
therefore panics.
Keep the call covered by CFI instead of exempting it:
- Add SYM_TYPED_FUNC_START_ALIGNED(), a variant of
SYM_TYPED_FUNC_START() that aligns the function entry rather than
the type hash preceding it, and use it to declare imx6_suspend():
fncpy() requires the entry point of the function it copies to be
8-byte aligned. The macro lives in arch/arm/include/asm/linkage.h
since the requirement comes from arm's fncpy().
- Add a cfi_type member at the end of struct imx6_cpu_pm_info, which
directly precedes the OCRAM copy of the function. It fits in the
struct's tail padding, so no sizes or offsets change. Fill it using
cfi_get_func_hash(), putting the hash where the caller's CFI check
expects it: four bytes before the function entry.
Also mark ccm_base, suspend_ocram_base and imx6_suspend_in_ocram_fn
as __ro_after_init: they are only written during __init, and the
function pointer in particular should not be writable afterwards.
Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yo'av Moshe <linux@yoavmoshe.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/linkage.h | 29 +++++++++++++++++++++++++++++
arch/arm/mach-imx/pm-imx6.c | 26 +++++++++++++++++++++++---
arch/arm/mach-imx/suspend-imx6.S | 6 ++++--
3 files changed, 56 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/linkage.h b/arch/arm/include/asm/linkage.h
index c4670694ada79..bba992f5d7a80 100644
--- a/arch/arm/include/asm/linkage.h
+++ b/arch/arm/include/asm/linkage.h
@@ -9,4 +9,33 @@
.type name, %function; \
END(name)
+#ifdef __ASSEMBLY__
+
+/*
+ * Variants of SYM_TYPED_START/SYM_TYPED_FUNC_START that align the
+ * function entry itself instead of the kCFI type hash preceding it,
+ * for functions whose entry point must meet an alignment requirement,
+ * such as the 8-byte alignment fncpy() demands of its source.
+ */
+#ifdef CONFIG_CFI
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align) \
+ linkage(name) ASM_NL \
+ .balign align ASM_NL \
+ .fill (align) - 4, 1, 0 ASM_NL \
+ __CFI_TYPE(name) ASM_NL \
+ name:
+
+#else /* CONFIG_CFI */
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align) \
+ SYM_START(name, linkage, .balign align)
+
+#endif /* CONFIG_CFI */
+
+#define SYM_TYPED_FUNC_START_ALIGNED(name, align) \
+ SYM_TYPED_START_ALIGNED(name, SYM_L_GLOBAL, align)
+
+#endif /* __ASSEMBLY__ */
+
#endif
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index a671ca498f887..3c73e2cdb8ceb 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -4,6 +4,8 @@
* Copyright 2011 Linaro Ltd.
*/
+#include <linux/build_bug.h>
+#include <linux/cfi.h>
#include <linux/clk/imx.h>
#include <linux/delay.h>
#include <linux/init.h>
@@ -18,6 +20,7 @@
#include <linux/of_platform.h>
#include <linux/platform_device.h>
#include <linux/regmap.h>
+#include <linux/stddef.h>
#include <linux/suspend.h>
#include <asm/cacheflush.h>
#include <asm/fncpy.h>
@@ -61,9 +64,9 @@
#define MX6Q_SUSPEND_OCRAM_SIZE 0x1000
#define MX6_MAX_MMDC_IO_NUM 33
-static void __iomem *ccm_base;
-static void __iomem *suspend_ocram_base;
-static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase);
+static void __iomem *ccm_base __ro_after_init;
+static void __iomem *suspend_ocram_base __ro_after_init;
+static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase) __ro_after_init;
/*
* suspend ocram space layout:
@@ -229,8 +232,18 @@ struct imx6_cpu_pm_info {
struct imx6_pm_base l2_base;
u32 mmdc_io_num; /* Number of MMDC IOs which need saved/restored. */
u32 mmdc_io_val[MX6_MAX_MMDC_IO_NUM][2]; /* To save offset and value */
+ u32 cfi_type; /* kCFI type hash of imx6_suspend() */
} __aligned(8);
+/*
+ * The ocram copy of imx6_suspend() starts right after struct imx6_cpu_pm_info,
+ * and the CFI check on the indirect call reads the kCFI type hash from the
+ * four bytes preceding the function entry, so cfi_type must occupy the last
+ * four bytes of the struct, i.e. fit into its tail padding.
+ */
+static_assert(offsetofend(struct imx6_cpu_pm_info, cfi_type) ==
+ sizeof(struct imx6_cpu_pm_info));
+
void imx6_set_int_mem_clk_lpm(bool enable)
{
u32 val = readl_relaxed(ccm_base + CGPR);
@@ -568,6 +581,13 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
mmdc_offset_array[i]);
}
+ /*
+ * Mask out the Thumb bit, as cfi_get_func_hash() expects the
+ * function's actual start address. Returns 0 if CONFIG_CFI=n.
+ */
+ pm_info->cfi_type =
+ cfi_get_func_hash((void *)((uintptr_t)&imx6_suspend & ~1UL));
+
imx6_suspend_in_ocram_fn = fncpy(
suspend_ocram_base + sizeof(*pm_info),
&imx6_suspend,
diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index 63ccc2d0e920a..95d5f723ea0ed 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -3,6 +3,7 @@
* Copyright 2014 Freescale Semiconductor, Inc.
*/
+#include <linux/cfi_types.h>
#include <linux/linkage.h>
#include <asm/assembler.h>
#include <asm/asm-offsets.h>
@@ -148,7 +149,8 @@
.endm
-ENTRY(imx6_suspend)
+/* fncpy() requires an 8-byte-aligned entry; see arch/arm/include/asm/fncpy.h */
+SYM_TYPED_FUNC_START_ALIGNED(imx6_suspend, 8)
ldr r1, [r0, #PM_INFO_PBASE_OFFSET]
ldr r2, [r0, #PM_INFO_RESUME_ADDR_OFFSET]
ldr r3, [r0, #PM_INFO_DDR_TYPE_OFFSET]
@@ -329,4 +331,4 @@ resume:
resume_mmdc
ret lr
-ENDPROC(imx6_suspend)
+SYM_FUNC_END(imx6_suspend)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 062/869] bpf: Fix queue/stack map u32 index overflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 061/869] ARM: imx: Fix suspend/resume crash with Clang CFI Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 063/869] hte: tegra194: Initialize slice locks before registering chip Greg Kroah-Hartman
` (814 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Chen, Andrii Nakryiko,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <chenyuan@kylinos.cn>
[ Upstream commit 802a30c5db726639df7f93b3a1982ecc64202abe ]
The queue/stack map addresses elements[] with the product of a u32
head/tail index and value_size, but the storage itself is allocated in
64-bit arithmetic. When max_entries * value_size reaches or exceeds
U32_MAX, the product wraps and push/peek/pop operate on the wrong
element, corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also make the u32 capacity counter
qs->size (max_entries + 1) wrap to 0 and permanently break the map.
The original bound check was removed by commit a37fb7ef24a4 ("bpf:
Eliminate rlimit-based memory accounting for queue_stack_maps maps"),
which deleted the bpf_map_charge_init() call and with it the
U32_MAX - PAGE_SIZE check that had earlier been moved into
bpf_map_charge_init() by c85d69135a91. Oversized queue/stack maps can
therefore be created again.
Restore the bound in queue_stack_map_alloc_check() with a single
comparison that rejects any max_entries/value_size combination whose
element storage would reach or exceed U32_MAX bytes, keeping the u32
index multiplication overflow-free and the capacity counter valid.
Fixes: a37fb7ef24a4 ("bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260831063226.621309-2-chenyuan_fl@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/queue_stack_maps.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index c1c9dee4dcdd0..b5628e4149817 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -59,6 +59,9 @@ static int queue_stack_map_alloc_check(union bpf_attr *attr)
*/
return -E2BIG;
+ if (attr->max_entries >= U32_MAX / attr->value_size)
+ return -E2BIG;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 063/869] hte: tegra194: Initialize slice locks before registering chip
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 062/869] bpf: Fix queue/stack map u32 index overflow Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 064/869] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() Greg Kroah-Hartman
` (813 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Dipen Patel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 1329abe1bae416ab2cff89c3312d33f745d341c7 ]
Registering the HTE chip publishes its request callbacks to consumers.
Initialize every slice lock before registration so a concurrent HTE
request cannot use an uninitialized lock.
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider")
Cc: stable@vger.kernel.org
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hte/hte-tegra194.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c
index 690eb9be30fb8..4644677370022 100644
--- a/drivers/hte/hte-tegra194.c
+++ b/drivers/hte/hte-tegra194.c
@@ -787,17 +787,17 @@ static int tegra_hte_probe(struct platform_device *pdev)
hte_dev->chip = gc;
+ for (i = 0; i < slices; i++) {
+ hte_dev->sl[i].flags = 0;
+ spin_lock_init(&hte_dev->sl[i].s_lock);
+ }
+
ret = devm_hte_register_chip(hte_dev->chip);
if (ret) {
dev_err(gc->dev, "hte chip register failed");
return ret;
}
- for (i = 0; i < slices; i++) {
- hte_dev->sl[i].flags = 0;
- spin_lock_init(&hte_dev->sl[i].s_lock);
- }
-
val = HTE_TECTRL_ENABLE_ENABLE |
(HTE_TECTRL_INTR_ENABLE << HTE_TECTRL_INTR_SHIFT) |
(hte_dev->itr_thrshld << HTE_TECTRL_OCCU_SHIFT);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 064/869] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 063/869] hte: tegra194: Initialize slice locks before registering chip Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 065/869] media: i2c: ov8856 : remove ACPI node bypass mechanism Greg Kroah-Hartman
` (812 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Abdun Nihaal,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 6132d70d0890c03546f6970893fd71938efb2a2f ]
In ath11k_dp_srng_setup(), the memory allocated for
ring->vaddr_unaligned is not freed in the error paths that follow.
Fix that by calling ath11k_dp_srng_cleanup() in those error paths.
Compile tested only. Issue found using a prototype static analysis tool
built on the LLVM compiler infrastructure.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260801114911.91483-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index 68c7ef190780a..5e67f088962e5 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -316,6 +316,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
case HAL_RXDMA_DIR_BUF:
break;
default:
+ ath11k_dp_srng_cleanup(ab, ring);
ath11k_warn(ab, "Not a valid ring type in dp :%d\n", type);
return -EINVAL;
}
@@ -327,6 +328,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, ¶ms);
if (ret < 0) {
+ ath11k_dp_srng_cleanup(ab, ring);
ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n",
ret, ring_num);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 065/869] media: i2c: ov8856 : remove ACPI node bypass mechanism
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 064/869] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 066/869] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count Greg Kroah-Hartman
` (811 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serin Yeh, Bryan ODonoghue,
Kieran Bingham, Sakari Ailus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serin Yeh <serin.yeh@intel.com>
[ Upstream commit 609a71568664acb7ee57b42de002ca782e3769e8 ]
On Intel platforms the sensor is enumerated via ACPI, and an INT3472
"discrete" companion device (the power-logic-control driver under
drivers/platform/x86/intel/int3472) registers the sensor's
reset/powerdown GPIOs and the regulator supply. These resources are
therefore discoverable and usable through the standard gpiod/regulator
lookups at probe time.
However, the driver guarded both the GPIO/regulator acquisition in
ov8856_get_hwcfg() and the whole power-on/off sequence with
is_acpi_node() and skipped them on ACPI. As a result the sensor was
never powered or reset by the driver, and probe failed when reading the
chip ID in ov8856_identify_module().
Remove the is_acpi_node() checks so the GPIO/regulator resources are
acquired and the full power sequence runs regardless of the firmware
interface. The driver now behaves consistently across DT and ACPI
platforms and initialises the hardware correctly.
Tested on Intel platforms with kernel 6.17 and 7.0.
Fixes: d2fa1134a48b ("media: i2c: ov8856: Use V4L2 legacy sensor clock helper")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8856.c | 29 ++++++++++-------------------
1 file changed, 10 insertions(+), 19 deletions(-)
diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index dd01e1d515ff6..2e104734ef0b1 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2071,9 +2071,6 @@ static int ov8856_power_on(struct device *dev)
struct ov8856 *ov8856 = to_ov8856(sd);
int ret;
- if (is_acpi_node(dev_fwnode(dev)))
- return 0;
-
ret = clk_prepare_enable(ov8856->xvclk);
if (ret < 0) {
dev_err(dev, "failed to enable xvclk\n");
@@ -2109,9 +2106,6 @@ static int ov8856_power_off(struct device *dev)
struct v4l2_subdev *sd = dev_get_drvdata(dev);
struct ov8856 *ov8856 = to_ov8856(sd);
- if (is_acpi_node(dev_fwnode(dev)))
- return 0;
-
gpiod_set_value_cansleep(ov8856->reset_gpio, 1);
regulator_bulk_disable(ARRAY_SIZE(ov8856_supply_names),
ov8856->supplies);
@@ -2282,21 +2276,18 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
dev_warn(dev, "external clock rate %u is unsupported",
xvclk_rate);
- if (!is_acpi_node(fwnode)) {
- ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
- GPIOD_OUT_LOW);
- if (IS_ERR(ov8856->reset_gpio))
- return PTR_ERR(ov8856->reset_gpio);
+ ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(ov8856->reset_gpio))
+ return PTR_ERR(ov8856->reset_gpio);
- for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
- ov8856->supplies[i].supply = ov8856_supply_names[i];
+ for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
+ ov8856->supplies[i].supply = ov8856_supply_names[i];
- ret = devm_regulator_bulk_get(dev,
- ARRAY_SIZE(ov8856_supply_names),
- ov8856->supplies);
- if (ret)
- return ret;
- }
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ov8856_supply_names),
+ ov8856->supplies);
+ if (ret)
+ return ret;
ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
if (!ep)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 066/869] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 065/869] media: i2c: ov8856 : remove ACPI node bypass mechanism Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 067/869] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Greg Kroah-Hartman
` (810 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serin Yeh, Kieran Bingham,
Sakari Ailus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serin Yeh <serin.yeh@intel.com>
[ Upstream commit a15976e69b1c70ea16ef1f7172a846f6ef5dfa14 ]
The driver currently prints the number of data lanes using
ov8856->cur_mode->data_lanes in ov8856_get_hwcfg(). However,
the ov8856->cur_mode structure is not assigned to a clearly
supported mode at that point. Due to the missing pointer,
enabling dynamic debug may lead to a kernel panic.
Instead, the correct number of CSI-2 data lanes should be taken
from bus_cfg.bus.mipi_csi2.num_data_lanes, which represents the
real hardware configuration determined at runtime.
Fixes: c492ec9ae9ed ("media: ov8856: Add support for 2 data lanes")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8856.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index 2e104734ef0b1..27d7ca17d4d68 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2307,7 +2307,8 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
goto check_hwcfg_error;
}
- dev_dbg(dev, "Using %u data lanes\n", ov8856->cur_mode->data_lanes);
+ dev_dbg(dev, "Using %u data lanes\n",
+ bus_cfg.bus.mipi_csi2.num_data_lanes);
if (bus_cfg.bus.mipi_csi2.num_data_lanes == 2)
ov8856->priv_lane = &lane_cfg_2;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 067/869] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 066/869] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 068/869] mtd: spi-nor: sfdp: check the length of the SCCR map Greg Kroah-Hartman
` (809 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Michael Walle,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit b9f34a95a81021fa1f3c9cb8cfd458e66824cad6 ]
The spi_nor_parse_profile1() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1,
DWORD4 and DWORD5 without ever checking the table is that long.
So if a flash reports a length of one, the buffer is only four bytes
while DWORD4 and DWORD5 sit at byte offsets 12 and 16. With a length of
zero kmalloc() returns ZERO_SIZE_PTR rather than an error, so the NULL
check doesn't catch it and the first read dereferences it. And the value
doesn't just get thrown away. It ends up as the dummy cycle count for
8D-8D-8D fast reads.
To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.
Fixes: fb27f198971a ("mtd: spi-nor: sfdp: parse xSPI Profile 1.0 table")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/sfdp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index a8324c2da0acf..7d6a604b89954 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1175,6 +1175,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor,
#define PROFILE1_DWORD5_DUMMY_166MHZ GENMASK(31, 27)
#define PROFILE1_DWORD5_DUMMY_133MHZ GENMASK(21, 17)
#define PROFILE1_DWORD5_DUMMY_100MHZ GENMASK(11, 7)
+#define SFDP_PROFILE1_DWORD_MIN 5
/**
* spi_nor_parse_profile1() - parse the xSPI Profile 1.0 table
@@ -1192,6 +1193,9 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
int ret;
u8 dummy, opcode;
+ if (profile1_header->length < SFDP_PROFILE1_DWORD_MIN)
+ return -EINVAL;
+
len = profile1_header->length * sizeof(*dwords);
dwords = kmalloc(len, GFP_KERNEL);
if (!dwords)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 068/869] mtd: spi-nor: sfdp: check the length of the SCCR map
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 067/869] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 069/869] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption Greg Kroah-Hartman
` (808 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Michael Walle,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 1413f38f37194673502e61cd3749e091c031370b ]
The spi_nor_parse_sccr() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1
and DWORD22 without ever checking the table is that long.
So if a flash reports a length of one, the buffer is only four bytes
while DWORD22 sits at byte offset 84. With a length of zero kmalloc()
returns ZERO_SIZE_PTR rather than an error, so the NULL check doesn't
catch it and the first read dereferences it.
To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.
The spi_nor_parse_sccr_mc() doesn't need the same check. It works out
the number of dice from the length it allocated with, so its highest
index stays inside the buffer.
Fixes: 7ab8b810757a ("mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/sfdp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index 7d6a604b89954..a9668c83ac5ef 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1266,6 +1266,7 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
}
#define SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE BIT(31)
+#define SFDP_SCCR_DWORD_MIN 22
/**
* spi_nor_parse_sccr() - Parse the Status, Control and Configuration Register
@@ -1284,6 +1285,9 @@ static int spi_nor_parse_sccr(struct spi_nor *nor,
size_t len;
int ret;
+ if (sccr_header->length < SFDP_SCCR_DWORD_MIN)
+ return -EINVAL;
+
len = sccr_header->length * sizeof(*dwords);
dwords = kmalloc(len, GFP_KERNEL);
if (!dwords)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 069/869] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 068/869] mtd: spi-nor: sfdp: check the length of the SCCR map Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 070/869] fs_pin: publish pins with RCU list helpers Greg Kroah-Hartman
` (807 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Michael Walle,
Tudor Ambarus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit f594a33f9721f08facd98d0a31adc14ff6da9d70 ]
All the parallel locking helpers (spi_nor_prep_and_lock(),
spi_nor_prep_and_lock_pe() and spi_nor_prep_and_lock_rd()) call
spi_nor_prep() then wait with a killable sleep. If the sleep gets
killed, we leave the controller in its prepared state.
Call ->unprepare() in these cases.
Fixes: 74df43b3f626 ("mtd: spi-nor: Enhance locking to support reads while writes")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/core.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 037407fc2e113..512d0e4e3b1f6 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -1281,6 +1281,9 @@ int spi_nor_prep_and_lock(struct spi_nor *nor)
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_exclusive(nor));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
@@ -1352,6 +1355,9 @@ static int spi_nor_prep_and_lock_pe(struct spi_nor *nor, loff_t start, size_t le
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_pe(nor, start, len));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
@@ -1425,6 +1431,9 @@ static int spi_nor_prep_and_lock_rd(struct spi_nor *nor, loff_t start, size_t le
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_rd(nor, start, len));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 070/869] fs_pin: publish pins with RCU list helpers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 069/869] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 071/869] fs: make sure to call fsnotify_inoderemove() only once when inode is dead Greg Kroah-Hartman
` (806 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Jan Kara,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 8d01d6b4c17c406f37a9b6edac93dfb858af30d0 ]
pin_insert() initializes a pin before adding it under pin_lock. The kill
paths read the list heads under RCU without taking that lock. Plain hlist
insertion does not publish the earlier initialization to those readers.
KCSAN weak-memory checking reported acct_on() callback initialization
racing with pin_kill() after the superblock-list publication. The
corresponding LKMM model permits the stale read with plain publication;
the RCU release/acquire pair forbids it.
Use the RCU hlist add and dereference helpers for both pin lists.
Fixes: 2798d4ce6160 ("acct: get rid of acct_lock for acct->count")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260903002100.34822-1-kmehltretter@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fs_pin.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/fs_pin.c b/fs/fs_pin.c
index 47ef3c71ce907..1a508f2167e0a 100644
--- a/fs/fs_pin.c
+++ b/fs/fs_pin.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/fs.h>
+#include <linux/rculist.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include "internal.h"
@@ -22,8 +23,8 @@ void pin_remove(struct fs_pin *pin)
void pin_insert(struct fs_pin *pin, struct vfsmount *m)
{
spin_lock(&pin_lock);
- hlist_add_head(&pin->s_list, &m->mnt_sb->s_pins);
- hlist_add_head(&pin->m_list, &real_mount(m)->mnt_pins);
+ hlist_add_head_rcu(&pin->s_list, &m->mnt_sb->s_pins);
+ hlist_add_head_rcu(&pin->m_list, &real_mount(m)->mnt_pins);
spin_unlock(&pin_lock);
}
@@ -73,7 +74,7 @@ void mnt_pin_kill(struct mount *m)
while (1) {
struct hlist_node *p;
rcu_read_lock();
- p = READ_ONCE(m->mnt_pins.first);
+ p = rcu_dereference(hlist_first_rcu(&m->mnt_pins));
if (!p) {
rcu_read_unlock();
break;
@@ -87,7 +88,7 @@ void group_pin_kill(struct hlist_head *p)
while (1) {
struct hlist_node *q;
rcu_read_lock();
- q = READ_ONCE(p->first);
+ q = rcu_dereference(hlist_first_rcu(p));
if (!q) {
rcu_read_unlock();
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 071/869] fs: make sure to call fsnotify_inoderemove() only once when inode is dead
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 070/869] fs_pin: publish pins with RCU list helpers Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 072/869] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT Greg Kroah-Hartman
` (805 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Goldstein, Jan Kara,
Christian Brauner (Amutable), Sasha Levin, Daehyeon Ko
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
[ Upstream commit 669bb5af15d41a21359d00a441490f87a88eb52a ]
Daehyeon reported a race wherein fsnotify_removeinode() can be called
when inode still has a live alias. This can lead to several undesired
outcomes such as crashes in fsnotify code or avoidance of inode mark
notifications.
Check that inode is really "dead", meaning no nlink and no more aliases
before calling fsnotify_inoderemove() for final cleanup of inode marks.
Also do not allow open_by_handle() to add new aliases to a "dead" inode.
Ideally, we'd call fsnotify_inoderemove() once last inode reference is
dropped to make things simpler. Alas fsnotify inode marks currently hold
inode references and thus this doesn't work. Once we teach fsnotify to
avoid holding inode references, these games with dead inodes can go as
well.
Reported-and-tested-by: Daehyeon Ko <4ncienth@gmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/20260827045007.3831259-1-4ncienth@gmail.com/
CC: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260902164924.1333135-2-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dcache.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 5ee1c3d592c85..1b4c210338022 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -442,6 +442,17 @@ static void dentry_free(struct dentry *dentry)
call_rcu(&dentry->d_u.d_rcu, __d_free);
}
+/*
+ * If inode is unlinked and doesn't have any aliases (i.e., all fds pointing to
+ * it are closed), it is pretty much dead. Except that file handle lookup could
+ * still revive it which causes issues to fsnotify. So once inode reaches this
+ * state we make sure to block creating any new aliases.
+ */
+static bool inode_notify_dead(struct inode *inode)
+{
+ return !inode->i_nlink && hlist_empty(&inode->i_dentry);
+}
+
/*
* Release the dentry's inode, using the filesystem
* d_iput() operation if defined.
@@ -451,14 +462,16 @@ static void dentry_unlink_inode(struct dentry * dentry)
__releases(dentry->d_inode->i_lock)
{
struct inode *inode = dentry->d_inode;
+ bool notify_dead;
raw_write_seqcount_begin(&dentry->d_seq);
__d_clear_type_and_inode(dentry);
hlist_del_init(&dentry->d_u.d_alias);
raw_write_seqcount_end(&dentry->d_seq);
+ notify_dead = inode_notify_dead(inode);
spin_unlock(&dentry->d_lock);
spin_unlock(&inode->i_lock);
- if (!inode->i_nlink)
+ if (notify_dead)
fsnotify_inoderemove(inode);
if (dentry->d_op && dentry->d_op->d_iput)
dentry->d_op->d_iput(dentry, inode);
@@ -2022,7 +2035,12 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
sb = inode->i_sb;
- res = d_find_any_alias(inode); /* existing alias? */
+ spin_lock(&inode->i_lock);
+ if (!inode_notify_dead(inode))
+ res = __d_find_any_alias(inode); /* existing alias? */
+ else
+ res = ERR_PTR(-ESTALE);
+ spin_unlock(&inode->i_lock);
if (res)
goto out;
@@ -2034,7 +2052,10 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
security_d_instantiate(new, inode);
spin_lock(&inode->i_lock);
- res = __d_find_any_alias(inode); /* recheck under lock */
+ if (!inode_notify_dead(inode))
+ res = __d_find_any_alias(inode); /* recheck under lock */
+ else
+ res = ERR_PTR(-ESTALE);
if (likely(!res)) { /* still no alias, attach a disconnected dentry */
unsigned add_flags = d_flags_for_inode(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 072/869] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 071/869] fs: make sure to call fsnotify_inoderemove() only once when inode is dead Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 073/869] thermal: intel: powerclamp: Reject invalid window_size values Greg Kroah-Hartman
` (804 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Judith Mendez,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 0ddd661c19ec1465e1f2c204fa9b2488acfabf4b ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
Link: https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals [0]
Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Judith Mendez <jm@ti.com>
Link: https://patch.msgid.link/20260813111238.56892-1-francesco@dolcini.it
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
index 059ec492a973e..5e8830fffb949 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -573,7 +573,7 @@ AM62X_IOPAD(0x15c, PIN_INPUT, 0) /* (AB22) MDIO0_MDIO */ /* ETH_1_MDIO, SODIMM
pinctrl_sdhci0: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
@@ -589,7 +589,7 @@ AM62X_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */
pinctrl_sdhci1: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */ /* SODIMM 74 */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */ /* SODIMM 78 */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */ /* SODIMM 78 */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */ /* SODIMM 80 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */ /* SODIMM 82 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */ /* SODIMM 70 */
@@ -601,7 +601,7 @@ AM62X_IOPAD(0x224, PIN_INPUT, 0) /* (D22) MMC1_DAT3 */ /* SODIMM 72 */
pinctrl_sdhci2: main-mmc2-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x120, PIN_INPUT, 0) /* (C24) MMC2_CMD */ /* WiFi_SDIO_CMD */
- AM62X_IOPAD(0x118, PIN_INPUT, 0) /* (D25) MMC2_CLK */ /* WiFi_SDIO_CLK */
+ AM62X_IOPAD(0x118, PIN_OUTPUT,0) /* (D25) MMC2_CLK */ /* WiFi_SDIO_CLK */
AM62X_IOPAD(0x114, PIN_INPUT, 0) /* (B24) MMC2_DAT0 */ /* WiFi_SDIO_DATA0 */
AM62X_IOPAD(0x110, PIN_INPUT, 0) /* (C25) MMC2_DAT1 */ /* WiFi_SDIO_DATA1 */
AM62X_IOPAD(0x10c, PIN_INPUT, 0) /* (E23) MMC2_DAT2 */ /* WiFi_SDIO_DATA2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 073/869] thermal: intel: powerclamp: Reject invalid window_size values
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 072/869] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 074/869] thermal: intel: int340x: Fix temperature selection around 0 C Greg Kroah-Hartman
` (803 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Rafael J. Wysocki,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 40989202104e498ff9adfb8c575d6cd159f13988 ]
window_size_set() sets ret to -EINVAL if new_window_size is outside the
valid range, but then falls through and still updates window_size to the
clamped value.
Return -EINVAL immediately and do not update window_size. Also drop the
now-redundant clamp() call.
Fixes: d6d71ee4a14a ("PM: Introduce Intel PowerClamp Driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260815090136.88540-2-thorsten.blum@linux.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/intel_powerclamp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c
index 9a4cec0009106..61665f945b4c0 100644
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -290,9 +290,10 @@ static int window_size_set(const char *arg, const struct kernel_param *kp)
pr_err("Out of recommended window size %lu, between 2-10\n",
new_window_size);
ret = -EINVAL;
+ goto exit_win;
}
- window_size = clamp(new_window_size, 2ul, 10ul);
+ window_size = new_window_size;
smp_mb();
exit_win:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 074/869] thermal: intel: int340x: Fix temperature selection around 0 C
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 073/869] thermal: intel: powerclamp: Reject invalid window_size values Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 075/869] isofs: fix Rock Ridge CE extent validation on multisession media Greg Kroah-Hartman
` (802 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Srinivas Pandruvada,
Rafael J. Wysocki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit e56e2b49c67d132728e52ce493079e83cc914657 ]
Since commit 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to
support negative CPU temperature"), intel_tcc_get_temp() can report
negative temperatures.
proc_thermal_get_zone_temp() still uses *temp as the current maximum and
as an implicit "no reading yet" marker. However, this breaks when a CPU
reports 0 C, because a subsequent negative reading can overwrite it.
Use bool temp_valid to track whether a valid temperature has been read.
Initialize *temp with the first valid reading and only update it with
warmer readings.
Fixes: 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature")
Cc: 6.3+ <stable@vger.kernel.org> # 6.3+
Signed-off-by: Thorsten Blum <blum@kernel.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260826153144.299746-3-blum@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/int340x_thermal/processor_thermal_device.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 48e7849d48160..dc9c82e8650e7 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -178,17 +178,21 @@ static int proc_thermal_get_zone_temp(struct thermal_zone_device *zone,
{
int cpu;
int curr_temp, ret;
-
- *temp = 0;
+ bool temp_valid = false;
for_each_online_cpu(cpu) {
ret = intel_tcc_get_temp(cpu, &curr_temp, false);
if (ret < 0)
return ret;
- if (!*temp || curr_temp > *temp)
+ if (!temp_valid || curr_temp > *temp) {
*temp = curr_temp;
+ temp_valid = true;
+ }
}
+ if (!temp_valid)
+ return -ENODATA;
+
*temp *= 1000;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 075/869] isofs: fix Rock Ridge CE extent validation on multisession media
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 074/869] thermal: intel: int340x: Fix temperature selection around 0 C Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 076/869] arm64: dts: mediatek: mt7986: correct timer frequency Greg Kroah-Hartman
` (801 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baolin Liu, Jan Kara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Liu <liubaolin@kylinos.cn>
[ Upstream commit 43de050fa4a31f7e7a73cf8974dcf6037e161a39 ]
Commit a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent
against volume size") compares the CE extent directly with s_nzones. The
extent is an absolute block number, while s_nzones is the number of blocks
relative to the selected ISO session. The comparison is therefore wrong
when a multisession disc starts at a non-zero block.
isofs_get_last_session() selects the last session on multisession
media, and its volume descriptors describe a volume beginning at that
session's LBA.
For example, a session beginning at LBA 45447 with 64 blocks can contain a
valid CE at absolute LBA 45467. The existing check rejects that CE, so the
ER continuation record is not read, Rock Ridge is disabled, and the mount
falls back to Joliet names.
Save the selected session start in filesystem-block units and validate the
CE extent against the half-open interval [session_start, session_end).
Scale the session length to the same block units and retain a separate
block-device limit. The lower bound is intentional: accepting arbitrary
blocks before the selected session could make a CE read data from a
previous session or another filesystem on the device.
Only apply the bounds check when cont_extent is non-zero. A zero extent is
the in-memory sentinel indicating that no CE continuation was found, rather
than a request to read block zero.
For a single-session image, session_start is zero and the effective volume
boundary remains unchanged.
Build-tested with:
make CONFIG_RUST= CONFIG_RUST_DRIVERS= fs/isofs/
Fixes: a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent against volume size")
Cc: stable@vger.kernel.org
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Link: https://patch.msgid.link/20260907082602.3777551-1-liubaolin12138@163.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/inode.c | 2 ++
fs/isofs/isofs.h | 2 ++
fs/isofs/rock.c | 11 +++++++++--
3 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 3433fa14cd014..8a0da54f391d0 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -821,6 +821,8 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
if (!sb_set_blocksize(s, orig_zonesize))
goto out_freesbi;
+ sbi->s_session_start = (sector_t)vol_desc_start <<
+ (ISOFS_BLOCK_BITS - s->s_blocksize_bits);
sbi->s_nls_iocharset = NULL;
#ifdef CONFIG_JOLIET
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index 5065558375333..a36a634797435 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -35,6 +35,8 @@ struct isofs_sb_info {
unsigned long s_firstdatazone;
unsigned long s_log_zone_size;
unsigned long s_max_size;
+ /* Session start in filesystem block units. */
+ sector_t s_session_start;
int s_rock_offset; /* offset of SUSP fields within SU area */
s32 s_sbsector;
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index 869b331eff4f6..a4a337301b6f9 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -9,6 +9,7 @@
#include <linux/slab.h>
#include <linux/pagemap.h>
+#include <linux/blkdev.h>
#include "isofs.h"
#include "rock.h"
@@ -84,6 +85,10 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
*/
static int rock_continue(struct rock_state *rs)
{
+ struct super_block *sb = rs->inode->i_sb;
+ struct isofs_sb_info *sbi = ISOFS_SB(sb);
+ sector_t session_end = sbi->s_session_start +
+ ((sector_t)sbi->s_nzones << (ISOFS_BLOCK_BITS - sb->s_blocksize_bits));
int ret = 1;
int blocksize = 1 << rs->inode->i_blkbits;
const int min_de_size = offsetof(struct rock_ridge, u);
@@ -101,11 +106,13 @@ static int rock_continue(struct rock_state *rs)
goto out;
}
- if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) {
+ if (rs->cont_extent &&
+ (rs->cont_extent < sbi->s_session_start ||
+ rs->cont_extent >= session_end)) {
printk(KERN_NOTICE "rock: corrupted directory entry. "
"extent=%u out of volume (nzones=%lu)\n",
(unsigned)rs->cont_extent,
- ISOFS_SB(rs->inode->i_sb)->s_nzones);
+ sbi->s_nzones);
ret = -EIO;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 076/869] arm64: dts: mediatek: mt7986: correct timer frequency
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 075/869] isofs: fix Rock Ridge CE extent validation on multisession media Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 6.18 077/869] media: cx231xx-audio: drain wq_trigger before audio fini Greg Kroah-Hartman
` (800 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Pesaresi,
AngeloGioacchino Del Regno, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Pesaresi <andreapesaresi82@gmail.com>
[ Upstream commit 1cf18e4b9815beaf0439c5b57b65b45151c82ad7 ]
The MT7986 architected timer runs at 12,986,200 Hz rather than 13 MHz.
Firmware reports 13 MHz through CNTFRQ_EL0, causing the system clock to
run slow by about 1062 ppm. This exceeds the kernel's 500 ppm NTP
correction limit and leaves clock discipline saturated.
The corrected rate comes from MediaTek's downstream OpenWrt feed, where
it is applied to both MT7986A and MT7986B. Since upstream mt7986b.dtsi
includes mt7986a.dtsi, add it once to the common timer node so the
architected timer driver uses the actual counter rate.
Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support")
Cc: stable@vger.kernel.org
Link: https://github.com/mediatek/mtk-openwrt-feeds/commit/6a4c41c41410cd5042ad10c39da6593ba036283c
Link: https://github.com/openwrt/openwrt/issues/24789
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 6786e5b590e85..df5f7d831d819 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -653,6 +653,7 @@ cpu_trip_active_low: active-low {
timer {
compatible = "arm,armv8-timer";
interrupt-parent = <&gic>;
+ clock-frequency = <12986200>;
interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
<GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
<GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 077/869] media: cx231xx-audio: drain wq_trigger before audio fini
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 076/869] arm64: dts: mediatek: mt7986: correct timer frequency Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 078/869] media: cx231xx: Fix cleanup path on failure Greg Kroah-Hartman
` (799 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit a691c54986412e1fa87f036d2577d5a78a75e658 ]
audio_trigger() is deferred work (dev->wq_trigger) armed from
snd_cx231xx_capture_trigger() on every PCM START/STOP; it dereferences
dev->adev state and may free the URBs via cx231xx_isoc_audio_deinit().
cx231xx_audio_fini() tore down that state without draining wq_trigger,
so work armed before or racing fini ran against freed state.
Use disable_work_sync() in fini to drain the work and prevent further
queueing. Initialize the work, lock and stream_started counter at the
top of cx231xx_audio_init(), before any fallible allocation, and clear
the partially-built audio state on its error path, so fini is safe even
if a later step fails.
This issue was found by an in-house static analysis tool.
Fixes: 61b04cb24a12 ("[media] cx231xx-audio: fix some locking issues")
Cc: stable@vger.kernel.org # v6.10+
Link: https://lore.kernel.org/r/8c7e1294-b906-4636-890c-b64d03b0e1d0@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index 9c71b32552df3..1179cb0334f4d 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -576,12 +576,19 @@ static int cx231xx_audio_init(struct cx231xx *dev)
dev_dbg(dev->dev,
"probing for cx231xx non standard usbaudio\n");
+ /*
+ * Extension init errors are ignored by the cx231xx core, so fini()
+ * must be safe even if initialization fails part way through.
+ */
+ spin_lock_init(&adev->slock);
+ INIT_WORK(&dev->wq_trigger, audio_trigger);
+ atomic_set(&dev->stream_started, 0);
+
err = snd_card_new(dev->dev, index[devnr], "Cx231xx Audio",
THIS_MODULE, 0, &card);
if (err < 0)
return err;
- spin_lock_init(&adev->slock);
err = snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm);
if (err < 0)
goto err_free_card;
@@ -596,8 +603,6 @@ static int cx231xx_audio_init(struct cx231xx *dev)
strscpy(card->shortname, "Cx231xx Audio", sizeof(card->shortname));
strscpy(card->longname, "Conexant cx231xx Audio", sizeof(card->longname));
- INIT_WORK(&dev->wq_trigger, audio_trigger);
-
err = snd_card_register(card);
if (err < 0)
goto err_free_card;
@@ -651,8 +656,10 @@ static int cx231xx_audio_init(struct cx231xx *dev)
err_free_pkt_size:
kfree(adev->alt_max_pkt_size);
+ adev->alt_max_pkt_size = NULL;
err_free_card:
snd_card_free(card);
+ adev->sndcard = NULL;
return err;
}
@@ -669,6 +676,8 @@ static int cx231xx_audio_fini(struct cx231xx *dev)
return 0;
}
+ disable_work_sync(&dev->wq_trigger);
+
if (dev->adev.sndcard) {
snd_card_free_when_closed(dev->adev.sndcard);
kfree(dev->adev.alt_max_pkt_size);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 078/869] media: cx231xx: Fix cleanup path on failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 6.18 077/869] media: cx231xx-audio: drain wq_trigger before audio fini Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 079/869] firewire: core: fix source bus ID detection for AT context in big-endian systems Greg Kroah-Hartman
` (798 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Farhad Alemi, Andi Shyti,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Shyti <andi.shyti@kernel.org>
[ Upstream commit 6e30287eaf3e41b86dfb86df3b811526693d74b4 ]
If cx231xx_init_v4l2() fails the probe currently jumps to
err_init, which only unregisters the V4L2 device. The analog
devices and I2C resources are left registered while the driver
state can be released.
A subsequent driver bind attempts to create the same I2C mux
channel links and triggers a warning when the existing
"channel-0" link is encountered. The remaining devices may also
access released driver state. This produces the following warning
can't create symlink to channel 0
WARNING: drivers/i2c/i2c-mux.c:403 at i2c_mux_add_adapter+0xcd8/0xeb0
Call Trace:
i2c_mux_add_adapter+0xcdc/0xeb0
cx231xx_dev_init+0x2fb/0x1260
cx231xx_usb_probe+0xc48/0x2140
usb_probe_interface+0x657/0xc70
...
Jump to err_video_alt instead, which performs the full device
cleanup before unregistering the V4L2 device.
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://github.com/farhad-alemi/public_bug_reports/tree/main/185-warning-in-i2c-mux-add-adapter/
Fixes: 4d2a7d3509f5 ("[media] cx231xx: move analog init code to a separate function")
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: <stable@vger.kernel.org> # v3.17+
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index d96b9ab276b76..1824e36e541f8 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1828,7 +1828,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
retval = cx231xx_init_v4l2(dev, udev, interface, isoc_pipe);
if (retval)
- goto err_init;
+ goto err_video_alt;
if (dev->current_pcb_config.ts1_source != 0xff) {
/* compute alternate max packet sizes for TS1 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 079/869] firewire: core: fix source bus ID detection for AT context in big-endian systems
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 078/869] media: cx231xx: Fix cleanup path on failure Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 080/869] media: au0828: Free URBs when starting DVB streaming fails Greg Kroah-Hartman
` (797 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Sakamoto, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
[ Upstream commit 6393d75914a6ac95a05621db8d9d6a98eafe72f7 ]
The source bus ID bit in AT DMA context is not detected correctly on
big-endian systems because the little-endian data is not converted to
CPU endianness.
Fix the bug. The helper functions related to this are never used in
driver code, so extend the test to check the field instead.
Cc: stable@vger.kernel.org # v6.12
Fixes: 8db9d1557122 ("firewire: ohci: add static inline functions to serialize/deserialize data of AT DMA")
Link: https://lore.kernel.org/r/20260908122840.2886621-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/ohci-serdes-test.c | 4 ++--
drivers/firewire/ohci.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/firewire/ohci-serdes-test.c b/drivers/firewire/ohci-serdes-test.c
index 258f668619ef1..87b136e041de3 100644
--- a/drivers/firewire/ohci-serdes-test.c
+++ b/drivers/firewire/ohci-serdes-test.c
@@ -43,7 +43,7 @@ static void test_self_id_receive_buffer_deserialization(struct kunit *test)
static void test_at_data_serdes(struct kunit *test)
{
static const __le32 expected[] = {
- cpu_to_le32(0x00020e80),
+ cpu_to_le32(0x00820e80),
cpu_to_le32(0xffc2ffff),
cpu_to_le32(0xe0000000),
};
@@ -56,7 +56,7 @@ static void test_at_data_serdes(struct kunit *test)
unsigned int destination_id = ohci1394_at_data_get_destination_id(expected);
u64 destination_offset = ohci1394_at_data_get_destination_offset(expected);
- KUNIT_EXPECT_FALSE(test, has_src_bus_id);
+ KUNIT_EXPECT_TRUE(test, has_src_bus_id);
KUNIT_EXPECT_EQ(test, 0x02, speed);
KUNIT_EXPECT_EQ(test, 0x03, tlabel);
KUNIT_EXPECT_EQ(test, 0x02, retry);
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 218666cfe14a5..63ccf2f445045 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -178,7 +178,7 @@
static inline bool ohci1394_at_data_get_src_bus_id(const __le32 *data)
{
- return !!((data[0] & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
+ return !!((le32_to_cpu(data[0]) & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
}
static inline void ohci1394_at_data_set_src_bus_id(__le32 *data, bool src_bus_id)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 080/869] media: au0828: Free URBs when starting DVB streaming fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 079/869] firewire: core: fix source bus ID detection for AT context in big-endian systems Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 081/869] media: i2c: tc358743: add missing color-space strings Greg Kroah-Hartman
` (796 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit b8dd133d96a40012f4b67fd48d8ddd7306a3e024 ]
start_urb_transfer() stores each allocated URB in dev->urbs[], but sets
urb_streaming only after all URBs have been submitted. If a later URB or
transfer buffer allocation fails, earlier entries are left allocated. A
submission failure calls stop_urb_transfer(), but that function returns
immediately while urb_streaming is false, leaving both submitted and
unsubmitted URBs behind.
Make stop_urb_transfer() release every populated slot regardless of the
streaming flag and clear each slot after release. Route all start errors
through this cleanup. usb_kill_urb() safely handles both submitted and
unsubmitted URBs, while the existing preallocation check preserves the
lifetime of shared transfer buffers.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 265a6510629a ("V4L/DVB (7621): Add support for Hauppauge HVR950Q/HVR850/FusioHDTV7-USB")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/au0828/au0828-dvb.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c
index 51752a922a744..4dc6377466858 100644
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -163,9 +163,6 @@ static int stop_urb_transfer(struct au0828_dev *dev)
dprintk(2, "%s()\n", __func__);
- if (!dev->urb_streaming)
- return 0;
-
if (dev->bulk_timeout_running == 1) {
dev->bulk_timeout_running = 0;
timer_delete(&dev->bulk_timeout);
@@ -179,6 +176,7 @@ static int stop_urb_transfer(struct au0828_dev *dev)
kfree(dev->urbs[i]->transfer_buffer);
usb_free_urb(dev->urbs[i]);
+ dev->urbs[i] = NULL;
}
}
@@ -200,8 +198,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
for (i = 0; i < URB_COUNT; i++) {
dev->urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
- if (!dev->urbs[i])
- return -ENOMEM;
+ if (!dev->urbs[i]) {
+ ret = -ENOMEM;
+ goto err;
+ }
purb = dev->urbs[i];
@@ -217,7 +217,7 @@ static int start_urb_transfer(struct au0828_dev *dev)
ret = -ENOMEM;
pr_err("%s: failed big buffer allocation, err = %d\n",
__func__, ret);
- return ret;
+ goto err;
}
purb->status = -EINPROGRESS;
@@ -235,10 +235,9 @@ static int start_urb_transfer(struct au0828_dev *dev)
for (i = 0; i < URB_COUNT; i++) {
ret = usb_submit_urb(dev->urbs[i], GFP_ATOMIC);
if (ret != 0) {
- stop_urb_transfer(dev);
pr_err("%s: failed urb submission, err = %d\n",
__func__, ret);
- return ret;
+ goto err;
}
}
@@ -249,6 +248,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
dev->bulk_timeout_running = 1;
return 0;
+
+err:
+ stop_urb_transfer(dev);
+ return ret;
}
static void au0828_start_transport(struct au0828_dev *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 081/869] media: i2c: tc358743: add missing color-space strings
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 080/869] media: au0828: Free URBs when starting DVB streaming fails Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 082/869] media: go7007: bound EZ-USB I2C transfers to the usb_buf size Greg Kroah-Hartman
` (795 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linkai Gong, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
[ Upstream commit cb37e83f1bbdf0964ed0a9524ce45a0694f98205 ]
VI_STATUS3 S_V_COLOR is four bits, so the index after the shift
is 0-15. input_color_space[] only has 14 entries. Add the two
reserved values so log_status() cannot walk off the table.
Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tc358743.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index a0ca19359c431..aefc442b5737c 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1373,7 +1373,8 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
static const char * const input_color_space[] = {
"RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
"xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
- "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+ "NA(10)", "NA(11)", "NA(12)", "opYCC 601", "NA(14)",
+ "NA(15)"};
v4l2_info(sd, "-----Chip status-----\n");
v4l2_info(sd, "Chip ID: 0x%02x\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 082/869] media: go7007: bound EZ-USB I2C transfers to the usb_buf size
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 081/869] media: i2c: tc358743: add missing color-space strings Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 083/869] media: saa7146: Initialize interrupt lock before requesting IRQ Greg Kroah-Hartman
` (794 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengzhuo Wei, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengzhuo Wei <me@cherr.cc>
[ Upstream commit 816c4628b23e8c3d925978433f4dd1a13620c01b ]
go7007_usb_i2c_master_xfer() copies msgs[i].len bytes into go->usb_buf,
a 16-byte buffer embedded in struct go7007, without any length check.
The adapter declares no transfer limits, so an SMBus block transfer
issued through /dev/i2c-N can write up to 34 bytes into it and corrupt
the struct fields that follow the buffer.
Bound the transfer size with i2c_adapter_quirks so the I2C core
rejects oversized messages before they reach the driver.
Fixes: 7955f03d18d1 ("[media] go7007: move out of staging into drivers/media/usb.")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-usb.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index 334cdde81a5c8..bf3cf320b2c9c 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1029,10 +1029,16 @@ static const struct i2c_algorithm go7007_usb_algo = {
.functionality = go7007_usb_functionality,
};
+static const struct i2c_adapter_quirks go7007_usb_quirks = {
+ .max_write_len = 12,
+ .max_read_len = 15,
+};
+
static struct i2c_adapter go7007_usb_adap_templ = {
.owner = THIS_MODULE,
.name = "WIS GO7007SB EZ-USB",
.algo = &go7007_usb_algo,
+ .quirks = &go7007_usb_quirks,
};
/********************* USB add/remove functions *********************/
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 083/869] media: saa7146: Initialize interrupt lock before requesting IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 082/869] media: go7007: bound EZ-USB I2C transfers to the usb_buf size Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 084/869] media: vim2m: keep transaction buffer count stable while streaming Greg Kroah-Hartman
` (793 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit e07c75a6bc4adf1ed09ede31756261e2c6bdede5 ]
The saa7146 interrupt handler can call SAA7146_IER_DISABLE(), which
serializes register access with dev->int_slock. request_irq() allows the
shared handler to run before saa7146_init_one() reaches the current lock
initialization block.
Initialize dev->int_slock before requesting the interrupt so every handler
path sees an initialized lock.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/saa7146/saa7146_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
index 27c53eed8fe39..e908af0693d26 100644
--- a/drivers/media/common/saa7146/saa7146_core.c
+++ b/drivers/media/common/saa7146/saa7146_core.c
@@ -340,6 +340,8 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
goto out;
}
+ spin_lock_init(&dev->int_slock);
+
/* create a nice device name */
sprintf(dev->name, "saa7146 (%d)", saa7146_num);
@@ -425,7 +427,6 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
dev->ext = ext;
mutex_init(&dev->v4l2_lock);
- spin_lock_init(&dev->int_slock);
spin_lock_init(&dev->slock);
mutex_init(&dev->i2c_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 084/869] media: vim2m: keep transaction buffer count stable while streaming
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 083/869] media: saa7146: Initialize interrupt lock before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 085/869] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions Greg Kroah-Hartman
` (792 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Younho Choi, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Younho Choi <gdool88@mju.ac.kr>
[ Upstream commit 50f5fed44d8e24081e8feed5154746fe193f11b8 ]
V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m
mem2mem job processes before the job is completed. The driver stores
the value in ctx->translen and device_work() uses it later to decide
whether the current transaction should continue.
Letting userspace change this control while streaming is active can
make a queued job observe a different transaction length than the one
it started with. That leaves the transaction state inconsistent with
the buffers currently queued for the job.
Grab the transaction buffer count control while either queue is
streaming, and release it only after both queues have stopped
streaming. The V4L2 control framework then rejects changes with
-EBUSY while the value is in use, while still allowing userspace to
configure the value before streaming starts.
Keep the control handler alive until after v4l2_m2m_ctx_release(),
since releasing the mem2mem context can call stop_streaming(), which
now ungrabs the control.
Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device")
Cc: stable@vger.kernel.org
Signed-off-by: Younho Choi <gdool88@mju.ac.kr>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
index 86c32699111ad..5db440bf728e9 100644
--- a/drivers/media/test-drivers/vim2m.c
+++ b/drivers/media/test-drivers/vim2m.c
@@ -205,6 +205,7 @@ struct vim2m_ctx {
struct vim2m_dev *dev;
struct v4l2_ctrl_handler hdl;
+ struct v4l2_ctrl *trans_num_bufs_ctrl;
/* Processed buffers in this transaction */
u8 num_processed;
@@ -1270,9 +1271,27 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count)
ctx->aborting = 0;
q_data->sequence = 0;
+ v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true);
+
return 0;
}
+static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx,
+ struct vb2_queue *q)
+{
+ struct vb2_queue *other_vq;
+
+ if (!ctx->fh.m2m_ctx)
+ return false;
+
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ other_vq = v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx);
+ else
+ other_vq = v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx);
+
+ return vb2_is_streaming(other_vq);
+}
+
static void vim2m_stop_streaming(struct vb2_queue *q)
{
struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
@@ -1286,11 +1305,14 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
else
vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
if (!vbuf)
- return;
+ break;
v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req,
&ctx->hdl);
v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
}
+
+ if (!vim2m_other_queue_is_streaming(ctx, q))
+ v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false);
}
static void vim2m_buf_request_complete(struct vb2_buffer *vb)
@@ -1392,7 +1414,8 @@ static int vim2m_open(struct file *file)
vim2m_ctrl_trans_time_msec.def = default_transtime;
v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL);
- v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
+ ctx->trans_num_bufs_ctrl =
+ v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
if (hdl->error) {
rc = hdl->error;
v4l2_ctrl_handler_free(hdl);
@@ -1447,10 +1470,10 @@ static int vim2m_release(struct file *file)
v4l2_fh_del(&ctx->fh, file);
v4l2_fh_exit(&ctx->fh);
- v4l2_ctrl_handler_free(&ctx->hdl);
mutex_lock(&dev->dev_mutex);
v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
mutex_unlock(&dev->dev_mutex);
+ v4l2_ctrl_handler_free(&ctx->hdl);
kfree(ctx);
atomic_dec(&dev->num_inst);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 085/869] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 084/869] media: vim2m: keep transaction buffer count stable while streaming Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 086/869] media: vicodec: make encoder CAPTURE dimensions read-only Greg Kroah-Hartman
` (791 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 0183746ebca4c478027e2261b904f844f1443b19 ]
A capture format whose width or height is one more than a multiple of 16
makes the FWHT codec write one 8x8 block row, or column, past the end of
the capture plane, and read the same block out of the reference frame for
P-coded frames.
vic_round_dim() is documented to round a frame dimension up so that both
the luma and the chroma plane end up a multiple of 8, but it only rounds
the chroma plane:
round_up((dim) / (div), 8) * (div)
For div == 2 the result is a multiple of 16 in every case but one: when
dim % 16 == 1, dim / div is already a multiple of 8 and the macro returns
dim - 1. encode_plane() and decode_plane() round the same dimension with
round_up(dim, 8), which yields dim + 7 -- one block more than the coded
dimension that sized the buffer.
On a KASAN-enabled kernel, a 641x360 YUYV P-frame triggers:
BUG: KASAN: slab-out-of-bounds in add_deltas+0x450/0xcc0
Read of size 1 at addr ffff888009070800 by task trigger_bin/70
Call Trace:
add_deltas+0x450/0xcc0
decode_plane+0x1916/0x3390
fwht_decode_frame+0x173/0x620
v4l2_fwht_decode+0x751/0x1120
device_run+0x6bb/0x1850
Round the dimension itself up to a multiple of 8 * div. The rounding
changes only for div == 2 and dim % 16 == 1, and MAX_WIDTH and MAX_HEIGHT
are both multiples of 16, so the rounded value still fits the advertised
limits.
Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/codec-fwht.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/test-drivers/vicodec/codec-fwht.h b/drivers/media/test-drivers/vicodec/codec-fwht.h
index 0eab24020e9e6..4b4d390310899 100644
--- a/drivers/media/test-drivers/vicodec/codec-fwht.h
+++ b/drivers/media/test-drivers/vicodec/codec-fwht.h
@@ -61,7 +61,7 @@
* both luma and chroma components resolutions are rounded up to
* a multiple of 8
*/
-#define vic_round_dim(dim, div) (round_up((dim) / (div), 8) * (div))
+#define vic_round_dim(dim, div) round_up(dim, 8 * (div))
struct fwht_cframe_hdr {
u32 magic1;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 086/869] media: vicodec: make encoder CAPTURE dimensions read-only
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 085/869] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 087/869] media: vidtv: fix frontend reference leak on unbind Greg Kroah-Hartman
` (790 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 2532e9d2f8ccb330a9c924b1ee34c5629240d352 ]
Setting the encoder's compressed CAPTURE format to a smaller resolution
than the raw OUTPUT format makes the encoder write past the end of the
CAPTURE buffer.
For a stateful encoder the CAPTURE width and height are not
client-settable; Documentation/userspace-api/media/v4l/dev-encoder.rst
specifies them as "ignored (read-only)" on VIDIOC_S_FMT. vicodec only
implements half of that: vidioc_s_fmt_vid_out() derives the CAPTURE coded
size and sizeimage from the OUTPUT format, but S_FMT on the CAPTURE queue
overwrites them. The encoder then takes its geometry from the OUTPUT
queue alone, and v4l2_fwht_encode() gets no destination length.
Overwrite the requested width and height with the OUTPUT queue's coded
dimensions in vidioc_try_fmt_vid_cap(), making them read-only as the
interface requires.
Fixes: efec9c815e5d ("media: vicodec: pass on enc output format to capture side")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 654da27b11406..cdc3af33b4bbe 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -893,6 +893,8 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
struct v4l2_format *f)
{
struct vicodec_ctx *ctx = file2ctx(file);
+ struct vicodec_q_data *q_data_out =
+ get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
struct v4l2_pix_format_mplane *pix_mp;
struct v4l2_pix_format *pix;
@@ -903,6 +905,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
pix = &f->fmt.pix;
pix->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
find_fmt(f->fmt.pix.pixelformat)->id;
+ if (ctx->is_enc) {
+ pix->width = q_data_out->coded_width;
+ pix->height = q_data_out->coded_height;
+ }
pix->colorspace = ctx->state.colorspace;
pix->xfer_func = ctx->state.xfer_func;
pix->ycbcr_enc = ctx->state.ycbcr_enc;
@@ -914,6 +920,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
pix_mp = &f->fmt.pix_mp;
pix_mp->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
find_fmt(pix_mp->pixelformat)->id;
+ if (ctx->is_enc) {
+ pix_mp->width = q_data_out->coded_width;
+ pix_mp->height = q_data_out->coded_height;
+ }
pix_mp->colorspace = ctx->state.colorspace;
pix_mp->xfer_func = ctx->state.xfer_func;
pix_mp->ycbcr_enc = ctx->state.ycbcr_enc;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 087/869] media: vidtv: fix frontend reference leak on unbind
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 086/869] media: vicodec: make encoder CAPTURE dimensions read-only Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 088/869] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail Greg Kroah-Hartman
` (789 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+32f018fd65e799f79ae0,
Piyush Patle, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Patle <piyushpatle228@gmail.com>
[ Upstream commit 6f412f9fe6a1f3ce9694757f50353bbec221d832 ]
dvb_register_frontend() keeps two references to the frontend. One is
released by dvb_unregister_frontend(), and the other by
dvb_frontend_detach(). vidtv only called dvb_unregister_frontend(), so
the second reference was never released. As a result,
__dvb_frontend_free() was never called, leaking the frontend private
data and its struct dvb_device.
The detach call was removed by commit 63101b756893 ("media: vidtv: fix
driver unbind/remove") because it caused an OOPS. The demod .release
callback freed vidtv_demod_state, and the I2C remove callbacks then
accessed the freed state.
That commit also removed those accesses from the I2C remove callbacks.
Restore the detach call, but remove the demod .release callback.
vidtv_demod_state is owned by the I2C client and is already freed by
vidtv_demod_i2c_remove(), so the frontend detach path should not free
it.
Tested with kmemleak and KASAN over 10 bind/unbind cycles. The reported
frontend and dvb_device leaks were present before the fix and were gone
after it, with no KASAN reports.
Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=32f018fd65e799f79ae0
Fixes: 63101b756893 ("media: vidtv: fix driver unbind/remove")
Cc: stable@vger.kernel.org
Tested-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
drivers/media/test-drivers/vidtv/vidtv_demod.c | 9 ---------
2 files changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index 8a8e097d2ac96..d6b90290bd4dd 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -474,6 +474,7 @@ static int vidtv_bridge_dvb_init(struct vidtv_dvb *dvb)
fail_demod_probe:
for (i = i - 1; i >= 0; --i) {
dvb_unregister_frontend(dvb->fe[i]);
+ dvb_frontend_detach(dvb->fe[i]);
fail_fe:
dvb_module_release(dvb->i2c_client_tuner[i]);
fail_tuner_probe:
@@ -552,6 +553,7 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
for (i = 0; i < NUM_FE; ++i) {
dvb_unregister_frontend(dvb->fe[i]);
+ dvb_frontend_detach(dvb->fe[i]);
dvb_module_release(dvb->i2c_client_tuner[i]);
dvb_module_release(dvb->i2c_client_demod[i]);
}
diff --git a/drivers/media/test-drivers/vidtv/vidtv_demod.c b/drivers/media/test-drivers/vidtv/vidtv_demod.c
index 505f96fccbf30..36bfeb33476b2 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_demod.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_demod.c
@@ -343,13 +343,6 @@ static int vidtv_diseqc_send_burst(struct dvb_frontend *fe,
return 0;
}
-static void vidtv_demod_release(struct dvb_frontend *fe)
-{
- struct vidtv_demod_state *state = fe->demodulator_priv;
-
- kfree(state);
-}
-
static const struct dvb_frontend_ops vidtv_demod_ops = {
.delsys = {
SYS_DVBT,
@@ -390,8 +383,6 @@ static const struct dvb_frontend_ops vidtv_demod_ops = {
FE_CAN_HIERARCHY_AUTO,
},
- .release = vidtv_demod_release,
-
.set_frontend = vidtv_demod_set_frontend,
.get_frontend = vidtv_demod_get_frontend,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 088/869] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 087/869] media: vidtv: fix frontend reference leak on unbind Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 089/869] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA Greg Kroah-Hartman
` (788 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c7fc4794e59786f5b4dc,
Jeffin Philip, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
[ Upstream commit 2af02ccd048b77713695d7817cf645ca50bf349e ]
Attempting to unbind a dvbdevice that is in the process of feeding
data causes a UAF as we free the underlying device without
stopping the feed first. Fix this by stopping the stream first using
vidtv_stop_streaming(). However, our codepath in the reproducer
(mentioned in the below reply) does not decrement our users
(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
by our read() in the reproducer, that is only possible on .release.
This can cause a task hang as dvb_dmxdev_release() uses wait_event()
in the wait_queue unless we use a close(fd)(in the reproducer).
Is this a problem? Please advise.
Reported-by: syzbot+c7fc4794e59786f5b4dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c7fc4794e59786f5b4dc
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index d6b90290bd4dd..60310ece35302 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -551,6 +551,8 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
mutex_destroy(&dvb->feed_lock);
+ vidtv_stop_streaming(dvb);
+
for (i = 0; i < NUM_FE; ++i) {
dvb_unregister_frontend(dvb->fe[i]);
dvb_frontend_detach(dvb->fe[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 089/869] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 088/869] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 090/869] staging: media: av7110: fix corrupted BER reporting in sp8870 Greg Kroah-Hartman
` (787 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Julian Braha, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Braha <julianbraha@gmail.com>
[ Upstream commit 1179929b3abd4adb6ca7fae91d649c64a7293aca ]
VIDEO_MMP_CAMERA selects I2C_GPIO without ensuring
'GPIOLIB || COMPILE_TEST' is enabled, despite I2C_GPIO depending on it.
Let's add the same dependency to VIDEO_MMP_CAMERA.
This unmet dependency bug was found by kconfirm, a static analysis tool for
Kconfig.
Fixes: 67a8dbbc4e04 ("[media] marvell-cam: Basic working MMP camera driver")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Braha <julianbraha@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/marvell/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/marvell/Kconfig b/drivers/media/platform/marvell/Kconfig
index d31f4730f2a38..ab58175e433c3 100644
--- a/drivers/media/platform/marvell/Kconfig
+++ b/drivers/media/platform/marvell/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_MMP_CAMERA
depends on V4L_PLATFORM_DRIVERS
depends on I2C && VIDEO_DEV
depends on ARCH_MMP || COMPILE_TEST
+ depends on GPIOLIB || COMPILE_TEST
depends on COMMON_CLK
select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR
select I2C_GPIO
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 090/869] staging: media: av7110: fix corrupted BER reporting in sp8870
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 089/869] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 091/869] staging: media: av7110: fix sp8870 initialization failure state Greg Kroah-Hartman
` (786 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Punnay Sharma, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Punnay Sharma <punnaysharma805@gmail.com>
[ Upstream commit 5764f9bd7b7a72c6df49db6c8c00d4f9994a55ba ]
In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).
The current implementation masks the lower bits via `tmp = ret & 0x3F;`
but subsequently overwrites `tmp` entirely when processing the upper
bits using a direct assignment (`tmp = ret << 6;`). This logical error
causes the lower 6 bits of the BER hardware metric to be silently
discarded.
Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
the MSB and LSB payloads before returning the metric to the DVB core.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/av7110/sp8870.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 0c813860f5b20..96fd738777744 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -401,7 +401,7 @@ static int sp8870_read_ber(struct dvb_frontend *fe, u32 *ber)
if (ret < 0)
return -EIO;
- tmp = ret << 6;
+ tmp |= ret << 6;
if (tmp >= 0x3FFF0)
tmp = ~0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 091/869] staging: media: av7110: fix sp8870 initialization failure state
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 090/869] staging: media: av7110: fix corrupted BER reporting in sp8870 Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 092/869] media: m2m-deinterlace: fix default capture field Greg Kroah-Hartman
` (785 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Punnay Sharma, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Punnay Sharma <punnaysharma805@gmail.com>
[ Upstream commit 30684fa98394bc0eb4362282908612aab7d4dad9 ]
The SP8870 DVB frontend driver prematurely flags the device as
initialized at the very beginning of the sp8870_init() routine, prior
to requesting the firmware (dvb-fe-sp8870.fw) and executing the I2C
upload sequence.
If request_firmware() times out or sp8870_firmware_upload() encounters
an I2C bus error, the function aborts and returns -EIO. However,
because `state->initialised` is already set to 1, all subsequent
invocations of `fe->ops.init()` by the DVB core will immediately return
0 (success) without attempting to load the firmware again. This leaves
the demodulator microcontroller halted and the frontend permanently dead
until the module is forcibly reloaded.
Relocate the `state->initialised = 1` assignment to the end of
sp8870_init(), ensuring the flag is only set after the firmware is
successfully uploaded and the system controller is actually restarted.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/av7110/sp8870.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 96fd738777744..b5b49f1ef5e7b 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -315,7 +315,6 @@ static int sp8870_init(struct dvb_frontend *fe)
sp8870_wake_up(state);
if (state->initialised)
return 0;
- state->initialised = 1;
dprintk("initialising frontend...\n");
@@ -353,6 +352,8 @@ static int sp8870_init(struct dvb_frontend *fe)
sp8870_writereg(state, 0x0D00, 0x010);
sp8870_writereg(state, 0x0D01, 0x000);
+ state->initialised = 1;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 092/869] media: m2m-deinterlace: fix default capture field
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 091/869] staging: media: av7110: fix sp8870 initialization failure state Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 093/869] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ Greg Kroah-Hartman
` (784 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacopo Mondi, Xu Rao, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
[ Upstream commit 4ee3ebede5d01efdcdd88c94f9df271d2eb237de ]
queue_init() initializes default formats for both the source and capture
queues. It first sets the source field to V4L2_FIELD_SEQ_TB, but then
stores the capture default, V4L2_FIELD_INTERLACED_TB, in the source queue
again while initializing the capture queue.
This overwrites the valid source default and leaves the capture field at
its zero-initialized value, V4L2_FIELD_ANY. vidioc_streamon() accepts
only V4L2_FIELD_SEQ_TB or V4L2_FIELD_SEQ_BT on the source queue, and
requires the capture queue to use a compatible interlaced or NONE field.
Userspace that relies on the default formats can therefore get -EINVAL
when starting streaming.
Initialize the capture field instead. The bug is usually hidden because
mem2mem applications commonly call S_FMT on both queues before streaming;
the TRY_FMT paths normalize the fields and S_FMT overwrites q_data[].field.
Fixes: 8f0755c06b90 ("[media] media: Add mem2mem deinterlacing driver")
Cc: stable@vger.kernel.org
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/m2m-deinterlace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/m2m-deinterlace.c b/drivers/media/platform/m2m-deinterlace.c
index e07e57d4206ba..83d6c54f015db 100644
--- a/drivers/media/platform/m2m-deinterlace.c
+++ b/drivers/media/platform/m2m-deinterlace.c
@@ -829,7 +829,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq,
q_data[V4L2_M2M_DST].width = 640;
q_data[V4L2_M2M_DST].height = 480;
q_data[V4L2_M2M_DST].sizeimage = (640 * 480 * 3) / 2;
- q_data[V4L2_M2M_SRC].field = V4L2_FIELD_INTERLACED_TB;
+ q_data[V4L2_M2M_DST].field = V4L2_FIELD_INTERLACED_TB;
return vb2_queue_init(dst_vq);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 093/869] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 092/869] media: m2m-deinterlace: fix default capture field Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 094/869] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
` (783 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 233d36a96009682208cc4ca1139b9e5641a8bf09 ]
wsa_macro_set_spkr_mode() unconditionally writes CDC_WSA_COMPANDER1_CTL3
(0x5CC) and CDC_WSA_COMPANDER1_CTL7 (0x5DC). On v2.5+ silicon these
registers moved to CDC_2_5_WSA_COMPANDER1_CTL3 (0x5EC) and
CDC_2_5_WSA_COMPANDER1_CTL7 (0x5FC); the v2.1 addresses are dead on
that hardware, so the update_bits() calls take a bus error:
wsa_macro 6c90000.codec: ASoC error (-5): at
snd_soc_component_update_bits() on 6c90000.codec for
register: [0x000005dc]
The flat regcache had been hiding the read side of this by returning
the zero-initialised cache slot instead of doing a bus read, so the
error only becomes visible once the cache reports the miss honestly
and regmap falls back to a real bus read.
Select the correct address for Compander1 CTL3/CTL7 based on
codec_version. The Compander0 and Boost registers used in the same
function have the same address across versions, so they stay
unchanged. Also collapse the two mode branches to a single sequence
with mode-selected values, which is what the switch was doing anyway.
Fixes: 727de4fbc546 ("ASoC: codecs: lpass-wsa-macro: Correct support for newer v2.5 version")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260908082806.648797-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-wsa-macro.c | 42 ++++++++++++++++++------------
1 file changed, 25 insertions(+), 17 deletions(-)
diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
index 8350b02b575fb..f094225ba40a4 100644
--- a/sound/soc/codecs/lpass-wsa-macro.c
+++ b/sound/soc/codecs/lpass-wsa-macro.c
@@ -1129,27 +1129,35 @@ static const struct regmap_config wsa_regmap_config = {
int wsa_macro_set_spkr_mode(struct snd_soc_component *component, int mode)
{
struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
+ unsigned int comp1_ctl3, comp1_ctl7;
+ u8 comp_val, boost_val;
wsa->spkr_mode = mode;
- switch (mode) {
- case WSA_MACRO_SPKR_MODE_1:
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x44);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x44);
- break;
- default:
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x80);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x80);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x01);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x01);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x58);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x58);
- break;
+ /* Compander1 CTL3/CTL7 moved on v2.5+ silicon. */
+ if (wsa->codec_version >= LPASS_CODEC_VERSION_2_5) {
+ comp1_ctl3 = CDC_2_5_WSA_COMPANDER1_CTL3;
+ comp1_ctl7 = CDC_2_5_WSA_COMPANDER1_CTL7;
+ } else {
+ comp1_ctl3 = CDC_WSA_COMPANDER1_CTL3;
+ comp1_ctl7 = CDC_WSA_COMPANDER1_CTL7;
}
+
+ if (mode == WSA_MACRO_SPKR_MODE_1) {
+ comp_val = 0x00;
+ boost_val = 0x44;
+ } else {
+ comp_val = 0x80;
+ boost_val = 0x58;
+ }
+
+ snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, comp_val);
+ snd_soc_component_update_bits(component, comp1_ctl3, 0x80, comp_val);
+ snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, comp_val ? 0x01 : 0x00);
+ snd_soc_component_update_bits(component, comp1_ctl7, 0x01, comp_val ? 0x01 : 0x00);
+ snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, boost_val);
+ snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, boost_val);
+
return 0;
}
EXPORT_SYMBOL(wsa_macro_set_spkr_mode);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 094/869] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 093/869] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 095/869] media: microchip-isc: fix awb_mutex and lock lifecycle Greg Kroah-Hartman
` (782 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Wang Yan,
Athira Rajeev, Arnaldo Carvalho de Melo, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit d9c7e2ede92ce258a5d4a6cbc55f75acd379c97d ]
min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements. POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself. A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.
This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").
Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.
Fixes: c4bbd4ec2e50a9ed ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/powerpc-vpadtl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index 55b9b6e070746..eacc845ebda26 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -681,7 +681,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
struct perf_session *session)
{
struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
- size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
+ size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
struct powerpc_vpadtl *vpa;
int err;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 095/869] media: microchip-isc: fix awb_mutex and lock lifecycle
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 094/869] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 096/869] media: microchip-isc: synchronize the IRQ before disabling clocks on stop Greg Kroah-Hartman
` (781 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Balakrishnan Sambath,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 5540b48c0702f6a1389db3d473d7fd0db930422a ]
isc->lock and awb_mutex were initialised in isc_async_complete() and
destroyed in isc_async_unbind(), tying their lifetime to the subdev
bind/unbind cycle instead of the device:
- isc_async_unbind() destroyed awb_mutex before cancel_work_sync(),
which takes it;
- a failed .complete() left them initialised, and isc->lock was
destroyed only on the .complete() error path, so the normal unbind
path leaked it;
- a rebind runs .complete() again and reinitialises a live mutex.
Initialise both with devm_mutex_init() at probe so they live for the
whole device lifetime and are freed at remove, and drop the init and
destroy from the .complete()/.unbind() callbacks.
isc_async_complete_err then only returned ret, so drop the label and
return directly at each error site.
Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/microchip/microchip-isc-base.c | 15 ++++-----------
.../platform/microchip/microchip-sama5d2-isc.c | 9 +++++++++
.../platform/microchip/microchip-sama7g5-isc.c | 9 +++++++++
3 files changed, 22 insertions(+), 11 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 32bdeae04ad07..ca4f3b5f58aa9 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1703,7 +1703,6 @@ static void isc_async_unbind(struct v4l2_async_notifier *notifier,
{
struct isc_device *isc = container_of(notifier->v4l2_dev,
struct isc_device, v4l2_dev);
- mutex_destroy(&isc->awb_mutex);
cancel_work_sync(&isc->awb_work);
video_unregister_device(&isc->video_dev);
v4l2_ctrl_handler_free(&isc->ctrls.handler);
@@ -1767,8 +1766,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
isc->current_subdev = container_of(notifier,
struct isc_subdev_entity, notifier);
- mutex_init(&isc->lock);
- mutex_init(&isc->awb_mutex);
init_completion(&isc->comp);
@@ -1787,7 +1784,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = vb2_queue_init(q);
if (ret < 0) {
dev_err(isc->dev, "vb2_queue_init() failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
/* Init video dma queues */
@@ -1798,13 +1795,13 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = isc_set_default_fmt(isc);
if (ret) {
dev_err(isc->dev, "Could not set default format\n");
- goto isc_async_complete_err;
+ return ret;
}
ret = isc_ctrl_init(isc);
if (ret) {
dev_err(isc->dev, "Init isc ctrols failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
/* Register video device */
@@ -1824,7 +1821,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
if (ret < 0) {
dev_err(isc->dev, "video_register_device failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
ret = isc_scaler_link(isc);
@@ -1839,10 +1836,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
isc_async_complete_unregister_device:
video_unregister_device(vdev);
-
-isc_async_complete_err:
- mutex_destroy(&isc->awb_mutex);
- mutex_destroy(&isc->lock);
return ret;
}
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 88e6d8e1c6c9c..18e1ec0b94fa6 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -30,6 +30,7 @@
#include <linux/interrupt.h>
#include <linux/math64.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/of_graph.h>
#include <linux/platform_device.h>
@@ -424,6 +425,14 @@ static int microchip_isc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, isc);
isc->dev = dev;
+ ret = devm_mutex_init(dev, &isc->lock);
+ if (ret)
+ return ret;
+
+ ret = devm_mutex_init(dev, &isc->awb_mutex);
+ if (ret)
+ return ret;
+
io_base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(io_base))
return PTR_ERR(io_base);
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 77c6c183451bf..07cfe1109ff09 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -33,6 +33,7 @@
#include <linux/interrupt.h>
#include <linux/math64.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/of_graph.h>
#include <linux/platform_device.h>
@@ -413,6 +414,14 @@ static int microchip_xisc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, isc);
isc->dev = dev;
+ ret = devm_mutex_init(dev, &isc->lock);
+ if (ret)
+ return ret;
+
+ ret = devm_mutex_init(dev, &isc->awb_mutex);
+ if (ret)
+ return ret;
+
io_base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(io_base))
return PTR_ERR(io_base);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 096/869] media: microchip-isc: synchronize the IRQ before disabling clocks on stop
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 095/869] media: microchip-isc: fix awb_mutex and lock lifecycle Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 097/869] media: microchip-isc: disable histogram and flush AWB work on teardown Greg Kroah-Hartman
` (780 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 19fa5407da5ef3e605cacfcd90f70d8b2c121cd7 ]
isc_stop_streaming() masks the DMA interrupt and then drops the runtime
PM reference, which disables the ISC clocks. microchip_isc_interrupt()
may still be executing on another CPU at that point; it reads ISC_INTSR
over regmap, and touching the unclocked registers triggers an external
abort.
Store the IRQ number at probe and call synchronize_irq() after masking
the interrupt, before dropping the PM reference.
Fixes: 106267444f12 ("[media] atmel-isc: add the Image Sensor Controller code")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-base.c | 3 +++
drivers/media/platform/microchip/microchip-isc.h | 1 +
drivers/media/platform/microchip/microchip-sama5d2-isc.c | 2 ++
drivers/media/platform/microchip/microchip-sama7g5-isc.c | 2 ++
4 files changed, 8 insertions(+)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index ca4f3b5f58aa9..debbc38717de1 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -425,6 +425,9 @@ static void isc_stop_streaming(struct vb2_queue *vq)
/* Disable DMA interrupt */
regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
+ /* let a running IRQ handler finish before the clock is disabled */
+ synchronize_irq(isc->irq);
+
pm_runtime_put_sync(isc->dev);
/* Disable stream on the sub device */
diff --git a/drivers/media/platform/microchip/microchip-isc.h b/drivers/media/platform/microchip/microchip-isc.h
index ad4e98a1dd8fc..f5e322c2e36bc 100644
--- a/drivers/media/platform/microchip/microchip-isc.h
+++ b/drivers/media/platform/microchip/microchip-isc.h
@@ -287,6 +287,7 @@ struct isc_device {
u32 dcfg;
struct device *dev;
+ int irq;
struct v4l2_device v4l2_dev;
struct video_device video_dev;
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 18e1ec0b94fa6..5bd109e93a8fb 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -448,6 +448,8 @@ static int microchip_isc_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ isc->irq = irq;
+
ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
"microchip-sama5d2-isc", isc);
if (ret < 0) {
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 07cfe1109ff09..d978ce448a4d2 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -437,6 +437,8 @@ static int microchip_xisc_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ isc->irq = irq;
+
ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
"microchip-sama7g5-xisc", isc);
if (ret < 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 097/869] media: microchip-isc: disable histogram and flush AWB work on teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 096/869] media: microchip-isc: synchronize the IRQ before disabling clocks on stop Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 098/869] media: microchip-isc: do not touch WB registers when not streaming Greg Kroah-Hartman
` (779 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 00d87c379915a3689b2488bd37f490875d79e20f ]
isc_stop_streaming() and the isc_start_streaming() error path dropped the
runtime PM reference with the histogram still enabled. A HISDONE firing
just before the stop, or a failed isc_update_profile() on the start path,
can queue isc_awb_work(), which reads the histogram registers before
taking its own PM reference and faults on the unclocked device.
Disable the histogram, synchronize the IRQ and flush the work before the
device is left unclocked. isc_configure() is the one enabling the
histogram and then calling isc_update_profile(), so do the cleanup in its
own failure path; isc_stop_streaming() does the same on teardown.
synchronize_irq() must come before cancel_work_sync(), so an in-flight
handler cannot re-queue awb_work after it is cancelled.
Fixes: 93d4a26c3dab ("[media] atmel-isc: add the isc pipeline function")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/microchip/microchip-isc-base.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index debbc38717de1..0f486dd5bd82c 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -289,6 +289,7 @@ static int isc_configure(struct isc_device *isc)
struct regmap *regmap = isc->regmap;
u32 pfe_cfg0, dcfg, mask, pipeline;
struct isc_subdev_entity *subdev = isc->current_subdev;
+ int ret;
pfe_cfg0 = isc->config.sd_format->pfe_cfg0_bps;
pipeline = isc->config.bits_pipeline;
@@ -321,7 +322,15 @@ static int isc_configure(struct isc_device *isc)
isc_set_histogram(isc, false);
/* Update profile */
- return isc_update_profile(isc);
+ ret = isc_update_profile(isc);
+ if (ret) {
+ /* flush the histogram work before the clocks are gated */
+ isc_set_histogram(isc, false);
+ synchronize_irq(isc->irq);
+ cancel_work_sync(&isc->awb_work);
+ }
+
+ return ret;
}
static int isc_prepare_streaming(struct vb2_queue *vq)
@@ -425,9 +434,13 @@ static void isc_stop_streaming(struct vb2_queue *vq)
/* Disable DMA interrupt */
regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
+ isc_set_histogram(isc, false);
+
/* let a running IRQ handler finish before the clock is disabled */
synchronize_irq(isc->irq);
+ cancel_work_sync(&isc->awb_work);
+
pm_runtime_put_sync(isc->dev);
/* Disable stream on the sub device */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 098/869] media: microchip-isc: do not touch WB registers when not streaming
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 097/869] media: microchip-isc: disable histogram and flush AWB work on teardown Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 099/869] media: microchip-isc: fix PM runtime leak in AWB work handler Greg Kroah-Hartman
` (778 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Balakrishnan Sambath,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit d8983c47d4d95eb1ed889dbb7516d3738fa854d8 ]
isc_s_awb_ctrl() called isc_update_awb_ctrls() unconditionally, writing
the white balance registers even when the device is runtime suspended;
on many ARM platforms accessing the unclocked registers is an external
abort. The write was also done without awb_lock, racing isc_awb_work(),
which holds it so the DMA done IRQ cannot latch a half-updated pipeline.
Write the registers only while streaming and not stopping, under
awb_lock, and update the profile there. The isc->stop check covers the
window where isc_stop_streaming() has gated the clocks but vb2 still
reports streaming. Otherwise the new values stay cached and
isc_configure() programs them at the next stream start.
Fixes: 4e52889f48fe ("media: atmel: atmel-isc-base: expose white balance as v4l2 controls")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/microchip/microchip-isc-base.c | 20 +++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 0f486dd5bd82c..cf4611443fd13 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1511,20 +1511,24 @@ static int isc_s_awb_ctrl(struct v4l2_ctrl *ctrl)
if (ctrl->cluster[ISC_CTRL_GB_OFF]->is_new)
ctrls->offset[ISC_HIS_CFG_MODE_GB] = isc->gb_off_ctrl->val;
- isc_update_awb_ctrls(isc);
-
mutex_lock(&isc->awb_mutex);
- if (vb2_is_streaming(&isc->vb2_vidq)) {
+ if (vb2_is_streaming(&isc->vb2_vidq) && !isc->stop) {
+ unsigned long flags;
+
/*
- * If we are streaming, we can update profile to
- * have the new settings in place.
+ * awb_lock keeps the DMA done IRQ from latching a
+ * partially written WB pipeline.
*/
+ spin_lock_irqsave(&isc->awb_lock, flags);
+ isc_update_awb_ctrls(isc);
+ spin_unlock_irqrestore(&isc->awb_lock, flags);
+
isc_update_profile(isc);
} else {
/*
- * The auto cluster will activate automatically this
- * control. This has to be deactivated when not
- * streaming.
+ * Not streaming: keep the cached values for the next
+ * stream start and deactivate the cluster-activated
+ * do_white_balance button.
*/
v4l2_ctrl_activate(isc->do_wb_ctrl, false);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 099/869] media: microchip-isc: fix PM runtime leak in AWB work handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 098/869] media: microchip-isc: do not touch WB registers when not streaming Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 100/869] media: microchip-isc: dont sleep in the clk .is_enabled callback Greg Kroah-Hartman
` (777 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 21ad8225822a892c4c273bf1368d477a83a19dbb ]
Early return when streaming stops skips pm_runtime_put_sync(),
leaking the reference and preventing runtime suspend.
Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-base.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index cf4611443fd13..21d108eb93c7b 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1432,7 +1432,7 @@ static void isc_awb_work(struct work_struct *w)
/* streaming is not active anymore */
if (isc->stop) {
mutex_unlock(&isc->awb_mutex);
- return;
+ goto out_pm_put;
}
isc_update_profile(isc);
@@ -1443,6 +1443,7 @@ static void isc_awb_work(struct work_struct *w)
if (ctrls->awb)
regmap_write(regmap, ISC_CTRLEN, ISC_CTRL_HISREQ);
+out_pm_put:
pm_runtime_put_sync(isc->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 100/869] media: microchip-isc: dont sleep in the clk .is_enabled callback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 099/869] media: microchip-isc: fix PM runtime leak in AWB work handler Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 101/869] media: stm32: csi: correct remote pad retrieval Greg Kroah-Hartman
` (776 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 61490ff518c7b3ea3ff1cd16bbc012e9e4f1ab74 ]
isc_clk_is_enabled() calls pm_runtime_resume_and_get() and
pm_runtime_put_sync(), which can sleep and are not safe here, as
.is_enabled must run in atomic context. clk_disable_unused() calls it so
at boot, and CONFIG_DEBUG_ATOMIC_SLEEP reports a "sleeping function
called from invalid context" BUG.
Use the atomic-safe pm_runtime_get_if_active() and pm_runtime_put()
instead. A suspended ISC has its clocks gated, so report the clock
disabled when the device is not already active.
Fixes: 01192aa1c5c2 ("media: atmel-isc: Enable the clocks during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-clk.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-clk.c b/drivers/media/platform/microchip/microchip-isc-clk.c
index 24358d804e75d..66dc522a61908 100644
--- a/drivers/media/platform/microchip/microchip-isc-clk.c
+++ b/drivers/media/platform/microchip/microchip-isc-clk.c
@@ -98,15 +98,14 @@ static int isc_clk_is_enabled(struct clk_hw *hw)
{
struct isc_clk *isc_clk = to_isc_clk(hw);
u32 status;
- int ret;
- ret = pm_runtime_resume_and_get(isc_clk->dev);
- if (ret < 0)
+ /* Runs in atomic context, so must not sleep to resume the ISC. */
+ if (pm_runtime_get_if_active(isc_clk->dev) <= 0)
return 0;
regmap_read(isc_clk->regmap, ISC_CLKSR, &status);
- pm_runtime_put_sync(isc_clk->dev);
+ pm_runtime_put(isc_clk->dev);
return status & ISC_CLK(isc_clk->id) ? 1 : 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 101/869] media: stm32: csi: correct remote pad retrieval
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 100/869] media: microchip-isc: dont sleep in the clk .is_enabled callback Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 102/869] media: stm32: csi: unregister async notifier on cleanup Greg Kroah-Hartman
` (775 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alain Volmat, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alain Volmat <alain.volmat@foss.st.com>
[ Upstream commit b83651d321d4fd07979a59f359dcb0266391f17a ]
The function media_entity_get_fwnode_pad is called in order to
retrieve the remote pad, which is the source of the CSI.
However this function is expecting the sensor endpoint fwnode
and not sensor device fwnode as it is currently given.
Correct this by properly relying on the notified matched fwnode
data instead of the subdev entity fwnode.
Cc: stable@kernel.org
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-csi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index fd2b6dfbd44c5..ecd0ed8e76b59 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -825,7 +825,7 @@ static int stm32_csi_async_bound(struct v4l2_async_notifier *notifier,
int remote_pad;
remote_pad = media_entity_get_fwnode_pad(&s_subdev->entity,
- s_subdev->fwnode,
+ asd->match.fwnode,
MEDIA_PAD_FL_SOURCE);
if (remote_pad < 0) {
dev_err(csidev->dev, "Couldn't find output pad for subdev %s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 102/869] media: stm32: csi: unregister async notifier on cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 101/869] media: stm32: csi: correct remote pad retrieval Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 103/869] mtd: rawnand: sunxi: reject ECC maximization on small pages Greg Kroah-Hartman
` (774 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 4957d480a0c87cf3d024e6ff1f57d1222f9212cb ]
stm32_csi_parse_dt() registers the async notifier before probe finishes.
If a later operation fails, the error path only cleans up the notifier's
connections. It does not unregister the notifier, leaving its entry on
the global notifier list after the devm-allocated csidev is freed.
The remove path has the same problem. A later async operation can then
walk the stale notifier entry and access freed memory.
Unregister the notifier before cleaning up its resources on both paths.
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-csi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index ecd0ed8e76b59..78c68cf90ffcb 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev)
return 0;
err_cleanup:
+ v4l2_async_nf_unregister(&csidev->notifier);
v4l2_async_nf_cleanup(&csidev->notifier);
return ret;
}
@@ -1067,6 +1068,8 @@ static void stm32_csi_remove(struct platform_device *pdev)
{
struct stm32_csi_dev *csidev = platform_get_drvdata(pdev);
+ v4l2_async_nf_unregister(&csidev->notifier);
+ v4l2_async_nf_cleanup(&csidev->notifier);
v4l2_async_unregister_subdev(&csidev->sd);
pm_runtime_disable(&pdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 103/869] mtd: rawnand: sunxi: reject ECC maximization on small pages
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 102/869] media: stm32: csi: unregister async notifier on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 104/869] media: adv7604: avoid negative array index in log_status when cp_read fails Greg Kroah-Hartman
` (773 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Hilliard, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hilliard <james.hilliard1@gmail.com>
[ Upstream commit a3c84084a73e170374b7dd493947efdef4ee57bc ]
When nand-ecc-maximize is set, the driver selects a 1024-byte ECC step
and divides the available OOB bytes by the resulting number of steps. A
NAND with a smaller page therefore produces zero steps and a division by
zero.
The older controllers also provide a 512-byte ECC block mode, but the
hardware documentation describes that as an ECC block size within NAND
pages whose supported sizes start at 1024 bytes. It does not document a
512-byte NAND page mode.
Reject pages smaller than 1024 bytes before deriving the step count. This
prevents the division by zero at the point where the incompatible
maximized geometry is selected without changing explicitly configured
512-byte ECC block handling.
Fixes: 4796d8655915 ("mtd: nand: sunxi: Support ECC maximization")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/sunxi_nand.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 75db1713e6177..f9b72671c5253 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1631,6 +1631,9 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) {
int bytes;
+ if (mtd->writesize < 1024)
+ return -EINVAL;
+
ecc->size = 1024;
nsectors = mtd->writesize / ecc->size;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 104/869] media: adv7604: avoid negative array index in log_status when cp_read fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 103/869] mtd: rawnand: sunxi: reject ECC maximization on small pages Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 105/869] media: stv090x: bound DiSEqC reply length to msg[] size Greg Kroah-Hartman
` (772 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 10d8dfda1c08f6788049aa100685e223d857f901 ]
cp_read() returns the negative errno from regmap_read() on I2C failure.
adv76xx_log_status() shifts the result right by 4 and uses it directly
to index csc_coeff_sel_rb[16] causing the right shift of a negative
number to result in -1, reading a negative place in the array.
Commit 8163419e3e05 ("media: adv7842: Avoid possible out-of-bounds
array accesses in adv7842_cp_log_status()") fixed the identical pattern
in the adv7842, so do the same thing here.
Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV7604 video decoder")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7604.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 516553fb17e98..cfecfff4c3aaa 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2641,8 +2641,9 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
"(16-235)" : "(0-255)",
(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
}
+ ret = cp_read(sd, info->cp_csc) >> 4;
v4l2_info(sd, "Color space conversion: %s\n",
- csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]);
+ ret < 0 ? "" : csc_coeff_sel_rb[ret]);
if (!is_digital_input(sd))
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 105/869] media: stv090x: bound DiSEqC reply length to msg[] size
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 104/869] media: adv7604: avoid negative array index in log_status when cp_read fails Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 106/869] media: stv0900: " Greg Kroah-Hartman
` (771 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit bad6ce6e0856f344910ba95b006e6c0ebee2d9c8 ]
The FIFO_BYTENBR_FIELD register field is 4 bits wide, giving a length
of 0..15, but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply.
A faulty or malicious DiSEqC slave (or i2c bus glitch) reporting more
than 4 bytes will the array and clobber the stack.
The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.
Fixes: e415c689a884 ("V4L/DVB (11579): Initial go at TT S2-1600")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/stv090x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
index f273efa330cfe..b95b6b4a69c73 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -3902,6 +3902,8 @@ static int stv090x_recv_slave_reply(struct dvb_frontend *fe, struct dvb_diseqc_s
if (rx_end) {
reply->msg_len = STV090x_GETFIELD_Px(reg, FIFO_BYTENBR_FIELD);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = STV090x_READ_DEMOD(state, DISRXDATA);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 106/869] media: stv0900: bound DiSEqC reply length to msg[] size
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 105/869] media: stv090x: bound DiSEqC reply length to msg[] size Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 107/869] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ Greg Kroah-Hartman
` (770 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 6d7e70111b9c80a9e4cb17fe6a6c4f5470847722 ]
The FIFO_BYTENBR field is 4 bits (mask 0x0f), giving a length of 0..15
but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply. A faulty or
malicious device reporting more than 4 bytes will the array and clobber
the stack.
The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.
Fixes: 99277b3824e4 ("V4L/DVB (10803): Add core code for ST STV0900 dual demodulator.")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/stv0900_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c
index e7b9b9b11d7df..ce228f2ef330c 100644
--- a/drivers/media/dvb-frontends/stv0900_core.c
+++ b/drivers/media/dvb-frontends/stv0900_core.c
@@ -1775,6 +1775,8 @@ static int stv0900_recv_slave_reply(struct dvb_frontend *fe,
if (stv0900_get_bits(intp, RX_END)) {
reply->msg_len = stv0900_get_bits(intp, FIFO_BYTENBR);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = stv0900_read_reg(intp, DISRXDATA);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 107/869] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 106/869] media: stv0900: " Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 108/869] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown Greg Kroah-Hartman
` (769 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alexander Shiyan,
Dmitry Osipenko, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <eagle.alexander923@gmail.com>
[ Upstream commit fce1e4fa3867c0ff19a31f9977741696710855a6 ]
Replace devm_request_irq() with devm_request_any_context_irq()
for the 5V detection interrupt handler. This allows the kernel
to choose the appropriate execution context (hardirq or threaded)
depending on the underlying interrupt controller. On some platforms,
the interrupt may be nested or require a threaded handler, and
using the fixed hardirq version can cause probe failures.
Switching to the more flexible function improves driver portability
without affecting functionality.
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@kernel.org
Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index 8e6f452f76c73..dbbd33f5908e5 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -2532,10 +2532,11 @@ static int hdmirx_setup_irq(struct snps_hdmirx_dev *hdmirx_dev,
irq_set_status_flags(irq, IRQ_NOAUTOEN);
hdmirx_dev->det_irq = irq;
- ret = devm_request_irq(dev, irq, hdmirx_5v_det_irq_handler,
- IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING,
- "rk_hdmirx-5v", hdmirx_dev);
- if (ret) {
+ ret = devm_request_any_context_irq(dev, irq, hdmirx_5v_det_irq_handler,
+ IRQF_TRIGGER_FALLING |
+ IRQF_TRIGGER_RISING,
+ "rk_hdmirx-5v", hdmirx_dev);
+ if (ret < 0) {
dev_err_probe(dev, ret, "failed to request hdmirx-5v irq\n");
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 108/869] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 107/869] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 109/869] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties Greg Kroah-Hartman
` (768 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Fan Wu, Marvin Lin,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit ae8a4b51df30e39c07704efd5500361d8138c4d0 ]
The VCD IRQ is devm-requested, but npcm_video_remove() frees the video
object before devres releases that IRQ. The threaded handler dereferences
video->vcd_regmap before checking VIDEO_STREAMING, so an interrupt in that
interval can access freed memory.
Request the IRQ with IRQF_NO_AUTOEN. Enable it after starting capture and
setting VIDEO_STREAMING, and disable it first in stop_streaming().
disable_irq() waits for an in-flight threaded handler to finish, after
which stop_streaming() can mask and reset the VCD without a handler
re-enabling it.
Use vb2_video_unregister_device() during remove. It releases the vb2
queue and calls stop_streaming() for an active stream, ensuring that the
IRQ is disabled before the video object is freed. Do not release the queue
separately.
If streaming is never started, IRQF_NO_AUTOEN keeps the IRQ disabled
until devres releases it.
This issue was found by an in-house static analysis tool.
Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Tested-by: Marvin Lin <kflin@nuvoton.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/nuvoton/npcm-video.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/nuvoton/npcm-video.c b/drivers/media/platform/nuvoton/npcm-video.c
index c4c5c318f7865..d10bda3757efe 100644
--- a/drivers/media/platform/nuvoton/npcm-video.c
+++ b/drivers/media/platform/nuvoton/npcm-video.c
@@ -120,6 +120,7 @@ struct npcm_video {
struct list_head buffers;
struct mutex buffer_lock; /* buffer list lock */
+ int irq;
unsigned long flags;
unsigned int sequence;
@@ -1486,6 +1487,7 @@ static int npcm_video_start_streaming(struct vb2_queue *q, unsigned int count)
}
set_bit(VIDEO_STREAMING, &video->flags);
+ enable_irq(video->irq);
return 0;
}
@@ -1494,6 +1496,7 @@ static void npcm_video_stop_streaming(struct vb2_queue *q)
struct npcm_video *video = vb2_get_drv_priv(q);
struct regmap *vcd = video->vcd_regmap;
+ disable_irq(video->irq);
clear_bit(VIDEO_STREAMING, &video->flags);
regmap_write(vcd, VCD_INTE, 0);
regmap_write(vcd, VCD_STAT, VCD_STAT_CLEAR);
@@ -1707,9 +1710,10 @@ static int npcm_video_init(struct npcm_video *video)
dev_err(dev, "Failed to find VCD IRQ\n");
return -ENODEV;
}
+ video->irq = irq;
rc = devm_request_threaded_irq(dev, irq, NULL, npcm_video_irq,
- IRQF_ONESHOT, DEVICE_NAME, video);
+ IRQF_ONESHOT | IRQF_NO_AUTOEN, DEVICE_NAME, video);
if (rc < 0) {
dev_err(dev, "Failed to request IRQ %d\n", irq);
return rc;
@@ -1807,8 +1811,7 @@ static void npcm_video_remove(struct platform_device *pdev)
struct v4l2_device *v4l2_dev = dev_get_drvdata(dev);
struct npcm_video *video = to_npcm_video(v4l2_dev);
- video_unregister_device(&video->vdev);
- vb2_queue_release(&video->queue);
+ vb2_video_unregister_device(&video->vdev);
v4l2_ctrl_handler_free(&video->ctrl_handler);
v4l2_device_unregister(v4l2_dev);
if (video->ece.enable)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 109/869] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 108/869] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 110/869] dmaengine: altera-msgdma: initialize state before requesting IRQ Greg Kroah-Hartman
` (767 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luca Ceresoli, Damon Ding,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damon Ding <damon.ding@rock-chips.com>
[ Upstream commit 02f569dd66c94dd67b2586f776235cf4177409ed ]
Revert the change that made samsung,link-rate and samsung,lane-count
optional for Exynos DP. Add error checking to fail probe early if the
required DT properties are missing.
If these properties are missing, video_info->max_link_rate and
video_info->max_lane_count remain zero, and so do link_train.link_rate
and link_train.lane_count used in the subsequent link training flow,
resulting in link training failure.
There is no way at all a device can work without these properties.
Here is the code flow when either max_link_rate or max_lane_count is 0:
analogix_dp_commit()
-> analogix_dp_full_link_train(dp, max_lanes = 0, max_rate = 0)
analogix_dp_full_link_train(max_lanes, max_rate):
// Read sink capabilities via DPCD and sanitize them
link_rate = read_dpcd(DP_MAX_LINK_RATE); // >= 0x06 after fixup
lane_count = read_dpcd(DP_MAX_LANE_COUNT); // >= 1 after fixup
// Clamp by the limits from DT
if (link_rate > max_rate) // 0x06 > 0, always true
link_rate = max_rate; // link_rate = 0
if (lane_count > max_lanes) // 1 > 0, always true
lane_count = max_lanes; // lane_count = 0
// Configure TX with the zeroed values
set_link_bandwidth(link_rate = 0)
// writel() is only executed for bwtype == 0x06/0x0a,
// so LINK_BW_SET is never written and stays at
// reset value; phy_configure() gets link_rate = 0.
set_lane_count(lane_count = 0)
// writel(0, ANALOGIX_DP_LANE_COUNT_SET) enables 0 lanes;
// phy_configure() is called with lanes = 0.
// Program sink for link training
drm_dp_dpcd_write(DP_LINK_BW_SET, {link_rate = 0/lane_count = 0})
// DP spec requires link rate in {0x06, 0x0a, 0x14} and
// lane count in {1, 2, 4}. Writing zeros is illegal, so
// the sink cannot enter the training state.
// Training loop
for (lane = 0; lane < lane_count /* 0 */; lane++)
// loop body never executes; training_lane[] stays
// uninitialized and no training register is programmed
Since the sanitized sink values are always non-zero (link_rate >= 0x06,
lane_count >= 1), the clamping with a zero maximum unconditionally
forces the training parameters to zero. Clock recovery can never be
achieved, so link training fails deterministically.
Consequently, making these properties mandatory again cannot break
any existing device: a DT without them could never have worked in
the first place. Failing probe early with a clear error message is
more helpful than a silent link training failure at runtime.
Fixes: 0d0abd894ead ("drm: bridge: analogix/dp: add max link rate and lane count limit for RK3288")
Cc: stable@vger.kernel.org
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Link: https://patch.msgid.link/20260828065153.590802-4-damon.ding@rock-chips.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index efe534977d12d..44761f7161f6f 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1389,6 +1389,7 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
{
struct device_node *dp_node = dp->dev->of_node;
struct video_info *video_info = &dp->video_info;
+ u32 val;
switch (dp->plat_data->dev_type) {
case RK3288_DP:
@@ -1409,10 +1410,14 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
* NOTE: those property parseing code is used for
* providing backward compatibility for samsung platform.
*/
- of_property_read_u32(dp_node, "samsung,link-rate",
- &video_info->max_link_rate);
- of_property_read_u32(dp_node, "samsung,lane-count",
- &video_info->max_lane_count);
+ if (of_property_read_u32(dp_node, "samsung,link-rate", &val))
+ return dev_err_probe(dp->dev, -EINVAL,
+ "Failed to get samsung,link-rate\n");
+ video_info->max_link_rate = val;
+ if (of_property_read_u32(dp_node, "samsung,lane-count", &val))
+ return dev_err_probe(dp->dev, -EINVAL,
+ "Failed to get samsung,lane-count\n");
+ video_info->max_lane_count = val;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 110/869] dmaengine: altera-msgdma: initialize state before requesting IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 109/869] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 111/869] ACPI: pfr_update: zero-initialize capability query result Greg Kroah-Hartman
` (766 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Adrian Ng Ho Yin,
Frank Li, Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit a5f8e3471fc20567df888267885dec3eb340eb37 ]
msgdma_probe() registers the IRQ before initializing the tasklet, lock,
and descriptor lists used by the interrupt handler. A pending interrupt
can access incomplete state during probe.
Initialize the handler state before requesting the IRQ so the interrupt
path observes ready software state.
Fixes: a85c6f1b2921 ("dmaengine: Add driver for Altera / Intel mSGDMA IP core")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260830053308.2190597-1-runyu.xiao@seu.edu.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/altera-msgdma.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index e1811a9be0bbe..2d4bca495b3d5 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -849,11 +849,6 @@ static int msgdma_probe(struct platform_device *pdev)
if (mdev->irq < 0)
return -ENXIO;
- ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
- 0, dev_name(&pdev->dev), mdev);
- if (ret)
- return ret;
-
tasklet_setup(&mdev->irq_tasklet, msgdma_tasklet);
dma_cookie_init(&mdev->dmachan);
@@ -865,6 +860,11 @@ static int msgdma_probe(struct platform_device *pdev)
INIT_LIST_HEAD(&mdev->done_list);
INIT_LIST_HEAD(&mdev->free_list);
+ ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
+ 0, dev_name(&pdev->dev), mdev);
+ if (ret)
+ return ret;
+
dma_dev = &mdev->dmadev;
/* Set DMA capabilities */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 111/869] ACPI: pfr_update: zero-initialize capability query result
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 110/869] dmaengine: altera-msgdma: initialize state before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 112/869] hte: tegra194-test: shut down timer before GPIO release Greg Kroah-Hartman
` (765 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Karl Mehltretter,
Rafael J. Wysocki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit d776369a9eded071df83e4738e1572c4c5b912d7 ]
query_capability() copies four ACPI buffers into fixed-size fields using
the firmware-supplied lengths. The existing overflow guard rejects
oversized buffers, but shorter buffers are accepted and leave trailing
bytes of the stack-allocated cap_hdr uninitialized. PFRU_IOC_QUERY_CAP
then copies the entire structure to userspace.
Zero-initialize cap_hdr before querying the firmware. This preserves the
existing handling of short firmware responses while preventing disclosure
of kernel stack data. Oversized buffers remain rejected.
A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
bytes in all four fields. With this change, the ioctl still succeeds and
each unwritten suffix is zero-filled, while 64-byte buffers continue to
return -EINVAL.
Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260827053741.79425-1-kmehltretter@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/pfr_update.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 9afd2c52fdbd8..98ace679601b8 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
- struct pfru_update_cap_info cap_hdr;
+ struct pfru_update_cap_info cap_hdr = {};
struct pfru_device *pfru_dev = to_pfru_dev(file);
void __user *p = (void __user *)arg;
u32 rev;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 112/869] hte: tegra194-test: shut down timer before GPIO release
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 111/869] ACPI: pfr_update: zero-initialize capability query result Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 113/869] power: supply: qcom_smbx: include base when petting watchdog Greg Kroah-Hartman
` (764 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Dipen Patel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 30167fadbf87fa901a2fee49c30a5c5a506a43e8 ]
tegra_hte_test_remove() releases GPIO descriptors before stopping
hte.timer. gpio_timer_cb() accesses hte.gpio_out and rearms the timer, so
a callback concurrent with remove can use a released descriptor and rearm
after teardown.
Shut down the timer before releasing the GPIO descriptors.
timer_shutdown_sync() waits for a running callback and prevents it from
being rearmed.
Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hte/hte-tegra194-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
index 94e931f453059..4951049e00b09 100644
--- a/drivers/hte/hte-tegra194-test.c
+++ b/drivers/hte/hte-tegra194-test.c
@@ -218,10 +218,10 @@ static void tegra_hte_test_remove(struct platform_device *pdev)
{
(void)pdev;
+ timer_shutdown_sync(&hte.timer);
free_irq(hte.gpio_in_irq, &hte);
gpiod_put(hte.gpio_in);
gpiod_put(hte.gpio_out);
- timer_delete_sync(&hte.timer);
}
static struct platform_driver tegra_hte_test_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 113/869] power: supply: qcom_smbx: include base when petting watchdog
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 112/869] hte: tegra194-test: shut down timer before GPIO release Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 114/869] power: supply: qcom_smbx: test battery health status bits Greg Kroah-Hartman
` (763 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2f0dec12007891398e6e3041aca0b8656918973d ]
BARK_BITE_WDOG_PET is an offset from the charger peripheral base, but
the watchdog bark handler writes it as an absolute SPMI address. This can
write another PMIC peripheral and leave the charger watchdog unserviced.
Add the charger base, as all other qcom_smbx register accesses do.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-1-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index b1cb925581ec6..11aab7e635592 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -757,7 +757,7 @@ static irqreturn_t smb_handle_wdog_bark(int irq, void *data)
power_supply_changed(chip->chg_psy);
- rc = regmap_write(chip->regmap, BARK_BITE_WDOG_PET,
+ rc = regmap_write(chip->regmap, chip->base + BARK_BITE_WDOG_PET,
BARK_BITE_WDOG_PET_BIT);
if (rc < 0)
dev_err(chip->dev, "Couldn't pet the dog rc=%d\n", rc);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 114/869] power: supply: qcom_smbx: test battery health status bits
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 113/869] power: supply: qcom_smbx: include base when petting watchdog Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 115/869] power: supply: qcom_smbx: fix float voltage selector Greg Kroah-Hartman
` (762 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 68f645192f64e1037685dbdb0dffb41a5a012056 ]
BATTERY_CHARGER_STATUS_2 contains independent status and fault bits.
Switching on the complete register only recognizes a fault when it is the
sole asserted bit, and can report a healthy battery when another status
bit is set at the same time.
Test the relevant fault bits in priority order, matching the Qualcomm
downstream driver handling.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-2-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 22 ++++++++--------------
1 file changed, 8 insertions(+), 14 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 11aab7e635592..6e976342a3fbd 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -629,26 +629,20 @@ static int smb_get_prop_health(struct smb_chip *chip, int *val)
return rc;
}
- switch (stat) {
- case CHARGER_ERROR_STATUS_BAT_OV_BIT:
+ if (stat & CHARGER_ERROR_STATUS_BAT_OV_BIT)
*val = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
- return 0;
- case BAT_TEMP_STATUS_TOO_COLD_BIT:
+ else if (stat & BAT_TEMP_STATUS_TOO_COLD_BIT)
*val = POWER_SUPPLY_HEALTH_COLD;
- return 0;
- case BAT_TEMP_STATUS_TOO_HOT_BIT:
+ else if (stat & BAT_TEMP_STATUS_TOO_HOT_BIT)
*val = POWER_SUPPLY_HEALTH_OVERHEAT;
- return 0;
- case BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT:
+ else if (stat & BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT)
*val = POWER_SUPPLY_HEALTH_COOL;
- return 0;
- case BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT:
+ else if (stat & BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT)
*val = POWER_SUPPLY_HEALTH_WARM;
- return 0;
- default:
+ else
*val = POWER_SUPPLY_HEALTH_GOOD;
- return 0;
- }
+
+ return 0;
}
static int smb_get_property(struct power_supply *psy,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 115/869] power: supply: qcom_smbx: fix float voltage selector
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 114/869] power: supply: qcom_smbx: test battery health status bits Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 116/869] power: supply: qcom_smbx: validate battery float voltage Greg Kroah-Hartman
` (761 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2a26d260e72a95e9f13b9e475f63aa404600fcb2 ]
FLOAT_VOLTAGE_CFG encodes 3,487,500 uV as selector zero and advances in
7,500 uV steps. The current calculation adds one to that selector, so it
programs the requested float voltage one step too high.
Remove the extra offset and name the hardware encoding constants.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-3-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 6e976342a3fbd..65ee918d1f09b 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -349,6 +349,8 @@
/* pmi8998 registers represent current in increments of 1/40th of an amp */
#define CURRENT_SCALE_FACTOR 25000
+#define SMB2_FLOAT_VOLTAGE_MIN_UV 3487500
+#define SMB2_FLOAT_VOLTAGE_STEP_UV 7500
/* clang-format on */
enum charger_status {
@@ -987,7 +989,8 @@ static int smb_probe(struct platform_device *pdev)
return dev_err_probe(chip->dev, rc,
"Failed to init status change work\n");
- rc = (chip->batt_info->voltage_max_design_uv - 3487500) / 7500 + 1;
+ rc = (chip->batt_info->voltage_max_design_uv -
+ SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
FLOAT_VOLTAGE_SETTING_MASK, rc);
if (rc < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 116/869] power: supply: qcom_smbx: validate battery float voltage
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 115/869] power: supply: qcom_smbx: fix float voltage selector Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 117/869] power: supply: qcom_smbx: notify battery overvoltage recovery Greg Kroah-Hartman
` (760 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit a2d7dc538da2cb4a7426f0742197e762cb635f38 ]
power_supply_get_battery_info() leaves absent optional properties at
-EINVAL. The driver uses voltage_max_design_uv without checking it, so a
missing or out-of-range value can become an invalid float-voltage
selector.
Prefer the constant-charge voltage because it describes the charger's CV
target, then fall back to the battery design voltage. Both properties are
optional in the simple-battery binding, so preserve the hardware setting
when neither is present. Reject a supplied target outside the SMB2 range.
smb_init_hw() enables charging before battery data is parsed and before
the remaining fallible probe steps. Save the initial charging-enable bit
and install a managed rollback before initialization. Keep the rollback
active across battery-info, voltage, IRQ and wake-IRQ setup, then remove it
only after probe can no longer fail.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-4-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 61 ++++++++++++++++++++++++++++++--
1 file changed, 58 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 65ee918d1f09b..dddc8f3e1073a 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -350,6 +350,7 @@
/* pmi8998 registers represent current in increments of 1/40th of an amp */
#define CURRENT_SCALE_FACTOR 25000
#define SMB2_FLOAT_VOLTAGE_MIN_UV 3487500
+#define SMB2_FLOAT_VOLTAGE_MAX_UV 4920000
#define SMB2_FLOAT_VOLTAGE_STEP_UV 7500
/* clang-format on */
@@ -377,6 +378,7 @@ struct smb_init_register {
* @base: Base address for smb registers
* @regmap: Register map
* @batt_info: Battery data from DT
+ * @initial_charge_enable: Charging enable state before hardware setup
* @status_change_work: Worker to handle plug/unplug events
* @cable_irq: USB plugin IRQ
* @wakeup_enabled: If the cable IRQ will cause a wakeup
@@ -390,6 +392,7 @@ struct smb_chip {
unsigned int base;
struct regmap *regmap;
struct power_supply_battery_info *batt_info;
+ u8 initial_charge_enable;
struct delayed_work status_change_work;
int cable_irq;
@@ -898,6 +901,19 @@ static int smb_init_hw(struct smb_chip *chip)
return 0;
}
+static void smb_restore_charge_enable(void *data)
+{
+ struct smb_chip *chip = data;
+ int rc;
+
+ rc = regmap_update_bits(chip->regmap,
+ chip->base + CHARGING_ENABLE_CMD,
+ CHARGING_ENABLE_CMD_BIT,
+ chip->initial_charge_enable);
+ if (rc < 0)
+ dev_err(chip->dev, "Couldn't restore charging state: %d\n", rc);
+}
+
static int smb_init_irq(struct smb_chip *chip, int *irq, const char *name,
irqreturn_t (*handler)(int irq, void *data))
{
@@ -925,6 +941,9 @@ static int smb_probe(struct platform_device *pdev)
struct power_supply_config supply_config = {};
struct power_supply_desc *desc;
struct smb_chip *chip;
+ unsigned int charge_enable;
+ unsigned int float_voltage_sel;
+ int float_voltage_uv;
int rc, irq;
chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -955,6 +974,18 @@ static int smb_probe(struct platform_device *pdev)
"Couldn't get usbin_i IIO channel\n");
}
+ rc = regmap_read(chip->regmap, chip->base + CHARGING_ENABLE_CMD,
+ &charge_enable);
+ if (rc < 0)
+ return dev_err_probe(chip->dev, rc,
+ "Couldn't read charging state\n");
+
+ chip->initial_charge_enable = charge_enable & CHARGING_ENABLE_CMD_BIT;
+ rc = devm_add_action_or_reset(chip->dev, smb_restore_charge_enable, chip);
+ if (rc)
+ return dev_err_probe(chip->dev, rc,
+ "Couldn't register charging state rollback\n");
+
rc = smb_init_hw(chip);
if (rc < 0)
return rc;
@@ -989,13 +1020,35 @@ static int smb_probe(struct platform_device *pdev)
return dev_err_probe(chip->dev, rc,
"Failed to init status change work\n");
- rc = (chip->batt_info->voltage_max_design_uv -
- SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
+ if (power_supply_battery_info_has_prop(chip->batt_info,
+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE_MAX)) {
+ float_voltage_uv =
+ chip->batt_info->constant_charge_voltage_max_uv;
+ } else if (power_supply_battery_info_has_prop(chip->batt_info,
+ POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN)) {
+ float_voltage_uv = chip->batt_info->voltage_max_design_uv;
+ } else {
+ dev_warn(chip->dev, "No battery float voltage; preserving hardware setting\n");
+ goto skip_float_voltage;
+ }
+
+ if (float_voltage_uv < SMB2_FLOAT_VOLTAGE_MIN_UV ||
+ float_voltage_uv > SMB2_FLOAT_VOLTAGE_MAX_UV)
+ return dev_err_probe(chip->dev, -EINVAL,
+ "float voltage %d uV outside %d-%d uV\n",
+ float_voltage_uv,
+ SMB2_FLOAT_VOLTAGE_MIN_UV,
+ SMB2_FLOAT_VOLTAGE_MAX_UV);
+
+ float_voltage_sel =
+ (float_voltage_uv - SMB2_FLOAT_VOLTAGE_MIN_UV) /
+ SMB2_FLOAT_VOLTAGE_STEP_UV;
rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
- FLOAT_VOLTAGE_SETTING_MASK, rc);
+ FLOAT_VOLTAGE_SETTING_MASK, float_voltage_sel);
if (rc < 0)
return dev_err_probe(chip->dev, rc, "Couldn't set vbat max\n");
+skip_float_voltage:
rc = smb_init_irq(chip, &irq, "bat-ov", smb_handle_batt_overvoltage);
if (rc < 0)
return rc;
@@ -1019,6 +1072,8 @@ static int smb_probe(struct platform_device *pdev)
if (rc < 0)
return dev_err_probe(chip->dev, rc, "Couldn't set wake irq\n");
+ devm_remove_action(chip->dev, smb_restore_charge_enable, chip);
+
platform_set_drvdata(pdev, chip);
/* Initialise charger state */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 117/869] power: supply: qcom_smbx: notify battery overvoltage recovery
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 116/869] power: supply: qcom_smbx: validate battery float voltage Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 118/869] power: supply: bq27xxx: synchronize work cancellation on suspend Greg Kroah-Hartman
` (759 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2548e4fa576a87a3b0d1b15a9c3f909bc54887b5 ]
The battery-overvoltage IRQ is configured for both edges, but its handler
only notifies the power-supply core while the fault bit is asserted. The
falling edge therefore does not publish the recovered health and status.
The handler also ignores register-read failures before testing status.
Handle read errors, log only an asserted fault, and notify the
power-supply core after every successful edge read.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-5-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index dddc8f3e1073a..55fe31aa3df3d 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -715,16 +715,22 @@ static irqreturn_t smb_handle_batt_overvoltage(int irq, void *data)
{
struct smb_chip *chip = data;
unsigned int status;
+ int rc;
- regmap_read(chip->regmap, chip->base + BATTERY_CHARGER_STATUS_2,
- &status);
+ rc = regmap_read(chip->regmap,
+ chip->base + BATTERY_CHARGER_STATUS_2, &status);
+ if (rc < 0) {
+ dev_err(chip->dev, "Couldn't read charger status: %d\n", rc);
+ return IRQ_HANDLED;
+ }
if (status & CHARGER_ERROR_STATUS_BAT_OV_BIT) {
/* The hardware stops charging automatically */
dev_err(chip->dev, "battery overvoltage detected\n");
- power_supply_changed(chip->chg_psy);
}
+ power_supply_changed(chip->chg_psy);
+
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 118/869] power: supply: bq27xxx: synchronize work cancellation on suspend
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 117/869] power: supply: qcom_smbx: notify battery overvoltage recovery Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 119/869] power: supply: bq27xxx: Ensure poll work is cancelled on remove Greg Kroah-Hartman
` (758 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengzhuo Wei, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengzhuo Wei <me@cherr.cc>
[ Upstream commit f0ff5673aa07ded2bb383ac526c1faee4fe9ca07 ]
The poll work requeues itself via mod_delayed_work() while the device
is not removed. cancel_delayed_work() does not wait for a callback
that is already running, so a poll racing with suspend can keep
issuing I2C transfers after suspend returns and requeue itself into
early resume.
Use cancel_delayed_work_sync() to quiesce polling before suspend
completes, as the teardown path already does.
Fixes: dfcb264a01a9 ("power: supply: bq27xxx: Stop and start delayed work in suspend and resume")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260827-bq27xxx-suspend-cancel-sync-v1-1-77a67711cbc3@cherr.cc
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq27xxx_battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 01c9ec1116fa0..4d4809a70b622 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -2291,7 +2291,7 @@ static int bq27xxx_battery_suspend(struct device *dev)
{
struct bq27xxx_device_info *di = dev_get_drvdata(dev);
- cancel_delayed_work(&di->work);
+ cancel_delayed_work_sync(&di->work);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 119/869] power: supply: bq27xxx: Ensure poll work is cancelled on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 118/869] power: supply: bq27xxx: synchronize work cancellation on suspend Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 120/869] iio: imu: inv_icm42600: fix odr change not caught in certain cases Greg Kroah-Hartman
` (757 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit db560f4b1c5253853f978385db066220e0c218dc ]
The di->work poll work is queued from the poll callback itself and from
bq27xxx_external_power_changed(). The cancel_delayed_work_sync() in
bq27xxx_battery_teardown() runs while the power_supply is still
registered, so external_power_changed() can re-arm the work after the
cancel, and it runs after the driver data has been freed.
Register a devm_delayed_work_autocancel() before
devm_power_supply_register(), so on unwind the power_supply is
unregistered first, after which no new external_power_changed()
callback can be dispatched, and the poll work is cancelled only then.
Drop the now-redundant cancel from bq27xxx_battery_teardown().
This issue was found by an in-house static analysis tool.
Fixes: 740b755a3b34 ("bq27x00: Poll battery state")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260903081312.225535-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq27xxx_battery.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 4d4809a70b622..cd30993b8a89e 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -43,6 +43,7 @@
*/
#include <linux/device.h>
+#include <linux/devm-helpers.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/param.h>
@@ -2234,7 +2235,6 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
};
int ret;
- INIT_DELAYED_WORK(&di->work, bq27xxx_battery_poll);
ret = devm_mutex_init(di->dev, &di->lock);
if (ret)
return ret;
@@ -2255,6 +2255,12 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
psy_desc->get_property = bq27xxx_battery_get_property;
psy_desc->external_power_changed = bq27xxx_external_power_changed;
+ /* Cancel the poll work after the power_supply is unregistered. */
+ ret = devm_delayed_work_autocancel(di->dev, &di->work,
+ bq27xxx_battery_poll);
+ if (ret)
+ return ret;
+
di->bat = devm_power_supply_register(di->dev, psy_desc, &psy_cfg);
if (IS_ERR(di->bat))
return dev_err_probe(di->dev, PTR_ERR(di->bat),
@@ -2281,8 +2287,6 @@ void bq27xxx_battery_teardown(struct bq27xxx_device_info *di)
mutex_lock(&di->lock);
di->removed = true;
mutex_unlock(&di->lock);
-
- cancel_delayed_work_sync(&di->work);
}
EXPORT_SYMBOL_GPL(bq27xxx_battery_teardown);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 120/869] iio: imu: inv_icm42600: fix odr change not caught in certain cases
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 119/869] power: supply: bq27xxx: Ensure poll work is cancelled on remove Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 121/869] sched/fair: Reset NUMA fault locality after scan period update Greg Kroah-Hartman
` (756 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit f670d4d3477386d62017936f0121909f93ac17f8 ]
When using both accel and gyro with different frequencies, the ODR
change flag in the FIFO header can be sometime in a packet with
invalid data. Since we are ignoring these packets, we miss the ODR
change and any further change are blocked until sensor is turned off.
Fix this by moving the packet data validity check after the ODR change
flag check.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 8 ++++----
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index 96a6213770d41..d19ff0e76c668 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1225,15 +1225,15 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
if (size <= 0)
return size;
- /* skip packet if no accel data or data is invalid */
- if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
- continue;
-
/* update odr */
if (odr & INV_ICM42600_SENSOR_ACCEL)
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ /* skip packet if no accel data or data is invalid */
+ if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
+ continue;
+
memcpy(&buffer.accel, accel, sizeof(buffer.accel));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
index a18dcac939298..194838d88284c 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -806,15 +806,15 @@ int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev)
if (size <= 0)
return size;
- /* skip packet if no gyro data or data is invalid */
- if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
- continue;
-
/* update odr */
if (odr & INV_ICM42600_SENSOR_GYRO)
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ /* skip packet if no gyro data or data is invalid */
+ if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
+ continue;
+
memcpy(&buffer.gyro, gyro, sizeof(buffer.gyro));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 121/869] sched/fair: Reset NUMA fault locality after scan period update
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 120/869] iio: imu: inv_icm42600: fix odr change not caught in certain cases Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 122/869] media: vivid: round the height down to the vertical subsampling factor Greg Kroah-Hartman
` (755 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Binwon Song, Eric Kim,
Peter Zijlstra (Intel), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Kim <seohyun.kim@outlook.kr>
[ Upstream commit e81ee06308379a5f2ededf997bcf17551bce5db7 ]
When updating the task scan period for NUMA locality checks,
update_task_scan_period() checks whether there were no faults or failed
migration on the last scan window, at which it prolongs the scan period.
However, p->numa_faults_locality, which is used to check for migration
failure and number of faults at the previous scan window is not cleared
after changing the scan period, which unintentionally increases
numa_scan_period up to numa_scan_period_max even when there were no
migration failures or no faults at previous scan.
Fix this by jumping to the out label on early exit at this case to
ensure p->numa_faults_locality is always cleared before returning.
Closes: https://lore.kernel.org/all/20250404095354.311156-1-qlsdnjs236@chungbuk.ac.kr/
Reported-by: Binwon Song <qlsdnjs236@chungbuk.ac.kr>
Signed-off-by: Eric Kim <seohyun.kim@outlook.kr>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/Message-ID:
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 67e8c2065d827..fbc277c6963c5 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2794,7 +2794,7 @@ static void update_task_scan_period(struct task_struct *p,
p->mm->numa_next_scan = jiffies +
msecs_to_jiffies(p->numa_scan_period);
- return;
+ goto out;
}
/*
@@ -2838,7 +2838,10 @@ static void update_task_scan_period(struct task_struct *p,
p->numa_scan_period = clamp(p->numa_scan_period + diff,
task_scan_min(p), task_scan_max(p));
- memset(p->numa_faults_locality, 0, sizeof(p->numa_faults_locality));
+
+out:
+ memset(p->numa_faults_locality, 0,
+ sizeof(p->numa_faults_locality));
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 122/869] media: vivid: round the height down to the vertical subsampling factor
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 121/869] sched/fair: Reset NUMA fault locality after scan period update Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 123/869] media: cx231xx: preserve I2C transfer length Greg Kroah-Hartman
` (754 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+cb43e758a4dc84dd467f,
Maxim Skokov, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Skokov <skokovmaksimevg@gmail.com>
[ Upstream commit a2ec28dd2a88d0721fc4a30242861e2be01d4023 ]
syzbot reports a vmalloc out-of-bounds write in the test pattern
generator:
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2617 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2063/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 720 at addr ffffc900038f9d50 by task vivid-000-vid-c/6017
The reproducer requests a 720x49 NV12 capture format, i.e. an odd
height for a format whose chroma plane is vertically subsampled.
The buffer size is derived from the height by a truncating division:
sizes[p] = (tpg_g_line_width(&dev->tpg, p) * h) /
dev->fmt_cap->vdownsampling[p] +
dev->fmt_cap->data_offset[p];
For a single buffer holding both planes tpg_g_line_width() returns
720 + 720 / 2 = 1080, so 1080 * 49 = 52920 bytes get allocated.
tpg_fill_plane_buffer() however emits one chroma line for every two
luma lines, i.e. DIV_ROUND_UP(49, 2) = 25 lines, and thus needs
49 * 720 + 25 * 720 = 53280 bytes. The memcpy() of the last chroma
line runs 360 bytes past the end of the buffer.
An odd height is not meaningful for a 4:2:0 format in the first place,
since the chroma plane would have to hold half a line. Rather than
fixing up each of the ~10 sites that divide the height by
vdownsampling[], round the height down to a multiple of the vertical
subsampling factor where it enters the driver. Adjusting the format is
what TRY_FMT/S_FMT are for, and it keeps every later division exact.
Formats without vertical subsampling are unaffected and keep accepting
odd heights.
Tested with the syzbot reproducer, which no longer triggers the splat,
and by streaming NV12, NV21, YUV420, YVU420 and YUYV at heights 47,
48, 49, 51, 480, 481 and 1081. v4l2-compliance gives identical results
before and after (48 of 50 succeeded on the vivid device in both
cases; the two failures are pre-existing and unrelated).
Fixes: ddcaee9dd4c0 ("[media] vivid: add support for single buffer planar formats")
Cc: stable@kernel.org
Reported-by: syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb43e758a4dc84dd467f
Signed-off-by: Maxim Skokov <skokovmaksimevg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
index d1c09bdb2f3b0..cc2b704717f39 100644
--- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c
+++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
@@ -568,6 +568,7 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
const struct vivid_fmt *fmt;
unsigned bytesperline, max_bpl;
unsigned factor = 1;
+ unsigned int vdiv = 1;
unsigned w, h;
unsigned p;
bool user_set_csc = !!(mp->flags & V4L2_PIX_FMT_FLAG_SET_CSC);
@@ -620,6 +621,18 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
mp->height = r.height / factor;
}
+ /*
+ * The chroma planes of vertically subsampled formats hold
+ * height / vdownsampling lines. If the height is not a multiple of
+ * the subsampling factor, then the buffer size calculations round
+ * that number down while the test pattern generator rounds it up,
+ * so the generator writes one line past the end of the buffer.
+ * Round the height down to keep both in sync.
+ */
+ for (p = 0; p < fmt->planes; p++)
+ vdiv = max(vdiv, fmt->vdownsampling[p]);
+ mp->height = rounddown(mp->height, vdiv);
+
/* This driver supports custom bytesperline values */
mp->num_planes = fmt->buffers;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 123/869] media: cx231xx: preserve I2C transfer length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 122/869] media: vivid: round the height down to the vertical subsampling factor Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 124/869] media: vivid: cancel svid ctrl work on release Greg Kroah-Hartman
` (753 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+ddccc0c0dbc0a38ffccb,
Juan Perdomo, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juan Perdomo <jcperdomo100@gmail.com>
[ Upstream commit a19c9502a69bbd42c18816b09cbefdeb4cb68066 ]
The I2C core stores message lengths in u16, but cx231xx truncates them to
u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
becomes a zero-length request. USB treats zero-length control transfers as
OUT regardless of bRequestType, so the IN control pipe trips the
usb_submit_urb() direction warning.
Use u16 for buf_size, matching both i2c_msg.len and
VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
URB_MAX_CTRL_SIZE check and return -EINVAL.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: stable@kernel.org
Reported-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
Tested-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx.h b/drivers/media/usb/cx231xx/cx231xx.h
index 19f5036a78d7f..f85d054fbb5cf 100644
--- a/drivers/media/usb/cx231xx/cx231xx.h
+++ b/drivers/media/usb/cx231xx/cx231xx.h
@@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data {
u8 direction; /* 1 - IN, 0 - OUT */
u8 saddr_len; /* sub address len */
u16 saddr_dat; /* sub addr data */
- u8 buf_size; /* buffer size */
+ u16 buf_size; /* buffer size */
u8 *p_buffer; /* pointer to the buffer */
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 124/869] media: vivid: cancel svid ctrl work on release
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 123/869] media: cx231xx: preserve I2C transfer length Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 125/869] media: vicodec: zero-initialize stateful decoder heap buffers Greg Kroah-Hartman
` (752 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 1adaefca7111235ff0a2219dd4899ac24601d6e8 ]
vivid_dev_release() cancels update_hdmi_ctrl_work but not its sibling
update_svid_ctrl_work, which vivid_vid_cap_s_ctrl() queues on
update_svid_ctrls_workqueue when a VIVID_CID_SVID_IS_CONNECTED_TO_OUTPUT
control is changed. The two work items were added together, but only
one of them is cancelled on release.
If the svid work is still pending or running when the last v4l2_device
reference is dropped, update_svid_ctrls_work_handler() runs after
kfree(dev): the handler iterates the global vivid_devs[] array and
calls v4l2_ctrl_modify_range() on every vivid_dev instance, including
this one after it has been freed.
Add the missing cancel_work_sync() next to the hdmi sibling, before
vivid_free_controls() releases the control handlers the work uses.
This issue was found by an in-house static analysis tool.
Fixes: d7c969f37515 ("media: vivid: Add 'Is Connected To' menu controls")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vivid/vivid-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c
index f44930502bdaf..64a15a24a9c37 100644
--- a/drivers/media/test-drivers/vivid/vivid-core.c
+++ b/drivers/media/test-drivers/vivid/vivid-core.c
@@ -854,6 +854,7 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev)
struct vivid_dev *dev = container_of(v4l2_dev, struct vivid_dev, v4l2_dev);
cancel_work_sync(&dev->update_hdmi_ctrl_work);
+ cancel_work_sync(&dev->update_svid_ctrl_work);
vivid_free_controls(dev);
v4l2_device_unregister(&dev->v4l2_dev);
#ifdef CONFIG_MEDIA_CONTROLLER
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 125/869] media: vicodec: zero-initialize stateful decoder heap buffers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 124/869] media: vivid: cancel svid ctrl work on release Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 126/869] crypto: atmel-tdes - zero-initialize device state Greg Kroah-Hartman
` (751 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 27953c044974baf7e24dee3e9342fe0103dea80c ]
The stateful decoder leaks uninitialized kernel heap memory to userspace.
A process that can open the decoder video node gets it back in the CAPTURE
buffers it dequeues.
The reference frame and the compressed frame buffer are allocated with
kvmalloc() in vicodec_start_streaming(), and the decoder can read them
before they have been written. The first frame is allowed to be a P-frame,
in which case it is decoded against a reference frame that was never
produced, and the padding rows below the visible area are never written
for any frame.
Use kvzalloc() for both allocations.
Fixes: 256bf813ba39 ("media: vicodec: add the virtual codec driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index cdc3af33b4bbe..841dc03d0edd2 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -1606,9 +1606,9 @@ static int vicodec_start_streaming(struct vb2_queue *q,
}
state->ref_stride = q_data->coded_width * info->luma_alpha_step;
- state->ref_frame.buf = kvmalloc(total_planes_size, GFP_KERNEL);
+ state->ref_frame.buf = kvzalloc(total_planes_size, GFP_KERNEL);
state->ref_frame.luma = state->ref_frame.buf;
- new_comp_frame = kvmalloc(ctx->comp_max_size, GFP_KERNEL);
+ new_comp_frame = kvzalloc(ctx->comp_max_size, GFP_KERNEL);
if (!state->ref_frame.luma || !new_comp_frame) {
kvfree(state->ref_frame.luma);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 126/869] crypto: atmel-tdes - zero-initialize device state
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 125/869] media: vicodec: zero-initialize stateful decoder heap buffers Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 127/869] crypto: atmel-aes - fix AADLENR for standalone GHASH Greg Kroah-Hartman
` (750 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thorsten Blum,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit dbe70508d507acd677e67eaf029040f5e3a3b2b3 ]
Commit c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of
kzalloc") accidentally replaced kzalloc() with devm_kmalloc(), so the
device state is no longer zeroed.
atmel_tdes_hw_init() tests dd->flags during probe: a stale TDES_FLAGS_INIT
skips the hardware reset, and a stale TDES_FLAGS_BUSY makes
atmel_tdes_handle_queue() treat the engine as permanently busy, leaving
every request queued and never dispatched.
Seen on a SAM9X75 Curiosity: the first TDES request after boot never
completes and the TDES interrupt count stays at zero, while the AES and
SHA engines on the same SoC work normally.
Switch to devm_kzalloc(), matching the Atmel AES and SHA drivers.
Fixes: c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of kzalloc")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-tdes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index d380f6741a2c5..72e91e0bb1b47 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -945,7 +945,7 @@ static int atmel_tdes_probe(struct platform_device *pdev)
struct resource *tdes_res;
int err;
- tdes_dd = devm_kmalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
+ tdes_dd = devm_kzalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
if (!tdes_dd)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 127/869] crypto: atmel-aes - fix AADLENR for standalone GHASH
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 126/869] crypto: atmel-tdes - zero-initialize device state Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 128/869] lib/842: reject output overflows from index and short data Greg Kroah-Hartman
` (749 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 0dd8cded0e6f8c9635fe1d79d60dc7b2599b099b ]
atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
to AES_AADLENR. But the GHASH it runs hashes the dd->datalen bytes passed
in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
The data sheet requires AES_AADLENR to hold the length of that input.
With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
wrong. Later requests only pass because dd->total still holds the
previous request's length.
This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
fails at boot:
alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
vector 0, cfg="in-place (one sglist)"
Without selftests the broken atmel-gcm-aes is preferred at priority 300.
Seen on a SAM9X75 Curiosity with 6.18 and current mainline.
Write dd->datalen instead.
Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-aes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index b393689400b4c..e057be7fc7130 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -1272,7 +1272,7 @@ static int atmel_aes_gcm_ghash_init(struct atmel_aes_dev *dd)
struct atmel_aes_gcm_ctx *ctx = atmel_aes_gcm_ctx_cast(dd->ctx);
/* Set the data length. */
- atmel_aes_write(dd, AES_AADLENR, dd->total);
+ atmel_aes_write(dd, AES_AADLENR, dd->datalen);
atmel_aes_write(dd, AES_CLENR, 0);
/* If needed, overwrite the GCM Intermediate Hash Word Registers */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 128/869] lib/842: reject output overflows from index and short data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 127/869] crypto: atmel-aes - fix AADLENR for standalone GHASH Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 129/869] lib/842: require a complete history block for repeat templates Greg Kroah-Hartman
` (748 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 38ed7182f3491ec1449ff246551e11ad82adba45 ]
The output length passed to sw842_decompress() is the caller's buffer
capacity. Indexed copies write 2, 4 or 8 bytes and short-data templates
write up to 7, but neither checks that capacity before writing and
decrementing p->olen.
Overwriting an undersized destination then underflows p->olen, which is
unsigned, so every later bounds check in the stream passes. Subsequent
operations keep writing past the destination, and a matching CRC lets
sw842_decompress() return success with an output length larger than the
capacity the caller supplied.
This is reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
made a KASAN kernel report vmalloc-out-of-bounds writes in __do_index() and
sw842_decompress() when zram read the page back.
Check the remaining output before both operations and return -ENOSPC,
matching the other output-producing templates.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/842/842_decompress.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 582085ef8b49c..87d1e0f8a4926 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -165,6 +165,9 @@ static int __do_index(struct sw842_param *p, u8 size, u8 bits, u64 fsize)
u64 index, offset, total = round_down(p->out - p->ostart, 8);
int ret;
+ if (size > p->olen)
+ return -ENOSPC;
+
ret = next_bits(p, &index, bits);
if (ret)
return ret;
@@ -344,6 +347,8 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
if (!bytes || bytes > SHORT_DATA_BITS_MAX)
return -EINVAL;
+ if (bytes > p.olen)
+ return -ENOSPC;
while (bytes-- > 0) {
ret = next_bits(&p, &tmp, 8);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 129/869] lib/842: require a complete history block for repeat templates
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 128/869] lib/842: reject output overflows from index and short data Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 130/869] crypto: ccp - Initialize DBC ioctl mutex before registering device Greg Kroah-Hartman
` (747 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit deb631649882bbf43f7c2fc79b5990139fd744ba ]
An 842 repeat template copies the preceding eight-byte output block. The
decoder rejects a repeat only when no output has been produced. A
short-data operation can produce between one and seven bytes before a
repeat.
Such a stream makes the repeat copy read before the start of the output
buffer. Depending on the surrounding mapping, this can fault or bring
preceding memory into the decompressed data.
This is also reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
to a short-data-then-repeat stream made a KASAN kernel report a
vmalloc-out-of-bounds read when zram read the page back.
Require at least one complete output block before accepting a repeat.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/842/842_decompress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 87d1e0f8a4926..45a9815abd637 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -309,7 +309,7 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
if (ret)
return ret;
- if (p.out == out) /* no previous bytes */
+ if (p.out - p.ostart < 8) /* no complete previous block */
return -EINVAL;
/* copy rep + 1 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 130/869] crypto: ccp - Initialize DBC ioctl mutex before registering device
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 129/869] lib/842: require a complete history block for repeat templates Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 131/869] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Greg Kroah-Hartman
` (746 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Tom Lendacky, Herbert Xu,
Sasha Levin, Mario Limonciello (AMD)
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit e9b1d168f2a70c0764d5748893fdf631c504c171 ]
dbc_dev_init() registers the DBC misc device before initializing
ioctl_mutex. Once misc_register() publishes the device, userspace can
open it and invoke dbc_ioctl() while the mutex is still uninitialized.
Initialize ioctl_mutex before calling misc_register() so the published
ioctl callback always sees an initialized mutex.
Fixes: c04cf9e14f10 ("crypto: ccp - Add support for fetching a nonce for dynamic boost control")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260829133410.1708684-1-runyu.xiao@seu.edu.cn/
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Assisted-by: Codex:GPT-5
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/dbc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/ccp/dbc.c b/drivers/crypto/ccp/dbc.c
index 410084a9039c9..4db49a14550c9 100644
--- a/drivers/crypto/ccp/dbc.c
+++ b/drivers/crypto/ccp/dbc.c
@@ -236,6 +236,8 @@ int dbc_dev_init(struct psp_device *psp)
goto cleanup_mbox;
}
+ mutex_init(&dbc_dev->ioctl_mutex);
+
dbc_dev->char_dev.minor = MISC_DYNAMIC_MINOR;
dbc_dev->char_dev.name = "dbc";
dbc_dev->char_dev.fops = &dbc_fops;
@@ -244,8 +246,6 @@ int dbc_dev_init(struct psp_device *psp)
if (ret)
goto cleanup_mbox;
- mutex_init(&dbc_dev->ioctl_mutex);
-
return 0;
cleanup_mbox:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 131/869] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 130/869] crypto: ccp - Initialize DBC ioctl mutex before registering device Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 132/869] affs: validate blocks before freeing them Greg Kroah-Hartman
` (745 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Rafael J. Wysocki,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
[ Upstream commit 61f7eee7d4664079fbce821576891c3ee5ccf597 ]
cpu_pm_notify() walks the notifier chain lockless under only
rcu_read_lock(). That only works if a removed notifier block is not
freed until every concurrent walker is done with it.
The chain used to be an atomic_notifier, whose unregister ends in
synchronize_rcu(). Commit b2f6662ac08d ("PM: cpu: Make notifier chain
use a raw_spinlock_t") switched it over to a raw_notifier, and in
doing so replaced that with raw_notifier_chain_unregister(), which
does not synchronize. The grace period quietly went away, so a driver
that frees the memory holding its notifier block right after
cpu_pm_unregister_notifier() returns can race with a concurrent
walker:
cpu1 (idle exit) cpu2 (driver remove)
---------------- --------------------
cpu_pm_notify(CPU_PM_EXIT)
rcu_read_lock()
nb = rcu_dereference_raw(*nl)
cpu_pm_unregister_notifier(&od->nb)
unlink, no grace period
remove() frees od (devm)
nb->notifier_call(nb, ...)
/* use after free */
The rcu_read_lock() on cpu1 does not stop cpu2 from freeing the
block, and nothing else does. The read side is the idle exit path,
so this can hit on any system where a driver with a cpu_pm notifier
gets unbound.
Add the grace period back. It is only needed when a notifier was
actually removed, so wait on success and return -ENOENT without
waiting otherwise. The kerneldoc gets back the "may sleep" note that
the same commit dropped.
Fixes: b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Bradley Morgan <include@grrlz.net>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260813074343.26460-3-include@grrlz.net
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cpu_pm.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
index 7481fbb947d32..a2a598ad6e6d5 100644
--- a/kernel/cpu_pm.c
+++ b/kernel/cpu_pm.c
@@ -10,6 +10,7 @@
#include <linux/cpu_pm.h>
#include <linux/module.h>
#include <linux/notifier.h>
+#include <linux/rcupdate.h>
#include <linux/spinlock.h>
#include <linux/syscore_ops.h>
@@ -76,7 +77,8 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
*
* Remove a driver from the CPU PM notifier list.
*
- * This function has the same return conditions as raw_notifier_chain_unregister.
+ * This function may sleep, and has the same return conditions as
+ * raw_notifier_chain_unregister.
*/
int cpu_pm_unregister_notifier(struct notifier_block *nb)
{
@@ -86,6 +88,11 @@ int cpu_pm_unregister_notifier(struct notifier_block *nb)
raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb);
raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+
+ /* Wait for the rcu_read_lock() walkers in cpu_pm_notify(). */
+ if (!ret)
+ synchronize_rcu();
+
return ret;
}
EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 132/869] affs: validate blocks before freeing them
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 131/869] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 133/869] dm vdo indexer: prevent delta list overflow on load Greg Kroah-Hartman
` (744 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit 78ea2058abf3ee053c0bd9c1b9a77304cb4ae58b ]
affs_free_block() accepts block numbers from on-disk file block tables
when truncating or unlinking files. The function currently rejects only
block numbers greater than s_partition_size before subtracting
s_reserved and using the result to index the in-memory bitmap descriptor
array.
That check still accepts reserved blocks and the one-past-end block at
s_partition_size. A crafted image can therefore make the subtraction
underflow or make the computed bitmap index equal to s_bmap_count,
leading to an out-of-bounds access on s_bitmap before the bitmap block is
read and updated.
Use the existing AFFS block validity helper so freeing uses the same
range as block reads and writes: s_reserved <= block < s_partition_size.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/affs/bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/affs/bitmap.c b/fs/affs/bitmap.c
index 5ba9ef2742f6e..f400b28eea28d 100644
--- a/fs/affs/bitmap.c
+++ b/fs/affs/bitmap.c
@@ -46,7 +46,7 @@ affs_free_block(struct super_block *sb, u32 block)
pr_debug("%s(%u)\n", __func__, block);
- if (block > sbi->s_partition_size)
+ if (!affs_validblock(sb, block))
goto err_range;
blk = block - sbi->s_reserved;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 133/869] dm vdo indexer: prevent delta list overflow on load
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 132/869] affs: validate blocks before freeing them Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 134/869] dm vdo indexer: validate record page numbers better Greg Kroah-Hartman
` (743 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Sakai, Mikulas Patocka,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Sakai <msakai@redhat.com>
[ Upstream commit 936293c9f3f4f2a0d1b80df9332e96c552ac3b37 ]
Check for corrupted delta lists sizes that overflow the
memory available for the delta_lists. An overflow can
cause the delta list data to be written outside the
reserved delta memory space.
Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-vdo/indexer/delta-index.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-vdo/indexer/delta-index.c b/drivers/md/dm-vdo/indexer/delta-index.c
index 0ac2443f0df36..a42de1af4b693 100644
--- a/drivers/md/dm-vdo/indexer/delta-index.c
+++ b/drivers/md/dm-vdo/indexer/delta-index.c
@@ -803,7 +803,7 @@ static void compute_new_list_offsets(struct delta_zone *delta_zone, u32 growing_
(delta_zone->size * BITS_PER_BYTE - delta_lists[tail_guard_index].size);
}
-static void rebalance_lists(struct delta_zone *delta_zone)
+static int rebalance_lists(struct delta_zone *delta_zone)
{
struct delta_list *delta_lists;
u32 i;
@@ -814,9 +814,17 @@ static void rebalance_lists(struct delta_zone *delta_zone)
for (i = 0; i <= delta_zone->list_count + 1; i++)
used_space += get_delta_list_byte_size(&delta_lists[i]);
+ if (delta_zone->size < used_space) {
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+ "delta zone lists overflow zone size %zu",
+ delta_zone->size);
+ }
+
compute_new_list_offsets(delta_zone, 0, 0, used_space);
for (i = 1; i <= delta_zone->list_count + 1; i++)
delta_lists[i].start = delta_zone->new_offsets[i];
+
+ return UDS_SUCCESS;
}
/* Start restoring a delta index from multiple input streams. */
@@ -944,8 +952,11 @@ int uds_start_restoring_delta_index(struct delta_index *delta_index,
}
/* Prepare each zone to start receiving the delta list data. */
- for (z = 0; z < delta_index->zone_count; z++)
- rebalance_lists(&delta_index->delta_zones[z]);
+ for (z = 0; z < delta_index->zone_count; z++) {
+ result = rebalance_lists(&delta_index->delta_zones[z]);
+ if (result != UDS_SUCCESS)
+ return result;
+ }
return UDS_SUCCESS;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 134/869] dm vdo indexer: validate record page numbers better
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 133/869] dm vdo indexer: prevent delta list overflow on load Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 135/869] f2fs: force out-place update for all writes on compressed file Greg Kroah-Hartman
` (742 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Sakai, Mikulas Patocka,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Sakai <msakai@redhat.com>
[ Upstream commit e3683a76a313a81f3f7bc7f65e4fc1e61232838b ]
Move the record_page_number validation check into the
chapter index lookup function in order to detect (and
discard) corrupted values on all paths.
Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-vdo/indexer/chapter-index.c | 15 +++++++++++----
drivers/md/dm-vdo/indexer/volume.c | 6 ------
2 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/md/dm-vdo/indexer/chapter-index.c b/drivers/md/dm-vdo/indexer/chapter-index.c
index fb1db41c794b3..7a744b2da28f9 100644
--- a/drivers/md/dm-vdo/indexer/chapter-index.c
+++ b/drivers/md/dm-vdo/indexer/chapter-index.c
@@ -284,10 +284,17 @@ int uds_search_chapter_index_page(struct delta_index_page *index_page,
if (result != UDS_SUCCESS)
return result;
- if (was_entry_found(&entry, address))
- *record_page_ptr = uds_get_delta_entry_value(&entry);
- else
+ if (!was_entry_found(&entry, address)) {
*record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+ return UDS_SUCCESS;
+ }
- return UDS_SUCCESS;
+ *record_page_ptr = uds_get_delta_entry_value(&entry);
+ result = VDO_ASSERT(*record_page_ptr < geometry->record_pages_per_chapter,
+ "0 <= %d < %u", *record_page_ptr,
+ geometry->record_pages_per_chapter);
+ if (result != VDO_SUCCESS)
+ *record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+
+ return result;
}
diff --git a/drivers/md/dm-vdo/indexer/volume.c b/drivers/md/dm-vdo/indexer/volume.c
index 425b3a74f4dba..f7de78e0d0dbd 100644
--- a/drivers/md/dm-vdo/indexer/volume.c
+++ b/drivers/md/dm-vdo/indexer/volume.c
@@ -891,12 +891,6 @@ int uds_search_cached_record_page(struct volume *volume, struct uds_request *req
if (record_page_number == NO_CHAPTER_INDEX_ENTRY)
return UDS_SUCCESS;
- result = VDO_ASSERT(record_page_number < geometry->record_pages_per_chapter,
- "0 <= %d < %u", record_page_number,
- geometry->record_pages_per_chapter);
- if (result != VDO_SUCCESS)
- return result;
-
page_number = geometry->index_pages_per_chapter + record_page_number;
physical_page = map_to_physical_page(volume->geometry, chapter, page_number);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 135/869] f2fs: force out-place update for all writes on compressed file
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 134/869] dm vdo indexer: validate record page numbers better Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 136/869] f2fs: compress: fix to handle race between truncate and writeback Greg Kroah-Hartman
` (741 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jiucheng Xu, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiucheng Xu <jiucheng.xu@amlogic.com>
[ Upstream commit a64a3fec11e77a3a0dc0009bdc58b925e45a1bb4 ]
For compressed file, compressed write may fail and fall back to raw
write.
-Thread A - Thread B
- f2fs_write_multi_pages - f2fs_down_write(&sbi->cp_rwsem);
- f2fs_write_compressed_pages - ...
- f2fs_trylock_op - ...
- f2fs_down_read_trylock(&sbi->cp_rwsem); - ...
- f2fs_write_raw_pages - ...
Thread B acquires the lock first, which causes Thread A to fail lock
acquisition and fall back to raw-data write.
IPU_FORCE is enabled on small-capacity storage devices (< 16GB),
so f2fs_write_raw_pages() overwrites the original compressed data
in-place.
The in-memory node has been updated with raw-data addresses, while the
node metadata stored on eMMC still remains in compressed state.
If a power-cut occurs before the node is flushed to disk, on-disk
inconsistency arises: disk data is raw, yet metadata treats it as a
compressed cluster, leading to decompression failure.
To eliminate this risk completely, force out-place update for all
write operations on compressed file.
Cc: stable@kernel.org
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 3455565b82451..aa6a844ed34dd 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2675,10 +2675,12 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
return true;
if (f2fs_used_in_atomic_write(inode))
return true;
- /* rewrite low ratio compress data w/ OPU mode to avoid fragmentation */
- if (f2fs_compressed_file(inode) &&
- F2FS_OPTION(sbi).compress_mode == COMPR_MODE_USER &&
- is_inode_flag_set(inode, FI_ENABLE_COMPRESS))
+ /*
+ * rewrite low ratio compress data w/ OPU mode to avoid fragmentation.
+ * If IO comes from compressed write path and fallback to raw write,
+ * force out‑place to prevent metadata‑data inconsistency.
+ */
+ if (f2fs_compressed_file(inode))
return true;
/* swap file is migrating in aligned write mode */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 136/869] f2fs: compress: fix to handle race between truncate and writeback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 135/869] f2fs: force out-place update for all writes on compressed file Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 6.18 137/869] ata: ahci_st: Do not ignore errors when getting the reset controls Greg Kroah-Hartman
` (740 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhiguo Niu, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit c0337e331b065074ce20e4258a578e07dd7e4083 ]
fsstress reports a kernel BUG in f2fs_truncate_partial_cluster():
kernel BUG at fs/f2fs/compress.c:1238!
RIP: 0010:f2fs_truncate_partial_cluster+0x292/0x2a0
Call Trace:
<TASK>
f2fs_truncate+0xf6/0x210
f2fs_setattr+0x6b7/0x770
notify_change+0x33b/0x520
do_truncate+0xc2/0xf0
vfs_truncate+0x153/0x1d0
ksys_truncate+0x78/0xd0
__x64_sys_truncate+0x16/0x20
do_syscall_64+0xbe/0x540
The root cause is that Thread A (truncate) and Thread B (background
writeback or fsync) can race as follows:
Thread A Thread B
- f2fs_setattr
- f2fs_truncate
- f2fs_truncate_blocks
- f2fs_truncate_partial_cluster
- f2fs_is_compressed_cluster
return 1
- f2fs_write_cache_pages
- f2fs_write_multi_pages
- f2fs_write_raw_pages
- f2fs_write_single_data_page
dn.data_blkaddr != COMPRESS_ADDR
(cluster converted to normal)
- f2fs_prepare_compress_overwrite
- f2fs_is_compressed_cluster
return 0
- return 0
- f2fs_bug_on(sbi, err == 0): BUG!
Writeback path does not acquire i_gc_rwsem or filemap_invalidate_lock.
When a compressed cluster fails compression during writeback, it is
overwritten with raw data blocks. If Thread A checked
f2fs_is_compressed_cluster() before the conversion, but calls
f2fs_prepare_compress_overwrite() after the conversion,
f2fs_prepare_compress_overwrite() returns 0 because the cluster is no
longer a compressed cluster.
To fix this, remove the f2fs_bug_on() and retry checking the cluster status
when f2fs_prepare_compress_overwrite() returns 0, so that it can fall back
to f2fs_do_truncate_blocks() to handle it as a normal cluster.
Cc: stable@kernel.org
Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 0399db98fccfc..8fea48dc50bad 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1219,6 +1219,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
int i;
int err;
+repeat:
err = f2fs_is_compressed_cluster(inode, start_idx);
if (err < 0)
return err;
@@ -1230,12 +1231,11 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
/* truncate compressed cluster */
err = f2fs_prepare_compress_overwrite(inode, &pagep,
start_idx, &fsdata);
-
- /* should not be a normal cluster */
- f2fs_bug_on(F2FS_I_SB(inode), err == 0);
-
- if (err <= 0)
+ if (err < 0)
return err;
+ else if (err == 0)
+ /* the cluster became non-compressed one due to race case */
+ goto repeat;
rpages = fsdata;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 137/869] ata: ahci_st: Do not ignore errors when getting the reset controls
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 136/869] f2fs: compress: fix to handle race between truncate and writeback Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 138/869] ata: ahci_st: Assert the power down reset in the probe() error path Greg Kroah-Hartman
` (739 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit c74ee9230a8d1d2f6fcbceff55f56f7dd9b9cccd ]
st_ahci_probe_resets() treats any error from devm_reset_control_get() as
"reset control not defined" and continues with a NULL reset control:
drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
if (IS_ERR(drv_data->pwr)) {
dev_info(dev, "power reset control not defined\n");
drv_data->pwr = NULL;
}
This also swallows -EPROBE_DEFER, which is returned when the reset
controller providing the reset has not been probed yet. probe() then
continues as if the device tree did not specify any reset, so the resets
of the SATA IP are never deasserted, and st_ahci_configure_oob() and
ahci_platform_init_host() access the MMIO of an IP which is still held in
reset and powered down, which can result in an external abort.
The resets are optional in the binding, as they are not part of its
required properties, so use devm_reset_control_get_optional(), which
returns NULL if the reset is not specified in the device tree, and
propagate all other errors.
Note that an absent reset is now indicated by a NULL reset control
instead of an error, so the "reset control not defined" messages are
dropped.
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-9-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci_st.c | 31 ++++++++++++++-----------------
1 file changed, 14 insertions(+), 17 deletions(-)
diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 4336c8a6e2087..819269a022efd 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -104,23 +104,20 @@ static int st_ahci_probe_resets(struct ahci_host_priv *hpriv,
{
struct st_ahci_drv_data *drv_data = hpriv->plat_data;
- drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
- if (IS_ERR(drv_data->pwr)) {
- dev_info(dev, "power reset control not defined\n");
- drv_data->pwr = NULL;
- }
-
- drv_data->sw_rst = devm_reset_control_get(dev, "sw-rst");
- if (IS_ERR(drv_data->sw_rst)) {
- dev_info(dev, "soft reset control not defined\n");
- drv_data->sw_rst = NULL;
- }
-
- drv_data->pwr_rst = devm_reset_control_get(dev, "pwr-rst");
- if (IS_ERR(drv_data->pwr_rst)) {
- dev_dbg(dev, "power soft reset control not defined\n");
- drv_data->pwr_rst = NULL;
- }
+ drv_data->pwr = devm_reset_control_get_optional(dev, "pwr-dwn");
+ if (IS_ERR(drv_data->pwr))
+ return dev_err_probe(dev, PTR_ERR(drv_data->pwr),
+ "failed to get pwr-dwn reset\n");
+
+ drv_data->sw_rst = devm_reset_control_get_optional(dev, "sw-rst");
+ if (IS_ERR(drv_data->sw_rst))
+ return dev_err_probe(dev, PTR_ERR(drv_data->sw_rst),
+ "failed to get sw-rst reset\n");
+
+ drv_data->pwr_rst = devm_reset_control_get_optional(dev, "pwr-rst");
+ if (IS_ERR(drv_data->pwr_rst))
+ return dev_err_probe(dev, PTR_ERR(drv_data->pwr_rst),
+ "failed to get pwr-rst reset\n");
return st_ahci_deassert_resets(hpriv, dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 138/869] ata: ahci_st: Assert the power down reset in the probe() error path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 6.18 137/869] ata: ahci_st: Do not ignore errors when getting the reset controls Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 139/869] ata: libahci: Free the IRQs when activating a multi-IRQ host fails Greg Kroah-Hartman
` (738 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 91e0a7452d7a81e924a499b23f30f3bf85fddbd2 ]
st_ahci_probe_resets() deasserts the "pwr-dwn" reset, but the probe()
error path of st_ahci_probe() only releases the host resources, so the
SATA IP is left powered up when probe() fails after
st_ahci_probe_resets() has succeeded, e.g. when
ahci_platform_enable_resources() fails.
The reset is asserted by st_ahci_host_stop(), however ->host_stop() is
only called through the ata_host_stop() devres action registered by
ata_host_start(), so it does not cover any failure happening before the
host has been started.
Factor the assert out into st_ahci_assert_pwrdwn() and call it when
either ahci_platform_enable_resources() or ahci_platform_init_host()
fails. The "pwr-dwn" reset control is an exclusive one, so asserting it
once more from st_ahci_host_stop() is harmless.
No functional change intended for ->host_stop() and st_ahci_suspend().
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-10-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci_st.c | 51 +++++++++++++++++++++++++------------------
1 file changed, 30 insertions(+), 21 deletions(-)
diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 819269a022efd..eea75961038cf 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -83,18 +83,27 @@ static int st_ahci_deassert_resets(struct ahci_host_priv *hpriv,
return 0;
}
-static void st_ahci_host_stop(struct ata_host *host)
+static int st_ahci_assert_pwrdwn(struct ahci_host_priv *hpriv,
+ struct device *dev)
{
- struct ahci_host_priv *hpriv = host->private_data;
struct st_ahci_drv_data *drv_data = hpriv->plat_data;
- struct device *dev = host->dev;
int err;
- if (drv_data->pwr) {
- err = reset_control_assert(drv_data->pwr);
- if (err)
- dev_err(dev, "unable to pwrdwn\n");
- }
+ if (!drv_data->pwr)
+ return 0;
+
+ err = reset_control_assert(drv_data->pwr);
+ if (err)
+ dev_err(dev, "unable to pwrdwn\n");
+
+ return err;
+}
+
+static void st_ahci_host_stop(struct ata_host *host)
+{
+ struct ahci_host_priv *hpriv = host->private_data;
+
+ st_ahci_assert_pwrdwn(hpriv, host->dev);
ahci_platform_disable_resources(hpriv);
}
@@ -159,38 +168,38 @@ static int st_ahci_probe(struct platform_device *pdev)
err = ahci_platform_enable_resources(hpriv);
if (err)
- return err;
+ goto assert_pwrdwn;
st_ahci_configure_oob(hpriv->mmio);
err = ahci_platform_init_host(pdev, hpriv, &st_ahci_port_info,
&ahci_platform_sht);
- if (err) {
- ahci_platform_disable_resources(hpriv);
- return err;
- }
+ if (err)
+ goto disable_resources;
return 0;
+
+disable_resources:
+ ahci_platform_disable_resources(hpriv);
+assert_pwrdwn:
+ st_ahci_assert_pwrdwn(hpriv, &pdev->dev);
+
+ return err;
}
static int st_ahci_suspend(struct device *dev)
{
struct ata_host *host = dev_get_drvdata(dev);
struct ahci_host_priv *hpriv = host->private_data;
- struct st_ahci_drv_data *drv_data = hpriv->plat_data;
int err;
err = ahci_platform_suspend_host(dev);
if (err)
return err;
- if (drv_data->pwr) {
- err = reset_control_assert(drv_data->pwr);
- if (err) {
- dev_err(dev, "unable to pwrdwn");
- return err;
- }
- }
+ err = st_ahci_assert_pwrdwn(hpriv, dev);
+ if (err)
+ return err;
ahci_platform_disable_resources(hpriv);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 139/869] ata: libahci: Free the IRQs when activating a multi-IRQ host fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 138/869] ata: ahci_st: Assert the power down reset in the probe() error path Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 140/869] ata: libata: Do not leave ata_host_stop() registered when activation fails Greg Kroah-Hartman
` (737 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 34a4a34431ed81d85d14f8fb8035e5a25214ad39 ]
ahci_host_activate_multi_irqs() requests one IRQ per port, but it does
not free them when requesting one of them, or when registering the host,
fails. The IRQs are only freed by the driver core, when it releases the
devres of the device after probe() has returned, while the caller of
ahci_host_activate() releases the resources of the host in its probe()
error path, e.g. ahci_probe() disables the clocks, regulators, resets and
PHYs of the host. An IRQ handler running in that window would access the
MMIO of a host which is no longer clocked.
ahci_host_activate_multi_irqs() did free the IRQs until commit
0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs"), which
removed the explicit free because devm makes it unnecessary. That is true
for freeing the IRQs as such, but not for the window described above:
devres is only released after probe() has returned, i.e. after the error
path of the caller has released the resources of the host.
Note that this window cannot be hit with the current users: the only user
of AHCI_HFLAG_MULTI_MSI is the AHCI PCI driver, which does not release
any resource in its probe() error path, and the ports of the host are
still frozen, i.e. their interrupts are masked, when ata_host_register()
fails.
Free the IRQs explicitly again, like ata_host_activate() does, so that
the IRQ handlers cannot run once ahci_host_activate() has failed.
Fixes: 0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-12-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libahci.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index ecb56bb50fd7c..510516c75a5a2 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2739,11 +2739,33 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
0, pp->irq_desc, host->ports[i]);
if (rc)
- return rc;
+ goto free_irqs;
ata_port_desc_misc(host->ports[i], irq);
}
- return ata_host_register(host, sht);
+ rc = ata_host_register(host, sht);
+ if (rc)
+ goto free_irqs;
+
+ return 0;
+
+free_irqs:
+ /*
+ * Free the IRQs which have been requested, so that the handlers can no
+ * longer access the MMIO of the host once we return, e.g. after the
+ * caller has disabled the clocks of the host.
+ */
+ while (--i >= 0) {
+ struct ahci_port_priv *pp = host->ports[i]->private_data;
+
+ if (!pp)
+ continue;
+
+ devm_free_irq(host->dev, hpriv->get_irq_vector(host, i),
+ host->ports[i]);
+ }
+
+ return rc;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 140/869] ata: libata: Do not leave ata_host_stop() registered when activation fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 139/869] ata: libahci: Free the IRQs when activating a multi-IRQ host fails Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 141/869] media: i2c: alvium-csi2: balance runtime PM usage count on remove Greg Kroah-Hartman
` (736 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit d2f977008cbbae195df678ee1e70e5802f9bd0b8 ]
ata_host_start() registers ata_host_stop() as a devres action as soon as
it has succeeded, which hands the release of the host resources over to
devres: ->port_stop() and ->host_stop() are then called by the driver
core when probe() fails.
ata_host_activate() and ahci_host_activate_multi_irqs() can both fail
after ata_host_start() has succeeded, e.g. if devm_request_irq() or
ata_host_register() fails, and they return the error with the devres
action still registered. A driver which releases the host resources in
its probe() error path therefore releases them twice: once itself and
once through ->host_stop().
All ahci-platform drivers are in that situation, e.g. ahci_probe() calls
ahci_platform_disable_resources() while ahci_host_stop() does the same
through devres. This gives refcount underflow warnings from the clk,
regulator and phy cores and, for shared resources, can disable resources
which are still in use by other devices.
Add ata_host_undo_start(), which stops the ports and drops the devres
action without calling ->host_stop(), and call it from both activation
helpers when they fail. Releasing the host resources on failure is then
always left to the caller, which is what all callers having a probe()
error path already assume.
This changes the semantics for the drivers which implement ->host_stop()
while also completely lacking error handling for the activate host call.
Add activate host error handling for sata_qstor and sata_fsl. For
sata_fsl this also means that hcr_base and host_priv are now released
when activating the host fails, which ->host_stop() did not do when
ata_host_start() itself failed.
Note that ata_pci_sff_activate_host() is deliberately left as is: none of
its callers releases the host resources in its probe() error path, they
all rely on ->host_stop() being called by devres, including
ata_pci_init_one(), which releases the devres group of the host itself.
Fixes: 1896b15eddb4 ("ahci_platform: perform platform exit in host_stop() hook")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-13-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libahci.c | 2 +
drivers/ata/libahci_platform.c | 4 ++
drivers/ata/libata-core.c | 75 +++++++++++++++++++++++++++++++---
drivers/ata/libata-sff.c | 5 +++
drivers/ata/sata_fsl.c | 6 ++-
drivers/ata/sata_qstor.c | 8 +++-
include/linux/libata.h | 1 +
7 files changed, 91 insertions(+), 10 deletions(-)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 510516c75a5a2..50b2c997b6bad 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2765,6 +2765,8 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
host->ports[i]);
}
+ ata_host_undo_start(host);
+
return rc;
}
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 7308d48cf748b..7703c22ef532d 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -692,6 +692,10 @@ EXPORT_SYMBOL_GPL(ahci_platform_get_resources);
* ahci-platform host, note any necessary resources (ie clks, phys, etc.)
* must be initialized / enabled before calling this.
*
+ * On failure, ->host_stop() is not called, so the caller has to release the
+ * resources it enabled (clocks, regulators, resets, PHYs) in its probe()
+ * error path.
+ *
* RETURNS:
* 0 on success otherwise a negative error code
*/
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cd9c96560ddd3..cb74c6a5d9aa1 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5976,6 +5976,46 @@ int ata_host_start(struct ata_host *host)
}
EXPORT_SYMBOL_GPL(ata_host_start);
+/**
+ * ata_host_undo_start - undo ata_host_start()
+ * @host: ATA host to undo_start
+ *
+ * Stop the ports of @host and drop the devres action registered by
+ * ata_host_start(), without calling ->host_stop(). Nothing is done if
+ * @host has not been started.
+ *
+ * This gives the release of the host resources back to the caller, which
+ * is what a driver whose probe() error path releases those resources
+ * itself needs when starting or activating the host fails.
+ *
+ * LOCKING:
+ * Inherited from calling layer (may sleep).
+ */
+void ata_host_undo_start(struct ata_host *host)
+{
+ int i;
+
+ if (!(host->flags & ATA_HOST_STARTED))
+ return;
+
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+
+ if (ap->ops->port_stop)
+ ap->ops->port_stop(ap);
+ }
+
+ /*
+ * Drop the action added by ata_host_start() without calling it.
+ * It does not exist if neither ->port_stop() nor ->host_stop() is
+ * implemented, in which case there is nothing to drop.
+ */
+ devres_destroy(host->dev, ata_host_stop, NULL, NULL);
+
+ host->flags &= ~ATA_HOST_STARTED;
+}
+EXPORT_SYMBOL_GPL(ata_host_undo_start);
+
/**
* ata_host_init - Initialize a host struct for sas (ipr, libsas)
* @host: host to initialize
@@ -6048,6 +6088,12 @@ static void async_port_probe(void *data, async_cookie_t cookie)
* starts ports, registers @host with ATA and SCSI layers and
* probe registered devices.
*
+ * On failure, the host remains started, i.e. the devres action
+ * registered by ata_host_start() is kept, so ->host_stop() is called by
+ * the driver core when probe() fails. A caller which releases the host
+ * resources in its own probe() error path must therefore call
+ * ata_host_undo_start().
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
@@ -6141,6 +6187,10 @@ EXPORT_SYMBOL_GPL(ata_host_register);
* have set polling mode on the port. In this case, @irq_handler
* should be NULL.
*
+ * On failure, the ports are stopped again and the devres action
+ * registered by ata_host_start() is dropped without calling
+ * ->host_stop(), so releasing the host resources is left to the caller.
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
@@ -6161,27 +6211,40 @@ int ata_host_activate(struct ata_host *host, int irq,
/* Special case for polling mode */
if (!irq) {
WARN_ON(irq_handler);
- return ata_host_register(host, sht);
+ rc = ata_host_register(host, sht);
+ if (rc)
+ goto undo_start;
+
+ return 0;
}
irq_desc = devm_kasprintf(host->dev, GFP_KERNEL, "%s[%s]",
dev_driver_string(host->dev),
dev_name(host->dev));
- if (!irq_desc)
- return -ENOMEM;
+ if (!irq_desc) {
+ rc = -ENOMEM;
+ goto undo_start;
+ }
rc = devm_request_irq(host->dev, irq, irq_handler, irq_flags,
irq_desc, host);
if (rc)
- return rc;
+ goto undo_start;
for (i = 0; i < host->n_ports; i++)
ata_port_desc_misc(host->ports[i], irq);
rc = ata_host_register(host, sht);
- /* if failed, just free the IRQ and leave ports alone */
- if (rc)
+ if (rc) {
+ /* Free the IRQ, so that the handler can no longer run */
devm_free_irq(host->dev, irq, host);
+ goto undo_start;
+ }
+
+ return 0;
+
+undo_start:
+ ata_host_undo_start(host);
return rc;
}
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 1e2a2c33cdc80..142347b5428dd 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -2256,6 +2256,11 @@ EXPORT_SYMBOL_GPL(ata_pci_sff_prepare_host);
* hosts. This separate helper is necessary because SFF hosts
* use two separate interrupts in legacy mode.
*
+ * Note that, unlike ata_host_activate(), the devres action registered
+ * by ata_host_start() is kept on failure, i.e. ->host_stop() is called
+ * by the driver core when probe() fails. All callers of this function
+ * rely on that, none of them releases the host resources itself.
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 040e5c3f635a9..a04e38cd41702 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1489,8 +1489,10 @@ static int sata_fsl_probe(struct platform_device *ofdev)
* device discovery process, invoking our port_start() handler &
* error_handler() to execute a dummy Softreset EH session
*/
- ata_host_activate(host, irq, sata_fsl_interrupt, SATA_FSL_IRQ_FLAG,
- &sata_fsl_sht);
+ retval = ata_host_activate(host, irq, sata_fsl_interrupt,
+ SATA_FSL_IRQ_FLAG, &sata_fsl_sht);
+ if (retval)
+ goto error_exit_with_cleanup;
host_priv->intr_coalescing.show = fsl_sata_intr_coalescing_show;
host_priv->intr_coalescing.store = fsl_sata_intr_coalescing_store;
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index cfb9b5b61cd7e..b2be1ce87878f 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -584,8 +584,12 @@ static int qs_ata_init_one(struct pci_dev *pdev,
qs_host_init(host, board_idx);
pci_set_master(pdev);
- return ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
- &qs_ata_sht);
+ rc = ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
+ &qs_ata_sht);
+ if (rc)
+ qs_host_stop(host);
+
+ return rc;
}
module_pci_driver(qs_ata_pci_driver);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 868af0a08f527..a92908f07e220 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -1136,6 +1136,7 @@ extern struct ata_host *ata_host_alloc_pinfo(struct device *dev,
extern void ata_host_get(struct ata_host *host);
extern void ata_host_put(struct ata_host *host);
extern int ata_host_start(struct ata_host *host);
+void ata_host_undo_start(struct ata_host *host);
extern int ata_host_register(struct ata_host *host,
const struct scsi_host_template *sht);
extern int ata_host_activate(struct ata_host *host, int irq,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 141/869] media: i2c: alvium-csi2: balance runtime PM usage count on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 140/869] ata: libata: Do not leave ata_host_stop() registered when activation fails Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 142/869] media: i2c: ov2735: fix power cleanup " Greg Kroah-Hartman
` (735 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sakari Ailus,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 0d2ca640318612402ae1c640d2da56b2914ff994 ]
alvium_probe() increments the runtime PM usage count with
pm_runtime_get_noresume() before enabling runtime PM. The probe error
path correctly balances this reference with pm_runtime_put_noidle(),
but the normal remove path only disables runtime PM.
pm_runtime_disable() does not decrement the usage count, so a
successful probe followed by driver removal leaves the runtime PM
usage count unbalanced.
Add the missing pm_runtime_put_noidle() to the remove path, matching
the existing probe error cleanup.
This issue was found by manual code inspection.
Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/alvium-csi2.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
index 3d399af013222..d08d01098a9a3 100644
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -2523,6 +2523,7 @@ static void alvium_remove(struct i2c_client *client)
* make sure to turn power off manually.
*/
pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
if (!pm_runtime_status_suspended(dev))
alvium_set_power(alvium, false);
pm_runtime_set_suspended(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 142/869] media: i2c: ov2735: fix power cleanup on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 141/869] media: i2c: alvium-csi2: balance runtime PM usage count on remove Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 143/869] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() Greg Kroah-Hartman
` (734 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sakari Ailus,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 06d4f202f007b160e650e8dd861a5fc223024f34 ]
ov2735_probe() explicitly powers on the sensor before enabling runtime
PM. The probe failure paths call ov2735_power_off(), but the remove path
does not perform the corresponding power-off operation.
The managed runtime PM helpers only clean up the runtime PM state.
devm_pm_runtime_set_active_enabled() disables runtime PM and restores
the suspended state during device resource release, while
devm_pm_runtime_get_noresume() drops the runtime PM usage reference.
Neither helper invokes ov2735_power_off().
As a result, removing the driver after a successful probe can leave the
sensor clock and regulators enabled and the GPIOs in the powered state.
Call ov2735_power_off() from ov2735_remove() to match the successful
ov2735_power_on() performed during probe.
This issue was found by manual code inspection.
Fixes: fa9e6df636fb ("media: i2c: add ov2735 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2735.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/ov2735.c b/drivers/media/i2c/ov2735.c
index b966002041417..f248fdb352af6 100644
--- a/drivers/media/i2c/ov2735.c
+++ b/drivers/media/i2c/ov2735.c
@@ -1081,6 +1081,7 @@ static void ov2735_remove(struct i2c_client *client)
v4l2_subdev_cleanup(&ov2735->sd);
media_entity_cleanup(&sd->entity);
v4l2_ctrl_handler_free(ov2735->sd.ctrl_handler);
+ ov2735_power_off(ov2735->dev);
}
static DEFINE_RUNTIME_DEV_PM_OPS(ov2735_pm_ops,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 143/869] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 142/869] media: i2c: ov2735: fix power cleanup " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 144/869] ntfs3: bound index head insertions by buffer capacity Greg Kroah-Hartman
` (733 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6a6f3051e705b5c8facb0bf5984d5b981509e0b7 ]
hp_convert_hexstr_to_str() decodes an ACPI string made up of
space-separated ASCII hex-byte tokens of the form "0xHH". For
example, the four-byte input "0x41" decodes to the single
character 'A', and the nine-byte input "0x09 0x41" decodes to
"\tA": each token is read in a five-byte step (four characters for
the token, one for the trailing delimiter), and produces one output
byte, or two if that byte is '\\', '\r', '\n', or '\t', which are
written back out as a backslash followed by the matching letter.
The output buffer is sized with kmalloc(input_len, GFP_KERNEL), the
raw encoded length of the input, not the decoded length. For
well-formed input this is generous, since five input bytes never
decode to more than two output bytes. But input_len comes directly
from the ACPI string length reported by firmware and isn't
guaranteed to respect the five-byte encoding, so a short input_len
can undersize the allocation. With input_len == 1, only one byte is
allocated, yet decoding still produces at least one output byte
plus the NUL terminator written unconditionally afterwards, so two
bytes are needed. That terminator write then lands one byte past
the end of the allocation.
KASAN caught exactly this during BIOS attribute enumeration on
boot, triggered by a one-byte encoded input value:
BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)
Size the allocation to the worst-case decoded length instead of the
raw input length: two output bytes for every five-byte input chunk
(DIV_ROUND_UP(input_len, 5)), plus one byte for the terminator.
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260915174615.63924-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 274bdecce6852..f665af1c11850 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
*len = 0;
*str = NULL;
- new_str = kmalloc(input_len, GFP_KERNEL);
+ new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
if (!new_str)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 144/869] ntfs3: bound index head insertions by buffer capacity
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 143/869] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 145/869] crypto: atmel-tdes - sync output bounce buffer before DMA Greg Kroah-Hartman
` (732 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+45ef5a8d661162757547,
Yousef Alhouseen, Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit 2f497d23652ff23da07b08cfb4b4a1c2a87f1892 ]
hdr_insert_head() shifts the existing index entries by ins_bytes without
checking that the resulting used size fits within hdr->total. A directory
index root larger than the newly allocated index buffer can therefore make
the memmove write beyond the buffer.
Reject insertions whose size would exceed the index header capacity and
make both split callers unwind the new node when that happens.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: syzbot+45ef5a8d661162757547@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=45ef5a8d661162757547
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/index.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 03ae5a817c1b4..97cbe176a83e5 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -596,6 +596,8 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr,
if (!e)
return NULL;
+ if (size_add(used, ins_bytes) > le32_to_cpu(hdr->total))
+ return NULL;
/* Now we just make room for the inserted entries and jam it in. */
to_move = used - le32_to_cpu(hdr->de_off);
@@ -1800,7 +1802,10 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni,
}
/* Copy root entries into new buffer. */
- hdr_insert_head(hdr, re, to_move);
+ if (!hdr_insert_head(hdr, re, to_move)) {
+ err = -EINVAL;
+ goto out_put_n;
+ }
/* Update bitmap attribute. */
indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits);
@@ -1952,7 +1957,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
/* Copy all the entries <= sp into the new buffer. */
de_t = hdr_first_de(hdr1);
to_copy = PtrOffset(de_t, sp);
- hdr_insert_head(hdr2, de_t, to_copy);
+ if (!hdr_insert_head(hdr2, de_t, to_copy)) {
+ err = -EINVAL;
+ put_indx_node(n2);
+ goto out;
+ }
/* Remove all entries (sp including) from hdr1. */
used = used1 - to_copy - sp_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 145/869] crypto: atmel-tdes - sync output bounce buffer before DMA
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 144/869] ntfs3: bound index head insertions by buffer capacity Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 146/869] usb: fotg210: validate endpoint index in ep0 handlers Greg Kroah-Hartman
` (731 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thorsten Blum,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit a38fdcb9c944525ca71e6aaf35e708586d0ae87d ]
The slow path maps its output bounce buffer once at probe time with
dma_map_single() and DMA_FROM_DEVICE, then reuses the mapping for every
request. After the CPU copies a result from the buffer,
dma_sync_single_for_device() must hand the buffer back to the device before
the next DMA transfer. The driver omits this call, so cache lines from the
previous result can remain valid while the device writes the next one.
This bug was masked by the completion paths calling
dma_sync_single_for_device() immediately before the CPU copied the output,
where dma_sync_single_for_cpu() was required. For DMA_FROM_DEVICE on
ARM926, dma_sync_single_for_device() invokes arm926_dma_map_area(), which
invalidates the cache lines. The misplaced call therefore discarded the
stale lines before every copy-out.
Commit c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
correctly changed the completion paths to call dma_sync_single_for_cpu().
On ARM926, that function invokes arm926_dma_unmap_area(), which is a no-op.
The missing pre-DMA dma_sync_single_for_device() was therefore exposed on
ARM926-based SAM9X60 and SAM9X7 SoCs.
With CONFIG_CRYPTO_SELFTESTS=y all four DES/TDES algorithms fail on
SAM9X75:
alg: skcipher: atmel-ecb-tdes encryption test failed (wrong result) on
test vector 2, cfg="unaligned buffer, offset=1"
Call dma_sync_single_for_device() for the output buffer before starting DMA
in both atmel_tdes_crypt_pdc() and atmel_tdes_crypt_dma().
Fixes: c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-tdes.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index 72e91e0bb1b47..ac0be3c4cd01d 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -373,6 +373,8 @@ static int atmel_tdes_crypt_pdc(struct atmel_tdes_dev *dd,
if (!(dd->flags & TDES_FLAGS_FAST)) {
dma_sync_single_for_device(dd->dev, dma_addr_in, length,
DMA_TO_DEVICE);
+ dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+ DMA_FROM_DEVICE);
}
len32 = DIV_ROUND_UP(length, sizeof(u32));
@@ -405,6 +407,8 @@ static int atmel_tdes_crypt_dma(struct atmel_tdes_dev *dd,
if (!(dd->flags & TDES_FLAGS_FAST)) {
dma_sync_single_for_device(dd->dev, dma_addr_in, length,
DMA_TO_DEVICE);
+ dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+ DMA_FROM_DEVICE);
}
addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 146/869] usb: fotg210: validate endpoint index in ep0 handlers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 145/869] crypto: atmel-tdes - sync output bounce buffer before DMA Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 147/869] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() Greg Kroah-Hartman
` (730 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liu Chao, Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Chao <liuc63@xiaopeng.com>
[ Upstream commit bbddb219b00af0792242a0ad1dc7fb3344f38733 ]
fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status()
use wIndex from the USB setup packet to index the fotg210->ep[] array
without verifying that the endpoint number falls below
FOTG210_MAX_NUM_EP (5). USB_ENDPOINT_NUMBER_MASK is 0x0f, so a
malicious host can issue a setup packet with wIndex 5..15, resulting in
an out-of-bounds array read. The resulting wild pointer is then
dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which
compute an MMIO register offset from ep->epnum and perform iowrite32
through it.
fotg210_clear_feature() is especially problematic: the out-of-bounds
access occurs at function entry (source-level) regardless of which
USB_RECIP_* case is taken, because the ep pointer is computed before the
switch statement.
Add upper-bound checks on the endpoint number derived from wIndex in
all three functions. Invalid endpoint numbers in clear_feature now
trigger fotg210_request_error() (STALL) instead of silently falling
through to fotg210_set_cxdone(). Also add the missing le16_to_cpu()
conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse
endianness warning.
Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/fotg210/fotg210-udc.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c
index 0bae12e34f9a7..26f29dba58f27 100644
--- a/drivers/usb/fotg210/fotg210-udc.c
+++ b/drivers/usb/fotg210/fotg210-udc.c
@@ -661,7 +661,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
case USB_RECIP_ENDPOINT: {
u8 epnum;
epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
- if (epnum)
+ if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210_set_epnstall(fotg210->ep[epnum]);
else
fotg210_set_cxstall(fotg210);
@@ -677,8 +677,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
static void fotg210_clear_feature(struct fotg210_udc *fotg210,
struct usb_ctrlrequest *ctrl)
{
- struct fotg210_ep *ep =
- fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
+ u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+ struct fotg210_ep *ep;
switch (ctrl->bRequestType & USB_RECIP_MASK) {
case USB_RECIP_DEVICE:
@@ -688,7 +688,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210,
fotg210_set_cxdone(fotg210);
break;
case USB_RECIP_ENDPOINT:
- if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
+ if (epnum >= FOTG210_MAX_NUM_EP) {
+ fotg210_request_error(fotg210);
+ break;
+ }
+ if (epnum) {
+ ep = fotg210->ep[epnum];
if (ep->wedged) {
fotg210_set_cxdone(fotg210);
break;
@@ -744,8 +749,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
fotg210->ep0_data = cpu_to_le16(0);
break;
case USB_RECIP_ENDPOINT:
- epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
- if (epnum)
+ epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+ if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210->ep0_data =
cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
<< USB_ENDPOINT_HALT);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 147/869] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 146/869] usb: fotg210: validate endpoint index in ep0 handlers Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 148/869] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() Greg Kroah-Hartman
` (729 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 480a5528cb6268d626632d45d4a1f29b4c0c11df ]
In wm8994_component_probe(), pm_runtime_get_sync() is invoked before
reading the GPIO configuration registers. If either regmap_read() fails,
the function jumps to err_irq without calling pm_runtime_put(), leaving
the runtime PM usage count incremented and causing a leak.
Add pm_runtime_put() on both GPIO read failure paths before jumping to
err_irq.
Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072737.1970990-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8994.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 128c3a59beac3..71e8dd18b57be 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4352,6 +4352,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
ret = regmap_read(control->regmap, WM8994_GPIO_1, ®);
if (ret < 0) {
dev_err(component->dev, "Failed to read GPIO1 state: %d\n", ret);
+ pm_runtime_put(component->dev);
goto err_irq;
}
if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {
@@ -4364,6 +4365,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
ret = regmap_read(control->regmap, WM8994_GPIO_6, ®);
if (ret < 0) {
dev_err(component->dev, "Failed to read GPIO6 state: %d\n", ret);
+ pm_runtime_put(component->dev);
goto err_irq;
}
if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 148/869] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 147/869] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 149/869] iio: accel: kxcjk-1013: Disable autosuspend on remove Greg Kroah-Hartman
` (728 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e04dcb895b4622d67164e218a1179785e2c75999 ]
In arizona_start_hpdet_acc_id(), pm_runtime_get_sync() is called to keep
the device powered during headphone detection. If setting the HPDET mode
or starting the measurement fails and the function jumps to err,
pm_runtime_put_autosuspend() was not called while info->hpdet_active was
set to false, resulting in a runtime PM usage count leak.
Add pm_runtime_put_autosuspend() in the err error path to keep runtime PM
balanced.
Fixes: 9dd5e53d9d2f ("extcon: arizona: Retry HPDET identification for high impedance")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072900.1971595-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/arizona-jack.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/arizona-jack.c b/sound/soc/codecs/arizona-jack.c
index 6b55610ad535d..b17c4539f4e49 100644
--- a/sound/soc/codecs/arizona-jack.c
+++ b/sound/soc/codecs/arizona-jack.c
@@ -713,6 +713,7 @@ static void arizona_start_hpdet_acc_id(struct arizona_priv *info)
snd_soc_jack_report(info->jack, SND_JACK_HEADPHONE,
SND_JACK_LINEOUT | SND_JACK_HEADPHONE);
+ pm_runtime_put_autosuspend(arizona->dev);
info->hpdet_active = false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 149/869] iio: accel: kxcjk-1013: Disable autosuspend on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 148/869] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 150/869] iio: accel: mma9551: disable " Greg Kroah-Hartman
` (727 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Srinivas Pandruvada, Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 1de1206a42741adfb72ca8b37dc71a6bc80cb074 ]
kxcjk1013_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 124e1b1d0924 ("iio: accel: kxcjk-1013: support runtime pm")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/kxcjk-1013.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 297853cd39e59..a8652bdd011a6 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1548,6 +1548,7 @@ static void kxcjk1013_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 150/869] iio: accel: mma9551: disable autosuspend on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 149/869] iio: accel: kxcjk-1013: Disable autosuspend on remove Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 151/869] iio: accel: mma9553: " Greg Kroah-Hartman
` (726 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8061720f6be1811478914f8b6143778d70f6033f ]
mma9551_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 6da93a6710a3 ("iio: accel: mma9551: Add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma9551.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/mma9551.c b/drivers/iio/accel/mma9551.c
index 02195deada49e..28342a757c6cf 100644
--- a/drivers/iio/accel/mma9551.c
+++ b/drivers/iio/accel/mma9551.c
@@ -503,6 +503,7 @@ static void mma9551_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 151/869] iio: accel: mma9553: disable autosuspend on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 150/869] iio: accel: mma9551: disable " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 152/869] iio: adc: at91-sama5d2: " Greg Kroah-Hartman
` (725 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 4dda1f9d25fb889649e81bbf015809daa512a049 ]
mma9553_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 40cb761306d6 ("iio: add driver for Freescale MMA9553")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma9553.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/mma9553.c b/drivers/iio/accel/mma9553.c
index f85384a7908f2..65533bc275eca 100644
--- a/drivers/iio/accel/mma9553.c
+++ b/drivers/iio/accel/mma9553.c
@@ -1140,6 +1140,7 @@ static void mma9553_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 152/869] iio: adc: at91-sama5d2: disable autosuspend on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 151/869] iio: accel: mma9553: " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 153/869] md/raid5: track disks array size to fix extra_page leak on error paths Greg Kroah-Hartman
` (724 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 022996906e70c6bc9a7968ee663ebbe314fe1524 ]
at91_adc_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 75d7556ac0e4 ("iio: adc: at91-sama5d2_adc: add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index aa4ba3f5a5060..8c16c5938601c 100644
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -2487,6 +2487,7 @@ static void at91_adc_remove(struct platform_device *pdev)
pm_runtime_disable(st->dev);
pm_runtime_set_suspended(st->dev);
+ pm_runtime_dont_use_autosuspend(st->dev);
clk_disable_unprepare(st->per_clk);
regulator_disable(st->vref);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 153/869] md/raid5: track disks array size to fix extra_page leak on error paths
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 152/869] iio: adc: at91-sama5d2: " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 154/869] md/raid5: fix NULL pointer dereference in raid5_free_percpu Greg Kroah-Hartman
` (723 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Yu Kuai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 5028ceee173bfcf844469cfb0d1c151d3f6d0296 ]
free_conf() iterates conf->pool_size entries to free extra_page
allocations, but pool_size may not reflect the actual size of the
conf->disks array. Two scenarios cause a mismatch:
1. setup_conf() early abort: pool_size is 0 (not yet set by
grow_stripes) but conf->disks has max_disks entries with
extra_page allocated. The loop iterates 0 times, leaking all
pages.
2. resize_stripes() Step 4 failure: conf->disks was replaced with
a newsize-entry array in Step 3, but pool_size is only updated
on success. The loop iterates pool_size (old, smaller value)
times, leaking (newsize - pool_size) pages.
Add a dedicated disks_cnt field to track the actual number of
entries in conf->disks. Set it immediately after each allocation
or replacement (in setup_conf and resize_stripes Step 3, where the
array is safely stalled with no concurrent access), and use it in
free_conf() instead of pool_size.
This leaves pool_size untouched, preserving the check_reshape()
retry behavior that depends on pool_size only being updated on
full success.
Fixes: d7bd398e97f2 ("md/r5cache: handle alloc_page failure")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-1-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 5 +++--
drivers/md/raid5.h | 1 +
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 56d7e05e94ce6..fded4b3eb88b9 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2627,6 +2627,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
} else {
kfree(conf->disks);
conf->disks = ndisks;
+ conf->disks_cnt = newsize;
}
} else
err = -ENOMEM;
@@ -7405,7 +7406,7 @@ static void free_conf(struct r5conf *conf)
free_thread_groups(conf);
shrink_stripes(conf);
raid5_free_percpu(conf);
- for (i = 0; i < conf->pool_size; i++)
+ for (i = 0; i < conf->disks_cnt; i++)
if (conf->disks[i].extra_page)
put_page(conf->disks[i].extra_page);
kfree(conf->disks);
@@ -7588,7 +7589,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
if (!conf->disks)
goto abort;
-
+ conf->disks_cnt = max_disks;
for (i = 0; i < max_disks; i++) {
conf->disks[i].extra_page = alloc_page(GFP_KERNEL);
if (!conf->disks[i].extra_page)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index eafc6e9ed6ee1..fa9647a862add 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -668,6 +668,7 @@ struct r5conf {
unsigned long cache_state;
struct shrinker *shrinker;
int pool_size; /* number of disks in stripeheads in pool */
+ int disks_cnt; /* number of entries in disks[] array */
spinlock_t device_lock;
struct disk_info *disks;
struct bio_set bio_split;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 154/869] md/raid5: fix NULL pointer dereference in raid5_free_percpu
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 153/869] md/raid5: track disks array size to fix extra_page leak on error paths Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 155/869] md/raid5: validate payload size before calculating payload_len Greg Kroah-Hartman
` (722 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Yu Kuai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 41742e35268d6a45161b187f51f42bc2ade14d0d ]
If cpuhp_state_add_instance() fails in raid5_alloc_percpu() (e.g., the
startup callback raid456_cpu_up_prepare fails due to an allocation
failure), conf->node is never added to the cpuhp instance list and
its pprev remains NULL (from kzalloc initialization).
When setup_conf() then jumps to abort, free_conf() calls
raid5_free_percpu(), which checks conf->percpu (non-NULL, since it was
allocated before the cpuhp failure) and proceeds to call
cpuhp_state_remove_instance(). This calls hlist_del() on the unhashed
node, which dereferences node->pprev (NULL), causing a kernel panic.
Guard the removal with hlist_unhashed_lockless() so that the cpuhp
instance is only removed if it was actually added. The lockless variant
uses READ_ONCE() for the pprev read, which is safe here because the
actual removal is synchronized by cpuhp_state_mutex inside
cpuhp_state_remove_instance().
Fixes: 29c6d1bbd7a2 ("md/raid5: Convert to hotplug state machine")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-2-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index fded4b3eb88b9..6dfefbacfe3c0 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7392,7 +7392,8 @@ static void raid5_free_percpu(struct r5conf *conf)
if (!conf->percpu)
return;
- cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
+ if (!hlist_unhashed_lockless(&conf->node))
+ cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
free_percpu(conf->percpu);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 155/869] md/raid5: validate payload size before calculating payload_len
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 154/869] md/raid5: fix NULL pointer dereference in raid5_free_percpu Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 156/869] drm/panic: Do not use un-escaped URL as format string Greg Kroah-Hartman
` (721 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junrui Luo, Martin Wilck, Yu Kuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
[ Upstream commit 38c795105992bbaa3418dd39cbff7348ad17537c ]
Commit b0cc3ae97e89 ("md/raid5: validate payload size before accessing
journal metadata") introduced a bounds check to verify that a given payload
fits into the current metadata block. In order to calculate the payload
size, it has to access the members payload->header.type and payload->size,
the offset of which may already be past the end of the metadata block,
because the loop condition only checks that the first byte of the payload
is inside, and the payload entries have variable sizes. Later on,
payload->checksum[0] and payload->checksum[1] are accessed without
verifying that payload->size is large enough.
Add another check to make sure that payload->size can be safely
accessed, and make sure that the checksum fields are accessible.
This issue has been found by AI (gemma4, Gemini) during a backport
review.
Cc: Junrui Luo <moonafterrain@outlook.com>
Cc: stable@vger.kernel.org
Fixes: b0cc3ae97e89 ("md/raid5: validate payload size before accessing journal metadata")
Signed-off-by: Martin Wilck <mwilck@suse.com>
Link: https://patch.msgid.link/20260907155103.2325511-1-mwilck@suse.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5-cache.c | 34 ++++++++++++++++++++++++++--------
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 2518781cbdf6d..1f7bf680234d0 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2001,27 +2001,36 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
if (!page)
return -ENOMEM;
- while (mb_offset < le32_to_cpu(mb->meta_size)) {
+ while (mb_offset + sizeof(struct r5l_payload_header) <= le32_to_cpu(mb->meta_size)) {
+ u32 payload_size;
sector_t payload_len;
payload = (void *)mb + mb_offset;
payload_flush = (void *)mb + mb_offset;
if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) {
+ if (mb_offset + sizeof(struct r5l_payload_data_parity)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
+ payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
payload_len = sizeof(struct r5l_payload_data_parity) +
- (sector_t)sizeof(__le32) *
- (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
- if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+ (sector_t)sizeof(__le32) * payload_size;
+ if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+ payload_size < 1)
goto mismatch;
if (r5l_recovery_verify_data_checksum(
log, ctx, page, log_offset,
payload->checksum[0]) < 0)
goto mismatch;
} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) {
+ if (mb_offset + sizeof(struct r5l_payload_data_parity)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
+ payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
payload_len = sizeof(struct r5l_payload_data_parity) +
- (sector_t)sizeof(__le32) *
- (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
- if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+ (sector_t)sizeof(__le32) * payload_size;
+ if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+ payload_size < conf->max_degraded)
goto mismatch;
if (r5l_recovery_verify_data_checksum(
log, ctx, page, log_offset,
@@ -2035,6 +2044,9 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
payload->checksum[1]) < 0)
goto mismatch;
} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
+ if (mb_offset + sizeof(struct r5l_payload_flush)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
payload_len = sizeof(struct r5l_payload_flush) +
(sector_t)le32_to_cpu(payload_flush->size);
if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
@@ -2096,7 +2108,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
mb_offset = sizeof(struct r5l_meta_block);
log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS);
- while (mb_offset < le32_to_cpu(mb->meta_size)) {
+ while (mb_offset + sizeof(struct r5l_payload_header) < le32_to_cpu(mb->meta_size)) {
sector_t payload_len;
int dd;
@@ -2106,6 +2118,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
int i, count;
+ if (mb_offset + sizeof(struct r5l_payload_flush) >
+ le32_to_cpu(mb->meta_size))
+ return -EINVAL;
payload_len = sizeof(struct r5l_payload_flush) +
(sector_t)le32_to_cpu(payload_flush->size);
if (mb_offset + payload_len >
@@ -2130,6 +2145,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
}
/* DATA or PARITY payload */
+ if (mb_offset + sizeof(struct r5l_payload_data_parity) >
+ le32_to_cpu(mb->meta_size))
+ return -EINVAL;
payload_len = sizeof(struct r5l_payload_data_parity) +
(sector_t)sizeof(__le32) *
(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 156/869] drm/panic: Do not use un-escaped URL as format string
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 155/869] md/raid5: validate payload size before calculating payload_len Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 157/869] drm/panic: Test address from kmap op for NULL Greg Kroah-Hartman
` (720 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Jocelyn Falempe,
Javier Martinez Canillas, dri-devel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 6596aae25585b183ebd528206bde6f12efaf8db1 ]
Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.
As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.12+
Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index d4b6ea42db0fe..b95d869257a84 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -662,7 +662,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
char *kmsg;
int max_qr_data_size, url_len;
- url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=",
+ url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
+ CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
utsname()->machine, utsname()->release);
max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 157/869] drm/panic: Test address from kmap op for NULL
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 156/869] drm/panic: Do not use un-escaped URL as format string Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 158/869] spi: spi-qpic-snand: publish the ECC context to snandc->qspi Greg Kroah-Hartman
` (719 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann,
Javier Martinez Canillas, Jocelyn Falempe, dri-devel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 6a6304ec3ceee879e3a2545b217eb11c8b7870e5 ]
Do nothing if kmap_local_page_try_from_panic() returns NULL. This is
not likely to hapen, as the previous page from the same memory area
has been mapped successfully.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 23437509a694 ("drm/panic: Fix 24bit pixel crossing page boundaries")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.18+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260911124540.279841-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index b95d869257a84..9c4ac2febc931 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -184,6 +184,8 @@ static void drm_panic_write_pixel24_xpage(void *vaddr, struct page *next_page,
u8 *p = vaddr + offset;
vaddr2 = kmap_local_page_try_from_panic(next_page);
+ if (!vaddr2)
+ return;
*p++ = color & 0xff;
color >>= 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 158/869] spi: spi-qpic-snand: publish the ECC context to snandc->qspi
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 157/869] drm/panic: Test address from kmap op for NULL Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 159/869] cpufreq: conservative: Restrict deferred downscaling to low load Greg Kroah-Hartman
` (718 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Johan Alvarado,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Alvarado <contact@c127.dev>
[ Upstream commit f94c9b68bb5fdbef9f841da493d5305ff634ebb5 ]
qcom_spi_ooblayout_ecc() and qcom_spi_ooblayout_free() read the ECC
configuration through snandc->qspi->ecc. qcom_spi_probe() points it at a
zeroed scratch struct and only qcom_spi_ecc_prepare_io_req_pipelined(),
which runs on page I/O, ever updates it. qcom_spi_ecc_init_ctx_pipelined()
installs the ooblayout but does not publish the context it just
allocated, and qcom_spi_ecc_cleanup_ctx_pipelined() frees that context
without clearing the pointer.
spinand_init() calls mtd_ooblayout_count_freebytes() right after the ECC
context is created and before any page I/O, so the ooblayout always runs
against a pointer that does not describe the current context:
- On a first probe it reads the zeroed struct from qcom_spi_probe(),
so steps, bytes and bbm_size are 0. The count then returns 0 rather
than an error, so the probe continues with mtd->oobavail set to 0.
- On a probe retry it reads the ecc_cfg the previous attempt freed.
A retry is easy to hit. On IPQ5018 with the qcom,smem-part parser the
partition parse returns -EPROBE_DEFER until SMEM has probed, so the
first spi-nand probe defers. It defers inside
mtd_device_parse_register(), after mtd_otp_nvmem_add() has already read
the factory OTP - that read goes through prepare_io_req and leaves
snandc->qspi->ecc pointing at the context that spinand_cleanup() then
frees. The second probe allocates a new context, never publishes it, and
computes the OOB layout from the freed one. Once the slab has been
reused, qecc->steps holds garbage and
oobregion->length = qecc->steps * 4;
goes negative. qcom_spi_ooblayout_free() only reports -ERANGE for
section 1 and later, so mtd_ooblayout_count_bytes() sums the regions and
returns that negative length as the byte count. The -512 below is
steps * 4 with steps == -128. It is a byte count that happens to
collide with -ERESTARTSYS, not an error the driver returned.
spinand_init() takes it as an error, and because it is not
-EPROBE_DEFER the driver core never retries and the NAND never appears:
spi-nand spi0.0: ESMT SPI NAND was found.
spi-nand spi0.0: probe with driver spi-nand failed with error -512
UBI error: cannot open mtd rootfs, error -2
Waiting for root device /dev/ubiblock0_1...
On a Mercusys MR80X (IPQ5018, ESMT F50D1G41LB) about half of the boots
failed to mount the rootfs, the outcome depending on whether the freed
memory had been overwritten yet.
Publish the context when it is created and clear the pointer when it is
destroyed. Clearing leaves snandc->qspi->ecc NULL after cleanup, which
is safe: the mtd is unregistered before cleanup_ctx runs, so no
ooblayout callback can follow.
Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Cc: stable@vger.kernel.org
Tested-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://patch.msgid.link/20260911184416.109790-2-contact@c127.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-qpic-snand.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
index 919e847c061db..567485785ec96 100644
--- a/drivers/spi/spi-qpic-snand.c
+++ b/drivers/spi/spi-qpic-snand.c
@@ -391,6 +391,8 @@ static int qcom_spi_ecc_init_ctx_pipelined(struct nand_device *nand)
dev_dbg(snandc->dev, "ECC strength: %u bits per %u bytes\n",
ecc_cfg->strength, ecc_cfg->step_size);
+ snandc->qspi->ecc = ecc_cfg;
+
return 0;
err_free_ecc_cfg:
@@ -407,6 +409,7 @@ static void qcom_spi_ecc_cleanup_ctx_pipelined(struct nand_device *nand)
kfree(snandc->qspi->oob_buf);
snandc->qspi->oob_buf = NULL;
+ snandc->qspi->ecc = NULL;
kfree(ecc_cfg);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 159/869] cpufreq: conservative: Restrict deferred downscaling to low load
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 158/869] spi: spi-qpic-snand: publish the ECC context to snandc->qspi Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 160/869] nilfs2: force clear dirty state when restoring from the shadow map Greg Kroah-Hartman
` (717 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luo Haiyang, Run Zhang, Zhongqiu Han,
Shengming Hu, Rafael J. Wysocki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengming Hu <hu.shengming@zte.com.cn>
[ Upstream commit 0fa55c5539173bceaeb400c69b1974aaa0cdb8dc ]
For a shared cpufreq policy, dbs_update() derives the load used for the
frequency decision from the maximum load among its CPUs, but it may
also record deferred idle periods accumulated by an idle CPU in the
policy.
Consequently, a single update can contain both a high decision load
from one CPU and multiple deferred idle periods from another CPU. The
conservative governor applies the deferred down steps before evaluating
the decision load. If that load subsequently triggers an up step, the
deferred down steps can outweigh the single up step and produce a net
frequency reduction.
This was observed on a policy shared by CPUs 2 and 3. A CPU-bound
SCHED_EXT task kept CPU 2 fully utilized while CPU 3 remained idle.
On this system, SCHED_EXT generated update-util callbacks less
frequently than CFS, resulting in sparse DBS updates such as:
load=100 idle_periods=7 interval=59 ms
load=100 idle_periods=4 interval=39 ms
load=100 idle_periods=2 interval=19 ms
load=100 idle_periods=7 interval=59 ms
With the default 5% frequency step and a 2.6 GHz policy maximum, seven
deferred periods reduce the requested frequency by seven 130 MHz steps
before the high decision load adds only one step. Repeated updates
therefore keep the policy near 530 MHz even though CPU 2 is fully
utilized.
There are two load values relevant to this behavior:
* sample_load is calculated from the busy and elapsed time of the
current sample.
* decision_load is returned by dbs_update() for the governor's
frequency decision. After a long idle interval, it may reuse
prev_load to improve the response to a waking task and can therefore
differ from sample_load.
The problem is that idle_periods is derived from accumulated idle time
and is applied independently of whether the current sample load is in
the conservative governor's downscaling region. A high sample load and
multiple deferred idle periods can therefore coexist, particularly
when updates are sparse.
As suggested by Zhongqiu Han, calculate the sample load separately from
the decision load. If no time has elapsed, use prev_load for the sample
load as the existing load calculation does, since no load can be
calculated for that interval.
Record the maximum sample load for the policy and apply deferred down
steps only when it is below down_threshold. This makes deferred
downscaling follow the same threshold that the conservative governor
normally uses to determine whether the policy load is low enough to
reduce the frequency.
The existing code applies deferred down steps whenever idle_periods is
valid, regardless of the sample load. When the decision load is in the
hold region, the locally adjusted frequency is not submitted unless
another frequency-update branch is taken. Thus, when the sample and
decision loads are the same and both are in the hold region, this
change does not alter the requested frequency.
The difference becomes visible when the decision load causes a
frequency update. In particular, if it exceeds up_threshold, the
governor applies a single up step after the deferred down steps and
submits the resulting request. Multiple deferred down steps can then
outweigh that up step and cause a frequency reduction even when the
sample load is above down_threshold.
With this change, deferred down steps are skipped whenever the maximum
sample load is at or above down_threshold, keeping deferred downscaling
consistent with the conservative governor's threshold semantics. The
requested frequency may therefore be higher than with the existing
behavior when deferred idle periods are present and the decision load
causes a frequency update. This is intentional, because the lower
request previously resulted from applying deferred downscaling while
the sampled policy load was outside the governor's downscaling region.
Accelerated deferred downscaling remains available when the policy
sample load is below down_threshold, including after a workload has
completed and the policy has become idle.
Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates")
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Luo Haiyang <luo.haiyang@zte.com.cn>
Reviewed-by: Run Zhang <zhang.run@zte.com.cn>
Suggested-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Link: https://patch.msgid.link/20260916140926740-DCokXh6dAgtqDn1EWdCh@zte.com.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq_conservative.c | 8 ++++---
drivers/cpufreq/cpufreq_governor.c | 29 +++++++++++++++++++-------
drivers/cpufreq/cpufreq_governor.h | 2 ++
3 files changed, 29 insertions(+), 10 deletions(-)
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 60bab2b71b1b9..4ee6990ab2ba9 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -85,10 +85,12 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
freq_step = get_freq_step(cs_tuners, policy);
/*
- * Decrease requested_freq one freq_step for each idle period that
- * we didn't update the frequency.
+ * Apply deferred down steps only when the policy sample load is
+ * below down_threshold. Otherwise, multiple deferred down steps may
+ * cause a net frequency decrease outside the downscaling region.
*/
- if (policy_dbs->idle_periods < UINT_MAX) {
+ if (policy_dbs->max_sample_load < cs_tuners->down_threshold &&
+ policy_dbs->idle_periods < UINT_MAX) {
unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
if (requested_freq > policy->min + freq_steps)
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 00a26fa6292c5..a10cf44600ffa 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -116,7 +116,8 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
struct policy_dbs_info *policy_dbs = policy->governor_data;
struct dbs_data *dbs_data = policy_dbs->dbs_data;
unsigned int ignore_nice = dbs_data->ignore_nice_load;
- unsigned int max_load = 0, idle_periods = UINT_MAX;
+ unsigned int max_load = 0, max_sample_load = 0;
+ unsigned int idle_periods = UINT_MAX;
unsigned int sampling_rate, io_busy, j;
/*
@@ -138,7 +139,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
struct cpu_dbs_info *j_cdbs = &per_cpu(cpu_dbs, j);
u64 update_time, cur_idle_time;
unsigned int idle_time, time_elapsed;
- unsigned int load;
+ unsigned int load, sample_load;
cur_idle_time = get_cpu_idle_time(j, &update_time, io_busy);
@@ -171,6 +172,20 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
j_cdbs->prev_cpu_nice = cur_nice;
}
+ /*
+ * Compute the sample load separately from the prev_load value
+ * that may be reused after a long idle interval. The conservative
+ * governor uses it to decide whether to apply deferred down steps.
+ * If no time has elapsed, retain the existing behavior and use
+ * prev_load.
+ */
+ if (unlikely(!time_elapsed))
+ sample_load = j_cdbs->prev_load;
+ else if (time_elapsed > idle_time)
+ sample_load = 100 * (time_elapsed - idle_time) / time_elapsed;
+ else
+ sample_load = 0;
+
if (unlikely(!time_elapsed)) {
/*
* That can only happen when this function is called
@@ -205,11 +220,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
load = j_cdbs->prev_load;
j_cdbs->prev_load = 0;
} else {
- if (time_elapsed > idle_time)
- load = 100 * (time_elapsed - idle_time) / time_elapsed;
- else
- load = 0;
-
+ load = sample_load;
j_cdbs->prev_load = load;
}
@@ -222,9 +233,13 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
if (load > max_load)
max_load = load;
+
+ if (sample_load > max_sample_load)
+ max_sample_load = sample_load;
}
policy_dbs->idle_periods = idle_periods;
+ policy_dbs->max_sample_load = max_sample_load;
return max_load;
}
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 1462d59277bd1..ceb33336b2b30 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -94,6 +94,8 @@ struct policy_dbs_info {
/* Multiplier for increasing sample delay temporarily. */
unsigned int rate_mult;
unsigned int idle_periods; /* For conservative */
+ /* Maximum load from the current policy sample. */
+ unsigned int max_sample_load;
/* Status indicators */
bool is_shared; /* This object is used by multiple CPUs */
bool work_in_progress; /* Work is being queued up or in progress */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 160/869] nilfs2: force clear dirty state when restoring from the shadow map
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 159/869] cpufreq: conservative: Restrict deferred downscaling to low load Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 161/869] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() Greg Kroah-Hartman
` (716 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi, Jiaming Zhang,
Viacheslav Dubeyko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <r772577952@gmail.com>
[ Upstream commit cb6702e63e0a16afd83875294e5ce53becdd1b1f ]
When garbage collection fails, nilfs2 rolls the DAT metadata file's page
cache back to a shadow copy taken before GC started.
nilfs_clear_dirty_pages() drops the dirty state of the folios in the DAT
cache, then nilfs_copy_back_pages() overwrites them with the saved
contents and warns if one is still dirty:
/* overwrite existing folio in the destination cache */
WARN_ON(folio_test_dirty(dfolio));
nilfs_clear_dirty_pages() used to clear the dirty state unconditionally,
which is safe here because the rollback runs with the log writer
stopped, so nothing else can dirty the cache while it runs. The same
helper is also used when writeback finds dirty folios after the
filesystem has degraded to read-only, where it does run concurrently
with the log writer, so commit ca76bb226bf4 ("nilfs2: do not force clear
folio if buffer is referenced") made nilfs_clear_folio_dirty() skip a
folio if any of its buffer heads is busy. The rollback caller shares
that helper, so its clearing step can now return with a folio still
dirty.
A DAT folio can hold a busy buffer head without anyone modifying the
folio: nilfs_mdt_read_block() submits read-ahead for the blocks
following the one it was asked for and waits only for the first, so the
read-ahead buffers are still locked when it returns. With a block size
smaller than the page size, a locked read-ahead buffer can share a folio
with a block that GC dirtied and keep the whole folio dirty past the
clearing step.
Add a force flag to nilfs_clear_dirty_pages() and
nilfs_clear_folio_dirty() that skips the busy buffer check, and set it
in the two calls from nilfs_mdt_restore_from_shadow_map(). The
read-only fallback callers keep passing false, so that commit still
protects them and the WARN_ON() is left alone.
Fixes: ca76bb226bf4 ("nilfs2: do not force clear folio if buffer is referenced")
Closes: https://lore.kernel.org/lkml/CANypQFZSYrtcshnUzOPiqatyLd-M8_OReOewQoAi_V5yY0dTtg@mail.gmail.com/
Cc: stable@vger.kernel.org
Suggested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/inode.c | 2 +-
fs/nilfs2/mdt.c | 6 +++---
fs/nilfs2/page.c | 50 +++++++++++++++++++++++++++--------------------
fs/nilfs2/page.h | 4 ++--
4 files changed, 35 insertions(+), 27 deletions(-)
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 87ddde159f0c9..1099864acabcb 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -163,7 +163,7 @@ static int nilfs_writepages(struct address_space *mapping,
int err = 0;
if (sb_rdonly(inode->i_sb)) {
- nilfs_clear_dirty_pages(mapping);
+ nilfs_clear_dirty_pages(mapping, false);
return -EROFS;
}
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 946b0d3534a5f..79e662e2bf334 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -407,7 +407,7 @@ static int nilfs_mdt_write_folio(struct folio *folio,
* have dirty folios that try to be flushed in background.
* So, here we simply discard this dirty folio.
*/
- nilfs_clear_folio_dirty(folio);
+ nilfs_clear_folio_dirty(folio, false);
folio_unlock(folio);
return -EROFS;
}
@@ -650,10 +650,10 @@ void nilfs_mdt_restore_from_shadow_map(struct inode *inode)
if (mi->mi_palloc_cache)
nilfs_palloc_clear_cache(inode);
- nilfs_clear_dirty_pages(inode->i_mapping);
+ nilfs_clear_dirty_pages(inode->i_mapping, true);
nilfs_copy_back_pages(inode->i_mapping, shadow->inode->i_mapping);
- nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping);
+ nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping, true);
nilfs_copy_back_pages(ii->i_assoc_inode->i_mapping,
NILFS_I(shadow->inode)->i_assoc_inode->i_mapping);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 89180e2f59fef..969e96ce0b843 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -370,8 +370,9 @@ void nilfs_copy_back_pages(struct address_space *dmap,
/**
* nilfs_clear_dirty_pages - discard dirty pages in address space
* @mapping: address space with dirty pages for discarding
+ * @force: whether to clear the dirty state regardless of busy buffer heads
*/
-void nilfs_clear_dirty_pages(struct address_space *mapping)
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force)
{
struct folio_batch fbatch;
unsigned int i;
@@ -392,7 +393,7 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
* was acquired. Skip processing in that case.
*/
if (likely(folio->mapping == mapping))
- nilfs_clear_folio_dirty(folio);
+ nilfs_clear_folio_dirty(folio, force);
folio_unlock(folio);
}
@@ -404,13 +405,16 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
/**
* nilfs_clear_folio_dirty - discard dirty folio
* @folio: dirty folio that will be discarded
+ * @force: whether to clear the states regardless of busy buffer heads
*
* nilfs_clear_folio_dirty() clears working states including dirty state for
- * the folio and its buffers. If the folio has buffers, clear only if it is
- * confirmed that none of the buffer heads are busy (none have valid
- * references and none are locked).
+ * the folio and its buffers. If the folio has buffers and force is false,
+ * clear only if it is confirmed that none of the buffer heads are busy (none
+ * have valid references and none are locked). If force is true, the states
+ * are cleared unconditionally, the caller should guarantee that the folio is
+ * not being modified concurrently.
*/
-void nilfs_clear_folio_dirty(struct folio *folio)
+void nilfs_clear_folio_dirty(struct folio *folio, bool force)
{
struct buffer_head *bh, *head;
@@ -423,24 +427,28 @@ void nilfs_clear_folio_dirty(struct folio *folio)
BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) |
BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) |
BIT(BH_Delay));
- bool busy, invalidated = false;
+
+ if (!force) {
+ bool busy, invalidated = false;
recheck_buffers:
- busy = false;
- bh = head;
- do {
- if (atomic_read(&bh->b_count) | buffer_locked(bh)) {
- busy = true;
- break;
+ busy = false;
+ bh = head;
+ do {
+ if (atomic_read(&bh->b_count) |
+ buffer_locked(bh)) {
+ busy = true;
+ break;
+ }
+ } while (bh = bh->b_this_page, bh != head);
+
+ if (busy) {
+ if (invalidated)
+ return;
+ invalidate_bh_lrus();
+ invalidated = true;
+ goto recheck_buffers;
}
- } while (bh = bh->b_this_page, bh != head);
-
- if (busy) {
- if (invalidated)
- return;
- invalidate_bh_lrus();
- invalidated = true;
- goto recheck_buffers;
}
bh = head;
diff --git a/fs/nilfs2/page.h b/fs/nilfs2/page.h
index 136cd1c143c9c..c3ba3468af5cb 100644
--- a/fs/nilfs2/page.h
+++ b/fs/nilfs2/page.h
@@ -41,8 +41,8 @@ void nilfs_folio_bug(struct folio *);
int nilfs_copy_dirty_pages(struct address_space *, struct address_space *);
void nilfs_copy_back_pages(struct address_space *, struct address_space *);
-void nilfs_clear_folio_dirty(struct folio *folio);
-void nilfs_clear_dirty_pages(struct address_space *mapping);
+void nilfs_clear_folio_dirty(struct folio *folio, bool force);
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force);
unsigned int nilfs_page_count_clean_buffers(struct folio *folio,
unsigned int from, unsigned int to);
unsigned long nilfs_find_uncommitted_extent(struct inode *inode,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 161/869] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 160/869] nilfs2: force clear dirty state when restoring from the shadow map Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 162/869] regulator: core: Fix rdev reference leak in regulator_resolve_supply() Greg Kroah-Hartman
` (715 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit c41b69e9f76fd9632662714c1d37860468e8d773 ]
of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented, but regulator_resolve_coupling() returns
without dropping it when the coupled regulator belongs to a different
coupler, leaking the reference.
Fixes: d8ca7d184b33 ("regulator: core: Introduce API for regulators coupling customization")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142535.2156720-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index eae756c82c262..ad7f26b14621b 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5659,6 +5659,7 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev)
if (c_rdev->coupling_desc.coupler != coupler) {
rdev_err(rdev, "coupler mismatch with %s\n",
rdev_get_name(c_rdev));
+ put_device(&c_rdev->dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 162/869] regulator: core: Fix rdev reference leak in regulator_resolve_supply()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 161/869] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 163/869] PCI: Skip Target Speed quirk on clamped ports with no link Greg Kroah-Hartman
` (714 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 195bbe5e1c29aa1349655a6162958149c1176034 ]
regulator_resolve_supply() takes a reference on the looked-up regulator
with regulator_dev_lookup(), but when the supply resolves to the
regulator itself that reference is never dropped: it leaks on the early
return and is lost as well when r is replaced with the dummy regulator.
Release the reference before handling the self-referent case.
Fixes: 4b639e254d3d ("regulator: avoid resolve_supply() infinite recursion")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142810.2156816-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index ad7f26b14621b..e2328539b9fdc 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2110,6 +2110,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
if (r == rdev) {
dev_err(dev, "Supply for %s (%s) resolved to itself\n",
rdev->desc->name, rdev->supply_name);
+ put_device(&rdev->dev);
if (!have_full_constraints()) {
ret = -EINVAL;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 163/869] PCI: Skip Target Speed quirk on clamped ports with no link
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 162/869] regulator: core: Fix rdev reference leak in regulator_resolve_supply() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 164/869] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm Greg Kroah-Hartman
` (713 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Wild, Maciej W. Rozycki,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit ff8a969f7dc8e79ea6113abcfa983e070b2b585a ]
Since commit 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe
failed link retraining") the Target Speed quirk lifts a firmware-imposed
2.5GT/s restriction on any downstream port, without checking whether the
link is up. Where nothing is plugged in, the retraining that follows can
never complete, so each attempt costs PCIE_LINK_RETRAIN_TIMEOUT_MS. The
quirk makes two of them -- the initial one and the restore on the error
path -- adding a fixed 2 s to every boot.
On an MSI PRO Z690-A WIFI DDR4 (Intel 600 Series PCH) with one empty x1
slot, running v7.2-rc5:
0.541 pci 0000:00:1c.0: removing 2.5GT/s downstream link speed restriction
1.541 pci 0000:00:1c.0: retraining failed
2.541 pci 0000:00:1c.2: [8086:7aba] type 01 class 0x060400
Where the Link Speed has already been clamped at 2.5GT/s and no link has
been established there is nothing worth doing, which is what the kerneldoc
for the quirk already describes: the restriction is to be lifted where
firmware arranged it "and the port reports its link already being up".
Bail out early in that case, before either the ASM2824 workaround or the
removal of the restriction is considered.
Ports whose link is up are unaffected, and so is the ASM2824 workaround,
which is reached with the Target Link Speed not clamped.
With this applied the quirk returns without touching the port: both
messages are gone, enumeration proceeds from 0000:00:1c.0 to 0000:00:1c.2
in 1 ms rather than 2 s, and the systemd "kernel" boot phase goes from
3.011 s to 1.036 s.
Fixes: 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining")
Reported-by: Andreas Wild <andiwild@gmail.com>
Closes: https://lore.kernel.org/lkml/20260801092152.5643-1-andiwild@gmail.com/
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221801
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Andreas Wild <andiwild@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Andreas Wild <andiwild@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260801201244.4421-1-andiwild@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index e03a3831bcc00..199f2a762b22a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -103,7 +103,11 @@ int pcie_failed_link_retrain(struct pci_dev *dev)
pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &oldlnkctl2);
- if (!(lnksta & PCI_EXP_LNKSTA_DLLLA) && pcie_lbms_seen(dev, lnksta)) {
+ if (lnksta & PCI_EXP_LNKSTA_DLLLA) {
+ ;
+ } else if (PCIE_LNKCTL2_TLS2SPEED(oldlnkctl2) == PCIE_SPEED_2_5GT) {
+ return ret;
+ } else if (pcie_lbms_seen(dev, lnksta)) {
pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
ret = pcie_set_target_speed(dev, PCIE_SPEED_2_5GT, false);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 164/869] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 163/869] PCI: Skip Target Speed quirk on clamped ports with no link Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 165/869] crypto: omap-des - fix crypto engine cleanup Greg Kroah-Hartman
` (712 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 016f22d2268e02df705868110fe4e402b51bfffc ]
zynqmp_sha_init_tfm() checks crypto_shash_statesize(tfm_ctx->fbk_tfm)
before assigning the fallback transform to it, which dereferences a NULL
pointer since the transform context is zero-initialized. Use the local
fallback_tfm pointer for the size check instead.
Fixes: c1dd353d18e5 ("crypto: zynqmp-sha - Make descsize an algorithm attribute")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/xilinx/zynqmp-sha.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/xilinx/zynqmp-sha.c b/drivers/crypto/xilinx/zynqmp-sha.c
index 5813017b6b79d..cd051e1f42753 100644
--- a/drivers/crypto/xilinx/zynqmp-sha.c
+++ b/drivers/crypto/xilinx/zynqmp-sha.c
@@ -59,7 +59,7 @@ static int zynqmp_sha_init_tfm(struct crypto_shash *hash)
return PTR_ERR(fallback_tfm);
if (crypto_shash_descsize(hash) <
- crypto_shash_statesize(tfm_ctx->fbk_tfm)) {
+ crypto_shash_statesize(fallback_tfm)) {
crypto_free_shash(fallback_tfm);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 165/869] crypto: omap-des - fix crypto engine cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 164/869] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 166/869] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() Greg Kroah-Hartman
` (711 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 5d69ed4cd4f9c68ff9a6ebb2e8a1079223a4ec6e ]
omap_des_probe() allocates and starts a crypto engine, but the remove
path does not call the matching crypto_engine_exit(). The probe failure
path already performs this cleanup.
crypto_engine_alloc_init() creates a kthread worker for processing
requests. Without crypto_engine_exit() during driver removal, the
worker is left running after the device is removed.
Call crypto_engine_exit() after unregistering the algorithms and before
tearing down the remaining request handling resources. This stops the
engine and destroys its worker.
This issue was found by manual code inspection.
Fixes: f1b77aaca85a ("crypto: omap-des - Integrate with the crypto engine framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-des.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 16d5c617d5ee8..96b399c7eca69 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -1084,6 +1084,8 @@ static void omap_des_remove(struct platform_device *pdev)
omap_des_unregister_algs(dd->pdata);
+ crypto_engine_exit(dd->engine);
+
cancel_work_sync(&dd->done_task);
omap_des_dma_cleanup(dd);
pm_runtime_disable(dd->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 166/869] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 165/869] crypto: omap-des - fix crypto engine cleanup Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 167/869] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs Greg Kroah-Hartman
` (710 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b2c0e5bf750e33b0e1dcdfbb2df8103a06c7caab ]
wm8994_mic_detect() resumes the component before configuring the MICBIAS
pins, but the default case of the micbias switch returns -EINVAL right
after taking that reference, skipping the pm_runtime_put() on the
success path. This leaks a runtime PM reference on every call with an
invalid micbias.
Release the reference before returning -EINVAL.
Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260917165130.2163278-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8994.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 71e8dd18b57be..80b1bb7e17749 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3533,6 +3533,7 @@ int wm8994_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
break;
default:
dev_warn(component->dev, "Invalid MICBIAS %d\n", micbias);
+ pm_runtime_put(component->dev);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 167/869] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 166/869] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 168/869] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() Greg Kroah-Hartman
` (709 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Xu Yilun, Xu Yilun,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit ac02245b0ca28388ba16273f2fa683c90da2e5dc ]
The fpga_mgr_lock() comment lists of_fpga_mgr_put() as a source of a
manager pointer. The helper which obtains that pointer is
of_fpga_mgr_get(). Correct the reference.
Fixes: ebf877a51ad7 ("fpga: mgr: separate getting/locking FPGA manager")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260912100937.86316-1-kmehltretter@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fpga/fpga-mgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index 0f4035b089a2e..f6856aabf27d5 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -744,7 +744,7 @@ EXPORT_SYMBOL_GPL(fpga_mgr_put);
* @mgr: fpga manager
*
* Given a pointer to FPGA Manager (from fpga_mgr_get() or
- * of_fpga_mgr_put()) attempt to get the mutex. The user should call
+ * of_fpga_mgr_get()) attempt to get the mutex. The user should call
* fpga_mgr_lock() and verify that it returns 0 before attempting to
* program the FPGA. Likewise, the user should call fpga_mgr_unlock
* when done programming the FPGA.
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 168/869] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 167/869] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 169/869] iio: accel: adis16201: fix channel order for buffer mode Greg Kroah-Hartman
` (708 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, ChiYuan Huang,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e0d673e5a5c4084f0da90c06ed3b0bc45e47d679 ]
In rt6190_out_enable(), pm_runtime_get_sync() is called at the start of
the function. However, if any subsequent regmap or regulator operation
fails, the function returns directly without dropping the runtime PM
reference, causing a runtime PM reference leak.
Add an error handling path with pm_runtime_put() to keep the reference
count balanced on failure.
Fixes: e6999e7cca7e ("regulator: rt6190: Add support for Richtek RT6190 regulator")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: ChiYuan Huang <cy_huang@richtek.com>
Link: https://patch.msgid.link/20260916072541.1968033-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/rt6190-regulator.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/regulator/rt6190-regulator.c b/drivers/regulator/rt6190-regulator.c
index 3883440295edf..bf99e18f6d5b0 100644
--- a/drivers/regulator/rt6190-regulator.c
+++ b/drivers/regulator/rt6190-regulator.c
@@ -109,19 +109,27 @@ static int rt6190_out_enable(struct regulator_dev *rdev)
ret = regmap_raw_read(regmap, RT6190_REG_OUTV, out_cfg,
sizeof(out_cfg));
if (ret)
- return ret;
+ goto err_pm_put;
ret = regulator_enable_regmap(rdev);
if (ret)
- return ret;
+ goto err_pm_put;
ret = regmap_raw_write(regmap, RT6190_REG_OUTV, out_cfg,
sizeof(out_cfg));
if (ret)
- return ret;
+ goto err_pm_put;
+
+ ret = regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
+ RT6190_ENGCP_MASK);
+ if (ret)
+ goto err_pm_put;
+
+ return 0;
- return regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
- RT6190_ENGCP_MASK);
+err_pm_put:
+ pm_runtime_put(data->dev);
+ return ret;
}
static int rt6190_out_disable(struct regulator_dev *rdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 169/869] iio: accel: adis16201: fix channel order for buffer mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 168/869] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 170/869] iio: imu: inv_icm42600: force accel odr change when switching power mode Greg Kroah-Hartman
` (707 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shehryar Ahmad, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shehryar Ahmad <shehryar.amd@gmail.com>
[ Upstream commit a4b9f1137b76faab6891ce0bd3f5c02dda7c392d ]
Reshuffle adis16201_channels to ascending scan_index order to avoid data
corruption during IIO core demultiplexing since the ADIS driver builds
the buffer in channel array order, while the IIO core demultiplexes it
in scan_index order.
This changes the raw buffer byte layout for existing adis16201 users
reading buffered data directly.
Fixes: 591298e54cea ("Staging: iio: accel: adis16201: Move adis16201 driver out of staging")
Cc: stable@vger.kernel.org
Signed-off-by: Shehryar Ahmad <shehryar.amd@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adis16201.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/accel/adis16201.c b/drivers/iio/accel/adis16201.c
index 5127e58eebc7d..f0cf3783bcd9a 100644
--- a/drivers/iio/accel/adis16201.c
+++ b/drivers/iio/accel/adis16201.c
@@ -202,19 +202,19 @@ static int adis16201_write_raw(struct iio_dev *indio_dev,
}
static const struct iio_chan_spec adis16201_channels[] = {
- ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
- 12),
- ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
ADIS_ACCEL_CHAN(X, ADIS16201_XACCL_OUT_REG, ADIS16201_SCAN_ACC_X,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
ADIS_ACCEL_CHAN(Y, ADIS16201_YACCL_OUT_REG, ADIS16201_SCAN_ACC_Y,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
- ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
- IIO_CHAN_SOFT_TIMESTAMP(7)
+ ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
+ 12),
+ ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
+ ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
+ IIO_CHAN_SOFT_TIMESTAMP(7),
};
static const struct iio_info adis16201_info = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 170/869] iio: imu: inv_icm42600: force accel odr change when switching power mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 169/869] iio: accel: adis16201: fix channel order for buffer mode Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 171/869] iio: light: apds9306: fix default sampling frequency definition Greg Kroah-Hartman
` (706 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit d52047d84963e5cf7c8ad502e0adf003fb0669de ]
When accel must switch from low-power mode to low-noise due to a change in
ODR, there is an hardware bug that sometimes prevent the ODR change flag
to be set in the FIFO header. If this happens, the driver is stuck waiting
for the ODR change flag that is never happening.
Fix this by using accel_force_odr flag set when switching mode for forcing
apply of ODR change. Do the apply after parsing FIFO data to let the flag
do the job if it is here.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 +
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 9 ++++++++-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 2 ++
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 9 +++++++++
4 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
index c8b48a5c5ed06..a44e4ea746a6d 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
@@ -177,6 +177,7 @@ struct inv_icm42600_state {
struct {
s64 gyro;
s64 accel;
+ bool accel_force_odr;
} timestamp;
struct inv_icm42600_apex apex;
struct inv_icm42600_fifo fifo;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index d19ff0e76c668..d858acad3bfb6 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1226,9 +1226,11 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
return size;
/* update odr */
- if (odr & INV_ICM42600_SENSOR_ACCEL)
+ if (odr & INV_ICM42600_SENSOR_ACCEL) {
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ st->timestamp.accel_force_odr = false;
+ }
/* skip packet if no accel data or data is invalid */
if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
@@ -1241,5 +1243,10 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ts_val);
}
+ if (st->timestamp.accel_force_odr) {
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+ st->timestamp.accel_force_odr = false;
+ }
+
return 0;
}
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
index 5c3840acf0857..2c3e41a24b33d 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -396,6 +396,8 @@ static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
mutex_lock(&st->lock);
inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+ if (sensor == INV_ICM42600_SENSOR_ACCEL)
+ st->timestamp.accel_force_odr = false;
ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
if (ret)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
index 76eb22488e5f3..e37b395dbd90b 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -324,6 +324,15 @@ int inv_icm42600_set_accel_conf(struct inv_icm42600_state *st,
break;
}
+ /*
+ * If we change mode from low-power to low-noise because of odr,
+ * we need to force odr change.
+ */
+ if (oldconf->mode == INV_ICM42600_SENSOR_MODE_LOW_POWER &&
+ conf->mode == INV_ICM42600_SENSOR_MODE_LOW_NOISE &&
+ conf->odr != oldconf->odr)
+ st->timestamp.accel_force_odr = true;
+
/* set ACCEL_CONFIG0 register (accel fullscale & odr) */
if (conf->fs != oldconf->fs || conf->odr != oldconf->odr) {
val = INV_ICM42600_ACCEL_CONFIG0_FS(conf->fs) |
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 171/869] iio: light: apds9306: fix default sampling frequency definition
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 170/869] iio: imu: inv_icm42600: force accel odr change when switching power mode Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 172/869] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 Greg Kroah-Hartman
` (705 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Tsz Shan Chan,
Subhajit Ghosh, Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tsz Shan Chan <tsz.chan.dev@gmail.com>
[ Upstream commit a1c005f6336aa41f23552e66ea1b98b9ee493a86 ]
APDS9306_SAMP_FREQ_10HZ is defined as 0.
According to the datasheet (Broadcom AV02-4755EN, page 11,
ALS_MEAS_RATE), bits[2:0] set the measurement rate:
- 000: 25ms (40Hz)
- 001: 20ms (20Hz)
- 010: 100ms (10Hz)
Change APDS9306_SAMP_FREQ_10HZ from 0 to 2 to write the correct value
for 10Hz.
Datasheet: https://docs.broadcom.com/doc/AV02-4755EN
Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Tsz Shan Chan <tchan@jacques.com.au>
Acked-by: Subhajit Ghosh <subhajit.ghosh@tweaklogic.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/apds9306.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c
index 5ce01037ae554..fc07518faec77 100644
--- a/drivers/iio/light/apds9306.c
+++ b/drivers/iio/light/apds9306.c
@@ -61,7 +61,7 @@
#define APDS9306_NUM_REPEAT_RATES 7
#define APDS9306_INT_SRC_CLEAR 0
#define APDS9306_INT_SRC_ALS 1
-#define APDS9306_SAMP_FREQ_10HZ 0
+#define APDS9306_SAMP_FREQ_10HZ 2
/**
* struct part_id_gts_multiplier - Part no. and corresponding gts multiplier
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 172/869] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 171/869] iio: light: apds9306: fix default sampling frequency definition Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 173/869] PCI: pciehp: Make pciehp_poll_mode parameter read-only Greg Kroah-Hartman
` (704 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Peng, Damien Le Moal,
Niklas Cassel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Peng <benquike@gmail.com>
[ Upstream commit 3bab8c7e0c6ba187a47163a1f71477213a278c48 ]
When an ATA_12, ATA_16, or ATA_32 pass-through command with a
multi-sector PIO command opcode (ATA_CMD_READ_MULTI,
ATA_CMD_WRITE_MULTI, ATA_CMD_READ_MULTI_EXT, ATA_CMD_WRITE_MULTI_EXT, or
ATA_CMD_WRITE_MULTI_FUA_EXT) is submitted via SG_IO on a device where
multiple-sector mode is not configured (dev->multi_count == 0),
ata_scsi_pass_thru() currently logs a warning and still dispatches the
taskfile. When the DRQ interrupt fires, ata_pio_sectors() triggers
WARN_ON_ONCE(qc->dev->multi_count == 0) and computes
nsect = min((qc->nbytes - qc->curbytes) / qc->sect_size, 0) = 0, failing
to transfer any sectors:
ata1.00: invalid multi_count 1 ignored
WARNING: drivers/ata/libata-sff.c:666 at ata_pio_sectors+0x27d/0x300
Call Trace:
<IRQ>
ata_sff_hsm_move+0x211/0x22e0
__ata_sff_port_intr+0x1c8/0x520
ata_bmdma_port_intr+0xa1/0x5b0
ata_bmdma_interrupt+0x1f5/0x550
Per ACS-3 section 7.12.7.21, if IDENTIFY DEVICE word 59 bit 8 is cleared
to zero (multi_count == 0) and a READ MULTIPLE or WRITE MULTIPLE command
is received without a preceding successful SET MULTIPLE MODE command, the
device returns command aborted (ABRT). Per the SAT specification, an ABRT
error translates to the ABORTED COMMAND sense key with NO ADDITIONAL SENSE
INFORMATION (0x00, 0x00).
Fail multi-sector taskfile commands in ata_scsi_pass_thru() with
ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0) when
dev->multi_count == 0.
Fixes: 1dce589c38c3 ("libata passthru: support PIO multi commands")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260921032556.1160734-1-benquike@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-scsi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index c780a7f157389..8b9530c505315 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3474,6 +3474,11 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
if (is_multi_taskfile(tf)) {
unsigned int multi_count = 1 << (cdb[1] >> 5);
+ if (!dev->multi_count) {
+ ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0);
+ return 1;
+ }
+
/* compare the passed through multi_count
* with the cached multi_count of libata
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 173/869] PCI: pciehp: Make pciehp_poll_mode parameter read-only
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 172/869] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 174/869] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup Greg Kroah-Hartman
` (703 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Bjorn Helgaas,
Lukas Wunner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 5ab17178fca6026d329cb6ced33c30f3b7d3e50a ]
pciehp_request_irq() and pciehp_free_irq() select different resources based
on the global pciehp_poll_mode parameter. The parameter is currently
writable through sysfs, so changing it while a controller is active can
make teardown try to stop a nonexistent polling thread or call free_irq()
for an IRQ that was not requested.
Keep the parameter available for boot and module configuration, but prevent
runtime changes to the registration mode.
Reproducer:
Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
e1000 device, using these device options:
-device pcie-root-port,id=rp1,chassis=1,slot=1 -device e1000,bus=rp1
Pass "pcie_ports=native pciehp.pciehp_poll_mode=1" to the guest kernel. As
root in the guest, replace the device name below with a bound pciehp
service device and run:
# dev=0000:00:1c.0:pcie004
# driver=/sys/bus/pci_express/drivers/pciehp
# echo 0 > /sys/module/pciehp/parameters/poll_mode
# echo "$dev" > "$driver/unbind"
# dmesg | grep 'Trying to free already-free IRQ'
The unfixed kernel accepts the runtime mode change and reports the warning
when the service device is removed. The fixed kernel rejects the write and
removes the device without the warning. The mode change is a deliberate
privileged test action and is not expected during ordinary operation.
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20260921142608.270312-1-runyu.xiao@seu.edu.cn
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/hotplug/pciehp_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index f59baa9129709..785b7d5e7c096 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -38,7 +38,7 @@ int pciehp_poll_time;
* not really modular, but the easiest way to keep compat with existing
* bootargs behaviour is to continue using module_param here.
*/
-module_param(pciehp_poll_mode, bool, 0644);
+module_param(pciehp_poll_mode, bool, 0444);
module_param(pciehp_poll_time, int, 0644);
MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 174/869] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 173/869] PCI: pciehp: Make pciehp_poll_mode parameter read-only Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 175/869] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU Greg Kroah-Hartman
` (702 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 35b028b25451e17d63b2cd36a11a86c5e18df1b9 ]
When a bounce buffer is required for DMA_TO_DEVICE transfers,
i3c_master_dma_map_single() rounds the DMA mapping length up to a
cache-line boundary:
map_len = ALIGN(len, cache_line_size());
It then allocates the bounce buffer with:
kmemdup(buf, map_len, GFP_KERNEL);
kmemdup() copies the full allocation size, causing it to read map_len
bytes from buf even though only len bytes are valid. This results in an
out-of-bounds read of up to cache_line_size() - 1 bytes past the end of
the caller's buffer.
Fix the issue by allocating the bounce buffer with kzalloc() and copying
only len bytes from the original buffer. The remaining bytes up to
map_len stay zero-filled, avoiding both the out-of-bounds read and
exposure of unrelated memory contents to the DMA engine.
Fixes: f8d9e56aeb87 ("i3c: master: Add helpers for DMA mapping and bounce buffer handling")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 038f7b2ec8c48..0dbcfb1a52049 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1955,12 +1955,11 @@ struct i3c_dma *i3c_master_dma_map_single(struct device *dev, void *buf,
if (force_bounce) {
dma_xfer->map_len = ALIGN(len, cache_line_size());
- if (dir == DMA_FROM_DEVICE)
- bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
- else
- bounce = kmemdup(buf, dma_xfer->map_len, GFP_KERNEL);
+ bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
if (!bounce)
return NULL;
+ if (dir != DMA_FROM_DEVICE)
+ memcpy(bounce, buf, len);
dma_buf = bounce;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 175/869] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 174/869] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 176/869] signalfd: dont dequeue the forced fatal signals Greg Kroah-Hartman
` (701 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit b1a25e8e143ef880450e6399fb0733b66a1c29f0 ]
The controller writes whole DWORDs, so a read whose length is not a
multiple of 4 overwrites up to 3 bytes past the end of the destination
buffer. That is a property of the controller, not of the IOMMU, but the
bounce buffer that works around it was used only when the device was
IOMMU mapped. Everywhere else the buffer is left unprotected.
Drop the device_iommu_mapped() condition.
The overrun is easily seen with CONFIG_SLUB_DEBUG=y and kernel command
line options intel_iommu=off slub_debug=FZPU, which reports it as a
kmalloc redzone overwrite, like:
[kmalloc Redzone overwritten] 0xffff8a354561570e-0xffff8a354561570f @offset=1806. First byte 0x15 instead of 0xcc
=============================================================================
BUG kmalloc-8 (Not tainted): Object corrupt
Allocated in i3c_master_retrieve_dev_info+0xc1/0x760 age=40 cpu=6 pid=1
...
Freed in i3c_master_enec_disec_locked+0xeb/0x140 age=40 cpu=6 pid=1
...
WARNING: mm/slub.c:1233 at object_err+0x1c1/0x1cf, CPU#6: swapper/0/1
...
Fixes: 9e23897bca62 ("i3c: mipi-i3c-hci: Use physical device pointer with DMA API")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 37717e530a250..15a34429197b5 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -376,7 +376,7 @@ static void hci_dma_unmap_xfer(struct i3c_hci *hci,
static struct i3c_dma *hci_dma_map_xfer(struct device *dev, struct hci_xfer *xfer)
{
enum dma_data_direction dir = xfer->rnw ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
- bool need_bounce = device_iommu_mapped(dev) && xfer->rnw && (xfer->data_len & 3);
+ bool need_bounce = xfer->rnw && (xfer->data_len & 3);
return i3c_master_dma_map_single(dev, xfer->data, xfer->data_len, need_bounce, dir);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 176/869] signalfd: dont dequeue the forced fatal signals
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 175/869] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 177/869] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted Greg Kroah-Hartman
` (700 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+0a4c46806941297fecb9,
Kusaram Devineni, Oleg Nesterov, Kees Cook, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
[ Upstream commit d72e0fb3b00c6a1146bcfd7186ad9f6f609ba236 ]
These signals should act like SIGKILL, in that userspace must never dequeue
them. But as Kusaram explains, io_uring-driven signalfd_read_iter() called
from get_signal() -> task_work_run() paths can do this before get_signal()
has a chance to dequeue such a signal and notice SA_IMMUTABLE.
Change signalfd_poll() and signalfd_dequeue() to add pending SA_IMMUTABLE
signals to ctx->sigmask.
TODO: we should probably change force_sig_info_to_task(HANDLER_EXIT) to
make fatal_signal_pending() true, or add a fatal_or_forced_signal_pending()
helper. Then signalfd_dequeue() could just return -EINTR in this case.
This also makes sense for get_signal(), which could prioritize a fatal
signal sent by (say) force_sig_seccomp(force_coredump => true), just like
it already prioritizes SIGKILL.
Cc: stable@kernel.org
Reported-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0a4c46806941297fecb9
Tested-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/69d122fd.050a0220.2dbe29.001c.GAE@google.com/
Suggested-by: Kusaram Devineni <kusaram@devineni.in>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/adO3HG8bvwRPcmte@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/signalfd.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/fs/signalfd.c b/fs/signalfd.c
index d469782f97f4d..0aa1657bbedf6 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -48,17 +48,30 @@ static int signalfd_release(struct inode *inode, struct file *file)
return 0;
}
+static void refine_sigmask(struct signalfd_ctx *ctx, sigset_t *sigmask)
+{
+ struct k_sigaction *k = current->sighand->action;
+ int n;
+
+ *sigmask = ctx->sigmask;
+ for (n = 1; n <= _NSIG; ++n, ++k) {
+ if (k->sa.sa_flags & SA_IMMUTABLE)
+ sigaddset(sigmask, n);
+ }
+}
+
static __poll_t signalfd_poll(struct file *file, poll_table *wait)
{
struct signalfd_ctx *ctx = file->private_data;
__poll_t events = 0;
+ sigset_t sigmask;
poll_wait(file, ¤t->sighand->signalfd_wqh, wait);
spin_lock_irq(¤t->sighand->siglock);
- if (next_signal(¤t->pending, &ctx->sigmask) ||
- next_signal(¤t->signal->shared_pending,
- &ctx->sigmask))
+ refine_sigmask(ctx, &sigmask);
+ if (next_signal(¤t->pending, &sigmask) ||
+ next_signal(¤t->signal->shared_pending, &sigmask))
events |= EPOLLIN;
spin_unlock_irq(¤t->sighand->siglock);
@@ -155,11 +168,13 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
int nonblock)
{
enum pid_type type;
- ssize_t ret;
DECLARE_WAITQUEUE(wait, current);
+ sigset_t sigmask;
+ ssize_t ret;
spin_lock_irq(¤t->sighand->siglock);
- ret = dequeue_signal(&ctx->sigmask, info, &type);
+ refine_sigmask(ctx, &sigmask);
+ ret = dequeue_signal(&sigmask, info, &type);
switch (ret) {
case 0:
if (!nonblock)
@@ -174,7 +189,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
add_wait_queue(¤t->sighand->signalfd_wqh, &wait);
for (;;) {
set_current_state(TASK_INTERRUPTIBLE);
- ret = dequeue_signal(&ctx->sigmask, info, &type);
+ ret = dequeue_signal(&sigmask, info, &type);
if (ret != 0)
break;
if (signal_pending(current)) {
@@ -184,6 +199,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
spin_unlock_irq(¤t->sighand->siglock);
schedule();
spin_lock_irq(¤t->sighand->siglock);
+ refine_sigmask(ctx, &sigmask);
}
spin_unlock_irq(¤t->sighand->siglock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 177/869] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 176/869] signalfd: dont dequeue the forced fatal signals Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 178/869] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Greg Kroah-Hartman
` (699 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Hui Peng, Kees Cook,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Peng <benquike@gmail.com>
[ Upstream commit 832b9b176be06a20747a267db6bc0010a24b74f4 ]
In seccomp_notify_addfd(), when SECCOMP_ADDFD_FLAG_SEND is set in
addfd.flags, knotif->state is optimistically transitioned from
SECCOMP_NOTIFY_SENT to SECCOMP_NOTIFY_REPLIED before waking the tracee
and waiting on kaddfd.completion:
if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
knotif->state = SECCOMP_NOTIFY_REPLIED;
...
}
If wait_for_completion_interruptible(&kaddfd.completion) is interrupted
by a signal before the tracee dequeues the kaddfd request
(!list_empty(&kaddfd.list)), seccomp_notify_addfd() removes kaddfd from
knotif->addfd and returns -EINTR to the supervisor without having
installed the file descriptor.
However, knotif->state is left as SECCOMP_NOTIFY_REPLIED (with
knotif->error == 0 and knotif->val == 0). This causes two problems:
1. When the tracee runs in do_user_notif(), it checks
if (knotif.state != SECCOMP_NOTIFY_REPLIED) after calling
seccomp_handle_addfd(). Because knotif->state is already
SECCOMP_NOTIFY_REPLIED, the tracee exits the notification wait loop
prematurely and returns 0 from the trapped syscall without the file
descriptor ever having been installed.
2. If the supervisor retries SECCOMP_IOCTL_NOTIF_ADDFD or
SECCOMP_IOCTL_NOTIF_SEND before the tracee runs, it fails with
-EINPROGRESS because knotif->state is no longer SECCOMP_NOTIFY_SENT.
Fix this by restoring knotif->state back to SECCOMP_NOTIFY_SENT if
SECCOMP_ADDFD_FLAG_SEND was set and kaddfd was not consumed before the
interrupted wait. Also add a seccomp_bpf selftest
(user_notification_addfd_send_interrupted) covering this race.
Tested in QEMU against Linux 7.3.0-rc3 using the
user_notification_addfd_send_interrupted selftest added in this patch
(./seccomp_bpf -t user_notification_addfd_send_interrupted): on the
unfixed kernel the test fails because the retry ioctl(listener,
SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) returns -EINPROGRESS (-1) and the
tracee prematurely exits do_user_notif() with return value 0 instead of
FD 42, whereas with this patch applied the test passes.
Fixes: 0ae71c7720e3 ("seccomp: Support atomic "addfd + send reply"")
Cc: stable@vger.kernel.org
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260922023204.2504832-1-benquike@gmail.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/seccomp.c | 7 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 179 ++++++++++++++++++
2 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 25f62867a16d9..7fc3b3b13875a 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1810,10 +1810,13 @@ static long seccomp_notify_addfd(struct seccomp_filter *filter,
* We need to check again if the addfd request has been handled,
* and if not, we will remove it from the queue.
*/
- if (list_empty(&kaddfd.list))
+ if (list_empty(&kaddfd.list)) {
ret = kaddfd.ret;
- else
+ } else {
list_del(&kaddfd.list);
+ if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND)
+ knotif->state = SECCOMP_NOTIFY_SENT;
+ }
out_unlock:
mutex_unlock(&filter->notify_lock);
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 19c9afa0be719..a0c22cd7a9c0c 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -4362,6 +4362,185 @@ TEST(user_notification_addfd_rlimit)
close(memfd);
}
+/* Just take a signal and do nothing else. */
+static void empty_handler(int signo)
+{
+}
+
+/*
+ * Verify that when SECCOMP_IOCTL_NOTIF_ADDFD with SECCOMP_ADDFD_FLAG_SEND is
+ * interrupted by a signal before the tracee dequeues the addfd request,
+ * knotif->state is restored from SECCOMP_NOTIFY_REPLIED back to
+ * SECCOMP_NOTIFY_SENT so that:
+ * 1. The woken tracee sees knotif->state == SECCOMP_NOTIFY_SENT in
+ * do_user_notif() and goes back to sleep instead of prematurely
+ * returning 0 from the trapped syscall without the FD installed.
+ * 2. The supervisor can retry SECCOMP_IOCTL_NOTIF_ADDFD (or
+ * SECCOMP_IOCTL_NOTIF_SEND) instead of failing with -EINPROGRESS.
+ *
+ * To deterministically hit the race window where the supervisor sleeps in
+ * wait_for_completion_interruptible(&kaddfd.completion) after waking the
+ * tracee (complete(&knotif->ready)) but before the tracee runs
+ * seccomp_handle_addfd(), pin all processes to a single CPU and enforce a
+ * strict 3-tier scheduling priority hierarchy on that CPU:
+ * - Supervisor: SCHED_FIFO priority 99 (highest)
+ * - Signal helper (sig_pid): SCHED_FIFO priority 50 (middle)
+ * - Tracee (pid): SCHED_IDLE (lowest)
+ */
+TEST(user_notification_addfd_send_interrupted)
+{
+ /*
+ * Save parent_pid before user_notif_syscall(__NR_getppid, ...) installs
+ * the seccomp filter on the calling process; children inherit that
+ * filter, so sig_pid must not call getppid().
+ */
+ pid_t tracee_pid, sig_pid, parent_pid = getpid();
+ long ret;
+ int status, listener, memfd, err;
+ struct seccomp_notif_addfd addfd = {};
+ struct seccomp_notif req = {};
+ struct sigaction sa = {};
+ struct sched_param sp_zero = { .sched_priority = 0 };
+ struct sched_param sp_fifo_high = { .sched_priority = 99 };
+ struct sched_param sp_fifo_mid = { .sched_priority = 50 };
+ struct timespec delay = { .tv_nsec = 15000000 };
+ cpu_set_t cpuset;
+ int cpu;
+
+ /* Pin the supervisor (and its future child processes) to one CPU. */
+ cpu = sched_getcpu();
+ if (cpu >= 0) {
+ CPU_ZERO(&cpuset);
+ CPU_SET(cpu, &cpuset);
+ sched_setaffinity(0, sizeof(cpuset), &cpuset);
+ }
+
+ sa.sa_handler = empty_handler;
+ ASSERT_EQ(sigaction(SIGUSR1, &sa, NULL), 0);
+
+ memfd = memfd_create("test", 0);
+ ASSERT_GE(memfd, 0);
+
+ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ASSERT_EQ(0, ret) {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+ /*
+ * Follow the convention of other user_notification_* tests in this
+ * file by trapping __NR_getppid: because the filter is installed on
+ * the supervisor before fork(), the trapped syscall must be a
+ * side-effect-free syscall that the supervisor itself never invokes.
+ * Even though getppid() does not normally return an FD,
+ * SECCOMP_ADDFD_FLAG_SEND replaces the trapped syscall's return value
+ * with the newly installed FD number (42).
+ */
+ listener = user_notif_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ tracee_pid = fork();
+ ASSERT_GE(tracee_pid, 0);
+
+ if (tracee_pid == 0) {
+ /*
+ * Tracee: invoke __NR_getppid as a dummy trigger syscall to
+ * trap into do_user_notif(). Verify that the syscall returns
+ * the injected FD number (42) and that FD 42 is open.
+ */
+ ret = syscall(__NR_getppid);
+ exit(ret != 42 || fcntl(42, F_GETFD) < 0);
+ }
+
+ /* Wait for the tracee to trap in do_user_notif(). */
+ ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+
+ /*
+ * Demote the tracee to SCHED_IDLE and promote the supervisor to
+ * SCHED_FIFO(99) on the same CPU.
+ */
+ ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_IDLE, &sp_zero), 0);
+ if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_high) != 0) {
+ kill(tracee_pid, SIGKILL);
+ waitpid(tracee_pid, NULL, 0);
+ SKIP(return, "SCHED_FIFO requires CAP_SYS_NICE");
+ }
+
+ addfd.srcfd = memfd;
+ addfd.newfd_flags = O_CLOEXEC;
+ addfd.newfd = 42;
+ addfd.id = req.id;
+ addfd.flags = SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND;
+
+ /*
+ * Fork a signal helper on the same CPU and set it to SCHED_FIFO(50).
+ * Because the supervisor is currently running at SCHED_FIFO(99) on
+ * this CPU, sig_pid is queued on the runqueue but cannot run until the
+ * supervisor blocks inside the kernel.
+ *
+ * When the supervisor invokes ioctl(SECCOMP_IOCTL_NOTIF_ADDFD) below:
+ * 1. seccomp_notify_addfd() sets knotif->state = SECCOMP_NOTIFY_REPLIED,
+ * wakes the tracee (SCHED_IDLE), and blocks in
+ * wait_for_completion_interruptible(&kaddfd.completion).
+ * 2. The CPU scheduler immediately runs sig_pid (SCHED_FIFO 50)
+ * ahead of the woken tracee (SCHED_IDLE).
+ * 3. sig_pid sends SIGUSR1 to parent_pid, waking the supervisor
+ * (SCHED_FIFO 99), which immediately preempts sig_pid, aborts the
+ * wait with -ERESTARTSYS (-EINTR), removes kaddfd from
+ * knotif->addfd, and restores knotif->state = SECCOMP_NOTIFY_SENT
+ * before the tracee has executed a single instruction.
+ */
+ sig_pid = fork();
+ if (sig_pid < 0) {
+ sched_setscheduler(0, SCHED_OTHER, &sp_zero);
+ kill(tracee_pid, SIGKILL);
+ waitpid(tracee_pid, NULL, 0);
+ }
+ ASSERT_GE(sig_pid, 0);
+ if (sig_pid == 0) {
+ if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_mid) != 0)
+ _exit(1);
+ kill(parent_pid, SIGUSR1);
+ _exit(0);
+ }
+
+ ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
+ err = errno;
+
+ /*
+ * Restore normal scheduling ASAP so the supervisor does not remain
+ * SCHED_FIFO on a single-CPU machine/VM/CI, then sleep briefly so the
+ * woken tracee runs in do_user_notif(). With knotif->state restored to
+ * SECCOMP_NOTIFY_SENT, the tracee must loop back to sleep waiting for
+ * the notification reply rather than returning 0 from __NR_getppid.
+ */
+ ASSERT_EQ(sched_setscheduler(0, SCHED_OTHER, &sp_zero), 0);
+ ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_OTHER, &sp_zero), 0);
+
+ EXPECT_EQ(ret, -1);
+ EXPECT_EQ(err, EINTR);
+ EXPECT_EQ(waitpid(sig_pid, &status, 0), sig_pid);
+ EXPECT_EQ(true, WIFEXITED(status));
+ EXPECT_EQ(0, WEXITSTATUS(status));
+
+ nanosleep(&delay, NULL);
+
+ /*
+ * Retry SECCOMP_IOCTL_NOTIF_ADDFD. Because knotif->state is
+ * SECCOMP_NOTIFY_SENT, the retry succeeds (returns 42) instead of
+ * failing with -EINPROGRESS, installs FD 42 into the tracee, and wakes
+ * the tracee to complete the syscall with return value 42.
+ */
+ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 42);
+
+ EXPECT_EQ(waitpid(tracee_pid, &status, 0), tracee_pid);
+ EXPECT_EQ(true, WIFEXITED(status));
+ EXPECT_EQ(0, WEXITSTATUS(status));
+
+ close(listener);
+ close(memfd);
+}
+
#ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP
#define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0)
#define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 178/869] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 177/869] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 179/869] leds: ktd2692: Pass context to regulator cleanup Greg Kroah-Hartman
` (698 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cong Nguyen, Frank Li,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
[ Upstream commit 07643be7b1eff94f7a49e142c1e92a1029d3db21 ]
device_run() allocates an ipu_image_convert_run object and, on the
success path, hands it to the IPU image conversion core via
ipu_image_convert_queue(); the run object is then freed asynchronously
by the completion callback ipu_ic_pp_complete().
However, if ipu_image_convert_queue() fails, the core never takes
ownership of the run object and the completion callback is never
invoked. The "err" label finishes the mem2mem job and reports the
buffers as errored, but never frees the run object that was just
allocated, leaking it on every queue failure.
Free the run object in the error path. There is no risk of a double
free: the completion callback only runs after the object was
successfully queued, which is mutually exclusive with reaching the
error path. It is also safe for the earlier "goto err" on allocation
failure, since run is NULL there and kfree(NULL) is a no-op.
Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Cc: stable@kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
index 1869c5792ecb4..085f4f8eb8bde 100644
--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -147,6 +147,7 @@ static void device_run(void *_ctx)
v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
v4l2_m2m_job_finish(priv->m2m_dev, ctx->fh.m2m_ctx);
+ kfree(run);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 179/869] leds: ktd2692: Pass context to regulator cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 178/869] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 180/869] media: ene_ir: Ensure teardown is done in the correct order Greg Kroah-Hartman
` (697 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit c73e9f04445f361d5f19ca2edfde742ce18348ef ]
regulator_disable_action() retrieves the driver context from device
driver data. However, ktd2692_parse_dt() registers the action before
ktd2692_probe() stores the context with platform_set_drvdata().
If devm_add_action_or_reset() cannot allocate the action, it invokes the
callback immediately. A later probe failure also invokes it during
managed-resource unwinding. Both paths dereference a NULL context.
Pass the already allocated context directly to the action and retain the
device pointer in it for error reporting. The context is allocated before
the action is registered, so reverse-order devres unwinding keeps it alive
through the callback.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: ee78b9360e14 ("leds: ktd2692: Fix an error handling path")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910194525.99654-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/flash/leds-ktd2692.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/flash/leds-ktd2692.c b/drivers/leds/flash/leds-ktd2692.c
index 0f16eefcfe4cd..04e2efdac3e6f 100644
--- a/drivers/leds/flash/leds-ktd2692.c
+++ b/drivers/leds/flash/leds-ktd2692.c
@@ -69,6 +69,8 @@ const struct expresswire_timing ktd2692_timing = {
};
struct ktd2692_context {
+ struct device *dev;
+
/* Common ExpressWire properties (ctrl GPIO and timing) */
struct expresswire_common_props props;
@@ -196,13 +198,12 @@ static void ktd2692_setup(struct ktd2692_context *led)
static void regulator_disable_action(void *_data)
{
- struct device *dev = _data;
- struct ktd2692_context *led = dev_get_drvdata(dev);
+ struct ktd2692_context *led = _data;
int ret;
ret = regulator_disable(led->regulator);
if (ret)
- dev_err(dev, "Failed to disable supply: %d\n", ret);
+ dev_err(led->dev, "Failed to disable supply: %d\n", ret);
}
static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
@@ -233,7 +234,7 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
dev_err(dev, "Failed to enable supply: %d\n", ret);
} else {
ret = devm_add_action_or_reset(dev,
- regulator_disable_action, dev);
+ regulator_disable_action, led);
if (ret)
return ret;
}
@@ -290,6 +291,7 @@ static int ktd2692_probe(struct platform_device *pdev)
if (!led)
return -ENOMEM;
+ led->dev = &pdev->dev;
fled_cdev = &led->fled_cdev;
led_cdev = &fled_cdev->led_cdev;
led->props.timing = ktd2692_timing;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 180/869] media: ene_ir: Ensure teardown is done in the correct order
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 179/869] leds: ktd2692: Pass context to regulator cleanup Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 181/869] media: serial_ir: Fix race condition where timer can be re-armed Greg Kroah-Hartman
` (696 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit ae6cfbad7ca346b78f4cdac38438bbfaed8c18a0 ]
The timer can be re-armed from the irq, so ensure that the timers are
deleted after the irq and that we only free the rc device once we are
sure that the irq has been silenced.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ene_ir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 136fc4192265d..7598b623e4e84 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1103,15 +1103,15 @@ static void ene_remove(struct pnp_dev *pnp_dev)
unsigned long flags;
rc_unregister_device(dev->rdev);
- timer_delete_sync(&dev->tx_sim_timer);
spin_lock_irqsave(&dev->hw_lock, flags);
ene_rx_disable(dev);
ene_rx_restore_hw_buffer(dev);
spin_unlock_irqrestore(&dev->hw_lock, flags);
- rc_free_device(dev->rdev);
free_irq(dev->irq, dev);
+ timer_delete_sync(&dev->tx_sim_timer);
release_region(dev->hw_io, ENE_IO_SIZE);
+ rc_free_device(dev->rdev);
kfree(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 181/869] media: serial_ir: Fix race condition where timer can be re-armed
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 180/869] media: ene_ir: Ensure teardown is done in the correct order Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 182/869] media: ir_toy: Validate the maximum tx carrier Greg Kroah-Hartman
` (695 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit d74ac4016ba64cb3b20f395511d0b18025ca0ba9 ]
Ensure the timer cannot be re-armed.
Fixes: 2940c7e49775 ("[media] serial_ir: generate timeout")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/serial_ir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 992fff82b5245..f6702b3df9a03 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -798,7 +798,7 @@ static int __init serial_ir_init_module(void)
static void __exit serial_ir_exit_module(void)
{
- timer_delete_sync(&serial_ir.timeout_timer);
+ timer_shutdown_sync(&serial_ir.timeout_timer);
serial_ir_exit();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 182/869] media: ir_toy: Validate the maximum tx carrier
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 181/869] media: serial_ir: Fix race condition where timer can be re-armed Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 183/869] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Greg Kroah-Hartman
` (694 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 27303392aa87b61692faadec8b00e0ca66bf98dd ]
Reject any carrier the hardware cannot generate. This also fixes
a divide by zero if a carrier of U32_MAX/16 is set.
Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ir_toy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index e79de56997a42..ba6c042127078 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -373,7 +373,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier)
u8 buf[3];
int err;
- if (carrier < 11800)
+ if (carrier < 11800 || carrier > 3000000)
return -EINVAL;
buf[0] = 0x06;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 183/869] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 182/869] media: ir_toy: Validate the maximum tx carrier Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 184/869] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() Greg Kroah-Hartman
` (693 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 05d9c515cf13056875abbf73adb4a19dd7ba32eb ]
If an excesively high carrier is set, meson_irtx_prepare_pulse() will
cause a divide by zero if tb_us is 0. Prevent such a carrier from being
set.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 1ab898069e67f..a0d07da09f67a 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -219,6 +219,9 @@ static int meson_irtx_set_carrier(struct rc_dev *rc, u32 carrier)
if (carrier == 0)
return -EINVAL;
+ if (!DIV_ROUND_CLOSEST(USEC_PER_SEC, carrier))
+ return -EINVAL;
+
ir->carrier = carrier;
meson_irtx_set_mod(ir);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 184/869] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 183/869] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 185/869] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address Greg Kroah-Hartman
` (692 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Sen Wang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ba593d662183de74d2b733b4c6e8cd26f04f0a65 ]
In __davinci_mcasp_set_clkdiv(), pm_runtime_get_sync() is called at the
entry of the function. If an invalid div_id is provided, the function
hits the default switch case and directly returns -EINVAL without calling
pm_runtime_put(), resulting in a runtime PM reference leak.
Add pm_runtime_put() in the default case before returning -EINVAL.
Fixes: 4ed8c9b737b6 ("ASoC: McASP: add support for clock dividers")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Tested-by: Sen Wang <sen@ti.com>
Link: https://patch.msgid.link/20260916073136.1971673-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/ti/davinci-mcasp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index 621a9d5f9377a..23a68ac3a3e3f 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -647,6 +647,7 @@ static int __davinci_mcasp_set_clkdiv(struct davinci_mcasp *mcasp, int div_id,
break;
default:
+ pm_runtime_put(mcasp->dev);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 185/869] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 184/869] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 186/869] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT Greg Kroah-Hartman
` (691 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Udit Kumar, Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 9852f2badc438de82b6828c11c80ef0a656f1d4d ]
MMC0_CLKLB and MMC0_CLK have incorrectly swapped register addresses
as per datasheet [0]. Set the correct MMC0_CLK address and drop the
unneeded MMC0_CLKLB pin configuration.
[0] https://www.ti.com/lit/gpn/am62a7 Rev. E: Table 5-1. Pin Attributes
Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Udit Kumar <u-kumar1@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-2-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index a902b88062093..29e7673dde331 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -313,8 +313,7 @@ AM62AX_IOPAD(0x0b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLKLB */
- AM62AX_IOPAD(0x21c, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 186/869] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 185/869] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 187/869] arm64: dts: ti: k3-am62a7-sk: Set SD " Greg Kroah-Hartman
` (690 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit aa7d5b1efa75e58c9d440dfd720205045fe6a806 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-4-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index 29e7673dde331..a9141640c35e6 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -313,7 +313,7 @@ AM62AX_IOPAD(0x0b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 187/869] arm64: dts: ti: k3-am62a7-sk: Set SD clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 186/869] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 188/869] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC " Greg Kroah-Hartman
` (689 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit cfad4f39124b218c2cbbbe17e742971abc9ac8b4 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-5-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index a9141640c35e6..17ae6f0ceecfc 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -329,7 +329,7 @@ AM62AX_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
- AM62AX_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+ AM62AX_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
AM62AX_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
AM62AX_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
AM62AX_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 188/869] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 187/869] arm64: dts: ti: k3-am62a7-sk: Set SD " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 189/869] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins " Greg Kroah-Hartman
` (688 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 4834050197f205a649e36661ca150e6ac8295008 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: d69383885576 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM62Ax")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-6-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
index b3d012a5a26aa..9da48a54855e0 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
@@ -120,7 +120,7 @@ AM62AX_IOPAD(0x15c, PIN_INPUT, 0) /* (V13) MDIO0_MDIO */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y6) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA6) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AB6) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (Y7) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 189/869] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 188/869] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 190/869] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin " Greg Kroah-Hartman
` (687 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 156f4c2208c8e5e04002402494de28c21c0afcbc ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: e6a51ffabfc1 ("arm64: ti: dts: Add support for AM62x LP SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-7-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
index 5ed757c19db60..fc79641d7bb5f 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
@@ -86,7 +86,7 @@ main_mmc0_pins_default: main-mmc0-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (V3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (Y1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (Y1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (V2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (V1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (W2) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 190/869] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 189/869] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 191/869] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins " Greg Kroah-Hartman
` (686 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 843c4d171975059eaa1436c8403d9a29f677a75c ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 92d8c028aa92 ("arm64: dts: ti: Add k3-am62-pocketbeagle2")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-8-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
index 7a4cffc27bda3..1c691629d4ad0 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
@@ -235,7 +235,7 @@ AM62X_IOPAD(0x0020, PIN_OUTPUT, 3) /* (J25) OSPI0_D5.UART6_TXD */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 191/869] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 190/869] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 192/869] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin " Greg Kroah-Hartman
` (685 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit c074abebc76f0e59d13dea499f582806c6a3d94d ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: f5a731f0787f ("arm64: dts: ti: Add k3-am625-beagleplay")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-9-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
index 7028d9835c4a8..5d05f4b9a6d91 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -323,7 +323,7 @@ emmc_pins_default: emmc-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x0220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x0218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x0218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x0214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x0210, PIN_INPUT, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x020c, PIN_INPUT, 0) /* (AA3) MMC0_DAT2 */
@@ -346,7 +346,7 @@ sd_pins_default: sd-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x023c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
- AM62X_IOPAD(0x0234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+ AM62X_IOPAD(0x0234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
AM62X_IOPAD(0x0230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x022c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
AM62X_IOPAD(0x0228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
@@ -358,7 +358,7 @@ AM62X_IOPAD(0x0240, PIN_INPUT, 7) /* (D17) MMC1_SDCD.GPIO1_48 */
wifi_pins_default: wifi-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x0120, PIN_INPUT, 0) /* (C24) MMC2_CMD */
- AM62X_IOPAD(0x0118, PIN_INPUT, 0) /* (D25) MMC2_CLK */
+ AM62X_IOPAD(0x0118, PIN_OUTPUT, 0) /* (D25) MMC2_CLK */
AM62X_IOPAD(0x0114, PIN_INPUT, 0) /* (B24) MMC2_DAT0 */
AM62X_IOPAD(0x0110, PIN_INPUT, 0) /* (C25) MMC2_DAT1 */
AM62X_IOPAD(0x010c, PIN_INPUT, 0) /* (E23) MMC2_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 192/869] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 191/869] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 193/869] arm64: dts: ti: k3-am625-sk-common: Set eMMC " Greg Kroah-Hartman
` (684 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 1e2e5016bda94b2bcd86258b5eb77fe3006639a0 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-10-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
index 58f78c0de292d..3c5ef8fc9cdd6 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -187,7 +187,7 @@ main_mmc1_pins_default: main-mmc1-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 193/869] arm64: dts: ti: k3-am625-sk-common: Set eMMC clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 192/869] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 194/869] arm64: dts: ti: k3-am62-phycore-som: " Greg Kroah-Hartman
` (683 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 8ef8a0e38d1377c6d51c06f95c64d87641b2c717 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-11-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
index fe0b98e1d1055..d492ff34c5b11 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
@@ -98,7 +98,7 @@ main_mmc0_pins_default: main-mmc0-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 194/869] arm64: dts: ti: k3-am62-phycore-som: Set eMMC clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 193/869] arm64: dts: ti: k3-am625-sk-common: Set eMMC " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 195/869] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD " Greg Kroah-Hartman
` (682 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit a3c2b6c52e02d58941c0b91bfba052788aeff890 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 3443c1c4ed61 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM625")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-12-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
index eeca643fedbe9..19ac2dbe66cb5 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
@@ -146,7 +146,7 @@ AM62X_IOPAD(0x15c, PIN_INPUT, 0) /* (AB22) MDIO0_MDIO */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 195/869] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin as OUTPUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 194/869] arm64: dts: ti: k3-am62-phycore-som: " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 196/869] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() Greg Kroah-Hartman
` (681 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 1d62ef8d47b535d31fb9cf38e5c36eb55b0189a4 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: f1b3adade045 ("arm64: dts: ti: Add am62x-phyboard-lyra carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-16-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
index aab74d6019b0a..5a09b4c1b659a 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
@@ -227,7 +227,7 @@ AM62X_IOPAD(0x068, PIN_INPUT, 3) /* (R21) GPMC0_AD11.MCASP2_AXR3 */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT_PULLUP, 0) /* (A21) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT_PULLUP, 0) /* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT_PULLUP, 0) /* (B21) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT_PULLUP, 0) /* (C21) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 196/869] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 195/869] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD " Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 6.18 197/869] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode Greg Kroah-Hartman
` (680 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Liviu Dudau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 73ef663c75688168e31dbe9c585b939be410a945 ]
malidp_crtc_atomic_enable() resumes the device with
pm_runtime_get_sync() and returns early when the resume fails. The
runtime PM usage count is incremented by pm_runtime_get_sync() even
when the resume fails, so returning without dropping the reference
leaks it and, once the error has been hit, prevents the device from
ever suspending again.
Drop the runtime PM reference with pm_runtime_put_noidle() on the
resume failure path before returning.
Fixes: 85f6421889ec ("drm: mali-dp: Enable power management for the device.")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260916102112.2018372-1-vulab@iscas.ac.cn
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/arm/malidp_crtc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c
index d72c22dcf6855..591f71577937e 100644
--- a/drivers/gpu/drm/arm/malidp_crtc.c
+++ b/drivers/gpu/drm/arm/malidp_crtc.c
@@ -56,6 +56,7 @@ static void malidp_crtc_atomic_enable(struct drm_crtc *crtc,
if (err < 0) {
DRM_DEBUG_DRIVER("Failed to enable runtime power management: %d\n", err);
+ pm_runtime_put_noidle(crtc->dev->dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 197/869] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 196/869] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 198/869] nilfs2: fix checkpoint root lifetime on sysfs errors Greg Kroah-Hartman
` (679 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, LFRon, Wentao Guan,
Mario Limonciello, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit b400642c5e93863ec17ea15fcbd3efc81c299531 ]
Since commit 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active
mode on shared memory systems"), shmem_init_perf() programs
AUTONOMOUS_SELECTION_ENABLE unconditionally, including in active mode.
Platforms that exclusively support autonomous selection report this field
as an Integer of 1, as required by the ACPI specification, instead of as a
register descriptor. cppc_get_reg_val() reads such a field back
successfully, but cppc_set_reg_val() rejects the write with -EOPNOTSUPP
because the entry is not an ACPI_TYPE_BUFFER.
shmem_init_perf() propagates that error, so every amd_pstate_epp_cpu_init()
fails, cpufreq_register_driver() ends up with an empty policy list and
returns -ENODEV, and amd-pstate refuses to load at all:
amd_pstate: failed to set auto_sel, ret: -95
amd_pstate: Failed to initialize CPU 0: -95
...
amd_pstate: failed to register with return -19
Skip the write when the register already holds the value the requested mode
needs. Active and guided mode are fixed on these platforms, which report
auto_sel as 1, while passive mode still fails to load on a platform that
cannot disable autonomous selection, exactly as it did before the
offending commit.
Fixes: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Cc: stable@vger.kernel.org
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: LFRon <ronforever@outlook.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260918090909.86544-1-guanwentao@uniontech.com
Signed-off-by: Mario Limonciello <superm1@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/amd-pstate.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index b1a200531628f..0b06bbd7215ff 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -469,8 +469,10 @@ static int shmem_init_perf(struct amd_cpudata *cpudata)
return 0;
}
- ret = cppc_set_auto_sel(cpudata->cpu,
- (cppc_state == AMD_PSTATE_PASSIVE) ? 0 : 1);
+ if ((cppc_state != AMD_PSTATE_PASSIVE) == auto_sel)
+ return 0;
+
+ ret = cppc_set_auto_sel(cpudata->cpu, !auto_sel);
if (ret)
pr_warn("failed to set auto_sel, ret: %d\n", ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 198/869] nilfs2: fix checkpoint root lifetime on sysfs errors
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 6.18 197/869] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 199/869] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits() Greg Kroah-Hartman
` (678 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
[ Upstream commit 2cb947450e0e5a88bb6bb5fca6dbfda1910e74b0 ]
nilfs_find_or_create_root() links a new checkpoint root into the
checkpoint tree and drops ns_cptree_lock before creating the root's
sysfs group. If nilfs_sysfs_create_snapshot_group() then fails, the
root is freed while it is still reachable from ns_cptree, so a
concurrent nilfs_lookup_root() can dereference freed memory.
nilfs_sysfs_create_snapshot_group() allocates memory and creates sysfs
nodes and may sleep, so it cannot run under the ns_cptree_lock spinlock.
Reorder the creation path so that the sysfs group is set up before the
root is published: initialize the root, create its sysfs group outside
the lock, and only then take ns_cptree_lock to link it into the tree.
On sysfs failure the root was never visible and is freed directly; in
the unlikely case a root with the same checkpoint number is already
present, the sysfs group of the new root is removed before it is freed.
Concurrent insertions are already serialized by ns_snapshot_mount_mutex,
so only the race against nilfs_lookup_root() needs to be closed.
Because kobject_put() does not guarantee that the embedded kobject's
release callback has run by the time it returns
(CONFIG_DEBUG_KOBJECT_RELEASE defers it), the container must not be
freed until the release completes. Keep that wait_for_completion() of
snapshot_kobj_unregister inside the sysfs helpers, so both the creation
error path and nilfs_sysfs_delete_snapshot_group() wait for the release
before their callers free the root.
Fixes: dd70edbde262 ("nilfs2: integrate sysfs support into driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 5 ++++-
fs/nilfs2/the_nilfs.c | 34 +++++++++++++++++++++-------------
2 files changed, 25 insertions(+), 14 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index bc52afbfc5c73..5bb74a45ad1ed 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -195,8 +195,10 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
"%llu", root->cno);
}
- if (err)
+ if (err) {
kobject_put(&root->snapshot_kobj);
+ wait_for_completion(&root->snapshot_kobj_unregister);
+ }
return err;
}
@@ -204,6 +206,7 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
{
kobject_put(&root->snapshot_kobj);
+ wait_for_completion(&root->snapshot_kobj_unregister);
}
/************************************************************************
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 9911a484398a0..b453229db3af9 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -887,6 +887,26 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
if (!new)
return NULL;
+ new->cno = cno;
+ new->ifile = NULL;
+ new->nilfs = nilfs;
+ refcount_set(&new->count, 1);
+ atomic64_set(&new->inodes_count, 0);
+ atomic64_set(&new->blocks_count, 0);
+
+ /*
+ * Register the sysfs group before publishing the root in the
+ * checkpoint tree. nilfs_sysfs_create_snapshot_group() can sleep,
+ * so it must run outside ns_cptree_lock; creating it first also
+ * ensures a concurrent nilfs_lookup_root() can never observe a root
+ * whose sysfs registration later fails and gets freed.
+ */
+ err = nilfs_sysfs_create_snapshot_group(new);
+ if (err) {
+ kfree(new);
+ return NULL;
+ }
+
spin_lock(&nilfs->ns_cptree_lock);
p = &nilfs->ns_cptree.rb_node;
@@ -903,29 +923,17 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
} else {
refcount_inc(&root->count);
spin_unlock(&nilfs->ns_cptree_lock);
+ nilfs_sysfs_delete_snapshot_group(new);
kfree(new);
return root;
}
}
- new->cno = cno;
- new->ifile = NULL;
- new->nilfs = nilfs;
- refcount_set(&new->count, 1);
- atomic64_set(&new->inodes_count, 0);
- atomic64_set(&new->blocks_count, 0);
-
rb_link_node(&new->rb_node, parent, p);
rb_insert_color(&new->rb_node, &nilfs->ns_cptree);
spin_unlock(&nilfs->ns_cptree_lock);
- err = nilfs_sysfs_create_snapshot_group(new);
- if (err) {
- kfree(new);
- new = NULL;
- }
-
return new;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 199/869] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 198/869] nilfs2: fix checkpoint root lifetime on sysfs errors Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 200/869] md: validate bblog_size when loading v1.x badblocks metadata Greg Kroah-Hartman
` (677 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Tony Luck, Qiuxu Zhuo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit f0d8c34b3b5e845113581d7d3b24ddaa61bce1f0 ]
In i10nm_get_ddr_munits(), get_ddr_munit() returns a PCI device with
its reference count incremented. If ioremap() fails to map the MMIO
space of the memory controller, the function returns -ENODEV without
putting the reference held by mdev, leaking it.
Put the device reference before returning on the ioremap failure path.
[Tony: Dropped the Cc: stable tag]
Fixes: c545f5e41225 ("EDAC/i10nm: Skip the absent memory controllers")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qzhuo@nvidia.com>
Link: https://patch.msgid.link/20260916091251.1997522-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/i10nm_base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index dfd49412f3199..59d359f3f3fb5 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -834,6 +834,7 @@ static int i10nm_get_ddr_munits(void)
mbase = ioremap(base + off, size);
if (!mbase) {
+ pci_dev_put(mdev);
i10nm_printk(KERN_ERR, "Failed to ioremap 0x%llx\n",
base + off);
return -ENODEV;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 200/869] md: validate bblog_size when loading v1.x badblocks metadata
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 199/869] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 201/869] crypto: qat - fix error source for QAT GEN6 transmit interface faults Greg Kroah-Hartman
` (676 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuchao Zhang, Yu Kuai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchao Zhang <ndaugoing@gmail.com>
[ Upstream commit ae5f89b23cb88667cfa1273b42d6a551db9c651e ]
In super_1_load(), when the on-disk feature_map does not have
MD_FEATURE_BAD_BLOCKS set but sb->bblog_offset is non-zero,
rdev->badblocks.shift is initialized to 0 without validating
sb->bblog_size. The same field is validated in the
MD_FEATURE_BAD_BLOCKS branch ("sectors > (PAGE_SIZE / 512)"), but this
branch bypasses that check.
A forged on-disk superblock (malicious storage device or crafted
image) can therefore carry an oversized sb->bblog_size. When bad
blocks are later recorded, super_1_sync() sets bb->size from
sb->bblog_size and md_write_metadata() issues a bio larger than the
single rdev->bb_page, reading beyond the page and leaking kernel
memory contents to disk.
sb->bblog_size is never modified by the kernel between load and sync,
and the MD_FEATURE_BAD_BLOCKS branch already validates it, so checking
it in this branch is sufficient to cover both paths.
Fix this by rejecting an oversized sb->bblog_size with -EINVAL,
matching the existing check in the MD_FEATURE_BAD_BLOCKS branch.
Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
Link: https://patch.msgid.link/20260922044606.30774-1-ndaugoing@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 44f44219ed7fe..8d9e111939f64 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1930,8 +1930,11 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
if (!badblocks_set(&rdev->badblocks, sector, count, 1))
return -EINVAL;
}
- } else if (sb->bblog_offset != 0)
+ } else if (sb->bblog_offset != 0) {
+ if (le16_to_cpu(sb->bblog_size) > (PAGE_SIZE / 512))
+ return -EINVAL;
rdev->badblocks.shift = 0;
+ }
if ((le32_to_cpu(sb->feature_map) &
(MD_FEATURE_PPL | MD_FEATURE_MULTIPLE_PPLS))) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 201/869] crypto: qat - fix error source for QAT GEN6 transmit interface faults
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 200/869] md: validate bblog_size when loading v1.x badblocks metadata Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 202/869] crypto: amlogic - Fix IRQ handler return value and fallthrough logic Greg Kroah-Hartman
` (675 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suman Kumar Chakraborty,
Giovanni Cabiddu, Ahsan Atta, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
[ Upstream commit eeaf1ccd4c05d9c6ad67345862b36670e8e4dfc2 ]
TI_CD_PAR_STS faults were being decoded under ERRSOU1, which is
incorrect for QAT GEN6 devices. They are actually raised on ERRSOU3.
Move the handling of TI_CD_PAR_STS faults as part of the ERRSOU3 logic
and split the status bits by their actual source:
- Bits 0-18 (TI_INT_ERR_DEVHALT) handled when a DEVHALT is signalled
and are counted once as ADF_RAS_FATAL.
- Bit 19 (TIMISCSTS) handled separately and counted as ADF_RAS_UNCORR.
Previously, a TI_INT_ERR_DEVHALT fault also incremented ADF_RAS_UNCORR
in addition to ADF_RAS_FATAL. Since a DEVHALT is already fatal, remove
the redundant increment.
Bits 20-25 of TI_CD_PAR_STS are unused/reserved on QAT GEN6. Remove them
from the mask.
Cc: stable@vger.kernel.org
Fixes: 7f3401d0a506 ("crypto: qat - enable RAS support for GEN6 devices")
Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/qat/qat_common/adf_gen6_ras.c | 20 +++++++++++++---
.../intel/qat/qat_common/adf_gen6_ras.h | 24 ++++++++++---------
2 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
index 967253082a984..902c4b1a23e3b 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
@@ -323,14 +323,26 @@ static void adf_handle_ti_cd_par_sts(struct adf_accel_dev *accel_dev, void __iom
u32 ti_cd_par_sts;
ti_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
- ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_MASK;
+ ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK;
if (ti_cd_par_sts) {
dev_err(&GET_DEV(accel_dev), "TI CD parity error: %#x\n", ti_cd_par_sts);
- ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_cd_par_sts);
}
}
+static void adf_handle_ti_misc_cd_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
+{
+ u32 ti_misc_cd_par_sts;
+
+ ti_misc_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
+ ti_misc_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK;
+ if (ti_misc_cd_par_sts) {
+ dev_err(&GET_DEV(accel_dev), "TI MISC CD parity error: %#x\n", ti_misc_cd_par_sts);
+ ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
+ ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_misc_cd_par_sts);
+ }
+}
+
static void adf_handle_ti_trnsb_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
{
u32 ti_trnsb_par_sts;
@@ -367,7 +379,6 @@ static void adf_handle_ti_err(struct adf_accel_dev *accel_dev, void __iomem *csr
adf_handle_ti_ci_par_sts(accel_dev, csr);
adf_handle_ti_pullfub_par_sts(accel_dev, csr);
adf_handle_ti_pushfub_par_sts(accel_dev, csr);
- adf_handle_ti_cd_par_sts(accel_dev, csr);
adf_handle_ti_trnsb_par_sts(accel_dev, csr);
adf_handle_iosfp_cmd_parerr(accel_dev, csr);
}
@@ -591,6 +602,8 @@ static void adf_handle_timiscsts(struct adf_accel_dev *accel_dev, void __iomem *
if (!(errsou & ADF_GEN6_ERRSOU3_TIMISCSTS_BIT))
return;
+ adf_handle_ti_misc_cd_par_sts(accel_dev, csr);
+
timiscsts = ADF_CSR_RD(csr, ADF_GEN6_TIMISCSTS);
if (timiscsts) {
dev_err(&GET_DEV(accel_dev), "Fatal error in transmit interface: %#x\n",
@@ -730,6 +743,7 @@ static void adf_handle_ti_int_err_devhalt(struct adf_accel_dev *accel_dev, void
if (!(errsou & ADF_GEN6_ERRSOU3_TI_INT_ERR_DEVHALT_BIT))
return;
+ adf_handle_ti_cd_par_sts(accel_dev, csr);
dev_err(&GET_DEV(accel_dev), "DEVHALT due to a TI internal memory error\n");
ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_FATAL);
}
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
index 66ced271d1733..11f7b2986f567 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
@@ -170,23 +170,25 @@ struct adf_ras_ops;
#define ADF_GEN6_TI_CD_PAR_ERR_MASK 0x500638
/*
- * TI CD parity status mask
+ * TI CD parity status mask - TI_INT_ERR_DEVHALT bits
* BIT(0) - BIT(15) - CtxMdRam[0:15]_sts parity status
* BIT(16) - Leaf2ClusterRam_sts parity status
* BIT(17) - BIT(18) - Ring2LeafRam[0:1]_sts parity status
- * BIT(19) - VirtualQ_sts parity status
- * BIT(20) - DtRdQ_sts parity status
- * BIT(21) - DtWrQ_sts parity status
- * BIT(22) - RiCmdQ_sts parity status
- * BIT(23) - BypassQ_sts parity status
- * BIT(24) - DtRdQ_sc_sts parity status
- * BIT(25) - DtWrQ_sc_sts parity status
*/
-#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+#define ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK \
(BIT(0) | BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5) | BIT(6) | \
BIT(7) | BIT(8) | BIT(9) | BIT(10) | BIT(11) | BIT(12) | BIT(13) | \
- BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18) | BIT(19) | BIT(20) | \
- BIT(21) | BIT(22) | BIT(23) | BIT(24) | BIT(25))
+ BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18))
+
+/*
+ * TI CD parity status mask - TIMISCSTS bit
+ * BIT(19) - VirtualQ_sts parity status
+ */
+#define ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK BIT(19)
+
+#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+ (ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK | \
+ ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK)
/* TI TRNSB parity status */
#define ADF_GEN6_TI_TRNSB_PAR_STS 0x500648
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 202/869] crypto: amlogic - Fix IRQ handler return value and fallthrough logic
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 201/869] crypto: qat - fix error source for QAT GEN6 transmit interface faults Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 203/869] crypto: hisilicon/hpre - fix pointer dereference before length check Greg Kroah-Hartman
` (674 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamad Raizudeen, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
[ Upstream commit 4b8ae2732070c5669adee2d5d3bb97b14af53a63 ]
In meson_irq_handler(), when an interrupt matches a flow but the status
register is empty, the driver prints an error but doesn't return. It
falls through the loop and incorrectly prints an `unknown irq` message.
Fix this by returning immediately. For empty status registers, return
IRQ_NONE instead of IRQ_HANDLED to avoid masking spurious interrupts and
allow the kernel to detect interrupt storms. Also use
dev_err_ratelimited() to prevent console lockups during an interrupt
storm.
Additionally, the handler returned IRQ_HANDLED for genuinely unknown
interrupts. Return IRQ_NONE instead for unhandled interrupts.
Cc: stable@vger.kernel.org
Fixes: 48fe583fe5417 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/amlogic/amlogic-gxl-core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/amlogic/amlogic-gxl-core.c b/drivers/crypto/amlogic/amlogic-gxl-core.c
index 6cb33949915fe..7194117518b9d 100644
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -37,12 +37,13 @@ static irqreturn_t meson_irq_handler(int irq, void *data)
complete(&mc->chanlist[flow].complete);
return IRQ_HANDLED;
}
- dev_err(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+ dev_err_ratelimited(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+ return IRQ_NONE;
}
}
- dev_err(mc->dev, "%s %d from unknown irq\n", __func__, irq);
- return IRQ_HANDLED;
+ dev_err_ratelimited(mc->dev, "%s %d from unknown irq\n", __func__, irq);
+ return IRQ_NONE;
}
static struct meson_alg_template mc_algs[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 203/869] crypto: hisilicon/hpre - fix pointer dereference before length check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 202/869] crypto: amlogic - Fix IRQ handler return value and fallthrough logic Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 204/869] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer Greg Kroah-Hartman
` (673 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 9770bb7d335f8f8db01e99168bbdd9ce2cb6238c ]
In hpre_rsa_drop_leading_zeros(), the loop condition dereferences *ptr
before checking *len, causing an out-of-bounds read when *len is zero.
Swap to while (*len && !**ptr) to test length first.
Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 839c1f6771436..37d5f12e0ef1c 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -720,7 +720,7 @@ static void hpre_dh_exit_tfm(struct crypto_kpp *tfm)
static void hpre_rsa_drop_leading_zeros(const char **ptr, size_t *len)
{
- while (!**ptr && *len) {
+ while (*len && !**ptr) {
(*ptr)++;
(*len)--;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 204/869] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 203/869] crypto: hisilicon/hpre - fix pointer dereference before length check Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 205/869] crypto: hisilicon/hpre - fix ECDH destination DMA mapping Greg Kroah-Hartman
` (672 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 232804a5ed70a8ace32c46d341d438aeba54bc67 ]
hpre_ecdh_msg_request_set() returns -EINVAL when the output buffer
is too small, after setting req->dst_len to the required size.
-EINVAL is misleading because the caller can retry with a larger
buffer. Return -EOVERFLOW as other kpp implementations do.
Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 37d5f12e0ef1c..870b296d45b45 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1460,7 +1460,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
if (req->dst_len < ctx->key_sz << 1) {
req->dst_len = ctx->key_sz << 1;
- return -EINVAL;
+ return -EOVERFLOW;
}
tmp = kpp_request_ctx(req);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 205/869] crypto: hisilicon/hpre - fix ECDH destination DMA mapping
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 204/869] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 206/869] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent Greg Kroah-Hartman
` (671 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 12d8edda8cdb41d18c4891851e25bf58be6be995 ]
hpre_ecdh_dst_data_init() rejects valid requests whose output length
does not equal ctx->key_sz << 1, and maps the user buffer using the
user-provided len instead of the hardware transfer size. Drop the
redundant length check and use ctx->key_sz << 1 for dma_map_single()
so the whole hardware output is mapped.
Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 870b296d45b45..41fa978079780 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1520,13 +1520,13 @@ static int hpre_ecdh_dst_data_init(struct hpre_asym_request *hpre_req,
struct device *dev = ctx->dev;
dma_addr_t dma;
- if (unlikely(!data || !sg_is_last(data) || len != ctx->key_sz << 1)) {
- dev_err(dev, "data or data length is illegal!\n");
+ if (unlikely(!data || !sg_is_last(data))) {
+ dev_err(dev, "data is illegal!\n");
return -EINVAL;
}
hpre_req->dst = NULL;
- dma = dma_map_single(dev, sg_virt(data), len, DMA_FROM_DEVICE);
+ dma = dma_map_single(dev, sg_virt(data), ctx->key_sz << 1, DMA_FROM_DEVICE);
if (unlikely(dma_mapping_error(dev, dma))) {
dev_err(dev, "dma map data err!\n");
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 206/869] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 205/869] crypto: hisilicon/hpre - fix ECDH destination DMA mapping Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 207/869] crypto: qat - zero the VF migration state buffer on save Greg Kroah-Hartman
` (670 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 40ec9605cb195e065470f8f23ef94b1b541411a3 ]
The HPRE driver hard-codes GFP_ATOMIC for RSA/DH and GFP_KERNEL for
ECDH. This may cause "scheduling while atomic" in atomic context or
unnecessary allocation failures under memory pressure.
Select GFP flags dynamically based on CRYPTO_TFM_REQ_MAY_SLEEP and
store them in hpre_asym_request::flags. The areq field is a union of
rsa/dh/ecdh request pointers; reading base.flags through any union
member other than the one that was written would be type-punning, so
a dedicated flags field avoids that.
Fixes: 98dfa9343f37 ("crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 41fa978079780..af5d10add106c 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -138,6 +138,7 @@ struct hpre_asym_request {
int err;
hpre_cb cb;
struct timespec64 req_time;
+ u32 flags;
};
static inline unsigned int hpre_align_sz(void)
@@ -186,6 +187,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
struct scatterlist *data, unsigned int len,
int is_src, dma_addr_t *tmp)
{
+ gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
struct hpre_ctx *ctx = hpre_req->ctx;
struct device *dev = ctx->dev;
void *ptr;
@@ -195,7 +197,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
if (unlikely(shift < 0))
return -EINVAL;
- ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, GFP_ATOMIC);
+ ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, gfp);
if (unlikely(!ptr))
return -ENOMEM;
@@ -419,6 +421,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_rsa_cb;
h_req->areq.rsa = akreq;
+ h_req->flags = akreq->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
} else {
@@ -433,6 +436,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_dh_cb;
h_req->areq.dh = kreq;
+ h_req->flags = kreq->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
msg->key = cpu_to_le64(ctx->dh.dma_xa_p);
@@ -1467,6 +1471,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_ecdh_cb;
h_req->areq.ecdh = req;
+ h_req->flags = req->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
msg->in = cpu_to_le64(DMA_MAPPING_ERROR);
@@ -1485,6 +1490,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
struct scatterlist *data, unsigned int len)
{
+ gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
struct hpre_sqe *msg = &hpre_req->req;
struct hpre_ctx *ctx = hpre_req->ctx;
struct device *dev = ctx->dev;
@@ -1498,7 +1504,7 @@ static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
if (unlikely(shift < 0))
return -EINVAL;
- ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, GFP_KERNEL);
+ ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, gfp);
if (unlikely(!ptr))
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 207/869] crypto: qat - zero the VF migration state buffer on save
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 206/869] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 208/869] media: cec: extron: clear response tail before dispatch Greg Kroah-Hartman
` (669 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 5d504e65516dde8c88117378292e9c78f3d2cf58 ]
The QAT VF migration state buffer is allocated with kmalloc(), while
qat_vf_save_state() exposes all state_size bytes to userspace. The state
manager writes only the serialized sections, leaving the unused tail
unchanged. The first save can therefore disclose stale heap contents,
and subsequent saves can disclose data left by an earlier migration.
Zero the whole buffer before writing the setup data. Once the setup data
is present, preserve it and zero the remaining state area before each
state save.
Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
index adb21656a3ba8..91eff18a505b7 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
@@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev *mdev)
return ret;
}
+ memset(mdev->state + mdev->setup_size, 0,
+ mdev->state_size - mdev->setup_size);
+
adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size,
mdev->state_size - mdev->setup_size);
if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
@@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev *mdev)
if (mdev->setup_size)
return 0;
+ memset(mdev->state, 0, mdev->state_size);
+
adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size);
if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 208/869] media: cec: extron: clear response tail before dispatch
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 207/869] crypto: qat - zero the VF migration state buffer on save Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 209/869] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Greg Kroah-Hartman
` (668 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <hppiscas@163.com>
[ Upstream commit a601427f03e015e3d4d2ba44cfa6e0de144983b9 ]
The serial receive buffer is reused between responses. Terminating a
short response with one NUL leaves bytes from the previous response
behind it, while the dispatcher also checks fixed offsets beyond some
prefixes. Those checks can consume stale tail bytes.
Clear up to ten bytes at the end of each completed response, limited by
the remaining array capacity. This includes the terminator and covers
the dispatcher's fixed-offset tests without adding a separate length
condition to every prefix branch.
The issue was found by our static-analysis tool.
Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
Cc: stable@vger.kernel.org
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
index 48410ce33490c..638def4cb5691 100644
--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
+++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
@@ -846,7 +846,9 @@ static irqreturn_t extron_interrupt(struct serio *serio, unsigned char data,
return IRQ_HANDLED;
memcpy(extron->data, extron->buf, extron->idx);
extron->len = extron->idx;
- extron->data[extron->len] = 0;
+ /* Keep fixed-offset response tests from using stale tail bytes. */
+ memset(extron->data + extron->len, 0,
+ min_t(size_t, 10, sizeof(extron->data) - extron->len));
if (debug)
dev_info(extron->dev, "received %s\n", extron->data);
extron->idx = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 209/869] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 208/869] media: cec: extron: clear response tail before dispatch Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 210/869] media: marvell: manage the MMP camera clock provider Greg Kroah-Hartman
` (667 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cf896de36144391bcde1,
Hans Verkuil, Rohinthan P, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohinthan P <rokinthanp03@gmail.com>
[ Upstream commit 9ff738f93084351ed6e818d4d58679a9e9083a8d ]
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Cc: stable@vger.kernel.org
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: simplified the v4l2_ctrl_auto_cluster code a bit]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-ctrls-core.c | 12 ++++++++++--
include/media/v4l2-ctrls.h | 6 ++++++
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 02e2ae93d1764..579787f0be351 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2431,7 +2431,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2453,8 +2456,13 @@ void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!master)
+ return;
+
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index 31fc1bee3797b..b900734ee9c1c 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,9 @@ bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl);
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and just
+ * returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
@@ -845,6 +848,9 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols. The first control
* must be the 'auto' control (e.g. autogain, autoexposure, etc.)
+ *
+ * If controls[0] is NULL, then this function does nothing and just
+ * returns.
* @manual_val: The value for the first control in the cluster that equals the
* manual setting.
* @set_volatile: If true, then all controls except the first auto control will
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 210/869] media: marvell: manage the MMP camera clock provider
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 209/869] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 211/869] media: go7007: unregister the I2C adapter on USB probe failure Greg Kroah-Hartman
` (666 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 9887716132d6c3c58cc67841dfb441c5a4a0d209 ]
mmpcam_probe() registers an OF clock provider before requesting the IRQ.
Neither a later probe failure nor driver removal unregisters that provider,
although the underlying clock is registered with devm_clk_register().
This leaves the provider referring to a clock whose lifetime has ended.
Use devm_of_clk_add_hw_provider() with the existing mclk_hw so the provider
is unregistered before the managed clock and camera storage are released.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/marvell/mmp-driver.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/marvell/mmp-driver.c b/drivers/media/platform/marvell/mmp-driver.c
index d3da7ebb4a2be..4c31b62751a12 100644
--- a/drivers/media/platform/marvell/mmp-driver.c
+++ b/drivers/media/platform/marvell/mmp-driver.c
@@ -25,6 +25,7 @@
#include <linux/list.h>
#include <linux/pm.h>
#include <linux/clk.h>
+#include <linux/clk-provider.h>
#include "mcam-core.h"
@@ -269,8 +270,8 @@ static int mmpcam_probe(struct platform_device *pdev)
/*
* Add OF clock provider.
*/
- ret = of_clk_add_provider(pdev->dev.of_node, of_clk_src_simple_get,
- mcam->mclk);
+ ret = devm_of_clk_add_hw_provider(&pdev->dev, of_clk_hw_simple_get,
+ &mcam->mclk_hw);
if (ret) {
dev_err(&pdev->dev, "can't add DT clock provider\n");
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 211/869] media: go7007: unregister the I2C adapter on USB probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 210/869] media: marvell: manage the MMP camera clock provider Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 212/869] media: cx18: Disable PCI device on " Greg Kroah-Hartman
` (665 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 14165cd16fa7c233aec6a407b56b304e7a283911 ]
USB probe failures after I2C adapter registration free the backing
go7007 structure without unregistering the adapter.
If i2c_adapter_online is set, unregister the adapter before releasing
USB resources so that I2C client removal can still use its callbacks.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 59aea928d57f ("[media] go7007: don't continue if firmware can't be loaded")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index bf3cf320b2c9c..ad9cc44660dd3 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1326,6 +1326,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
return 0;
allocfail:
+ if (go->i2c_adapter_online)
+ i2c_del_adapter(&go->i2c_adapter);
go7007_usb_release(go);
kfree(go);
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 212/869] media: cx18: Disable PCI device on probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 211/869] media: go7007: unregister the I2C adapter on USB probe failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 213/869] media: tw68: balance PCI enable on cleanup Greg Kroah-Hartman
` (664 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 2aefbc29765641e1e1a26b96cee194ac7d34ff49 ]
cx18_setup_pci() enables the PCI device but does not disable it when
DMA mask setup or the memory-region reservation fails. Later probe
failure paths release the region without balancing the enable either.
Unwind the enable inside cx18_setup_pci() when that helper fails after
enabling the device. Once setup succeeds, disable it in the probe
cleanup after releasing the memory region. Setup failures skip that
cleanup, so each successful enable is balanced exactly once.
Keep the existing error codes and normal removal path unchanged.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx18/cx18-driver.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index 74c59a94b2b05..d3bd31e38efa4 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -806,12 +806,12 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
}
if (dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32))) {
CX18_ERR("No suitable DMA available, card %d\n", cx->instance);
- return -EIO;
+ goto err_disable_device;
}
if (!request_mem_region(cx->base_addr, CX18_MEM_SIZE, "cx18 encoder")) {
CX18_ERR("Cannot request encoder memory region, card %d\n",
cx->instance);
- return -EIO;
+ goto err_disable_device;
}
/* Enable bus mastering and memory mapped IO for the CX23418 */
@@ -835,6 +835,10 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
cx->pci_dev->irq, pci_latency, (u64)cx->base_addr);
return 0;
+
+err_disable_device:
+ pci_disable_device(pci_dev);
+ return -EIO;
}
static void cx18_init_subdevs(struct cx18 *cx)
@@ -1121,6 +1125,7 @@ static int cx18_probe(struct pci_dev *pci_dev,
cx18_iounmap(cx);
free_mem:
release_mem_region(cx->base_addr, CX18_MEM_SIZE);
+ pci_disable_device(pci_dev);
free_workqueues:
destroy_workqueue(cx->in_work_queue);
err:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 213/869] media: tw68: balance PCI enable on cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 212/869] media: cx18: Disable PCI device on " Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 214/869] media: adv7180: Initialize mutex before ancillary clients Greg Kroah-Hartman
` (663 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit fc02261fdca3ea95e4dcb6b38ab77f0f197c3750 ]
tw68_initdev() leaves the PCI device enabled after a later probe failure
or tw68_finidev(). Use pcim_enable_device() to balance the enable reference
when the driver is detached or probe fails.
The managed disable runs after the managed IRQ has been released.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: e15d1c12c587 ("[media] tw68: refactor and cleanup the tw68 driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/tw68/tw68-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index 08b7ce1043aaf..27ce670197cc3 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -228,7 +228,7 @@ static int tw68_initdev(struct pci_dev *pci_dev,
/* pci init */
dev->pci = pci_dev;
- if (pci_enable_device(pci_dev)) {
+ if (pcim_enable_device(pci_dev)) {
err = -EIO;
goto fail1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 214/869] media: adv7180: Initialize mutex before ancillary clients
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 213/869] media: tw68: balance PCI enable on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 215/869] media: au0828: Fix media device leak in au0828_usb_probe() Greg Kroah-Hartman
` (662 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9d46d17a65e86010b1f5604e5cf61ce1e197f77a ]
The VPP ancillary-client error path unregisters the CSI client before
destroying state->mutex. For I2P variants, the failure can occur before
mutex_init(), so cleanup destroys an uninitialized mutex.
Initialize the mutex immediately after allocating the driver state, before
creating any ancillary clients. This keeps every cleanup path matched with
a completed mutex initialization.
A QEMU x86_64 test using an i2c-stub bus instantiated an ADV7280 client
at address 0x21 and occupied its VPP ancillary address 0x42. This forced
i2c_new_ancillary_device() to return -EBUSY. An instrumentation oracle
observed an uninitialized mutex on the buggy kernel and an initialized
mutex on the fixed kernel. The failure was deliberately injected to
exercise the error path; no natural crash was observed.
Fixes: 851a54effbd8 ("[media] adv7180: Add I2P support")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 5cbc973df684d..6223911e324ae 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1425,6 +1425,7 @@ static int adv7180_probe(struct i2c_client *client)
if (state == NULL)
return -ENOMEM;
+ mutex_init(&state->mutex);
state->client = client;
state->field = V4L2_FIELD_ALTERNATE;
state->chip_info = i2c_get_match_data(client);
@@ -1466,7 +1467,6 @@ static int adv7180_probe(struct i2c_client *client)
}
state->irq = client->irq;
- mutex_init(&state->mutex);
state->curr_norm = V4L2_STD_NTSC;
state->input = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 215/869] media: au0828: Fix media device leak in au0828_usb_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 214/869] media: adv7180: Initialize mutex before ancillary clients Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 216/869] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() Greg Kroah-Hartman
` (661 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 7b7a69c91c0537d48150942d9707614a4fdd3766 ]
au0828_media_device_init() takes a reference to a media device with
media_device_usb_allocate(). When au0828_v4l2_device_register()
fails right after, the error path only unregisters the entities and
frees au0828_dev, so that reference is never released.
Release it with media_device_delete() on that path.
Fixes: 812658d88d26 ("media: change au0828 to use Media Device Allocator API")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/au0828/au0828-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
index 1e246b47766dd..c7ff52044bd25 100644
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -697,6 +697,10 @@ static int au0828_usb_probe(struct usb_interface *interface,
retval = au0828_v4l2_device_register(interface, dev);
if (retval) {
au0828_usb_v4l2_media_release(dev);
+#ifdef CONFIG_MEDIA_CONTROLLER
+ media_device_delete(dev->media_dev, KBUILD_MODNAME,
+ THIS_MODULE);
+#endif
mutex_unlock(&dev->lock);
kfree(dev);
return retval;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 216/869] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 215/869] media: au0828: Fix media device leak in au0828_usb_probe() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 217/869] media: vpif_display: " Greg Kroah-Hartman
` (660 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b00fbdad64d4ea7d594bc67988c1722fe5b3be50 ]
vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.
Release the reference with i2c_put_adapter() on the success path
and in the probe_subdev_out cleanup, and initialise i2c_adap so
that the cleanup is a no-op when the adapter was never acquired.
Fixes: 6ffefff5a9e7 ("V4L/DVB (12906c): V4L : vpif capture driver for DM6467")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/davinci/vpif_capture.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/ti/davinci/vpif_capture.c b/drivers/media/platform/ti/davinci/vpif_capture.c
index 9fbef24025744..5158417fe603e 100644
--- a/drivers/media/platform/ti/davinci/vpif_capture.c
+++ b/drivers/media/platform/ti/davinci/vpif_capture.c
@@ -1603,7 +1603,7 @@ vpif_capture_get_pdata(struct platform_device *pdev,
static int vpif_probe(struct platform_device *pdev)
{
struct vpif_subdev_info *subdevdata;
- struct i2c_adapter *i2c_adap;
+ struct i2c_adapter *i2c_adap = NULL;
int subdev_count;
int res_idx = 0;
int i, err;
@@ -1693,9 +1693,12 @@ static int vpif_probe(struct platform_device *pdev)
}
}
+ i2c_put_adapter(i2c_adap);
+
return 0;
probe_subdev_out:
+ i2c_put_adapter(i2c_adap);
v4l2_async_nf_cleanup(&vpif_obj.notifier);
/* free sub devices memory */
kfree(vpif_obj.sd);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 217/869] media: vpif_display: Fix i2c adapter reference leak in vpif_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 216/869] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 218/869] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock Greg Kroah-Hartman
` (659 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit f5863ea3f99265e5e297e3dcf0f47432fee2b8ac ]
vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.
Release the reference with i2c_put_adapter() on the success path and
in the probe_subdev_out cleanup.
Fixes: e7332e3a552f ("V4L/DVB (12176): davinci/vpif_display: Add VPIF display driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/davinci/vpif_display.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/ti/davinci/vpif_display.c b/drivers/media/platform/ti/davinci/vpif_display.c
index 1e7815e9f8e07..ba16370b70f98 100644
--- a/drivers/media/platform/ti/davinci/vpif_display.c
+++ b/drivers/media/platform/ti/davinci/vpif_display.c
@@ -1289,9 +1289,12 @@ static int vpif_probe(struct platform_device *pdev)
if (err)
goto probe_subdev_out;
+ i2c_put_adapter(i2c_adap);
+
return 0;
probe_subdev_out:
+ i2c_put_adapter(i2c_adap);
kfree(vpif_obj.sd);
vpif_unregister:
v4l2_device_unregister(&vpif_obj.v4l2_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 218/869] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 217/869] media: vpif_display: " Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 219/869] media: atmel-isi: release unregistered video device on remove Greg Kroah-Hartman
` (658 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Sinn, Sascha Hauer,
Dmitry Osipenko, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Sinn <lucas.sinn@wolfvision.net>
[ Upstream commit e8554ac860356f1f4cd9bce454271dce1ed35fc1 ]
hdmirx_get_detected_timings() divides the TMDS clock by
hdmirx_dev->color_depth, but nothing on its own path ever sets it. The
only producer is hdmirx_get_colordepth(), reached solely from
hdmirx_format_change() at the tail of hdmirx_wait_signal_lock().
VIDIOC_QUERY_DV_TIMINGS does not come through there. It only refuses to
proceed while signal_not_lock() is true, and that reads the lock state
straight out of the hardware, so it can already be false while the work
ending in hdmirx_format_change() has yet to run. Query the timings in
that window, on the first lock after a boot, and color_depth is still
zero from devm_kzalloc().
The division does not fault. do_div() is plain C on 64 bit and arm64
compiles it to udiv, which returns zero for a zero divisor. What comes
out is a pixelclock of zero, and a stitched output frame.
Read the colordepth where it is used instead.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lucas Sinn <lucas.sinn@wolfvision.net>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/synopsys/hdmirx/snps_hdmirx.c | 71 ++++++++++---------
1 file changed, 36 insertions(+), 35 deletions(-)
diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index dbbd33f5908e5..22a5e137f5b6d 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -154,7 +154,6 @@ struct snps_hdmirx_dev {
int num_clks;
u32 edid_blocks_written;
u32 cur_fmt_fourcc;
- u32 color_depth;
spinlock_t rst_lock; /* to lock register access */
u8 edid[EDID_NUM_BLOCKS_MAX * EDID_BLOCK_SIZE];
};
@@ -378,6 +377,38 @@ static void hdmirx_toggle_polarity(struct snps_hdmirx_dev *hdmirx_dev)
VPROC_HSYNC_POL_OVR_EN, 0);
}
+static u32 hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
+{
+ struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
+ u32 val, color_depth_reg, color_depth;
+
+ val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
+ color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
+
+ switch (color_depth_reg) {
+ case 0x4:
+ color_depth = 24;
+ break;
+ case 0x5:
+ color_depth = 30;
+ break;
+ case 0x6:
+ color_depth = 36;
+ break;
+ case 0x7:
+ color_depth = 48;
+ break;
+ default:
+ color_depth = 24;
+ break;
+ }
+
+ v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
+ __func__, color_depth, color_depth_reg);
+
+ return color_depth;
+}
+
/*
* When querying DV timings during preview, if the DMA's timing is stable,
* we retrieve the timings directly from the DMA. However, if the current
@@ -391,7 +422,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
struct v4l2_bt_timings *bt = &timings->bt;
u32 val, tmdsqpclk_freq, pix_clk;
unsigned int num_retries = 0;
- u32 field_type, deframer_st;
+ u32 field_type, deframer_st, color_depth;
u64 tmp_data, tmds_clk;
bool is_dvi_mode;
int ret;
@@ -412,10 +443,11 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
deframer_st = hdmirx_readl(hdmirx_dev, DEFRAMER_STATUS);
is_dvi_mode = !(deframer_st & OPMODE_STS_MASK);
+ color_depth = hdmirx_get_colordepth(hdmirx_dev);
tmdsqpclk_freq = hdmirx_readl(hdmirx_dev, CMU_TMDSQPCLK_FREQ);
tmds_clk = tmdsqpclk_freq * 4 * 1000;
tmp_data = tmds_clk * 24;
- do_div(tmp_data, hdmirx_dev->color_depth);
+ do_div(tmp_data, color_depth);
pix_clk = tmp_data;
bt->pixelclock = pix_clk;
@@ -427,7 +459,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
v4l2_dbg(2, debug, v4l2_dev, "tmds_clk:%llu, pix_clk:%d\n", tmds_clk, pix_clk);
v4l2_dbg(1, debug, v4l2_dev, "interlace:%d, fmt:%d, color:%d, mode:%s\n",
bt->interlaced, hdmirx_dev->pix_fmt,
- hdmirx_dev->color_depth,
+ color_depth,
is_dvi_mode ? "dvi" : "hdmi");
v4l2_dbg(2, debug, v4l2_dev, "deframer_st:%#x\n", deframer_st);
@@ -947,36 +979,6 @@ static void hdmirx_controller_init(struct snps_hdmirx_dev *hdmirx_dev)
VS_REMAPFILTER_EN_QST | VS_FILTER_ORDER_QST(0x3));
}
-static void hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
-{
- struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
- u32 val, color_depth_reg;
-
- val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
- color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
-
- switch (color_depth_reg) {
- case 0x4:
- hdmirx_dev->color_depth = 24;
- break;
- case 0x5:
- hdmirx_dev->color_depth = 30;
- break;
- case 0x6:
- hdmirx_dev->color_depth = 36;
- break;
- case 0x7:
- hdmirx_dev->color_depth = 48;
- break;
- default:
- hdmirx_dev->color_depth = 24;
- break;
- }
-
- v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
- __func__, hdmirx_dev->color_depth, color_depth_reg);
-}
-
static void hdmirx_get_pix_fmt(struct snps_hdmirx_dev *hdmirx_dev)
{
struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
@@ -1087,7 +1089,6 @@ static void hdmirx_format_change(struct snps_hdmirx_dev *hdmirx_dev)
};
hdmirx_get_pix_fmt(hdmirx_dev);
- hdmirx_get_colordepth(hdmirx_dev);
hdmirx_get_avi_infoframe(hdmirx_dev);
v4l2_dbg(1, debug, v4l2_dev, "%s: queue res_chg_event\n", __func__);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 219/869] media: atmel-isi: release unregistered video device on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 218/869] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 220/869] ASoC: fsl_xcvr: free IRQ before canceling reset work Greg Kroah-Hartman
` (657 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Eugen Hristev,
Sakari Ailus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit c0a6d78dad3af1def80f04df82bfd70456ec406c ]
atmel_isi_probe() allocates the video device before registering the
V4L2 async notifier. The video device is registered later from the
notifier complete callback once the remote subdevice has been bound.
The remove path relies on the notifier unbind callback to unregister
the video device. However, if the remote subdevice is never bound, or
the complete callback fails before video_register_device() succeeds,
the video device remains unregistered. In that case the unbind path
does not release the object allocated by video_device_alloc(), and the
remove path leaks it.
Only unregister the video device from the unbind callback when it has
actually been registered, and clear the driver pointer afterwards.
After unregistering and cleaning up the notifier, release the video
device directly if the pointer is still present. This covers devices
that were allocated but never registered while avoiding a second
release of successfully registered devices.
This issue was found by manual code inspection.
Fixes: d12c9088c0b2a ("[media] atmel-isi: remove dependency of the soc-camera framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/atmel/atmel-isi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
index a05a744cbb756..6a7e240c5b180 100644
--- a/drivers/media/platform/atmel/atmel-isi.c
+++ b/drivers/media/platform/atmel/atmel-isi.c
@@ -1121,10 +1121,13 @@ static void isi_graph_notify_unbind(struct v4l2_async_notifier *notifier,
{
struct atmel_isi *isi = notifier_to_isi(notifier);
+ if (!video_is_registered(isi->vdev))
+ return;
+
dev_dbg(isi->dev, "Removing %s\n", video_device_node_name(isi->vdev));
- /* Checks internally if vdev have been init or not */
video_unregister_device(isi->vdev);
+ isi->vdev = NULL;
}
static int isi_graph_notify_bound(struct v4l2_async_notifier *notifier,
@@ -1323,6 +1326,8 @@ static void atmel_isi_remove(struct platform_device *pdev)
pm_runtime_disable(&pdev->dev);
v4l2_async_nf_unregister(&isi->notifier);
v4l2_async_nf_cleanup(&isi->notifier);
+ if (isi->vdev)
+ video_device_release(isi->vdev);
v4l2_device_unregister(&isi->v4l2_dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 220/869] ASoC: fsl_xcvr: free IRQ before canceling reset work
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 219/869] media: atmel-isi: release unregistered video device on remove Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 221/869] memory: stm32_omm: fix child clock leak on set_amcr() error path Greg Kroah-Hartman
` (656 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Shengjiu Wang, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 83701fdb2d8d644c547773791da48d6ecb3a5e1d ]
irq0_isr() schedules work_rst on a preamble error, and reset_rx_work()
touches regmap. remove() cancels that work while the IRQ is still
registered, so the handler can queue it again during teardown. The IRQ
is also requested before INIT_WORK() and spin_lock_init(). Probe
failure does not call remove(), so freeing the IRQ leaves queued work
running, and an earlier interrupt schedules uninitialized work.
Initialize the lock and devm_work_autocancel() before the IRQ. Failed
probe then frees the IRQ and cancels the work. Unbind frees the IRQ
before cancel_work_sync() and pm_runtime_disable().
Fixes: 1e5d0f106164 ("ASoC: fsl_xcvr: reset RX dpath after wrong preamble")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://patch.msgid.link/20260923054017.93553-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_xcvr.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
index d7a823384c08a..08683f989cee2 100644
--- a/sound/soc/fsl/fsl_xcvr.c
+++ b/sound/soc/fsl/fsl_xcvr.c
@@ -3,6 +3,7 @@
#include <linux/bitrev.h>
#include <linux/clk.h>
+#include <linux/devm-helpers.h>
#include <linux/firmware.h>
#include <linux/interrupt.h>
#include <linux/module.h>
@@ -57,6 +58,7 @@ struct fsl_xcvr {
struct snd_aes_iec958 tx_iec958;
u8 cap_ds[FSL_XCVR_CAPDS_SIZE];
struct work_struct work_rst;
+ int irq;
spinlock_t lock; /* Protect hw_reset and trigger */
struct snd_pcm_hw_constraint_list spdif_constr_rates;
u32 spdif_constr_rates_list[SPDIF_NUM_RATES];
@@ -1555,7 +1557,7 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
struct fsl_xcvr *xcvr;
struct resource *rx_res, *tx_res;
void __iomem *regs;
- int ret, irq;
+ int ret;
xcvr = devm_kzalloc(dev, sizeof(*xcvr), GFP_KERNEL);
if (!xcvr)
@@ -1643,12 +1645,22 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
return dev_err_probe(dev, PTR_ERR(xcvr->reset),
"failed to get XCVR reset control\n");
+ /*
+ * irq0_isr() schedules work_rst. Prepare the work and its lock
+ * before the IRQ, and register the cancel action first so a failed
+ * probe frees the IRQ and then cancels any queued work.
+ */
+ spin_lock_init(&xcvr->lock);
+ ret = devm_work_autocancel(dev, &xcvr->work_rst, reset_rx_work);
+ if (ret)
+ return ret;
+
/* get IRQs */
- irq = platform_get_irq(pdev, 0);
- if (irq < 0)
- return irq;
+ xcvr->irq = platform_get_irq(pdev, 0);
+ if (xcvr->irq < 0)
+ return xcvr->irq;
- ret = devm_request_irq(dev, irq, irq0_isr, 0, pdev->name, xcvr);
+ ret = devm_request_irq(dev, xcvr->irq, irq0_isr, 0, pdev->name, xcvr);
if (ret)
return dev_err_probe(dev, ret, "failed to claim IRQ0\n");
@@ -1689,8 +1701,6 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
fsl_xcvr_comp.name);
}
- INIT_WORK(&xcvr->work_rst, reset_rx_work);
- spin_lock_init(&xcvr->lock);
return ret;
}
@@ -1698,6 +1708,8 @@ static void fsl_xcvr_remove(struct platform_device *pdev)
{
struct fsl_xcvr *xcvr = dev_get_drvdata(&pdev->dev);
+ /* Free the IRQ first so irq0_isr() cannot requeue work_rst. */
+ devm_free_irq(&pdev->dev, xcvr->irq, xcvr);
cancel_work_sync(&xcvr->work_rst);
pm_runtime_disable(&pdev->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 221/869] memory: stm32_omm: fix child clock leak on set_amcr() error path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 220/869] ASoC: fsl_xcvr: free IRQ before canceling reset work Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 222/869] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names Greg Kroah-Hartman
` (655 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Fernando Mancera Gomez,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
[ Upstream commit a22355280361d2a376a2020059a2bae11e6cea10 ]
When the mux is enabled, stm32_omm_configure() enables the two OSPI
child clocks via stm32_omm_toggle_child_clock(dev, true); they are meant
to stay enabled for the device's lifetime and are disabled again in
stm32_omm_remove() and on the devm_of_platform_populate() error path.
However, if the subsequent stm32_omm_set_amcr() call fails, the function
jumps to the "error:" label which only calls pm_runtime_put_sync_suspend()
before returning, leaving the two child clocks enabled. As this happens
during probe, the error is propagated and .remove() is never called, so
the clock enable references are leaked. devm_clk_bulk_get() only releases
the clock handles on unwind, it does not undo clk_prepare_enable().
Disable the child clocks on the set_amcr() error path, mirroring the
cleanup already done on the devm_of_platform_populate() failure path.
Fixes: 8181d061dcff ("memory: Add STM32 Octo Memory Manager driver")
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Link: https://patch.msgid.link/20260917235925.44185-1-diegomancera.dev@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/stm32_omm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/memory/stm32_omm.c b/drivers/memory/stm32_omm.c
index 2a1af229d2444..faef903342495 100644
--- a/drivers/memory/stm32_omm.c
+++ b/drivers/memory/stm32_omm.c
@@ -275,6 +275,8 @@ static int stm32_omm_configure(struct device *dev)
writel_relaxed(omm->cr, omm->io_base + OMM_CR);
ret = stm32_omm_set_amcr(dev, true);
+ if (ret && (mux & CR_MUXEN))
+ stm32_omm_toggle_child_clock(dev, false);
error:
pm_runtime_put_sync_suspend(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 222/869] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 221/869] memory: stm32_omm: fix child clock leak on set_amcr() error path Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 223/869] arm64: dts: freescale: imx8mp-verdin-ivy: " Greg Kroah-Hartman
` (654 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 28cec01a2be2cf1e20aabd435f250f665ce24c8e ]
gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.
GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.
Fixes: adca46171ff7 ("arm64: dts: freescale: imx8mm-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
index 29075ff5eda63..b64751aa31d50 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
@@ -270,8 +270,8 @@ &gpio3 {
"",
"",
"",
- "DIG_1", /* SODIMM 56 */
- "DIG_2", /* SODIMM 58 */
+ "DIGI_1", /* SODIMM 56 */
+ "DIGI_2", /* SODIMM 58 */
"REL1", /* SODIMM 60 */
"REL2", /* SODIMM 62 */
"", /* 10 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 223/869] arm64: dts: freescale: imx8mp-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 222/869] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 224/869] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo Greg Kroah-Hartman
` (653 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit cb45264c27fad31f7c58fbb1a5c2f7ec16018dae ]
gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.
GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.
Fixes: b98948b04295 ("arm64: dts: freescale: imx8mp-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
index db1b4ee7728c0..bf021e85cfc94 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
@@ -333,8 +333,8 @@ &gpio3 {
"",
"",
"",
- "DIG_1", /* SODIMM 56 */
- "DIG_2", /* SODIMM 58 */
+ "DIGI_1", /* SODIMM 56 */
+ "DIGI_2", /* SODIMM 58 */
"REL1", /* SODIMM 60 */
"REL2", /* SODIMM 62 */
"", /* 10 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 224/869] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 223/869] arm64: dts: freescale: imx8mp-verdin-ivy: " Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 225/869] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs Greg Kroah-Hartman
` (652 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 90bc5a53c7f0733ec37a5c041b4e1aefa3d8d965 ]
gpio3's gpio-line-names has "SLEEP#" instead of "SMARC_SLEEP#" for the
SMARC SLEEP# connector signal, while the gpio-keys node driven by the
very same GPIO line already labels it "SMARC_SLEEP#", and the imx95
Toradex SMARC variant names the equivalent line "SMARC_SLEEP#" too.
GPIO line names are meant to be stable across the whole Toradex SMARC
family, using the official SMARC-connector signal names from the
SMARC specification and the SoM datasheet's pin assignment table, so
userspace GPIO tooling that looks up a line by name works the same on
any Toradex SMARC board.
Fixes: 97dc91c04558 ("arm64: dts: freescale: add Toradex SMARC iMX8MP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
index bebe19eb360f8..576da7875601f 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
@@ -323,7 +323,7 @@ &gpio3 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_lvds_dsi_sel>;
gpio-line-names = "ETH_0_INT#", /* 0 */
- "SLEEP#",
+ "SMARC_SLEEP#",
"",
"",
"",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 225/869] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 224/869] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 226/869] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical Greg Kroah-Hartman
` (651 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit f377ac5999a5d045168ddd25d204691c6653c06a ]
pinctrl_gpios_ext_yavia (SODIMM 64/66) is defined but never applied to
gpio3, so those pins stay at their NAND reset function instead of GPIO.
Fix SODIMM 64 to the correct pad, MX8MP_IOMUXC_NAND_READY_B (GPIO3_IO16).
Fixes: b694fbe2ff40 ("arm64: dts: imx8mp-verdin: Add yavia carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
index cc389cda2af2e..20d99012d4f32 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
@@ -117,6 +117,11 @@ &flexcan1 {
status = "okay";
};
+&gpio3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpios_ext_yavia>;
+};
+
&gpio4 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_ctrl_sleep_moci>;
@@ -262,7 +267,7 @@ MX8MP_IOMUXC_NAND_DATA03__GPIO3_IO09 0x106 /* SODIMM 62 */
pinctrl_gpios_ext_yavia: gpiosextyaviagrp {
fsl,pins = <
- MX8MP_IOMUXC_NAND_CE1_B__GPIO3_IO02 0x106 /* SODIMM 64 */
+ MX8MP_IOMUXC_NAND_READY_B__GPIO3_IO16 0x106 /* SODIMM 64 */
MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x106 /* SODIMM 66 */
>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 226/869] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 225/869] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 227/869] drm/panel: ebbg-ft8719: Set prepare_prev_first Greg Kroah-Hartman
` (650 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Konrad Dybcio,
Mieczyslaw Nalewaj, Stanislaw Pal, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
[ Upstream commit 33f9cb56cc28d002511e471be74f8ff241984178 ]
On IPQ5018, the APCS core clock feeds the CPUs. It can use
different clocks as its parent, but during system boot it
utilizes GPLL0.
Under some cicumstances, the 'gpll0_main' clock is getting
disabled during kernel start which results in a system hang
then the hardware watchdog restarts the board after a while.
This can happen when a driver gets a clock in its probe function,
then releases it either directly or by devres cleanup on probe
failure.
For example, since v6.18 the kernel often fails to boot on the
TP-Link Archer AX55 v1 board by using the in-tree dts. In the
failing configuration, the 'ipq-cmn-pll' driver is built into
the kernel and the problem is caused by the pm_runtim_put()
call in the ipq_cmn_pll_clk_probe() function. Due to this call,
runtime pm disables the 'gcc_cmn_blk_ahb_clk' clock asynchronously
which results in disabling 'gpll0_main' as well.
Mark the clock as critical in order to avoid such hangs.
Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Tested-by: Stanislaw Pal <kuncy7@gmail.com>
Link: https://lore.kernel.org/r/20260918-ipq5018-mark-gpll0_main-critical-v1-1-fbe8f27a0106@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5018.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index 64792cda06202..e2d01cdc39c96 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -69,6 +69,15 @@ static struct clk_alpha_pll gpll0_main = {
.parent_data = gcc_xo_data,
.num_parents = ARRAY_SIZE(gcc_xo_data),
.ops = &clk_alpha_pll_stromer_ops,
+ /*
+ * During system boot, this PLL feeds the CPUs.
+ * Mark it as critical to ensure that CCF does
+ * not disable it, even if there are no active
+ * consumers. This is needed to avoid a system
+ * hang caused by turning off the clock driving
+ * the CPUs.
+ */
+ .flags = CLK_IS_CRITICAL,
},
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 227/869] drm/panel: ebbg-ft8719: Set prepare_prev_first
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 226/869] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 228/869] mfd: da903x: Cancel IRQ work during teardown Greg Kroah-Hartman
` (649 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Casey Connolly, Marco Mattiolo,
Neil Armstrong, David Heidelberg, Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Connolly <casey.connolly@linaro.org>
[ Upstream commit 4eeeac9d7c3600a6cae75b2a7bc9c5b67530923c ]
This corrects the host initialisation sequence so that we can send
DSI/DCS commands in prepare().
Cc: stable@vger.kernel.org
Fixes: b00de0e237da ("drm/panel: introduce ebbg,ft8719 panel")
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Tested-by: Marco Mattiolo <marco.mattiolo@hotmail.it>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260908-ebbg-ft8719-fixups-v2-1-5454ae1f5581@ixit.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-ebbg-ft8719.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
index fb9f9f42be4f2..1ab09c50a6306 100644
--- a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
+++ b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
@@ -198,6 +198,8 @@ static int ebbg_ft8719_probe(struct mipi_dsi_device *dsi)
dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
MIPI_DSI_CLOCK_NON_CONTINUOUS;
+ ctx->panel.prepare_prev_first = true;
+
ret = drm_panel_of_backlight(&ctx->panel);
if (ret)
return dev_err_probe(dev, ret, "Failed to get backlight\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 228/869] mfd: da903x: Cancel IRQ work during teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 227/869] drm/panel: ebbg-ft8719: Set prepare_prev_first Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 229/869] mfd: Fix MAX77705 dependency on regmap Greg Kroah-Hartman
` (648 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Hongyan Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit fd2258999ecdc7164ef0cda2d4102e4558a5660f ]
The IRQ handler disables the IRQ and schedules irq_work. Releasing the
IRQ does not drain that work, which can continue to use the devm-allocated
chip and notifier state.
Manage both IRQ-work cancellation and subdevice removal with devres.
Register the subdevice-removal action before requesting the IRQ, then add
the IRQ-work action after the request. This avoids leaving a live IRQ
without work cancellation if action registration fails. Devres cleanup
then disables the IRQ and drains the work before releasing the IRQ and
removing child devices. Register both actions before creating the children
so partial probe failures use the same ordering.
This issue was found by the author's in-house static analysis tool.
The patch was reviewed by the author against the latest mainline tree.
Fixes: 26b8f5e1e2d1 ("mfd: add base support for Dialog DA9030/DA9034 PMICs")
Cc: stable@vger.kernel.org
Suggested-by: Lee Jones <lee@kernel.org>
Assisted-by: Codex:GPT-5
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260814153019.1114-1-getshell@seu.edu.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da903x.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index e86b39de3303a..e4ad48e1f139b 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
return IRQ_HANDLED;
}
+static void da903x_cancel_irq_work(void *data)
+{
+ struct da903x_chip *chip = data;
+
+ disable_irq(chip->client->irq);
+ cancel_work_sync(&chip->irq_work);
+}
+
static const struct da903x_chip_ops da903x_ops[] = {
[0] = {
.init_chip = da9030_init_chip,
@@ -456,6 +464,13 @@ static int da903x_remove_subdevs(struct da903x_chip *chip)
return device_for_each_child(chip->dev, NULL, __remove_subdev);
}
+static void da903x_remove_subdevs_action(void *data)
+{
+ struct da903x_chip *chip = data;
+
+ da903x_remove_subdevs(chip);
+}
+
static int da903x_add_subdevs(struct da903x_chip *chip,
struct da903x_platform_data *pdata)
{
@@ -484,7 +499,6 @@ static int da903x_add_subdevs(struct da903x_chip *chip,
return 0;
failed:
- da903x_remove_subdevs(chip);
return ret;
}
@@ -520,6 +534,11 @@ static int da903x_probe(struct i2c_client *client)
chip->ops->mask_events(chip, chip->events_mask);
chip->ops->read_events(chip, &tmp);
+ ret = devm_add_action_or_reset(&client->dev,
+ da903x_remove_subdevs_action, chip);
+ if (ret)
+ return ret;
+
ret = devm_request_irq(&client->dev, client->irq, da903x_irq_handler,
IRQF_TRIGGER_FALLING,
"da903x", chip);
@@ -529,14 +548,12 @@ static int da903x_probe(struct i2c_client *client)
return ret;
}
- return da903x_add_subdevs(chip, pdata);
-}
-
-static void da903x_remove(struct i2c_client *client)
-{
- struct da903x_chip *chip = i2c_get_clientdata(client);
+ ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
+ chip);
+ if (ret)
+ return ret;
- da903x_remove_subdevs(chip);
+ return da903x_add_subdevs(chip, pdata);
}
static struct i2c_driver da903x_driver = {
@@ -544,7 +561,6 @@ static struct i2c_driver da903x_driver = {
.name = "da903x",
},
.probe = da903x_probe,
- .remove = da903x_remove,
.id_table = da903x_id_table,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 229/869] mfd: Fix MAX77705 dependency on regmap
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 228/869] mfd: da903x: Cancel IRQ work during teardown Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 230/869] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" Greg Kroah-Hartman
` (647 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 2fdae2d590a0a5ad4cd60bf8e7a6ecba7265f268 ]
The max77705 uses devm_regmap_add_irq_chip(), so add REGMAP_IRQ
and REGMAP_I2C to what the core driver selects in order to provide
these APIs.
This fixes a build error:
drivers/mfd/max77705.o: in function `max77705_i2c_probe':
max77705.c:(.text+0x250): undefined reference to `devm_regmap_add_irq_chip'
Cc: stable@vger.kernel.org
Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260827-deps-reg-max77705-v1-1-c83a74d3d428@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/Kconfig | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 55a9fea95195b..ae39cbf317107 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -989,6 +989,8 @@ config MFD_MAX77705
depends on I2C
select MFD_CORE
select MFD_SIMPLE_MFD_I2C
+ select REGMAP_I2C
+ select REGMAP_IRQ
help
Say yes here to add support for Maxim Integrated MAX77705 PMIC.
This is a Power Management IC with Charger, safe LDOs, Flash, Haptic
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 230/869] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 229/869] mfd: Fix MAX77705 dependency on regmap Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 231/869] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral Greg Kroah-Hartman
` (646 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit b296be1dc008fe3a536341afae01f66bb302e67f ]
The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v2-1-189cff560a28@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wcd934x.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..7bea64fc09562 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -2,6 +2,7 @@
// Copyright (c) 2019, Linaro Limited
#include <linux/clk.h>
+#include <linux/dma-mapping.h>
#include <linux/gpio/consumer.h>
#include <linux/interrupt.h>
#include <linux/kernel.h>
@@ -217,6 +218,11 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
struct gpio_desc *reset_gpio;
int ret;
+ ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Failed to set DMA mask\n");
+
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 231/869] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 230/869] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 232/869] hwmon: (k10temp) Stop matching Hygon devices Greg Kroah-Hartman
` (645 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, David Heidelberg, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit dcf0e640b553d33512fbcaedb909c32ba9636a64 ]
ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.
This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.
Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v3-1-d3920c6563c4@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wcd934x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 7bea64fc09562..d57796933d873 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -229,7 +229,7 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
- return dev_err_probe(ddata->dev, ddata->irq,
+ return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
ddata->extclk = devm_clk_get(dev, "extclk");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 232/869] hwmon: (k10temp) Stop matching Hygon devices
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 231/869] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 233/869] perf loongarch: Fix discarded const qualifier in _get_field() Greg Kroah-Hartman
` (644 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Wang, Guenter Roeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Wang <wanglin@open-hieco.net>
[ Upstream commit 08e6615c909b2504a5862764f3a7fca00c7ab066 ]
k10temp matches the Hygon F3 device, but derives the node passed to
amd_smn_read() from the F3 PCI slot using the AMD fixed-slot mapping
(slot - 0x18). Hygon PCI slots do not encode DF node identity, and
their SMN roots are grouped by socket.
The derived node number therefore cannot identify a valid Hygon SMN
target or provide usable temperature monitoring. Removing the match
does not disable a working monitoring path.
Remove the Hygon PCI match and Family 0x18 branch. Hygon temperature
monitoring will use the Hygon node and SMN interfaces in a separate
series.
Fixes: d93217d84c6c ("hwmon: (k10temp) Add Hygon Dhyana support")
Cc: stable@vger.kernel.org
Signed-off-by: Lin Wang <wanglin@open-hieco.net>
Link: https://patch.msgid.link/20260921055603.25112-6-wanglin@open-hieco.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/k10temp.rst | 8 +++-----
drivers/hwmon/k10temp.c | 5 ++---
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/Documentation/hwmon/k10temp.rst b/Documentation/hwmon/k10temp.rst
index 91b99adc6c487..9680c4f3383c3 100644
--- a/Documentation/hwmon/k10temp.rst
+++ b/Documentation/hwmon/k10temp.rst
@@ -28,8 +28,6 @@ Supported chips:
* AMD Family 17h processors: "Zen", "Zen 2"
-* AMD Family 18h processors: "Hygon Dhyana"
-
* AMD Family 19h processors: "Zen 3"
Prefix: 'k10temp'
@@ -128,7 +126,7 @@ it.
Models from 17h family report relative temperature, the driver aims to
compensate and report the real temperature.
-On Family 17h and Family 18h CPUs, additional temperature sensors may report
-Core Complex Die (CCD) temperatures. Up to 8 such temperatures are reported
-as temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU
+On Family 17h CPUs, additional temperature sensors may report Core Complex
+Die (CCD) temperatures. Up to 8 such temperatures are reported as
+temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU
variant.
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index b98d5ec72c4ff..15a0518ff209a 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -65,7 +65,7 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
#define F15H_M60H_HARDWARE_TEMP_CTRL_OFFSET 0xd8200c64
#define F15H_M60H_REPORTED_TEMP_CTRL_OFFSET 0xd8200ca4
-/* Common for Zen CPU families (Family 17h and 18h and 19h and 1Ah) */
+/* Common for Zen CPU families (Family 17h, 19h and 1Ah) */
#define ZEN_REPORTED_TEMP_CTRL_BASE 0x00059800
#define ZEN_CCD_TEMP(offset, x) (ZEN_REPORTED_TEMP_CTRL_BASE + \
@@ -464,7 +464,7 @@ static int k10temp_probe(struct pci_dev *pdev, const struct pci_device_id *id)
data->read_tempreg = read_tempreg_pci;
}
- if (boot_cpu_data.x86 == 0x17 || boot_cpu_data.x86 == 0x18) {
+ if (boot_cpu_data.x86 == 0x17) {
switch (boot_cpu_data.x86_model) {
case 0x1: /* Zen */
case 0x8: /* Zen+ */
@@ -567,7 +567,6 @@ static const struct pci_device_id k10temp_id_table[] = {
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
- { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
{}
};
MODULE_DEVICE_TABLE(pci, k10temp_id_table);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 233/869] perf loongarch: Fix discarded const qualifier in _get_field()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 232/869] hwmon: (k10temp) Stop matching Hygon devices Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 234/869] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Greg Kroah-Hartman
` (643 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Namhyung Kim, Bibo Mao, Huacai Chen, Arnaldo Carvalho de Melo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit ed1293302f811fa709897d4a90ad78592938e4aa ]
When building perf on LoongArch, the following compilation errors occur:
CC arch/loongarch/util/header.o
arch/loongarch/util/header.c: In function '_get_field':
arch/loongarch/util/header.c:31:15: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
31 | line2 = strrchr(line, ' ');
| ^
arch/loongarch/util/header.c:36:12: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
36 | nl = strrchr(line, '\n');
| ^
cc1: all warnings being treated as errors
Declare 'line2' and 'nl' as const char * to ensure type safety. In modern
glibc versions, strrchr() returns a 'const char *' if the input string is
const.
This is similar to commit 7378b6656aa4 ("perf riscv: Fix discarded const
qualifier in _get_field()").
Fixes: 492ac37fa38faf52 ("perf kvm: Add kvm-stat for loongarch64")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--git a/tools/perf/arch/loongarch/util/header.c b/tools/perf/arch/loongarch/util/header.c
index 0c6d823334a21..46f53a74f71e8 100644
--- a/tools/perf/arch/loongarch/util/header.c
+++ b/tools/perf/arch/loongarch/util/header.c
@@ -26,7 +26,7 @@
static char *_get_field(const char *line)
{
- char *line2, *nl;
+ const char *line2, *nl;
line2 = strrchr(line, ' ');
if (!line2)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 234/869] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 233/869] perf loongarch: Fix discarded const qualifier in _get_field() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 235/869] kobject: fix out-of-bounds access in kobject_action_type() Greg Kroah-Hartman
` (642 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+6646318bbcf419411bc5,
Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit ff1227f70eead8704ecfec69259fb4c041f92cda ]
Syzbot reported a deadlock between nilfs_evict_inode(), executed via
an asynchronous workqueue (kworker) as:
process_one_work()
process_scheduled_works()
nilfs_iput_work_func()
nilfs_dispose_list()
iput()
iput_final()
evict()
s_op->evict_inode()
nilfs_evict_inode()
and find_inode(), called via
nilfs_mkdir()
nilfs_new_inode()
nilfs_insert_inode_locked()
insert_inode_locked4()
inode_insert5()
find_inode()
When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears its
ifile bitmap entry and then synchronously triggers the log writer via
nilfs_transaction_commit() if IS_SYNC(inode) is true.
If a concurrent directory creation via nilfs_new_inode() attempts to
allocate the same newly freed inode number, however, find_inode() called
just before inserting it into the inode hash, blocks waiting for the old
inode's evict() to complete.
Meanwhile, the synchronous log writer invoked from nilfs_evict_inode()
tries to acquire a write lock on 'ns_segctor_sem' which is read locked
by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
resulting in a deadlock.
The synchronous log writer invocation from nilfs_evict_inode() is a
legacy artifact; it is no longer necessary because the call itself
(triggered by iput()) is now handled asynchronously with a kworker
if i_nlink == 0. It merely increases the risk of deadlock.
Fix this deadlock by removing the synchronous log writer trigger from
nilfs_evict_inode().
Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor over I_SYNC flag")
Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/inode.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 1099864acabcb..16e3745ce6e96 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -897,13 +897,7 @@ void nilfs_evict_inode(struct inode *inode)
nilfs_clear_inode(inode);
- if (IS_SYNC(inode))
- nilfs_set_transaction_flag(NILFS_TI_SYNC);
nilfs_transaction_commit(sb);
- /*
- * May construct a logical segment and may fail in sync mode.
- * But delete_inode has no return value.
- */
}
int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 235/869] kobject: fix out-of-bounds access in kobject_action_type()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 234/869] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 236/869] ASoC: Intel: atom: Fix platform device leak on probe failure Greg Kroah-Hartman
` (641 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jiacheng Xu,
Vishal Moola (Fractile), Danilo Krummrich, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiacheng Xu <stitch@zju.edu.cn>
[ Upstream commit d516455c940555566642b975d1835c67f08136b3 ]
kobject_action_type() compares the input against each known action
using strncmp() and then indexes the action string using count_first
to check for an exact-length match.
An embedded NUL can make strncmp() return zero even when count_first
exceeds the length of the action string. For example, the five-byte
input "add\0X" makes the parser access kobject_actions[KOBJ_ADD][5],
which is beyond the end of the "add" string.
Check the action string length with strlen() instead of indexing it
with the input-derived offset. This rejects malformed action strings
containing embedded NUL bytes with -EINVAL instead of invoking
undefined behavior.
Cc: stable@kernel.org
Fixes: 60a96a59569b ("Driver core: accept all valid action-strings in uevent-trigger")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Link: https://patch.msgid.link/20260920053726.22626-1-stitch@zju.edu.cn
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/kobject_uevent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 5a2480467ab98..bdc2720b7aac5 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
if (strncmp(kobject_actions[action], buf, count_first) != 0)
continue;
- if (kobject_actions[action][count_first] != '\0')
+ if (strlen(kobject_actions[action]) != count_first)
continue;
if (args)
*args = args_start;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 236/869] ASoC: Intel: atom: Fix platform device leak on probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 235/869] kobject: fix out-of-bounds access in kobject_action_type() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 237/869] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls Greg Kroah-Hartman
` (640 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit dcc36d766dc82bc57cd730915d484119befcfca8 ]
sst_acpi_probe() registers platform devices for the SST platform and
machine board using platform_device_register_data(), but does not
unregister them when later probe steps fail.
Fixes: caf94ed8629a ("ASoC: Intel: bytcr_rt5640: fixup DAI codec_name with HID")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924134932.1590967-1-lgs201920130244@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/atom/sst/sst_acpi.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 2571806304755..92a68dbd841ed 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -253,6 +253,11 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
return 0;
}
+static void sst_unregister_platform_device(void *data)
+{
+ platform_device_unregister(data);
+}
+
static int sst_acpi_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -341,7 +346,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
pdata->platform);
return PTR_ERR(plat_dev);
}
-
+ ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+ plat_dev);
+ if (ret)
+ return ret;
/*
* Create platform device for sst machine driver,
* pass machine info as pdata
@@ -354,6 +362,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
return PTR_ERR(mdev);
}
+ ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+ mdev);
+ if (ret)
+ return ret;
/* Fill sst platform data */
ctx->pdata = pdata;
strcpy(ctx->firmware_name, mach->fw_filename);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 237/869] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 236/869] ASoC: Intel: atom: Fix platform device leak on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 238/869] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws Greg Kroah-Hartman
` (639 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junjie Cao, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
[ Upstream commit 0bc42544a4a06e8d76eb412d2b1414db910a311d ]
rt712_sdca_dmic_set_gain_get() and rt712_sdca_dmic_set_gain_put() take
the component drvdata as struct rt712_sdca_priv, but this driver stores
a struct rt712_sdca_dmic_priv.
regmap and mbq_regmap are at the same offsets in both structs, so the
register accesses work. slave is not: rt712_sdca_priv has dmic_component
in front of it, so its slave overlays rt712_sdca_dmic_priv's params,
which this driver never writes. When regmap_write() fails in the put
handler, dev_err() is called with &NULL->dev (RSI below):
rt712-sdca-dmic sdw:0:3:025d:1713:01: Defer on undeferrable control: 40800f13
BUG: kernel NULL pointer dereference, address: 0000000000000058
RIP: 0010:__dev_printk+0x10/0x70
RDX: ffffcdac45f83cd0 RSI: 0000000000000008 RDI: ffffffffa09cb5cb
Call Trace:
_dev_err+0x7f/0x99
rt712_sdca_dmic_set_gain_put.cold+0x20/0x25 [snd_soc_rt712_sdca_dmic]
snd_ctl_elem_write+0x19a/0x1f0 [snd]
snd_ctl_ioctl+0x658/0x8a0 [snd]
Seen on a Dell Precision 5690 running 7.2.5-200.fc44, with alsactl
writing the control during boot. Compile-tested only.
Fixes: 63a511284c9e ("ASoC: rt712-sdca: Add RT712 SDCA driver for Mic topology")
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2532834
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20260920024232.710189-1-junjie.cao@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt712-sdca-dmic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt712-sdca-dmic.c b/sound/soc/codecs/rt712-sdca-dmic.c
index bc5b872f1e42f..bbbea9af73cd2 100644
--- a/sound/soc/codecs/rt712-sdca-dmic.c
+++ b/sound/soc/codecs/rt712-sdca-dmic.c
@@ -247,7 +247,7 @@ static int rt712_sdca_dmic_set_gain_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol)
{
struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
- struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+ struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
struct rt712_sdca_dmic_kctrl_priv *p =
(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
unsigned int regvalue, ctl, i;
@@ -278,7 +278,7 @@ static int rt712_sdca_dmic_set_gain_put(struct snd_kcontrol *kcontrol,
struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
struct rt712_sdca_dmic_kctrl_priv *p =
(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
- struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+ struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
unsigned int gain_val[4];
unsigned int i, adc_vol_flag = 0, changed = 0;
unsigned int regvalue[4];
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 238/869] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 237/869] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 239/869] regulator: core: Fix coupled regulators reference leak on removal Greg Kroah-Hartman
` (638 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Brian Masney,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit b4243850393f2f24e21b9f4b2c56233e60c904b4 ]
Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in ap_cpu_clock_probe(), which reads .hws[] to skip clusters
that have already been set up and writes it inside the CPU node loop,
but only assigns .num after the loop. With CONFIG_UBSAN_BOUNDS and a
compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this
triggers an array-index-out-of-bounds report during probe of the AP806
and AP807 CPU clocks, and with CONFIG_UBSAN_TRAP the first access traps.
Initialize .num with nclusters, the number of elements .hws[] was
allocated with, right after the allocation. For the in-tree AP806 and
AP807 device trees, which list the CPU nodes in ascending order, this is
exactly the value the old assignment produced. It is also the correct
value for any other node order, since of_clk_hw_onecell_get() rejects
indices at or beyond .num.
Cc: stable@vger.kernel.org
Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mvebu/ap-cpu-clk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c
index 1e44ace7d9519..ed3ca59e0ee97 100644
--- a/drivers/clk/mvebu/ap-cpu-clk.c
+++ b/drivers/clk/mvebu/ap-cpu-clk.c
@@ -284,6 +284,8 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
if (!ap_cpu_data)
return -ENOMEM;
+ ap_cpu_data->num = nclusters;
+
for_each_of_cpu_node(dn) {
char *clk_name = "cpu-cluster-0";
struct clk_init_data init;
@@ -333,8 +335,6 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
ap_cpu_data->hws[cluster_index] = &ap_cpu_clk[cluster_index].hw;
}
- ap_cpu_data->num = cluster_index + 1;
-
ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, ap_cpu_data);
if (ret)
dev_err(dev, "failed to register OF clock provider\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 239/869] regulator: core: Fix coupled regulators reference leak on removal
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 238/869] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 240/869] hwmon: (lm95245) Fix negative temperature conversion Greg Kroah-Hartman
` (637 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b9205f0837ca91a0bbe6aa9002207656840c1406 ]
of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented and regulator_resolve_coupling() stores it
in coupling_desc.coupled_rdevs[]. regulator_remove_coupling() clears
those pointers without dropping the references, so they are leaked when
the couple is torn down.
Release the reference of each coupled regulator while removing the
coupling.
Fixes: d3d64537c339 ("regulator: core: Resolve coupled regulators")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917143052.2156903-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e2328539b9fdc..bb0b7268b2b58 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5707,6 +5707,8 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
c_desc->coupled_rdevs[i] = NULL;
c_desc->n_resolved--;
+
+ put_device(&c_rdev->dev);
}
if (coupler && coupler->detach_regulator) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 240/869] hwmon: (lm95245) Fix negative temperature conversion
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 239/869] regulator: core: Fix coupled regulators reference leak on removal Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 241/869] fuse: dont drop destination page cache on a zero byte copy reply Greg Kroah-Hartman
` (636 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridham Khurana, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <khurana.ridham222@gmail.com>
[ Upstream commit f58c16056f8585ebafb0f1f5d90c23085443a4b9 ]
temp_from_reg_signed() uses only the high byte when the sign bit is set
and drops the fractional bits in the low byte. Writing -500 to
temp2_offset stores 0xff80 (-0.5 degrees C) in the offset registers,
but reading temp2_offset back returns -1000.
Negative temp1_input and temp2_input values are rounded down to the
next whole degree the same way. The chip reports -0.125 degrees C as
0xffe0, which the driver returns as -1000.
Treat the register pair as a single 16-bit two's complement value.
Fixes: fffd80ccc1e6 ("hwmon: LM95245 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260923172551.1593798-1-khurana.ridham222@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/lm95245.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hwmon/lm95245.c b/drivers/hwmon/lm95245.c
index 3bdc305308479..9c977d2820f9c 100644
--- a/drivers/hwmon/lm95245.c
+++ b/drivers/hwmon/lm95245.c
@@ -98,9 +98,9 @@ static int temp_from_reg_unsigned(u8 val_h, u8 val_l)
static int temp_from_reg_signed(u8 val_h, u8 val_l)
{
- if (val_h & 0x80)
- return (val_h - 0x100) * 1000;
- return temp_from_reg_unsigned(val_h, val_l);
+ s16 val_hl = (val_h << 8) | val_l;
+
+ return val_hl * 1000 / 256;
}
static int lm95245_read_conversion_rate(struct lm95245_data *data)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 241/869] fuse: dont drop destination page cache on a zero byte copy reply
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 240/869] hwmon: (lm95245) Fix negative temperature conversion Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 242/869] platform/x86/intel/pmt: Block mmap when callback is present Greg Kroah-Hartman
` (635 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joanne Koong, Miklos Szeredi,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit f7585e1ce3418ec282485854b3d8d31c6a961e37 ]
__fuse_copy_file_range() clears the destination page cache after the
server replies:
truncate_inode_pages_range(inode_out->i_mapping,
ALIGN_DOWN(pos_out, PAGE_SIZE),
ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);
A server may legitimately reply that it copied nothing, eg if the source
file turns out to be shorter than the size the kernel has cached for it.
If pos_out is 0 as well, the end of the range is ALIGN(0, PAGE_SIZE) - 1,
which is -1. lend is a uoff_t and truncate_inode_pages_range() takes -1
as its end of file sentinel, so rather than clearing nothing it drops
every folio in the destination mapping.
That is not only a cache drop. truncate_cleanup_folio() calls
folio_cancel_dirty(), and fuse_writeback_range() only wrote back
[pos_out, pos_out + len - 1], so dirty data elsewhere in the destination
file is discarded without ever reaching the server.
Skip the call when the server copied nothing, since there is nothing
stale to clear in that case.
Fixes: 9b46418c40fe ("fuse: copy_file_range should truncate cache")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a7a3ac5b34f42..18a3ef3a96953 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3094,9 +3094,11 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
goto out;
}
- truncate_inode_pages_range(inode_out->i_mapping,
- ALIGN_DOWN(pos_out, PAGE_SIZE),
- ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);
+ if (bytes_copied)
+ truncate_inode_pages_range(inode_out->i_mapping,
+ ALIGN_DOWN(pos_out, PAGE_SIZE),
+ ALIGN(pos_out + bytes_copied,
+ PAGE_SIZE) - 1);
file_update_time(file_out);
fuse_write_update_attr(inode_out, pos_out + bytes_copied, bytes_copied);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 242/869] platform/x86/intel/pmt: Block mmap when callback is present
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 241/869] fuse: dont drop destination page cache on a zero byte copy reply Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 243/869] mtd: rawnand: nuvoton: fix clock cleanup on probe failure Greg Kroah-Hartman
` (634 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael J. Ruhl, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <michael.j.ruhl@intel.com>
[ Upstream commit 0d4cd92b41dd33a3112959f9be86002ff309de73 ]
With the introduction of the .read_telem() callback, control
for access to a devices data area must be done by the callback
owner.
This means that an area cannot be mmap-ed with the default PMT
handler.
If the .read_telem() callback is present, do not support mmap.
Fixes: 045a513040cc ("platform/x86/intel/pmt: Use PMT callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20260910135954.1586360-2-michael.j.ruhl@intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/pmt/class.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/pmt/class.c b/drivers/platform/x86/intel/pmt/class.c
index 8077274726b5d..9ec843617e3c9 100644
--- a/drivers/platform/x86/intel/pmt/class.c
+++ b/drivers/platform/x86/intel/pmt/class.c
@@ -339,7 +339,14 @@ static int intel_pmt_dev_register(struct intel_pmt_entry *entry,
sysfs_bin_attr_init(&entry->pmt_bin_attr);
entry->pmt_bin_attr.attr.name = ns->name;
entry->pmt_bin_attr.attr.mode = 0440;
- entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
+ /*
+ * The read_telem callback controls access to the memory area. Block
+ * usage if the read_telem callback is present.
+ */
+ if (!(entry->cb && entry->cb->read_telem))
+ entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
entry->pmt_bin_attr.read = intel_pmt_read;
entry->pmt_bin_attr.size = entry->size;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 243/869] mtd: rawnand: nuvoton: fix clock cleanup on probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 242/869] platform/x86/intel/pmt: Block mmap when callback is present Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 244/869] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() Greg Kroah-Hartman
` (633 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8a485a40f45a19c5fcafb5cbee7387c2762af7c4 ]
ma35_nand_probe() gets and enables the NAND clock with
devm_clk_get_enabled(), but the ma35_nand_chips_init() failure path
also calls clk_disable() before returning.
devm_clk_get_enabled() registers a managed cleanup that calls
clk_disable_unprepare() on probe failure and driver removal. Calling
clk_disable() explicitly first drops the clock enable count, so the
managed cleanup attempts to disable the clock again and triggers the
clock framework warning for an already disabled clock.
Remove the redundant clk_disable() and let the managed clock cleanup
handle the clock state.
This issue was found by manual code inspection.
Fixes: 5abb5d414d55 ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
index 1a285cd8fad62..f659d3a6b9ef4 100644
--- a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
+++ b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
@@ -993,7 +993,6 @@ static int ma35_nand_probe(struct platform_device *pdev)
ret = ma35_nand_chips_init(&pdev->dev, nand);
if (ret) {
dev_err(&pdev->dev, "failed to init NAND chips\n");
- clk_disable(nand->clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 244/869] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 243/869] mtd: rawnand: nuvoton: fix clock cleanup on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 245/869] mtd: maps: pci: balance PCI enable on cleanup Greg Kroah-Hartman
` (632 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 94edcda45d888c3bb1310de11e10e4537c166f00 ]
atmel_nand_controller_init() takes a reference to the MCK clock with
of_clk_get() and keeps it in nc->mck for the lifetime of the
controller. If the "atmel,smc" phandle is missing or the SMC regmap
cannot be obtained afterwards, the error path jumps to out_release_dma
which only releases the DMA channel, so the clock reference is leaked.
The callers return the error directly and never run
atmel_nand_controller_cleanup(), where the clock is normally put.
Release the reference on those error paths. The path on which
of_clk_get() itself fails keeps jumping to out_release_dma, as nc->mck
only holds an error pointer there.
Fixes: f9ce2eddf176 ("mtd: nand: atmel: Add ->setup_data_interface() hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/atmel/nand-controller.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index 83ba4ebd02d41..b954e70b4c6b3 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2086,7 +2086,7 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
if (!np) {
dev_err(dev, "Missing or invalid atmel,smc property\n");
ret = -EINVAL;
- goto out_release_dma;
+ goto out_put_mck;
}
nc->smc = syscon_node_to_regmap(np);
@@ -2094,11 +2094,13 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
if (IS_ERR(nc->smc)) {
ret = PTR_ERR(nc->smc);
dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
- goto out_release_dma;
+ goto out_put_mck;
}
return 0;
+out_put_mck:
+ clk_put(nc->mck);
out_release_dma:
if (nc->dmac)
dma_release_channel(nc->dmac);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 245/869] mtd: maps: pci: balance PCI enable on cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 244/869] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 246/869] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Greg Kroah-Hartman
` (631 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Miquel Raynal, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 3be16e5d4990bf96309ac5ba35cb369c6015bce7 ]
mtd_pci_probe() leaves the PCI device enabled on later probe failure and
mtd_pci_remove() does not disable it either. Use pcim_enable_device() to
release the enable reference after the existing map and region cleanup.
The imbalance is already present in the initial Git import.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c
index ca00d211e73e4..c6bbce6aed417 100644
--- a/drivers/mtd/maps/pci.c
+++ b/drivers/mtd/maps/pci.c
@@ -256,7 +256,7 @@ static int mtd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
struct mtd_info *mtd = NULL;
int err;
- err = pci_enable_device(dev);
+ err = pcim_enable_device(dev);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 246/869] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 245/869] mtd: maps: pci: balance PCI enable on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 247/869] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() Greg Kroah-Hartman
` (630 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit cfc5ebc9540e29f8f96db88bbfa261139e5afedb ]
The Write to Buffer command takes the number of words to program minus
one, and do_write_buffer() sends that count as a single bus word:
map_write(map, CMD(words - 1), cmd_adr);
CMD() replicates the value into every device lane, so each device reads
the count off its own data lines - eight of them on an x8 part. A count
that does not fit in eight bits is truncated there, which limits one
Write to Buffer to 256 words on an x8 device, however large a buffer the
chip advertises in its CFI query.
The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8)
advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers()
split the data into 512-byte chunks and do_write_buffer() sent a count of
511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the
program when the 257th arrived. Chunks below 256 bytes - the leading
partial chunk of a write - completed normally, so only the full-size ones
failed:
MTD do_write_buffer_wait(): software timeout, address:0x03278bff.
jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68
jffs2: No space for garbage collection. Aborting GC thread
Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and
recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from
MaxBufWriteSize before the fixups run.
The clamp deliberately keys off the device width rather than the part,
even though the driver already recognises this one in is_m29ew(): the
ceiling comes from the width of a device's data bus, not from the chip,
so any x8 device advertising a larger buffer is told a count it cannot
receive. The M29EW is only where it was found.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/chips/cfi_cmdset_0002.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 7c91429a670bb..c8a82b1592c9d 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -283,6 +283,21 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
pr_debug("Using buffer write method\n");
mtd->_write = cfi_amdstd_write_buffers;
}
+
+ /*
+ * The word count of the Write to Buffer command is a single bus
+ * word per device, so an x8 device can be told to program at most
+ * 256 bytes however large a buffer it advertises - including when
+ * several of them are interleaved on a wider bus, where CMD()
+ * replicates the count into each device's lane and it is truncated
+ * there.
+ */
+ if (cfi->device_type == CFI_DEVICETYPE_X8 &&
+ cfi->cfiq->MaxBufWriteSize > 8) {
+ cfi->cfiq->MaxBufWriteSize = 8;
+ mtd->writebufsize = cfi_interleave(cfi) <<
+ cfi->cfiq->MaxBufWriteSize;
+ }
}
#endif /* !FORCE_WORD_WRITE */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 247/869] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 246/869] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 248/869] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() Greg Kroah-Hartman
` (629 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 1a122f5fecbabd47b81b1be3f0934f57b78aad42 ]
init_amd76xrom() obtains the PCI device with pci_get_device() and
hands the reference over to amd76xrom_init_one(), which stores it in
window->pdev. When reserving the ROM window fails, that function
returns -EBUSY directly instead of going through amd76xrom_cleanup(),
so the reference is neither released nor cleared.
Drop the reference and clear window->pdev on that path.
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/amd76xrom.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 281fcbaa74e70..43411ec02ed59 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -152,6 +152,8 @@ static int amd76xrom_init_one(struct pci_dev *pdev,
printk(KERN_ERR MOD_NAME
" %s(): Unable to register resource %pR - kernel bug?\n",
__func__, &window->rsrc);
+ pci_dev_put(window->pdev);
+ window->pdev = NULL;
return -EBUSY;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 248/869] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 247/869] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 249/869] mtd: maps: l440gx: Fix double put of the PM device " Greg Kroah-Hartman
` (628 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 521ad948e04934b2d70ae899bc016bbb38802e90 ]
init_l440gx() takes a single reference on the PIIX4 ISA bridge with
pci_get_device() and drops it again right after the lookups, before
the flash window is set up. The pci_assign_resource() failure path
then calls pci_dev_put() on the same device a second time, releasing a
reference that is no longer owned and underflowing the reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/l440gx.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 832b880d1aaf8..85cd273ce0654 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
/* Allocate the resource region */
if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
- pci_dev_put(dev);
pci_dev_put(pm_dev);
printk(KERN_WARNING "Could not allocate pm iobase resource\n");
iounmap(l440gx_map.virt);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 249/869] mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 248/869] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 250/869] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Greg Kroah-Hartman
` (627 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e6ca524ee5b2705be30ea19ce2e55122d9f9ed8f ]
The PIIX4 PM device reference taken with pci_get_device() is dropped
again before the iobase resource is allocated. If pci_assign_resource()
fails, the error path calls pci_dev_put() on pm_dev a second time,
releasing a reference that is no longer owned and underflowing the
reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/l440gx.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 85cd273ce0654..1df5ea5fafcac 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
/* Allocate the resource region */
if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
- pci_dev_put(pm_dev);
printk(KERN_WARNING "Could not allocate pm iobase resource\n");
iounmap(l440gx_map.virt);
return -ENXIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 250/869] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 249/869] mtd: maps: l440gx: Fix double put of the PM device " Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 251/869] mtd: Call get_wunit() on the master partition Greg Kroah-Hartman
` (626 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 62ee3da38f41bef83c1cf250f6816a0ee187674b ]
mtd_get_sb() is called with a reference to the MTD device already
taken by the caller. When sget_dev() fails, the function returns the
error without dropping that reference, so the device is never released
and its refcount never reaches zero. Every mount attempt on an MTD
device whose superblock cannot be set up leaks a reference.
Restore the put_mtd_device() that the fs_context conversion dropped on
this path.
Fixes: 0f071004109d ("mtd: Provide fs_context-aware mount_mtd() replacement")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdsuper.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index b7e3763c47f0c..22ddeaa7d5221 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -31,8 +31,10 @@ static int mtd_get_sb(struct fs_context *fc,
int ret;
sb = sget_dev(fc, MKDEV(MTD_BLOCK_MAJOR, mtd->index));
- if (IS_ERR(sb))
+ if (IS_ERR(sb)) {
+ put_mtd_device(mtd);
return PTR_ERR(sb);
+ }
if (sb->s_root) {
/* new mountpoint for an already mounted superblock */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 251/869] mtd: Call get_wunit() on the master partition
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 250/869] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 252/869] hwmon: (coretemp) Refresh the temperature on the first read Greg Kroah-Hartman
` (625 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Weinberger, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
[ Upstream commit 904f18430e8cce829cb9130eab7a93020e33fc89 ]
The code checks whether master has get_wunit() but still calls
it on the child. Fix this.
Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdcore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 51c8ed4893480..f84e4213b6788 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -562,7 +562,7 @@ int mtd_pairing_info_to_wunit(struct mtd_info *mtd,
return -EINVAL;
if (master->pairing && master->pairing->get_wunit)
- return mtd->pairing->get_wunit(master, info);
+ return master->pairing->get_wunit(master, info);
return info->pair;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 252/869] hwmon: (coretemp) Refresh the temperature on the first read
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 251/869] mtd: Call get_wunit() on the master partition Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 253/869] dcache: report a Tasks-RCU quiescent state in dentry_kill() Greg Kroah-Hartman
` (624 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Neri, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit e463cd582ca125e359ad1a66cb076434c14638b2 ]
show_temp() reads the status MSR only when the cached temperature is
older than one second. Commit 5c0e64dde80f ("hwmon: (coretemp) Remove
obsolete temp_data->valid") dropped the tdata->valid check that used to
force the very first read, leaving that comparison as the only trigger.
A never-updated temp_data carries a zero timestamp, which does not look
stale on 32-bit kernels: jiffies starts 300 seconds short of wrapping,
so the comparison stays false until jiffies wraps and passes HZ. For the
first 301 seconds of uptime temp%d_input reports the zero left by the
allocator rather than the CPU temperature. 64-bit kernels are
unaffected: jiffies starts at a positive value there and does not wrap.
Backdate the timestamp when the temperature data is allocated. One jiffy
older than the caching interval is stale under either word size, and the
first refresh overwrites it.
Fixes: 5c0e64dde80f ("hwmon: (coretemp) Remove obsolete temp_data->valid")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20260924-coretemp-temp-fault-v1-1-1884f0ff97d5@linux.intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index a84a32ada8bd5..e8697d6b9998a 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -511,6 +511,11 @@ init_temp_data(struct platform_data *pdata, unsigned int cpu, int pkg_flag)
tdata->cpu = cpu;
tdata->cpu_core_id = topology_core_id(cpu);
tdata->attr_size = MAX_CORE_ATTRS;
+ /*
+ * A zero timestamp does not look stale on 32-bit, where jiffies
+ * starts just short of wrapping. Backdate it instead.
+ */
+ tdata->last_updated = jiffies - HZ - 1;
mutex_init(&tdata->update_lock);
return tdata;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 253/869] dcache: report a Tasks-RCU quiescent state in dentry_kill()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 252/869] hwmon: (coretemp) Refresh the temperature on the first read Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 254/869] ASoC: sdw_utils: clear stale RT711 device reference on exit Greg Kroah-Hartman
` (623 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit a647a53bc89a046bee4a12a0a5627f2dfaaef807 ]
I am constantly seeing the following warning on Meta's fleet:
INFO: rcu_tasks detected stalls on tasks:
native_queued_spin_lock_slowpath
locked_inode_to_wb_and_lock_list
inode_io_list_del
evict
__dentry_kill
shrink_dentry_list
shrink_dcache_tree
d_invalidate
btrfs_delete_subvolume
btrfs_ioctl_snap_destroy
btrfs_ioctl
do_syscall_64
dentry_kill() is the common funnel for dentry teardown: dput(),
shrink_dentry_list() and shrink_dcache_tree() all reach it, once per
dentry, and its cond_resched() is the only reschedule point on that path.
cond_resched() is not an RCU-tasks quiescent state.
Use cond_resched_tasks_rcu_qs() so the teardown reports an RCU-tasks
quiescent state as it proceeds.
Fixes: 9c5f1d30199d ("dcache: move cond_resched() into the end of __dentry_kill()")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260918-dcache-task-rcu-qa-v1-1-963ec83e6d0b@debian.org
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 1b4c210338022..04adb623e584e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -686,7 +686,7 @@ static struct dentry *__dentry_kill(struct dentry *dentry)
if (dentry->d_op && dentry->d_op->d_release)
dentry->d_op->d_release(dentry);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
/* now that it's negative, ->d_parent is stable */
if (!IS_ROOT(dentry)) {
parent = dentry->d_parent;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 254/869] ASoC: sdw_utils: clear stale RT711 device reference on exit
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 253/869] dcache: report a Tasks-RCU quiescent state in dentry_kill() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 255/869] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() Greg Kroah-Hartman
` (622 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Cemin, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Cemin <dcemin@nvidia.com>
[ Upstream commit 7c7df141dcabaa5370b5e52a9d64e2c1ea13a338 ]
asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev
but leaves the pointer populated. If the card cleanup path reaches the
exit hook more than once after a failed or deferred probe, a later
invocation reuses the stale pointer and calls put_device() again,
underflowing the refcount and leading to oopses when later probe,
driver bind, or suspend paths walk the SoundWire bus after the device
reference was released. Observed as boot- and suspend-time oopses on an
arm64 platform with an RT712 headset codec, reproducible
deterministically by repeated machine-driver probe cycling with the
codec drivers unloaded.
Clear the pointer after put_device() so repeated cleanup becomes a
no-op, which also makes the existing NULL check at the top of the exit
hook effective. This matches what commit 046173b98de3 ("ASoC: sdw_utils:
fix double put_device() on aggregated amps") did for the aggregated amp
references.
Fixes: 811648340707 ("ASoC: Intel: sof_sdw: avoid oops in error handling")
Cc: stable@vger.kernel.org
Signed-off-by: David Cemin <dcemin@nvidia.com>
Link: https://patch.msgid.link/20260912182131.1156475-1-dcemin@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/sdw_utils/soc_sdw_rt711.c b/sound/soc/sdw_utils/soc_sdw_rt711.c
index 4aa93fdefef63..1d020d44d474b 100644
--- a/sound/soc/sdw_utils/soc_sdw_rt711.c
+++ b/sound/soc/sdw_utils/soc_sdw_rt711.c
@@ -123,6 +123,7 @@ int asoc_sdw_rt711_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_
device_remove_software_node(ctx->headset_codec_dev);
put_device(ctx->headset_codec_dev);
+ ctx->headset_codec_dev = NULL;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 255/869] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 254/869] ASoC: sdw_utils: clear stale RT711 device reference on exit Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 256/869] peci: aspeed: Initialize state before requesting IRQ Greg Kroah-Hartman
` (621 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit f0cc352be29ba616e0682f66f551d3f3029886fd ]
wcd9335_slim_status() obtains the SLIM interface device with
of_slim_get_device(), which uses device_find_child() internally and
returns the device with a reference held. As the device_find_child()
documentation says: you will need to drop the reference with
put_device() after use. The reference is stored in wcd->slim_ifc_dev
and never dropped, so the SLIM interface device cannot be released.
Fix it by using devm_add_action_or_reset() or put_device() respectively.
Found by code review.
Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Link: https://patch.msgid.link/20260914095009.12049-1-make_ruc2021@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wcd9335.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 1c050b8c19de4..9887a10881b07 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5092,6 +5092,13 @@ static int wcd9335_slim_probe(struct slim_device *slim)
return 0;
}
+static void wcd9335_put_device_action(void *data)
+{
+ struct device *dev = data;
+
+ put_device(dev);
+}
+
static int wcd9335_slim_status(struct slim_device *sdev,
enum slim_device_status status)
{
@@ -5116,6 +5123,11 @@ static int wcd9335_slim_status(struct slim_device *sdev,
return -EINVAL;
}
+ ret = devm_add_action_or_reset(dev, wcd9335_put_device_action,
+ &wcd->slim_ifc_dev->dev);
+ if (ret)
+ return ret;
+
slim_get_logical_addr(wcd->slim_ifc_dev);
wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 256/869] peci: aspeed: Initialize state before requesting IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 255/869] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 6.18 257/869] peci: npcm: " Greg Kroah-Hartman
` (620 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Iwona Winiarska,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 61cf765b654b76a62510269521a65e4e4a488f4c ]
The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.
Fixes: a85e4c52086c ("peci: Add peci-aspeed controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902142600.3580382-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/peci/controller/peci-aspeed.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/peci/controller/peci-aspeed.c b/drivers/peci/controller/peci-aspeed.c
index ad3a7d71ed4c6..57e1a71386074 100644
--- a/drivers/peci/controller/peci-aspeed.c
+++ b/drivers/peci/controller/peci-aspeed.c
@@ -527,14 +527,14 @@ static int aspeed_peci_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
+ init_completion(&priv->xfer_complete);
+ spin_lock_init(&priv->lock);
+
ret = devm_request_irq(&pdev->dev, priv->irq, aspeed_peci_irq_handler,
0, "peci-aspeed", priv);
if (ret)
return ret;
- init_completion(&priv->xfer_complete);
- spin_lock_init(&priv->lock);
-
priv->rst = devm_reset_control_get(&pdev->dev, NULL);
if (IS_ERR(priv->rst))
return dev_err_probe(priv->dev, PTR_ERR(priv->rst),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 257/869] peci: npcm: Initialize state before requesting IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 256/869] peci: aspeed: Initialize state before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 258/869] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area() Greg Kroah-Hartman
` (619 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Iwona Winiarska,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 425125e6d408b5969afb99c3e95a391f1f1ad81d ]
The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.
Fixes: 3e16184a1bd8 ("peci: Add peci-npcm controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902152256.3591658-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/peci/controller/peci-npcm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/peci/controller/peci-npcm.c b/drivers/peci/controller/peci-npcm.c
index 9318689912412..3cc4e959aff36 100644
--- a/drivers/peci/controller/peci-npcm.c
+++ b/drivers/peci/controller/peci-npcm.c
@@ -253,14 +253,14 @@ static int npcm_peci_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
+ init_completion(&priv->xfer_complete);
+ spin_lock_init(&priv->lock);
+
ret = devm_request_irq(&pdev->dev, priv->irq, npcm_peci_irq_handler,
0, "peci-npcm-irq", priv);
if (ret)
return ret;
- init_completion(&priv->xfer_complete);
- spin_lock_init(&priv->lock);
-
ret = npcm_peci_init_ctrl(priv);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 258/869] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 6.18 257/869] peci: npcm: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 259/869] MIPS: mm: do not write a huge TLB entry when the probe misses Greg Kroah-Hartman
` (618 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Thomas Bogendoerfer,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit 975d4a6a6d4d23a39e2f49cafcc082d937960bc4 ]
Since hugetlb mappings were made to go through the architecture's
arch_get_unmapped_area{,_topdown}(), every architecture that implements
those has to align hugetlb files itself. The generic implementation and
loongarch do it with huge_page_mask_align(); MIPS was left out.
A non-MAP_FIXED mmap() of a hugetlbfs file therefore returns an address
that is only SHMLBA aligned, and the kernel then installs 2 MB PMDs for
a VMA that starts in the middle of a PMD. The consequences on an
Octeon (CN63XX) board running a process that links libhugetlbfs with
HUGETLB_ELFMAP=R and HUGETLB_MORECORE=yes, all within a minute of
start: the neighbouring 4 KB page table is clobbered, the TLB ends up
with overlapping entries ("Caught Machine Check exception - caused by
multiple matching entries in the TLB"), process exit trips
BUG_ON(start & ~huge_page_mask(h)) in __unmap_hugepage_range(), and
freed pages leak into unrelated kernel structures (oopses in the irq
maple tree, in pte_offset_map, ...).
Do what loongarch does in commit 3109d5ff484b ("LoongArch: Set hugetlb
mmap base address aligned with pmd size"): when the file is a hugetlb
file, use its page mask as the search alignment instead of the cache
colour mask.
Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/mmap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 5d2a1225785b8..119edaa928f33 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/elf-randomize.h>
#include <linux/errno.h>
+#include <linux/hugetlb.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/export.h>
@@ -72,8 +73,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
}
info.length = len;
- info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
info.align_offset = pgoff << PAGE_SHIFT;
+ if (filp && is_file_hugepages(filp))
+ info.align_mask = huge_page_mask_align(filp);
+ else
+ info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
if (dir == DOWN) {
info.flags = VM_UNMAPPED_AREA_TOPDOWN;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 259/869] MIPS: mm: do not write a huge TLB entry when the probe misses
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 258/869] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 260/869] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Greg Kroah-Hartman
` (617 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Thomas Bogendoerfer,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit 0cb17268887e1df5c425ea052f5146b42d126323 ]
__update_tlb() probes for the 8K pair at the address it is given and,
for a huge pmd, writes the huge entry with tlbwi at the probed index or
with tlbwr when the probe misses. That works only if the caller passes
the faulting address, so that the probe finds the 4K entry the refill
handler loaded for the faulting page and the huge entry replaces it.
update_mmu_cache_pmd() is not called that way. do_set_pmd() has always
passed the huge-aligned address, and since commit ebcfc63d6bca ("mm:
abstract THP allocation") the anonymous THP fault path does too
(map_anon_folio_pmd()). The probe then misses the stale 4K entry, which
sits at the faulting page somewhere else in the 2 MB range, tlbwr adds
a huge entry next to it, and the TLB holds two entries matching the
faulting address. Octeon raises "Machine Check exception - caused by
multiple matching entries in the TLB" on the next refill of that page;
a process on a CN63XX board died this way within a second of start, on
the first anonymous THP of its bss.
Skip the write when the probe misses. The refill and TLBL/TLBS handlers
probe the faulting address themselves and rewrite the stale entry with
the huge one (they also set the software young bit), so the entry is
installed on the next access at the cost of one exception.
Fixes: fd062c847a8c ("MIPS: TLB support for hugetlbfs.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/tlb-r4k.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 24fe85fa169d1..78bafa317fa6f 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -332,6 +332,19 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
/* this could be a huge page */
if (pmd_leaf(*pmdp)) {
unsigned long lo;
+
+ /*
+ * The probe above only covers the 8K pair at @address, and
+ * a huge mapping is installed with the huge-aligned address
+ * while the refill that started the fault left a 4K entry
+ * for the faulting page elsewhere in the range. Writing the
+ * huge entry to a random index would leave two entries
+ * matching the faulting address; leave it to the refill and
+ * TLBL/TLBS handlers, which probe the faulting address.
+ */
+ if (idx < 0)
+ goto out;
+
write_c0_pagemask(PM_HUGE_MASK);
ptep = (pte_t *)pmdp;
lo = pte_to_entrylo(pte_val(*ptep));
@@ -339,10 +352,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
write_c0_entrylo1(lo + (HPAGE_SIZE >> 7));
mtc0_tlbw_hazard();
- if (idx < 0)
- tlb_write_random();
- else
- tlb_write_indexed();
+ tlb_write_indexed();
tlbw_use_hazard();
write_c0_pagemask(PM_DEFAULT_MASK);
} else
@@ -380,6 +390,9 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
tlb_write_indexed();
}
tlbw_use_hazard();
+#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+out:
+#endif
htw_start();
flush_micro_tlb_vm(vma);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 260/869] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 259/869] MIPS: mm: do not write a huge TLB entry when the probe misses Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 261/869] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region Greg Kroah-Hartman
` (616 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Piotr Kubik, Pablo Neira Ayuso,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Kubik <piotr@kubik.pl>
[ Upstream commit 1ae2d094b0200f687923298c0e42579273558988 ]
ctnetlink_filter_match_tuple() rejects an entry when
!ipv6_addr_cmp(filter, entry) is true. ipv6_addr_cmp() is a memcmp() and
returns 0 for equal addresses, so the condition is true exactly when the
addresses match: a CTA_FILTER dump with an IPv6 CTA_IP_SRC or CTA_IP_DST
skips every entry that matches the requested address and returns all the
others. The IPv4 branch compares with != and behaves correctly.
Observed with libnetfilter_conntrack NFCT_FILTER_DUMP_TUPLE: a dump
filtered on src 2001:db8::10 returned only the unrelated entries, and a
dump filtered on ::1 returned every entry except the ::1 ones.
conntrack-tools does not use the tuple filter for -L, which is why this
went unnoticed.
Use ipv6_addr_equal() so the IPv6 branch mirrors the IPv4 one.
Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
Cc: stable@vger.kernel.org
Signed-off-by: Piotr Kubik <piotr@kubik.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6ccb23a640d85..0ff9da922c392 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1098,13 +1098,13 @@ static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple,
break;
case NFPROTO_IPV6:
if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) &&
- !ipv6_addr_cmp(&filter_tuple->src.u3.in6,
- &ct_tuple->src.u3.in6))
+ !ipv6_addr_equal(&filter_tuple->src.u3.in6,
+ &ct_tuple->src.u3.in6))
return 0;
if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) &&
- !ipv6_addr_cmp(&filter_tuple->dst.u3.in6,
- &ct_tuple->dst.u3.in6))
+ !ipv6_addr_equal(&filter_tuple->dst.u3.in6,
+ &ct_tuple->dst.u3.in6))
return 0;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 261/869] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 260/869] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 262/869] arm64: dts: qcom: sdm845-xiaomi-polaris: " Greg Kroah-Hartman
` (615 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 511c4fea32708a065e03503c0e4d44f48990c530 ]
Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.
Cc: stable@vger.kernel.org
Fixes: 77809cf74a8c ("arm64: dts: qcom: Add support for Xiaomi Poco F1 (Beryllium)")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-1-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
index dbd5f08b5cdd3..3db935a7442ea 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
@@ -27,6 +27,7 @@
/delete-node/ &slpi_mem;
/delete-node/ &spss_mem;
/delete-node/ &rmtfs_mem;
+/delete-node/ &xbl_mem;
/ {
chassis-type = "handset";
@@ -55,6 +56,11 @@ key-vol-up {
/* Reserved memory changes from downstream */
reserved-memory {
+ xbl-mem@85d00000 {
+ reg = <0 0x85d00000 0 0x200000>;
+ no-map;
+ };
+
tz_mem: memory@86200000 {
reg = <0 0x86200000 0 0x4900000>;
no-map;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 262/869] arm64: dts: qcom: sdm845-xiaomi-polaris: Extend the xbl_mem region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 261/869] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 263/869] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC Greg Kroah-Hartman
` (614 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Bjorn Andersson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 38458f12419f456b16385c118bcacd76899d99b9 ]
Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.
Cc: stable@vger.kernel.org
Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-2-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
index 1c50a0563bc47..8fc7cbc087ed1 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
@@ -32,6 +32,7 @@
/delete-node/ &mba_region;
/delete-node/ &slpi_mem;
/delete-node/ &spss_mem;
+/delete-node/ &xbl_mem;
/ {
model = "Xiaomi Mi MIX 2S";
@@ -63,6 +64,11 @@ key-vol-up {
};
reserved-memory {
+ xbl-mem@85d00000 {
+ reg = <0 0x85d00000 0 0x200000>;
+ no-map;
+ };
+
adsp_mem: memory@8c500000 {
reg = <0 0x8c500000 0 0x1e00000>;
no-map;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 263/869] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 262/869] arm64: dts: qcom: sdm845-xiaomi-polaris: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 264/869] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid() Greg Kroah-Hartman
` (613 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio,
Kathiravan Thirumoorthy, Abel Vesa, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 117d8d40be1ded4f35f3252efa83607a7134d5e0 ]
Connect the QMP PHY USB3 output to GCC so the USB3 PHY pipe clock can
propagate to the USB controller.
Cc: stable@vger.kernel.org
Fixes: a98bfb31f676 ("arm64: dts: qcom: ipq9574: Add USB related nodes")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-4-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq9574.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq9574.dtsi b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
index 86c9cb9fffc98..d3895259f25cc 100644
--- a/arch/arm64/boot/dts/qcom/ipq9574.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
@@ -432,7 +432,7 @@ gcc: clock-controller@1800000 {
<&pcie1_phy>,
<&pcie2_phy>,
<&pcie3_phy>,
- <0>;
+ <&usb_0_qmpphy>;
#clock-cells = <1>;
#reset-cells = <1>;
#interconnect-cells = <1>;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 264/869] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 263/869] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 265/869] ALSA: mpu401: shut down timer before freeing MPU Greg Kroah-Hartman
` (612 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Lu Baolu, Kevin Tian,
Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit ddea230c9fc28d1f2090ceeab3d66ce2bea658e9 ]
Callers request a full Device-TLB flush by passing MAX_AGAW_PFN_WIDTH
(64 - VTD_PAGE_SHIFT == 52) as @size_order. Two expressions in
qi_desc_dev_iotlb_pasid() are not prepared for a value that large:
unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
...
if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
The second evaluates to 1UL << 64, which is undefined on all
architectures. On x86_64 the shift count masks to zero, IS_ALIGNED(addr,
1) is trivially true, and the alignment sanity check silently degrades
into a no-op.
The first evaluates to 1UL << 63. That is well defined on 64-bit builds,
where unsigned long is 64 bits wide, but is undefined on 32-bit ones. In
practice x86 masks the shift count to five bits, so the expression yields
1UL << 31 and ~mask becomes 0x7fffffff. That value is zero-extended when
applied to the 64-bit descriptor, so
desc->qw1 &= ~mask;
clears qw1[63:32] as well as bit 31, collapsing the ADDR field that had
just been filled with ones. Reaching that requires a scalable-mode PASID
configuration on 32-bit x86, which is not a realistic deployment, but the
construct is wrong regardless.
Compute the mask with BIT_ULL() so that it is 64-bit on every
architecture, and skip the alignment check for a full flush, where it is
both meaningless and the source of the out-of-range shift.
Note that @size_order must not be clamped below 64 - VTD_PAGE_SHIFT. With
S set, hardware derives the invalidation range from the least significant
zero bit N of ADDR and matches bits [63:N+1] of the incoming address. For
size_order 52 the descriptor sets ADDR[63:12] and clears bit 63, making
N = 63 and the comparison range empty, so everything is invalidated.
Reducing @size_order to 51 would instead leave N = 62 and cause hardware
to compare address bit 63; since callers pass an address of 0, only the
lower half of the address space would be invalidated. Bound @size_order
at 64 - VTD_PAGE_SHIFT so that a bogus caller cannot reintroduce an
out-of-range shift, without altering the full-flush encoding.
The non-PASID variant qi_desc_dev_iotlb() already uses 1ULL and is
unaffected.
Fixes: f701c9f36bcb7 ("iommu/vt-d: Factor out invalidation descriptor composition")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260623060122.3796325-1-guanghuifeng%40linux.alibaba.com
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.h | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index e696e019e9697..33c9e06df63f9 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1183,12 +1183,20 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
unsigned int size_order,
struct qi_desc *desc)
{
- unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
-
desc->qw0 = QI_DEV_EIOTLB_PASID(pasid) | QI_DEV_EIOTLB_SID(sid) |
QI_DEV_EIOTLB_QDEP(qdep) | QI_DEIOTLB_TYPE |
QI_DEV_IOTLB_PFSID(pfsid);
+ /*
+ * The widest range the descriptor can express is a full flush, encoded
+ * by making bit 63 the least significant zero bit of ADDR, that is
+ * @size_order == 64 - VTD_PAGE_SHIFT. Bound @size_order there so that
+ * a caller passing something larger cannot produce an out-of-range
+ * shift below.
+ */
+ if (size_order > 64 - VTD_PAGE_SHIFT)
+ size_order = 64 - VTD_PAGE_SHIFT;
+
/*
* If S bit is 0, we only flush a single page. If S bit is set,
* The least significant zero bit indicates the invalidation address
@@ -1198,7 +1206,8 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
* Max Invs Pending (MIP) is set to 0 for now until we have DIT in
* ECAP.
*/
- if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
+ if (size_order < 64 - VTD_PAGE_SHIFT &&
+ !IS_ALIGNED(addr, BIT_ULL(VTD_PAGE_SHIFT + size_order)))
pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
addr, size_order);
@@ -1214,7 +1223,7 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
desc->qw1 |= GENMASK_ULL(size_order + VTD_PAGE_SHIFT - 1,
VTD_PAGE_SHIFT);
/* Clear size_order bit to indicate size */
- desc->qw1 &= ~mask;
+ desc->qw1 &= ~BIT_ULL(VTD_PAGE_SHIFT + size_order - 1);
/* Set the S bit to indicate flushing more than 1 page */
desc->qw1 |= QI_DEV_EIOTLB_SIZE;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 265/869] ALSA: mpu401: shut down timer before freeing MPU
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 264/869] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 266/869] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() Greg Kroah-Hartman
` (611 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9332af5220d42341bb1446a62c545c0518e990ef ]
When an MPU401 interface has no usable IRQ, the driver polls raw-MIDI
input and output with a timer. During raw-MIDI teardown, the timer callback
can already be running when snd_mpu401_uart_remove_timer() clears the last
mode bit and calls timer_delete(). That API neither waits for a running
callback nor prevents it from rearming the timer, and free_irq() does not
synchronize timer callbacks. snd_mpu401_uart_free() can therefore release
mpu while the timer callback still uses it.
Initialize the timer once when the MPU object is created and only rearm it
while a timer mode is active. Shut it down synchronously after freeing the
IRQ so an in-flight callback completes before mpu and its resources are
released.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260927093809.681726-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/mpu401/mpu401_uart.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
index 4af89822bf32b..94213c1ff1700 100644
--- a/sound/drivers/mpu401/mpu401_uart.c
+++ b/sound/drivers/mpu401/mpu401_uart.c
@@ -155,20 +155,20 @@ static void snd_mpu401_uart_timer(struct timer_list *t)
scoped_guard(spinlock_irqsave, &mpu->timer_lock) {
/*mpu->mode |= MPU401_MODE_TIMER;*/
- mod_timer(&mpu->timer, 1 + jiffies);
+ if (mpu->timer_invoked)
+ mod_timer(&mpu->timer, 1 + jiffies);
}
if (mpu->rmidi)
_snd_mpu401_uart_interrupt(mpu);
}
/*
- * initialize the timer callback if not programmed yet
+ * arm the timer if it is not already active
*/
static void snd_mpu401_uart_add_timer (struct snd_mpu401 *mpu, int input)
{
guard(spinlock_irqsave)(&mpu->timer_lock);
if (mpu->timer_invoked == 0) {
- timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
mod_timer(&mpu->timer, 1 + jiffies);
}
mpu->timer_invoked |= input ? MPU401_MODE_INPUT_TIMER :
@@ -474,6 +474,7 @@ static void snd_mpu401_uart_free(struct snd_rawmidi *rmidi)
struct snd_mpu401 *mpu = rmidi->private_data;
if (mpu->irq >= 0)
free_irq(mpu->irq, (void *) mpu);
+ timer_shutdown_sync(&mpu->timer);
release_and_free_resource(mpu->res);
kfree(mpu);
}
@@ -528,6 +529,7 @@ int snd_mpu401_uart_new(struct snd_card *card, int device,
spin_lock_init(&mpu->input_lock);
spin_lock_init(&mpu->output_lock);
spin_lock_init(&mpu->timer_lock);
+ timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
mpu->hardware = hardware;
mpu->irq = -1;
mpu->rmidi = rmidi;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 266/869] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 265/869] ALSA: mpu401: shut down timer before freeing MPU Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 267/869] iio: dac: ad5755: validate SPI match data Greg Kroah-Hartman
` (610 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 082723fee626532f176727b6438b666a96d5246c ]
of_slim_get_device() returns a device with an elevated reference count,
and wcd->slim_ifc_dev is intentionally kept for the codec lifetime on
success. However, all the failure paths of wcd9335_slim_status() return
without dropping that reference, leaking the SLIM interface device
whenever the register maps cannot be created or the codec fails to come
up.
Put the device on each of those error paths.
Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917164853.2163184-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wcd9335.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 9887a10881b07..d607400b3976d 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5131,25 +5131,32 @@ static int wcd9335_slim_status(struct slim_device *sdev,
slim_get_logical_addr(wcd->slim_ifc_dev);
wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);
- if (IS_ERR(wcd->regmap))
+ if (IS_ERR(wcd->regmap)) {
+ put_device(&wcd->slim_ifc_dev->dev);
return dev_err_probe(dev, PTR_ERR(wcd->regmap),
"Failed to allocate slim register map\n");
+ }
wcd->if_regmap = regmap_init_slimbus(wcd->slim_ifc_dev,
&wcd9335_ifc_regmap_config);
- if (IS_ERR(wcd->if_regmap))
+ if (IS_ERR(wcd->if_regmap)) {
+ put_device(&wcd->slim_ifc_dev->dev);
return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
"Failed to allocate ifc register map\n");
+ }
ret = wcd9335_bring_up(wcd);
if (ret) {
dev_err(dev, "Failed to bringup WCD9335\n");
+ put_device(&wcd->slim_ifc_dev->dev);
return ret;
}
ret = wcd9335_irq_init(wcd);
- if (ret)
+ if (ret) {
+ put_device(&wcd->slim_ifc_dev->dev);
return ret;
+ }
wcd9335_probe(wcd);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 267/869] iio: dac: ad5755: validate SPI match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 266/869] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 268/869] iio: frequency: adf4377: reject devices without " Greg Kroah-Hartman
` (609 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 85e2c8ca7ac9e39a61e7fb18728918f6e966f439 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad5755_probe() stores and later dereferences the result.
Validate the match data before it is used.
Fixes: 62d3fb9dcc09 ("iio: dac: ad5755: make use of of_device_id table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/ad5755.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
index d0e5f35462b1b..ce188c5a9ad15 100644
--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -819,6 +819,9 @@ static int ad5755_probe(struct spi_device *spi)
spi_set_drvdata(spi, indio_dev);
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
+
st->spi = spi;
st->pwr_down = 0xf;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 268/869] iio: frequency: adf4377: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 267/869] iio: dac: ad5755: validate SPI match data Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 269/869] iio: imu: adis16400: validate SPI " Greg Kroah-Hartman
` (608 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 2f3196d27e3bfcee0569d23a123aedcc6ddd39f1 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but the result is later dereferenced by the property parsing and
initialization paths.
Reject devices without match data before continuing probe.
Fixes: 6140a92cd086 ("iio: frequency: adf4377: add adf4378 support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/frequency/adf4377.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/frequency/adf4377.c b/drivers/iio/frequency/adf4377.c
index 48aa4b015a141..0548f626bb45c 100644
--- a/drivers/iio/frequency/adf4377.c
+++ b/drivers/iio/frequency/adf4377.c
@@ -964,6 +964,9 @@ static int adf4377_probe(struct spi_device *spi)
st->regmap = regmap;
st->spi = spi;
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
+
mutex_init(&st->lock);
ret = adf4377_properties_parse(st);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 269/869] iio: imu: adis16400: validate SPI match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 268/869] iio: frequency: adf4377: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 270/869] iio: potentiometer: x9250: reject devices without " Greg Kroah-Hartman
` (607 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 2c01a0a1c5550b4f502c7747c06d2e57a240cd87 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but adis16400_probe() immediately dereferences the result.
Validate the match data before it is used.
Fixes: 2ef920e0e5c0 ("iio: imu: adis16400: Use separate structures rather than an array for chip info")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/adis16400.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 7e85c1b8dc160..9f8721c196a95 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -1150,6 +1150,9 @@ static int adis16400_probe(struct spi_device *spi)
/* setup the industrialio driver allocated elements */
st->variant = spi_get_device_match_data(spi);
+ if (!st->variant)
+ return -ENODATA;
+
indio_dev->name = spi_get_device_id(spi)->name;
indio_dev->channels = st->variant->channels;
indio_dev->num_channels = st->variant->num_channels;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 270/869] iio: potentiometer: x9250: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 269/869] iio: imu: adis16400: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 271/869] iio: pressure: bmp280: validate SPI " Greg Kroah-Hartman
` (606 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit d13716e3defd5b8cec3ee2c27f4d9b7e01314067 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but x9250_probe() later dereferences the result while naming the IIO
device.
Reject devices without match data before enabling the regulators.
Fixes: 66bfc528a6fd ("iio: potentiometer: Add support for the Renesas X9250 potentiometers")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/potentiometer/x9250.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/potentiometer/x9250.c b/drivers/iio/potentiometer/x9250.c
index 7353484926997..1c9e22459058b 100644
--- a/drivers/iio/potentiometer/x9250.c
+++ b/drivers/iio/potentiometer/x9250.c
@@ -155,10 +155,15 @@ static const char *const x9250_regulator_names[] = {
static int x9250_probe(struct spi_device *spi)
{
+ const struct x9250_cfg *cfg;
struct iio_dev *indio_dev;
struct x9250 *x9250;
int ret;
+ cfg = spi_get_device_match_data(spi);
+ if (!cfg)
+ return -ENODATA;
+
ret = devm_regulator_bulk_get_enable(&spi->dev, ARRAY_SIZE(x9250_regulator_names),
x9250_regulator_names);
if (ret)
@@ -176,7 +181,7 @@ static int x9250_probe(struct spi_device *spi)
x9250 = iio_priv(indio_dev);
x9250->spi = spi;
- x9250->cfg = spi_get_device_match_data(spi);
+ x9250->cfg = cfg;
x9250->wp_gpio = devm_gpiod_get_optional(&spi->dev, "wp", GPIOD_OUT_LOW);
if (IS_ERR(x9250->wp_gpio))
return dev_err_probe(&spi->dev, PTR_ERR(x9250->wp_gpio),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 271/869] iio: pressure: bmp280: validate SPI match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 270/869] iio: potentiometer: x9250: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 272/869] iio: adc: ad7606: reject devices without " Greg Kroah-Hartman
` (605 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 206fc54554c28d76c5d8f66091b846ef1dd88f64 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but bmp280_spi_probe() immediately dereferences the result.
Validate the match data before selecting the regmap bus.
Fixes: faac4dda9a91 ("iio: pressure: bmp280: Use spi_get_device_match_data()")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/pressure/bmp280-spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
index 3b90384f17d73..e303923df6757 100644
--- a/drivers/iio/pressure/bmp280-spi.c
+++ b/drivers/iio/pressure/bmp280-spi.c
@@ -83,6 +83,8 @@ static int bmp280_spi_probe(struct spi_device *spi)
struct regmap *regmap;
chip_info = spi_get_device_match_data(spi);
+ if (!chip_info)
+ return -ENODATA;
if (chip_info->spi_read_extra_byte)
bmp_regmap_bus = &bmp380_regmap_bus;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 272/869] iio: adc: ad7606: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 271/869] iio: pressure: bmp280: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 273/869] iio: adc: max11205: " Greg Kroah-Hartman
` (604 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 7830650d5293a0f412a869225262ca51b661e49f ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ad7606_spi_probe() dereferences the returned bus information to pass
the chip information and bus operations to the core, causing a NULL
pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before entering the core.
Fixes: bc69e9fffde4 ("iio: adc: ad7606: Add compatibility to fw_nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7606_spi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c
index f28e4ca377076..bec3f656406bf 100644
--- a/drivers/iio/adc/ad7606_spi.c
+++ b/drivers/iio/adc/ad7606_spi.c
@@ -456,7 +456,11 @@ static const struct ad7606_bus_info ad7616_bus_info = {
static int ad7606_spi_probe(struct spi_device *spi)
{
- const struct ad7606_bus_info *bus_info = spi_get_device_match_data(spi);
+ const struct ad7606_bus_info *bus_info;
+
+ bus_info = spi_get_device_match_data(spi);
+ if (!bus_info)
+ return -ENODATA;
return ad7606_probe(&spi->dev, spi->irq, NULL,
bus_info->chip_info, bus_info->bops);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 273/869] iio: adc: max11205: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 272/869] iio: adc: ad7606: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 274/869] iio: adc: mcp3911: " Greg Kroah-Hartman
` (603 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit a07b5db685b2a3084240f9b4a9ee44f3b478c6e3 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
max11205_probe() immediately dereferences the returned chip information
to set the IIO device name, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.
Fixes: bf3c855be801 ("iio: adc: max11205: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/max11205.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/adc/max11205.c b/drivers/iio/adc/max11205.c
index 6c803df220b6e..e8404973b01a0 100644
--- a/drivers/iio/adc/max11205.c
+++ b/drivers/iio/adc/max11205.c
@@ -117,6 +117,8 @@ static int max11205_probe(struct spi_device *spi)
ad_sd_init(&st->sd, indio_dev, spi, &max11205_sigma_delta_info);
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
indio_dev->name = st->chip_info->name;
indio_dev->modes = INDIO_DIRECT_MODE;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 274/869] iio: adc: mcp3911: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 273/869] iio: adc: max11205: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 275/869] iio: adc: ti-adc128s052: validate SPI " Greg Kroah-Hartman
` (602 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit d3410a48d5eb9dd8238099cb0ee368d12005a385 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
mcp3911_probe() stores the result and later calls through chip->config
and accesses other chip-specific fields, causing a NULL pointer
dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.
Fixes: 732ad34260d3 ("iio: adc: mcp3911: add support for the whole MCP39xx family")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/mcp3911.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
index a6f21791c6859..5bdfe5e267188 100644
--- a/drivers/iio/adc/mcp3911.c
+++ b/drivers/iio/adc/mcp3911.c
@@ -722,6 +722,8 @@ static int mcp3911_probe(struct spi_device *spi)
adc = iio_priv(indio_dev);
adc->spi = spi;
adc->chip = spi_get_device_match_data(spi);
+ if (!adc->chip)
+ return -ENODATA;
ret = devm_regulator_get_enable_read_voltage(dev, "vref");
if (ret < 0 && ret != -ENODEV)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 275/869] iio: adc: ti-adc128s052: validate SPI match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 274/869] iio: adc: mcp3911: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 276/869] iio: accel: adxl313: reject devices without " Greg Kroah-Hartman
` (601 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 4ac257f2fd2a9cac00e748486fa003b4e1cc453e ]
SPI driver_override allows a device to bind to this driver without
matching either the firmware tables or SPI device ID table. In that
case, spi_get_device_match_data() returns NULL.
adc128_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before it reaches the match data access.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.
Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-adc128s052.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
index 4ae65793ad9b3..19c30d60c504c 100644
--- a/drivers/iio/adc/ti-adc128s052.c
+++ b/drivers/iio/adc/ti-adc128s052.c
@@ -196,12 +196,14 @@ static int adc128_probe(struct spi_device *spi)
adc = iio_priv(indio_dev);
adc->spi = spi;
- indio_dev->name = spi_get_device_id(spi)->name;
+ config = spi_get_device_match_data(spi);
+ if (!config)
+ return -ENODATA;
+
+ indio_dev->name = spi->modalias;
indio_dev->modes = INDIO_DIRECT_MODE;
indio_dev->info = &adc128_info;
- config = spi_get_device_match_data(spi);
-
indio_dev->channels = config->channels;
indio_dev->num_channels = config->num_channels;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 276/869] iio: accel: adxl313: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 275/869] iio: adc: ti-adc128s052: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 277/869] iio: accel: adxl380: " Greg Kroah-Hartman
` (600 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit defd4c0b29f1cd17caa5feebac33fc5fdf4e1916 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
adxl313_spi_probe() dereferences chip_data to select the regmap
configuration, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before selecting the configuration.
Fixes: d6e3ee74d16f ("iio: accel: adxl313: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl313_spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/adxl313_spi.c b/drivers/iio/accel/adxl313_spi.c
index dedb0885c2772..b2287f4f4442f 100644
--- a/drivers/iio/accel/adxl313_spi.c
+++ b/drivers/iio/accel/adxl313_spi.c
@@ -79,6 +79,8 @@ static int adxl313_spi_probe(struct spi_device *spi)
return ret;
chip_data = spi_get_device_match_data(spi);
+ if (!chip_data)
+ return -ENODATA;
regmap = devm_regmap_init_spi(spi,
&adxl31x_spi_regmap_config[chip_data->type]);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 277/869] iio: accel: adxl380: reject devices without match data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 276/869] iio: accel: adxl313: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 278/869] iio: adc: stm32: fix minimum sampling time values Greg Kroah-Hartman
` (599 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 9f6d174e9fa5b265e7a0a6caa0c5b579bf899702 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
adxl380_spi_probe() passes the result to adxl380_probe(), which
dereferences chip_info to set the IIO device name and operations,
causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data in the SPI frontend.
Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl380_spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/adxl380_spi.c b/drivers/iio/accel/adxl380_spi.c
index 6edd0d211ffad..b51edc021b267 100644
--- a/drivers/iio/accel/adxl380_spi.c
+++ b/drivers/iio/accel/adxl380_spi.c
@@ -26,6 +26,8 @@ static int adxl380_spi_probe(struct spi_device *spi)
struct regmap *regmap;
chip_data = spi_get_device_match_data(spi);
+ if (!chip_data)
+ return -ENODATA;
regmap = devm_regmap_init_spi(spi, &adxl380_spi_regmap_config);
if (IS_ERR(regmap))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 278/869] iio: adc: stm32: fix minimum sampling time values
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 277/869] iio: accel: adxl380: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 279/869] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() Greg Kroah-Hartman
` (598 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cheick Traore, Fabrice Gasnier,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheick Traore <cheick.traore-ext@st.com>
[ Upstream commit ef04fdc999ee40a58d513ea48d391c7dc78c908c ]
- On stm32mp15: vddcpu and vddq_ddr are not connected to internal
channel, so their sampling time shouldn't be set.
- On stm32mp13: vddcpu and vddq_ddr are connected to internal channels
and the value for vddcore was not correct. Values from the datasheet
are 1us (e.g. 1000ns) for ts_vddcore, ts_vddcpu and ts_vddq_ddr.
Fixes: 7cb2303dd024 ("iio: adc: stm32: manage min sampling time on all internal channels")
Cc: stable@vger.kernel.org
Signed-off-by: Cheick Traore <cheick.traore-ext@st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/stm32-adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index dae35ab929b62..ab4433210ad09 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -2743,7 +2743,7 @@ static const struct stm32_adc_cfg stm32h7_adc_cfg = {
.set_ovs = stm32h7_adc_set_ovs,
};
-static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 100, 100, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 0, 0, 4300, 9800 };
static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp1) == STM32_ADC_INT_CH_NB);
static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
@@ -2765,7 +2765,7 @@ static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
.set_ovs = stm32h7_adc_set_ovs,
};
-static const unsigned int stm32_adc_min_ts_mp13[] = { 100, 0, 0, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp13[] = { 1000, 1000, 1000, 4300, 9800 };
static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp13) == STM32_ADC_INT_CH_NB);
static const struct stm32_adc_cfg stm32mp13_adc_cfg = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 279/869] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 278/869] iio: adc: stm32: fix minimum sampling time values Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 280/869] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read Greg Kroah-Hartman
` (597 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Costa, Bartosz Golaszewski,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Costa <2000.costalucas@gmail.com>
[ Upstream commit 8db44cca03df066186d6220bfad9fa482d7cdc13 ]
of_find_compatible_node() returns a device_node with its reference count
incremented, but bcm2835_spi_setup() only uses the return value to test
for a matching node in the loop and never releases it.
Declare the node with a scope-based __free(device_node) cleanup so the
reference is dropped automatically when leaving the loop body, matching
the existing __free(kfree) usage in the same function.
Fixes: e19c1272c80a ("spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent")
Cc: stable@vger.kernel.org
Signed-off-by: Lucas Costa <2000.costalucas@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260925193008.127314-1-2000.costalucas@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm2835.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 192cc5ef65fb7..61f70da3959e5 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1297,7 +1297,9 @@ static int bcm2835_spi_setup(struct spi_device *spi)
}
for (i = 0; i < ARRAY_SIZE(pinctrl_compats); i++) {
- if (of_find_compatible_node(NULL, NULL, pinctrl_compats[i]))
+ struct device_node *np __free(device_node) =
+ of_find_compatible_node(NULL, NULL, pinctrl_compats[i]);
+ if (np)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 280/869] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 279/869] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 281/869] cxl/acpi: Check ACPI companion before use Greg Kroah-Hartman
` (596 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Konstantin Komarov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
[ Upstream commit e2fcb0040b0b4097b2e97f3fbe77d3b66df9e816 ]
find_log_rec() validates the on-disk LFS_RECORD_HDR.client_data_len
field (`len`, a raw u32 read straight from a mounted $LogFile page)
against the log's total available space:
len = le32_to_cpu(rh->client_data_len);
rec_len = len + log->record_header_len;
if (rec_len >= log->total_avail)
return -EINVAL;
The addition is unchecked. For len in [0xffffffd0, 0xffffffff] (i.e.
log->record_header_len away from UINT_MAX), `rec_len` wraps to a small
u32 value that trivially clears the `rec_len >= log->total_avail`
guard, so a record whose declared length is actually ~4 GiB is
reported as valid and in-page.
Because find_log_rec() wrongly accepts the record, its caller
read_log_rec_lcb() hands it back to log_replay() as good. On the
transaction-table replay leg, log_replay() re-derives the record
length directly from the same raw, still-unclamped client_data_len
field and uses it to size the restart-table blob:
rec_len = le32_to_cpu(frh->client_data_len); /* ~0xffffffff */
...
t16 = le16_to_cpu(lrh->redo_off);
rt = Add2Ptr(lrh, t16);
t32 = rec_len - t16; /* still ~4 GiB */
if (!check_rstbl(rt, t32))
return -EINVAL;
check_rstbl()'s own `bytes < ts` bounds guard is defeated because the
caller-supplied `bytes` (t32) is itself the poisoned ~4 GiB value, so
the guard can never trigger. The subsequent entry-validation loop then
walks `rt->used` (also attacker-controlled) entries of
sizeof(struct RESTART_TABLE) == 0x18 bytes each straight past the end
of the kmalloc(log->page_size) log-page buffer allocated in
read_log_page(), producing an out-of-bounds read that is reachable
simply by mounting a crafted $LogFile (no genuine dirty-page /
crash-recovery state is required). Confirmed via KASAN as a
slab-out-of-bounds read in check_rstbl(), called from log_replay() ->
ntfs_loadlog_and_replay() -> ntfs_fill_super() -> mount(2).
Fix the root cause instead of hardening every downstream consumer of
the poisoned length: make the addition in find_log_rec() overflow-safe
with check_add_overflow(), mirroring the pattern fs/ntfs3/run.c
already uses to validate other attacker-controlled on-disk
length/offset arithmetic decoded from MAPPING_PAIRS runs, e.g.:
if (check_add_overflow(vcn64, len, &next_vcn))
return -EINVAL;
...
if (check_add_overflow(lcn, len, &lcn_end))
return -EINVAL;
(fs/ntfs3/run.c, run_unpack()).
With the overflow rejected instead of silently wrapped, `rec_len` is
only ever a true, non-wrapped sum, so the existing
`rec_len >= log->total_avail` check now correctly rejects any
oversized record up front. log_replay()'s transaction-table leg then
never gets a chance to re-read the poisoned client_data_len, and
check_rstbl() is never invoked with an attacker-inflated `bytes` for
this path.
Verified on a v6.19 KASAN build: mounting a crafted $LogFile whose
client_data_len overflows trips a KASAN slab-out-of-bounds-read
report in check_rstbl() before this fix; with check_add_overflow()
applied, the same image is cleanly rejected during log replay and no
KASAN report fires.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ae15c2fc48646..ca3533a10d064 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -7,6 +7,7 @@
#include <linux/blkdev.h>
#include <linux/fs.h>
+#include <linux/overflow.h>
#include <linux/random.h>
#include <linux/slab.h>
@@ -2455,7 +2456,8 @@ static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
* Check that the length field isn't greater than the total
* available space the log file.
*/
- rec_len = len + log->record_header_len;
+ if (check_add_overflow(len, log->record_header_len, &rec_len))
+ return -EINVAL;
if (rec_len >= log->total_avail)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 281/869] cxl/acpi: Check ACPI companion before use
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 280/869] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 282/869] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped Greg Kroah-Hartman
` (595 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Dave Jiang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 371c2ad1624283b6c7a62a28199f5161d388a738 ]
Platform drivers can be forced to match devices outside their ID tables
through driver_override. cxl_acpi_probe() assumes that every bound device
has an ACPI companion and dereferences adev->dev.bus without checking the
result of ACPI_COMPANION(). Force-binding cxl_acpi to a platform device
without a companion therefore causes a NULL pointer dereference.
This was reproduced by setting the driver override for the pcspkr platform
device to cxl_acpi and binding it through sysfs:
BUG: kernel NULL pointer dereference, address: 0000000000000280
#PF: supervisor read access in kernel mode
RIP: cxl_acpi_probe+0xf4/0x220
Call Trace:
platform_probe+0x4d/0x80
really_probe+0x106/0x370
device_driver_attach+0x4c/0xa0
bind_store+0xd0/0x100
Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
companion before use") fixed the same force-binding issue in another
platform driver. Check the companion before setting up the CXL root and
return -ENODEV when it is absent.
Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260926071605.3013893-1-yaojiale02@163.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/acpi.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index bd2e282ca93a0..5e9bb0df46dd8 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -892,13 +892,17 @@ static int pair_cxl_resource(struct device *dev, void *data)
static int cxl_acpi_probe(struct platform_device *pdev)
{
- int rc;
+ struct cxl_cfmws_context ctx;
+ struct acpi_device *adev;
struct resource *cxl_res;
struct cxl_root *cxl_root;
struct cxl_port *root_port;
struct device *host = &pdev->dev;
- struct acpi_device *adev = ACPI_COMPANION(host);
- struct cxl_cfmws_context ctx;
+ int rc;
+
+ adev = ACPI_COMPANION(host);
+ if (!adev)
+ return -ENODEV;
device_lock_set_class(&pdev->dev, &cxl_root_key);
rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 282/869] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 281/869] cxl/acpi: Check ACPI companion before use Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 283/869] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines Greg Kroah-Hartman
` (594 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Loic Poulain,
Hitesh Patel, Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit eed550a8191c2f6984047a1b794b313d1bacf77d ]
The VFE 17x interrupt handler reads and clears the bus status
registers on every interrupt, but only acts on the per write master
BUF_DONE bits when bit 9 of IRQ_STATUS_0 is set as well. Bit 9 is the
ping-pong flag of image master 1. It has nothing to do with the other
write masters, and it is not guaranteed to be set in the same
interrupt in which a write master reports a completed buffer.
The bus status is read-to-clear. When a buffer done arrives while bit
9 is not set, the handler clears the status and never calls
wm_done() for it. The buffer stays queued in the driver and the video
node never receives that frame.
With one RDI streaming this is rare. With two RDIs streaming on the
same VFE, for instance two virtual channels demultiplexed by the CSID,
the interrupt rate doubles and one of the two lines loses buffer done
events continuously.
Act on the bus status alone, as the other gen2 VFE handlers do.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe-17x.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index e5ee7e717b3bc..c011f64f63e93 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -364,9 +364,8 @@ static irqreturn_t vfe_isr(int irq, void *dev)
vfe->isr_ops.comp_done(vfe, i);
for (wm = 0; wm < MSM_VFE_IMAGE_MASTERS_NUM; wm++)
- if (status0 & BIT(9))
- if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
- vfe->isr_ops.wm_done(vfe, wm);
+ if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
+ vfe->isr_ops.wm_done(vfe, wm);
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 283/869] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 282/869] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 284/869] media: qcom: camss: vfe: Fix VFE reset while another line is streaming Greg Kroah-Hartman
` (593 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Loic Poulain,
Hitesh Patel, Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit fc02156a3efb747b724a490cc50e1ad8c28a3b23 ]
On the gen2 VFE bus there is no crossbar between the RDI paths and
the bus write masters: RDI n is served by write master n. The common
vfe_get_output_v2() reflects this by mapping line->id to write master
line->id, and every gen2 VFE except 17x uses it.
The 17x code kept its own vfe_get_output(), which reserves whichever
write master is free first. That happens to be the right one as long
as a single line streams and it is RDI0. As soon as two lines of the
same VFE stream, for instance two virtual channels demultiplexed by
the CSID to RDI0 and RDI1, the second line to start is given the
write master of the other RDI. Both write masters are then programmed
with the buffer address and frame size of the wrong line. The frames
are truncated to the smaller of the two buffers and the SMMU faults
on the larger one.
Use vfe_get_output_v2() on 17x like the other gen2 VFEs and drop the
duplicate. This also removes an error path that released
output->wm_idx[0] before it had been assigned.
The gen1 VFEs are not affected: they have a bus crossbar and any write
master can serve any line, so vfe_reserve_wm() is correct there.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/qcom/camss/camss-vfe-17x.c | 41 +------------------
1 file changed, 1 insertion(+), 40 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index c011f64f63e93..62c2405359a06 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -382,45 +382,6 @@ static int vfe_halt(struct vfe_device *vfe)
return 0;
}
-static int vfe_get_output(struct vfe_line *line)
-{
- struct vfe_device *vfe = to_vfe(line);
- struct vfe_output *output;
- unsigned long flags;
- int wm_idx;
-
- spin_lock_irqsave(&vfe->output_lock, flags);
-
- output = &line->output;
- if (output->state > VFE_OUTPUT_RESERVED) {
- dev_err(vfe->camss->dev, "Output is running\n");
- goto error;
- }
-
- output->wm_num = 1;
-
- wm_idx = vfe_reserve_wm(vfe, line->id);
- if (wm_idx < 0) {
- dev_err(vfe->camss->dev, "Can not reserve wm\n");
- goto error_get_wm;
- }
- output->wm_idx[0] = wm_idx;
-
- output->drop_update_idx = 0;
-
- spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return 0;
-
-error_get_wm:
- vfe_release_wm(vfe, output->wm_idx[0]);
- output->state = VFE_OUTPUT_OFF;
-error:
- spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return -EINVAL;
-}
-
/*
* vfe_enable - Enable streaming on VFE line
* @line: VFE line
@@ -441,7 +402,7 @@ static int vfe_enable(struct vfe_line *line)
mutex_unlock(&vfe->stream_lock);
- ret = vfe_get_output(line);
+ ret = vfe_get_output_v2(line);
if (ret < 0)
goto error_get_output;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 284/869] media: qcom: camss: vfe: Fix VFE reset while another line is streaming
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 283/869] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 285/869] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists Greg Kroah-Hartman
` (592 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hitesh Patel, Bryan ODonoghue,
Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit e5d4b0e69a4017fd39354499c9d7583f625f0524 ]
vfe_disable_output() stops the write masters of the line being
disabled and then resets the whole VFE. The reset is not limited to
that line.
When two lines of one VFE stream at the same time, which is the case
whenever a CSID demultiplexes several virtual channels to different
RDIs, stopping the first line resets the VFE underneath the second
line. The second line's write master configuration is wiped, the
buffers it had in flight are never completed, and the VFE is left in
a state in which the next global reset is not acknowledged. Stopping
or restarting the second line then fails with:
VFE reset timeout
Move the reset to vfe_disable() and do it under stream_lock, as part
of the decrement that makes the count reach zero, so that exactly one
caller resets and no line can be enabled while the reset runs.
Stopping the line's write masters is enough to quiesce that line on
its own. With a single line streaming, the reset happens exactly as
before.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[bod: Converted vfe_disable_output to void]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index 20e0d6604fa93..bf76ac3fd4c52 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -804,7 +804,7 @@ int vfe_put_output(struct vfe_line *line)
return 0;
}
-static int vfe_disable_output(struct vfe_line *line)
+static void vfe_disable_output(struct vfe_line *line)
{
struct vfe_device *vfe = to_vfe(line);
struct vfe_output *output = &line->output;
@@ -816,8 +816,6 @@ static int vfe_disable_output(struct vfe_line *line)
vfe->res->hw_ops->vfe_wm_stop(vfe, output->wm_idx[i]);
output->gen2.active_num = 0;
spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return vfe_reset(vfe);
}
/*
@@ -829,21 +827,19 @@ static int vfe_disable_output(struct vfe_line *line)
int vfe_disable(struct vfe_line *line)
{
struct vfe_device *vfe = to_vfe(line);
- int ret;
+ int ret = 0;
- ret = vfe_disable_output(line);
- if (ret)
- goto error;
+ vfe_disable_output(line);
vfe_put_output(line);
mutex_lock(&vfe->stream_lock);
- vfe->stream_count--;
+ if (--vfe->stream_count == 0)
+ ret = vfe_reset(vfe);
mutex_unlock(&vfe->stream_lock);
-error:
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 285/869] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 284/869] media: qcom: camss: vfe: Fix VFE reset while another line is streaming Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 286/869] media: venus: Fix iova allocation from restrict region Greg Kroah-Hartman
` (591 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenmeng Liu, Bryan ODonoghue,
Hans de Goede, Cory Keitz, Loic Poulain, Vladimir Zapolskiy,
Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 583b27edfe669fe27c631b4ac77c0ce0250f7bba ]
The "gcc_axi_hf" clock is correctly listed in the clock list of the
8775p 2 main VFE-s, but it is missing from all the VFE-lite clock lists,
causing these to not work on platforms where the firmware allows turning
off "gcc_axi_hf".
Add the missing "gcc_axi_hf" to fix the VFE-lite blocks not working on
these platforms.
Fixes: 924f45e58b1fe ("media: qcom: camss: Add missing clocks for VFE lite on sa8775p")
Cc: stable@vger.kernel.org
Suggested-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Tested-by: Cory Keitz <ckeitz@amazon.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss.c | 25 ++++++++++++++---------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index c1148f6ad6b26..0fb43cb6348da 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2926,10 +2926,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE2 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -2951,10 +2952,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE3 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -2976,10 +2978,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE4 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -3001,10 +3004,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE5 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -3026,10 +3030,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE6 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 286/869] media: venus: Fix iova allocation from restrict region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 285/869] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 287/869] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP Greg Kroah-Hartman
` (590 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vikash Garodia, Dmitry Baryshkov,
Vishnu Reddy, Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 953439251b596cee039fbfeaffeb1d88a4b40f43 ]
The VPU issues DMA through several SMMU streams, and the hardware does
not give every stream the same addressable range. The non-pixel stream
cannot address the low 600MB of IOVA space, while the pixel stream can
address the full range:
+-----------------------------------------------------------+
| non-pixel stream addressable range (600 MB - 3.5 GB) |
| 0x25800000 - 0xe0000000 |
+-----------------------------------------------------------+
| pixel stream addressable range (0 - 3.5 GB) |
| 0x00000000 - 0xe0000000 |
+-----------------------------------------------------------+
A single "iommus" property on the video-codec node puts every stream
in one IOMMU domain sharing one IOVA space, so nothing stops a
non-pixel buffer from landing below 600MB. Once an allocation lands
below that boundary the hardware faults, which shows up as unhandled
SMMU page faults and spontaneous reboots.
https://gitlab.freedesktop.org/drm/msm/-/work_items/100
Fix this by reserving the 0-600MB range, below the boundary the
non-pixel stream cannot address, using dma_iova_try_alloc() so the
IOMMU-DMA core never hands that range out to a real DMA mapping. This
reserves only IOVA space, it does not allocate any physical memory.
Since sub-nodes for non-pixel, pixel, and secure streams do not exist
yet and only a single device is available, the restriction is applied
to both non-pixel and pixel stream IDs.
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[bod: took iova_state description from iris and applied to venus in core.h]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/core.c | 66 ++++++++++++++++++++++--
drivers/media/platform/qcom/venus/core.h | 6 +++
2 files changed, 69 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 66a750ed16096..236934a0022a9 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -374,6 +374,57 @@ static int venus_add_dynamic_nodes(struct venus_core *core)
static void venus_remove_dynamic_nodes(struct venus_core *core) {}
#endif
+static void venus_unreserve_iova_region(struct device *dev, struct dma_iova_state *state)
+{
+ unsigned int i;
+
+ for (i = 0; dma_iova_size(&state[i]); i++)
+ dma_iova_free(dev, &state[i]);
+}
+
+static int venus_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state,
+ unsigned long start, unsigned long size)
+{
+ unsigned long dma_limit = dev->bus_dma_limit;
+ unsigned long end, rem, chunk;
+ struct dma_iova_state *state;
+ unsigned int count = 0;
+ int ret = -ENOMEM;
+
+ state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL);
+ if (!state)
+ return ret;
+
+ end = start + size;
+ rem = end - max(start, PAGE_SIZE);
+ dev->bus_dma_limit = end - 1;
+
+ while (rem) {
+ chunk = min(end & -end, (u64)1 << (fls64(rem) - 1));
+
+ if (!dma_iova_try_alloc(dev, &state[count], 0, chunk))
+ goto err_free_iova;
+
+ if (state[count].addr != end - chunk || state[count].__size != chunk)
+ goto err_free_iova;
+
+ rem -= chunk;
+ end -= chunk;
+ count++;
+ }
+
+ *iova_state = state;
+ dev->bus_dma_limit = dma_limit;
+
+ return 0;
+
+err_free_iova:
+ venus_unreserve_iova_region(dev, state);
+ dev->bus_dma_limit = dma_limit;
+
+ return ret;
+}
+
static int venus_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -418,10 +469,15 @@ static int venus_probe(struct platform_device *pdev)
return ret;
}
- ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+ ret = venus_reserve_iova_region(dev, &core->iova_state, VENUS_NP_RESERVE_IOVA_START,
+ VENUS_NP_RESERVE_IOVA_SIZE);
if (ret)
goto err_core_put;
+ ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+ if (ret)
+ goto err_unresv_iova_region;
+
dma_set_max_seg_size(dev, UINT_MAX);
INIT_LIST_HEAD(&core->instances);
@@ -431,13 +487,13 @@ static int venus_probe(struct platform_device *pdev)
ret = hfi_create(core, &venus_core_ops);
if (ret)
- goto err_core_put;
+ goto err_unresv_iova_region;
ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
"venus", core);
if (ret)
- goto err_core_put;
+ goto err_unresv_iova_region;
venus_assign_register_offsets(core);
@@ -522,6 +578,8 @@ static int venus_probe(struct platform_device *pdev)
v4l2_device_unregister(&core->v4l2_dev);
err_hfi_destroy:
hfi_destroy(core);
+err_unresv_iova_region:
+ venus_unreserve_iova_region(dev, core->iova_state);
err_core_put:
if (core->pm_ops->core_put)
core->pm_ops->core_put(core);
@@ -559,6 +617,8 @@ static void venus_remove(struct platform_device *pdev)
hfi_destroy(core);
+ venus_unreserve_iova_region(dev, core->iova_state);
+
mutex_destroy(&core->pm_lock);
mutex_destroy(&core->lock);
venus_dbgfs_deinit(core);
diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
index 70e7b40affa93..497e8f50290fe 100644
--- a/drivers/media/platform/qcom/venus/core.h
+++ b/drivers/media/platform/qcom/venus/core.h
@@ -8,6 +8,7 @@
#define __VENUS_CORE_H_
#include <linux/bitops.h>
+#include <linux/dma-mapping.h>
#include <linux/list.h>
#include <media/videobuf2-v4l2.h>
#include <media/v4l2-ctrls.h>
@@ -30,6 +31,9 @@
#define VENUS_MAX_FPS 240
+#define VENUS_NP_RESERVE_IOVA_START 0x0
+#define VENUS_NP_RESERVE_IOVA_SIZE 0x25800000
+
extern int venus_fw_debug;
struct freq_tbl {
@@ -183,6 +187,7 @@ struct venus_format {
* @dump_core: a flag indicating that a core dump is required
* @ocs: OF changeset pointer
* @hwmode_dev: a flag indicating that HW_CTRL_TRIGGER is used in clock driver
+ * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region
*/
struct venus_core {
void __iomem *base;
@@ -243,6 +248,7 @@ struct venus_core {
unsigned long dump_core;
struct of_changeset *ocs;
bool hwmode_dev;
+ struct dma_iova_state *iova_state;
};
struct vdec_controls {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 287/869] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 286/869] media: venus: Fix iova allocation from restrict region Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 288/869] media: iris: Fix frame interval enumeration for non-divisor framerates Greg Kroah-Hartman
` (589 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishnu Reddy, Vikash Garodia,
Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 1facae9bc3c1cfcabc77184754d64c349831cbc5 ]
The bus_info field returned by VIDIOC_QUERYCAP used the abbreviated
prefix "plat:" instead of the standard "platform:" prefix expected
for platform devices. v4l2-compliance validates that bus_info for
platform devices starts with "platform:", and fails otherwise:
fail: ../utils/v4l2-compliance/v4l2-compliance.cpp(671):
missing bus_info prefix ('plat:aa00000.video-codec:dec')
Update the format string in iris_querycap() to use "platform:" so
that v4l2-compliance bus_info check passes.
Fixes: 94ef75095d5e ("media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vidc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index 83b2b0e59f035..d6db5ae85990b 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -462,7 +462,7 @@ static int iris_querycap(struct file *filp, void *fh, struct v4l2_capability *ca
info = "enc";
}
snprintf(cap->bus_info, sizeof(cap->bus_info),
- "plat:%s:%s", dev_name(core->dev), info);
+ "platform:%s:%s", dev_name(core->dev), info);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 288/869] media: iris: Fix frame interval enumeration for non-divisor framerates
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 287/869] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 289/869] ALSA: sgio2audio: Only free successfully requested IRQs Greg Kroah-Hartman
` (588 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Vishnu Reddy,
Bryan ODonoghue, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 3ad393b701dd99274f09403185f71ec7a93135bd ]
iris_enum_frameintervals() advertised frame intervals using
V4L2_FRMIVAL_TYPE_STEPWISE with step=1/MAXIMUM_FPS where MAXIMUM_FPS
is 480. This caused client to enumerate only framerates of the form
MAXIMUM_FPS/n (where n is a positive integer), restricting support to
exact divisors of MAXIMUM_FPS (e.g., 480, 240, 160, 120, 96, 80, 60,
30, 24, 1).
Framerates that are not exact divisors of MAXIMUM_FPS, such as 29 fps,
25 fps, were excluded from the enumerated list. There is no hardware
restriction to framerates that are exact divisors of MAXIMUM_FPS. This
caused GStreamer caps negotiation to fail with an "internal data
stream error" when encoding content at such framerates.
Fix this by using V4L2_FRMIVAL_TYPE_CONTINUOUS. With CONTINUOUS type,
GStreamer creates a continuous framerate range [1, max_fps], allowing
any integer framerate within the range to pass caps negotiation. The
step field is set to 1/1 as required by the V4L2 specification for
continuous frame intervals.
Fixes: a6882431a138 ("media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vidc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index d6db5ae85990b..b916e8c8a6456 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -434,14 +434,14 @@ static int iris_enum_frameintervals(struct file *filp, void *fh,
mbpf = NUM_MBS_PER_FRAME(fival->height, fival->width);
fps = DIV_ROUND_UP(core->iris_platform_data->max_core_mbps, mbpf);
- fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+ fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
fival->stepwise.min.numerator = 1;
fival->stepwise.min.denominator =
min_t(u32, fps, MAXIMUM_FPS);
fival->stepwise.max.numerator = 1;
fival->stepwise.max.denominator = 1;
fival->stepwise.step.numerator = 1;
- fival->stepwise.step.denominator = MAXIMUM_FPS;
+ fival->stepwise.step.denominator = 1;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 289/869] ALSA: sgio2audio: Only free successfully requested IRQs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 288/869] media: iris: Fix frame interval enumeration for non-divisor framerates Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 290/869] m68k: dmasound: Keep the Q40 IRQ handler registered Greg Kroah-Hartman
` (587 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit af3d225b639c6f9fb8fd5e1e27f11672d56724b6 ]
snd_sgio2audio_create() calls snd_sgio2audio_free() when an IRQ
request fails. The cleanup helper currently walks the complete IRQ table,
including entries whose request_irq() calls have not been attempted yet.
free_irq() then receives an IRQ and dev_id pair that was never registered.
Pass the number of successfully requested IRQs to the cleanup helper on
the request failure path, while retaining the full-table cleanup for
teardown after all requests have succeeded.
Fixes: 862c2c0a61c5 ("ALSA: ALSA driver for SGI O2 audio board")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929084540.2065213-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/mips/sgio2audio.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
index 077fdf2181c15..e3480f23f7f3c 100644
--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -742,7 +742,8 @@ static struct {
/* ALSA driver */
-static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
+static int snd_sgio2audio_free(struct snd_sgio2audio *chip,
+ unsigned int irq_count)
{
int i;
@@ -752,7 +753,7 @@ static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
writeq(0, &mace->perif.audio.control);
/* release IRQ's */
- for (i = 0; i < ARRAY_SIZE(snd_sgio2_isr_table); i++)
+ for (i = 0; i < irq_count; i++)
free_irq(snd_sgio2_isr_table[i].irq,
&chip->channel[snd_sgio2_isr_table[i].idx]);
@@ -768,7 +769,7 @@ static int snd_sgio2audio_dev_free(struct snd_device *device)
{
struct snd_sgio2audio *chip = device->device_data;
- return snd_sgio2audio_free(chip);
+ return snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
}
static const struct snd_device_ops ops = {
@@ -819,7 +820,7 @@ static int snd_sgio2audio_create(struct snd_card *card,
0,
snd_sgio2_isr_table[i].desc,
&chip->channel[snd_sgio2_isr_table[i].idx])) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, i);
printk(KERN_ERR "sgio2audio: cannot allocate irq %d\n",
snd_sgio2_isr_table[i].irq);
return -EBUSY;
@@ -843,13 +844,13 @@ static int snd_sgio2audio_create(struct snd_card *card,
/* initialize the AD1843 codec */
err = ad1843_init(&chip->ad1843);
if (err < 0) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
return err;
}
err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
if (err < 0) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
return err;
}
*rchip = chip;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 290/869] m68k: dmasound: Keep the Q40 IRQ handler registered
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 289/869] ALSA: sgio2audio: Only free successfully requested IRQs Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 291/869] ALSA: core: Check shutdown flag at D0 power-state, too Greg Kroah-Hartman
` (586 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit fa2e77ac5bf81a60864e71fc72196227692d7162 ]
Q40PlayNextFrame() re-registers the sample IRQ after stopping it. This
function can be called with dmasound.lock held and from the sample IRQ
handler, so free_irq() and request_irq() can sleep or deadlock. A failed
re-registration can also leave playback without an IRQ.
Register one handler for the lifetime of the driver and select mono or
stereo sample handling inside that handler. Call the frame completion
path after releasing dmasound.lock so it can refill the queue safely.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929085400.2068977-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/oss/dmasound/dmasound_q40.c | 65 ++++++++++++++-----------------
1 file changed, 29 insertions(+), 36 deletions(-)
diff --git a/sound/oss/dmasound/dmasound_q40.c b/sound/oss/dmasound/dmasound_q40.c
index e25a78dd1bf2a..339311e5d8070 100644
--- a/sound/oss/dmasound/dmasound_q40.c
+++ b/sound/oss/dmasound/dmasound_q40.c
@@ -49,9 +49,8 @@ static int Q40SetFormat(int format);
static int Q40SetVolume(int volume);
static void Q40PlayNextFrame(int index);
static void Q40Play(void);
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy);
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy);
-static void Q40Interrupt(void);
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy);
+static void q40_frame_done(void);
/*** Mid level stuff *********************************************************/
@@ -372,8 +371,8 @@ static void Q40Free(void *ptr, unsigned int size)
static int __init Q40IrqInit(void)
{
/* Register interrupt handler. */
- if (request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
- "DMA sound", Q40Interrupt))
+ if (request_irq(Q40_IRQ_SAMPLE, q40_audio_interrupt, 0,
+ "DMA sound", q40_frame_done))
return 0;
return(1);
@@ -384,7 +383,7 @@ static int __init Q40IrqInit(void)
static void Q40IrqCleanUp(void)
{
master_outb(0,SAMPLE_ENABLE_REG);
- free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
+ free_irq(Q40_IRQ_SAMPLE, q40_frame_done);
}
#endif /* MODULE */
@@ -403,7 +402,6 @@ static void Q40PlayNextFrame(int index)
u_char *start;
u_long size;
u_char speed;
- int error;
/* used by Q40Play() if all doubts whether there really is something
* to be played are already wiped out.
@@ -420,15 +418,6 @@ static void Q40PlayNextFrame(int index)
speed=(dmasound.hard.speed==10000 ? 0 : 1);
master_outb( 0,SAMPLE_ENABLE_REG);
- free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
- if (dmasound.soft.stereo)
- error = request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
- "Q40 sound", Q40Interrupt);
- else
- error = request_irq(Q40_IRQ_SAMPLE, Q40MonoInterrupt, 0,
- "Q40 sound", Q40Interrupt);
- if (error && printk_ratelimit())
- pr_err("Couldn't register sound interrupt\n");
master_outb( speed, SAMPLE_RATE_REG);
master_outb( 1,SAMPLE_CLEAR_REG);
@@ -456,31 +445,35 @@ static void Q40Play(void)
spin_unlock_irqrestore(&dmasound.lock, flags);
}
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy)
-{
- spin_lock(&dmasound.lock);
- if (q40_sc>1){
- *DAC_LEFT=*q40_pp++;
- *DAC_RIGHT=*q40_pp++;
- q40_sc -=2;
- master_outb(1,SAMPLE_CLEAR_REG);
- }else Q40Interrupt();
- spin_unlock(&dmasound.lock);
- return IRQ_HANDLED;
-}
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy)
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy)
{
+ bool frame_done = false;
+
spin_lock(&dmasound.lock);
- if (q40_sc>0){
- *DAC_LEFT=*q40_pp;
- *DAC_RIGHT=*q40_pp++;
- q40_sc --;
- master_outb(1,SAMPLE_CLEAR_REG);
- }else Q40Interrupt();
+ if (dmasound.hard.stereo) {
+ if (q40_sc > 1) {
+ *DAC_LEFT = *q40_pp++;
+ *DAC_RIGHT = *q40_pp++;
+ q40_sc -= 2;
+ master_outb(1, SAMPLE_CLEAR_REG);
+ } else {
+ frame_done = true;
+ }
+ } else if (q40_sc > 0) {
+ *DAC_LEFT = *q40_pp;
+ *DAC_RIGHT = *q40_pp++;
+ q40_sc--;
+ master_outb(1, SAMPLE_CLEAR_REG);
+ } else {
+ frame_done = true;
+ }
spin_unlock(&dmasound.lock);
+ if (frame_done)
+ q40_frame_done();
return IRQ_HANDLED;
}
-static void Q40Interrupt(void)
+
+static void q40_frame_done(void)
{
if (!write_sq.active) {
/* playing was interrupted and sq_reset() has already cleared
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 291/869] ALSA: core: Check shutdown flag at D0 power-state, too
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 290/869] m68k: dmasound: Keep the Q40 IRQ handler registered Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 292/869] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe() Greg Kroah-Hartman
` (585 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit ad63c5b62843895e8c3cd7291ed07cc659df0355 ]
The snd_power_ref_and_wait() skips the card->shutdown check when the
card is already in D0 state and immediately returns as successful, by
assuming the all-green in D0. This assumption makes the code after
this sync point behaving as if all power is up and ready, even though
actually it might have been already at the disconnected state.
Add the missing check of shutdown flag there for the more consistent
behavior.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260929125346.1478631-2-tiwai@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/init.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sound/core/init.c b/sound/core/init.c
index 3a45fa6fc515e..2bf98de846f61 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1141,12 +1141,12 @@ EXPORT_SYMBOL(snd_card_file_remove);
int snd_power_ref_and_wait(struct snd_card *card)
{
snd_power_ref(card);
- if (snd_power_get_state(card) == SNDRV_CTL_POWER_D0)
- return 0;
- wait_event_cmd(card->power_sleep,
- card->shutdown ||
- snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
- snd_power_unref(card), snd_power_ref(card));
+ if (snd_power_get_state(card) != SNDRV_CTL_POWER_D0) {
+ wait_event_cmd(card->power_sleep,
+ card->shutdown ||
+ snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
+ snd_power_unref(card), snd_power_ref(card));
+ }
if (card->shutdown) {
snd_power_unref(card);
return -ENODEV;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 292/869] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 291/869] ALSA: core: Check shutdown flag at D0 power-state, too Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 293/869] pseries/plpks: fix error handling in plpks_read_var() Greg Kroah-Hartman
` (584 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hal Feng, Brian Masney,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 1c4f9480473917558908c083d1293b4ebb3d50c5 ]
In jh7110_ispcrg_probe(), the error path for pm_runtime_get_sync()
failure directly returns without releasing the runtime PM reference
count. The call to __pm_runtime_resume() increments the usage count
unconditionally before attempting to resume, and does not decrement it
on failure. Thus the leaked reference makes it impossible to suspend
the device later.
All other error paths correctly jump to err_exit and call
pm_runtime_put_sync(). Fix this by replacing pm_runtime_get_sync()
with pm_runtime_resume_and_get(), which properly balances the
reference count on error.
Cc: stable@vger.kernel.org
Fixes: 81279f5d0812 ("clk: starfive: Add StarFive JH7110 Image-Signal-Process clock driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Hal Feng <hal.feng@starfivetech.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/starfive/clk-starfive-jh7110-isp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/starfive/clk-starfive-jh7110-isp.c b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
index f3fa069db193e..c02c8b29a1230 100644
--- a/drivers/clk/starfive/clk-starfive-jh7110-isp.c
+++ b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
@@ -130,7 +130,7 @@ static int jh7110_ispcrg_probe(struct platform_device *pdev)
/* enable power domain and clocks */
pm_runtime_enable(priv->dev);
- ret = pm_runtime_get_sync(priv->dev);
+ ret = pm_runtime_resume_and_get(priv->dev);
if (ret < 0)
return dev_err_probe(priv->dev, ret, "failed to turn on power\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 293/869] pseries/plpks: fix error handling in plpks_read_var()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 292/869] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 294/869] pseries/plpks: validate input to plpks_signed_update_var() Greg Kroah-Hartman
` (583 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit d52a1659cb1718f93166ab8dd8621237e564a1c4 ]
When a PLPKS variable is initialized without a policy and used to read an
object with the PLPKS_WRAPPINGKEY policy set, the hypervisor returns
H_AUTHORITY along with the object's policy. However, plpks_read_var()
currently treats this the same as any other H_AUTHORITY failure and returns
an error without propagating the policy information to the caller.
Distinguish this case from other H_AUTHORITY failures and propagate the
returned policy to the caller while preserving the authorization error.
Remove the explicit assignment of zero to rc on H_SUCCESS, as it is
redundant.
Also validate the PLPKS variable pointer before dereferencing it.
Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-2-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index b1667ed05f988..1ea3ef0a36254 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -562,6 +562,9 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
u8 *output;
int rc;
+ if (!var)
+ return -EINVAL;
+
if (var->namelen > PLPKS_MAX_NAME_SIZE)
return -EINVAL;
@@ -593,22 +596,21 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
virt_to_phys(var->name), var->namelen, virt_to_phys(output),
maxobjsize);
-
if (rc != H_SUCCESS) {
rc = pseries_status_to_err(rc);
- goto out_free_output;
+ if (rc != -EPERM || !retbuf[1])
+ goto out_free_output;
+ goto out_copy_policy;
}
if (!var->data || var->datalen > retbuf[0])
var->datalen = retbuf[0];
- var->policy = retbuf[1];
-
if (var->data)
memcpy(var->data, output, var->datalen);
- rc = 0;
-
+out_copy_policy:
+ var->policy = retbuf[1];
out_free_output:
kfree(output);
out_free_label:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 294/869] pseries/plpks: validate input to plpks_signed_update_var()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 293/869] pseries/plpks: fix error handling in plpks_read_var() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 295/869] pseries/plpks: clear sensitive PLPKS buffers Greg Kroah-Hartman
` (582 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit b59ff2d50b817eeec1259f357aae821c7834007f ]
plpks_signed_update_var() dereferences the supplied PLPKS variable pointer
without validating it. A NULL argument could therefore result in a NULL
pointer dereference.
Reject a NULL pointer argument with -EINVAL.
Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-4-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 1ea3ef0a36254..3686d66277262 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -434,6 +434,9 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
u64 continuetoken = 0;
u64 timeout = 0;
+ if (!var)
+ return -EINVAL;
+
if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 295/869] pseries/plpks: clear sensitive PLPKS buffers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 294/869] pseries/plpks: validate input to plpks_signed_update_var() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 296/869] pseries/plpks: clear signed update authentication buffer Greg Kroah-Hartman
` (581 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Nayna Jain, Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit fe18716ff314eb32299048fd64242d31b4e852cf ]
PLPKS read, remove, and write operations use authentication buffers that
contain passwords. The read output buffer may also contain sensitive data.
Freeing these buffers with kfree(), without wiping the contents, can leave
sensitive data in memory.
Use kfree_sensitive() to wipe the buffers when freeing them.
Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-5-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 3686d66277262..dbfbf12bda3c0 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -518,7 +518,7 @@ int plpks_write_var(struct plpks_var var)
rc = pseries_status_to_err(rc);
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
@@ -552,7 +552,7 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
rc = pseries_status_to_err(rc);
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
@@ -615,11 +615,11 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
out_copy_policy:
var->policy = retbuf[1];
out_free_output:
- kfree(output);
+ kfree_sensitive(output);
out_free_label:
kfree(label);
out_free_auth:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 296/869] pseries/plpks: clear signed update authentication buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 295/869] pseries/plpks: clear sensitive PLPKS buffers Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 297/869] pseries/plpks: clear SED key data after use Greg Kroah-Hartman
` (580 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Nayna Jain, Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 63de55024e7c85975f4410380323edb05b186d7c ]
The PLPKS signed update operation uses an authentication buffer that
contains a password. Freeing this buffer with kfree(), without wiping
the contents, can leave sensitive data in memory.
Use kfree_sensitive() to wipe the buffer when freeing it.
Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-7-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index dbfbf12bda3c0..719f7e513c5a4 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -479,7 +479,7 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 297/869] pseries/plpks: clear SED key data after use
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 296/869] pseries/plpks: clear signed update authentication buffer Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 298/869] ASoC: pcm6240: do not free an unrequested IRQ Greg Kroah-Hartman
` (579 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Greg Joyce, Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 217ba01e5b9096091acc2c1a3776cb3eb88c00ff ]
Explicitly clear the temporary buffer containing SED key data after read
and write operations.
Fixes: ec8cf230cecc ("powerpc/pseries: PLPKS SED Opal keystore support")
Cc: stable@vger.kernel.org # 6.7
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Greg Joyce <gjoyce@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-8-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks_sed_ops.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks_sed_ops.c b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
index 7c873c9589eff..ac3ec2ca7fbee 100644
--- a/arch/powerpc/platforms/pseries/plpks_sed_ops.c
+++ b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
@@ -84,14 +84,16 @@ int sed_read_key(char *keyname, char *key, u_int *keylen)
ret = plpks_read_os_var(&var);
if (ret != 0)
- return ret;
+ goto out;
len = min_t(u16, be32_to_cpu(data.key_len), var.datalen);
memcpy(key, data.key, len);
key[len] = '\0';
*keylen = len;
- return 0;
+out:
+ memzero_explicit(&data, sizeof(data));
+ return ret;
}
/*
@@ -102,6 +104,7 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
struct plpks_var var;
struct plpks_sed_object_data data;
struct plpks_var_name vname;
+ int ret;
plpks_init_var(&var, keyname);
@@ -127,5 +130,8 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
vname.name = var.name;
plpks_remove_var(var.component, var.os, vname);
- return plpks_write_var(var);
+ ret = plpks_write_var(var);
+ memzero_explicit(&data, sizeof(data));
+
+ return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 298/869] ASoC: pcm6240: do not free an unrequested IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 297/869] pseries/plpks: clear SED key data after use Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 299/869] nilfs2: clear dirty flag on bdev buffers on log write failure Greg Kroah-Hartman
` (578 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 995b96380ba5d98131acc162608da3538e1395d8 ]
The driver obtains an IRQ number from device tree but never requests an
IRQ handler for the PCM6240 device. Removing the device must not pass
that number to free_irq().
Leave IRQ ownership to a matching request path if one is added later.
Fixes: 1324eafd37aa ("ASoc: PCM6240: Create PCM6240 Family driver code")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929095920.2092147-1-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/pcm6240.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/sound/soc/codecs/pcm6240.c b/sound/soc/codecs/pcm6240.c
index 08cc52b374a9a..0275fb420ef2b 100644
--- a/sound/soc/codecs/pcm6240.c
+++ b/sound/soc/codecs/pcm6240.c
@@ -2034,8 +2034,6 @@ static const struct regmap_config pcmdevice_i2c_regmap = {
static void pcmdevice_remove(struct pcmdevice_priv *pcm_dev)
{
- if (pcm_dev->irq)
- free_irq(pcm_dev->irq, pcm_dev);
mutex_destroy(&pcm_dev->codec_lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 299/869] nilfs2: clear dirty flag on bdev buffers on log write failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 298/869] ASoC: pcm6240: do not free an unrequested IRQ Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 300/869] nilfs2: ignore non-fatal signals during synchronous log write wait Greg Kroah-Hartman
` (577 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi, Viacheslav Dubeyko,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit 6faad04a002603d800134398fcd042b403b32d35 ]
Since the commit referenced in the Fixes tag stopped directly calling
inode_attach_wb(), a dirty flag is set on buffers (with
mark_buffer_dirty()) allocated to the backing device for segment
summaries and the super root block during log writes.
While this dirty flag is cleared upon a successful log write, it remains
uncleared if the log write fails.
Consequently, when a log write fails, these backing device buffers are
left in an inconsistent state where their uptodate flag and the dirty
flag of the containing page/folio are cleared, but the buffer's dirty
flag remains as stale garbage.
Particularly when the block size is smaller than the page size, if other
buffers on the same page/folio become dirty, this buffer unexpectedly
becomes a target for writeback again. As a result, if the block is
later reused for other data or metadata, that contents risks being
corrupted.
Fix this issue by calling clear_buffer_dirty() for the backing device
buffers when aborting log writes in nilfs_abort_logs().
Fixes: 68142cb628f7 ("nilfs2: do not call inode_attach_wb() directly")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/segment.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index c20340f4e0dc3..f1f26647d7b3d 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1825,6 +1825,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
list_for_each_entry(segbuf, logs, sb_list) {
list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
b_assoc_buffers) {
+ clear_buffer_dirty(bh);
clear_buffer_uptodate(bh);
if (bh->b_folio != bd_folio) {
if (bd_folio)
@@ -1836,6 +1837,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
b_assoc_buffers) {
if (bh == segbuf->sb_super_root) {
+ clear_buffer_dirty(bh);
clear_buffer_uptodate(bh);
if (bh->b_folio != bd_folio) {
folio_end_writeback(bd_folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 300/869] nilfs2: ignore non-fatal signals during synchronous log write wait
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 299/869] nilfs2: clear dirty flag on bdev buffers on log write failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 301/869] pwm: tiehrpwm: Clear period on disable to allow reconfiguration Greg Kroah-Hartman
` (576 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f6c7e1f1809f235eeb90,
Wang Jianjian, Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit 7131aaa74bcc7c9da1f1d1c8724da75c775557a0 ]
Based on a syzbot report, Wang Jianjian pointed out that following a
successful directory operation in nilfs_rename(), a synchronous write
requested within nilfs_transaction_commit(), triggered by a sync flag
set by nilfs_commit_chunk(), could be interrupted by a user signal.
This interruption leaves in-memory metadata updates intact while
returning an error, causing inconsistency with the VFS dentry cache and
ultimately triggering a kernel warning.
According to "signal(7)", local disks are not classified as "slow
devices" (such as terminals, FIFOs, or pipes) and their I/O operations
on disk devices are not interrupted by signals. In kernel space,
waiting for such disk I/O should therefore not be aborted by ordinary
(non-fatal) signals.
Suppress this issue by modifying nilfs_segctor_sync(), which waits for
the log writer thread to complete synchronous writes, to catch only
fatal signals via fatal_signal_pending() and return -EINTR rather than
-ERESTARTSYS. To complement this change and prevent the wait loop from
busy-looping when schedule() returns immediately due to a pending
non-fatal signal, switch the wait state from TASK_INTERRUPTIBLE to
TASK_KILLABLE.
This serves as an effective interim stabilization measure without
structural changes until a comprehensive fix for metadata consistency
is implemented.
Reported-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6c7e1f1809f235eeb90
Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
Tested-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Cc: Wang Jianjian <wangjianjian3@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/ioctl.c | 2 +-
fs/nilfs2/recovery.c | 2 +-
fs/nilfs2/segment.c | 10 +++++-----
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 913e1a472c8fe..bcb68f92f05e6 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -972,10 +972,10 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
* Return: 0 on success, or one of the following negative error codes on
* failure:
* * %-EFAULT - Failure during execution of requested operation.
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error.
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index a9c61d0492cbd..dfff3bc84bcd3 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -785,11 +785,11 @@ static void nilfs_abort_roll_forward(struct the_nilfs *nilfs)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EINVAL - Inconsistent filesystem state.
* * %-EIO - I/O error.
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
*/
int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
struct super_block *sb,
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index f1f26647d7b3d..e967d16b2f130 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2255,7 +2255,7 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
wake_up(&sci->sc_wait_daemon);
for (;;) {
- set_current_state(TASK_INTERRUPTIBLE);
+ set_current_state(TASK_KILLABLE);
/*
* Synchronize only while the log writer thread is alive.
@@ -2269,11 +2269,11 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
err = wait_req.err;
break;
}
- if (!signal_pending(current)) {
+ if (!fatal_signal_pending(current)) {
schedule();
continue;
}
- err = -ERESTARTSYS;
+ err = -EINTR;
break;
}
finish_wait(&sci->sc_wait_request, &wait_req.wq);
@@ -2307,10 +2307,10 @@ static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err, bool force)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error (including metadata corruption).
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
int nilfs_construct_segment(struct super_block *sb)
@@ -2337,10 +2337,10 @@ int nilfs_construct_segment(struct super_block *sb)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error (including metadata corruption).
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 301/869] pwm: tiehrpwm: Clear period on disable to allow reconfiguration
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 300/869] nilfs2: ignore non-fatal signals during synchronous log write wait Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 302/869] IB/hfi1: Shutdown self-rearming timers before freeing Greg Kroah-Hartman
` (575 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Sverdlin,
Uwe Kleine-König, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
[ Upstream commit e74b9a7ee50071aad25d3989bf985292f90b0c6e ]
Both channels share one period register, so ehrpwm_pwm_config() rejects a
period differing from the sibling's period_cycles[]. That value was cleared
only in .free(), not in .disable(), so a stopped channel kept blocking the
sibling from switching to a new frequency. Clear it in .disable() too.
Testcase:
cd /sys/class/pwm/pwmchip0; echo 0 > export; echo 1 > export
for p in pwm0 pwm1; do
echo 1000000 > $p/period; echo 500000 > $p/duty_cycle
echo 1 > $p/enable; echo 0 > $p/enable; echo 2000000 > $p/period
done
echo 1 > pwm0/enable # before: -EINVAL, after: succeeds
Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20260929120806.2790355-1-alexander.sverdlin@siemens.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 2533c95b0ba9d..c02f69de44dcf 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -358,6 +358,9 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
/* Disable clock on PWM disable */
pm_runtime_put_sync(pwmchip_parent(chip));
+
+ /* A disabled channel must not constrain the sibling's period */
+ pc->period_cycles[pwm->hwpwm] = 0;
}
static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 302/869] IB/hfi1: Shutdown self-rearming timers before freeing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 301/869] pwm: tiehrpwm: Clear period on disable to allow reconfiguration Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 303/869] i3c: master: adi: free the IRQ before unregistering the master Greg Kroah-Hartman
` (574 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Leon Romanovsky,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9d3259e41ccd5016cd2c6d013232b89df6d73011 ]
The HFI1 receive error and synthetic counter timers rearm themselves from
their callbacks. Their cleanup paths use timer_delete_sync(), which only
waits for a running callback and does not prevent a concurrent or
subsequent rearm.
Use timer_shutdown_sync() when releasing these timers. This prevents a
callback from enqueueing either timer after cleanup begins, before the
containing hfi1_devdata is freed.
Preserve the existing work cancellation and workqueue destruction ordering
for synthetic counters.
Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930070455.2934286-1-runyu.xiao@seu.edu.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/chip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 57c70384d2107..648b31f37aa80 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -5576,7 +5576,7 @@ static int init_rcverr(struct hfi1_devdata *dd)
static void free_rcverr(struct hfi1_devdata *dd)
{
if (dd->rcverr_timer.function)
- timer_delete_sync(&dd->rcverr_timer);
+ timer_shutdown_sync(&dd->rcverr_timer);
}
static void handle_rxe_err(struct hfi1_devdata *dd, u32 unused, u64 reg)
@@ -12308,7 +12308,7 @@ static void free_cntrs(struct hfi1_devdata *dd)
int i;
if (dd->synth_stats_timer.function)
- timer_delete_sync(&dd->synth_stats_timer);
+ timer_shutdown_sync(&dd->synth_stats_timer);
cancel_work_sync(&dd->update_cntr_work);
ppd = (struct hfi1_pportdata *)(dd + 1);
for (i = 0; i < dd->num_pports; i++, ppd++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 303/869] i3c: master: adi: free the IRQ before unregistering the master
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 302/869] IB/hfi1: Shutdown self-rearming timers before freeing Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 304/869] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure Greg Kroah-Hartman
` (573 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Frank Li,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 1c1e2d90aa452764df66bb1dd774aa0d06d89cc8 ]
adi_i3c_master_irq() is requested with devm_request_irq(), so it stays
registered when adi_i3c_master_remove() runs, and the writes masking the
controller IRQ sources do not synchronize with a handler that is already
running on another CPU. i3c_master_unregister() then frees the
struct i3c_dev_desc objects that master->ibi.slots[] still point to, so
the IBI path in adi_i3c_master_handle_ibi() can dereference freed memory.
Fix this by storing the IRQ number in the private structure and calling
devm_free_irq() after the IRQ sources are masked, so a running handler
is finished before the master is torn down.
This issue was found by an in-house static analysis tool.
Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260923085340.490776-1-fanwu01@zju.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/adi-i3c-master.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/i3c/master/adi-i3c-master.c b/drivers/i3c/master/adi-i3c-master.c
index 178029769bab4..d6278d03012db 100644
--- a/drivers/i3c/master/adi-i3c-master.c
+++ b/drivers/i3c/master/adi-i3c-master.c
@@ -115,6 +115,7 @@ struct adi_i3c_master {
spinlock_t lock; /* Protect transfer */
} xferqueue;
void __iomem *regs;
+ int irq;
struct clk *clk;
unsigned long i3c_scl_lim;
struct {
@@ -957,6 +958,7 @@ static int adi_i3c_master_probe(struct platform_device *pdev)
irq = platform_get_irq(pdev, 0);
if (irq < 0)
return irq;
+ master->irq = irq;
version = readl(master->regs + ADI_AXI_REG_VERSION);
if (ADI_AXI_PCORE_VER_MAJOR(version) != 1)
@@ -1001,6 +1003,8 @@ static void adi_i3c_master_remove(struct platform_device *pdev)
writel(0x00, master->regs + REG_IRQ_MASK);
writel(0x01, master->regs + REG_ENABLE);
+ devm_free_irq(&pdev->dev, master->irq, master);
+
i3c_master_unregister(&master->base);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 304/869] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 303/869] i3c: master: adi: free the IRQ before unregistering the master Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 305/869] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable() Greg Kroah-Hartman
` (572 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit d27f831aaf20aaf06e41ceb1b260e10672269155 ]
If msm_hdmi_phy_resource_enable() fails, e.g. when enabling regulators,
it should reverse the state of things already changed.
msm_hdmi_phy_resource_enable() is used also in probe path, thus such
failure, which could be simple deferred probe, would leave these
resources permanently enabled for the rest of the runtime.
Cc: <stable@vger.kernel.org>
Fixes: 15b4a4523859 ("drm/msm/hdmi: Create a separate HDMI PHY driver")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752654/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-1-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
index 6777cba9255e2..bc603a79c0851 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
@@ -67,16 +67,28 @@ int msm_hdmi_phy_resource_enable(struct hdmi_phy *phy)
ret = regulator_bulk_enable(cfg->num_regs, phy->regs);
if (ret) {
DRM_DEV_ERROR(dev, "failed to enable regulators: (%d)\n", ret);
- return ret;
+ goto err_pm_put;
}
for (i = 0; i < cfg->num_clks; i++) {
ret = clk_prepare_enable(phy->clks[i]);
- if (ret)
+ if (ret) {
DRM_DEV_ERROR(dev, "failed to enable clock: %s (%d)\n",
cfg->clk_names[i], ret);
+ goto err_clk_unprepare;
+ }
}
+ return 0;
+
+err_clk_unprepare:
+ for (; i > 0; i--)
+ clk_disable_unprepare(phy->clks[i - 1]);
+ regulator_bulk_disable(cfg->num_regs, phy->regs);
+
+err_pm_put:
+ pm_runtime_put_sync(dev);
+
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 305/869] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 304/869] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 306/869] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable Greg Kroah-Hartman
` (571 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit dd6ecace57851878e62367a6f1a26dd5b9aa217f ]
Properly handle power up failures during .atomic_pre_enable() by
aborting the .atomic_pre_enable() to avoid accessing registers why
blocks did not bring up. Otherwise this could lead to imprecise aborts
when accessing MMIO while entire power domain is off.
Cc: <stable@vger.kernel.org>
Fixes: ba3d7bf3a7ab ("drm/msm/hdmi: Convert PHY files according to new design")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752652/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-2-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 30 ++++++++++++++++++--------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index 93a491a103e0a..45bc4db5f66cd 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -13,14 +13,16 @@
#include "msm_kms.h"
#include "hdmi.h"
-static void msm_hdmi_power_on(struct drm_bridge *bridge)
+static int msm_hdmi_power_on(struct drm_bridge *bridge)
{
struct drm_device *dev = bridge->dev;
struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
struct hdmi *hdmi = hdmi_bridge->hdmi;
int ret;
- pm_runtime_resume_and_get(&hdmi->pdev->dev);
+ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev);
+ if (ret)
+ return ret;
if (hdmi->extp_clk) {
DBG("pixclock: %lu", hdmi->pixclock);
@@ -29,9 +31,14 @@ static void msm_hdmi_power_on(struct drm_bridge *bridge)
DRM_DEV_ERROR(dev->dev, "failed to set extp clk rate: %d\n", ret);
ret = clk_prepare_enable(hdmi->extp_clk);
- if (ret)
+ if (ret) {
DRM_DEV_ERROR(dev->dev, "failed to enable extp clk: %d\n", ret);
+ pm_runtime_put(&hdmi->pdev->dev);
+ return ret;
+ }
}
+
+ return 0;
}
static void power_off(struct drm_bridge *bridge)
@@ -302,13 +309,18 @@ static void msm_hdmi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
msm_hdmi_set_timings(hdmi, &crtc_state->adjusted_mode);
- mutex_lock(&hdmi->state_mutex);
- if (!hdmi->power_on) {
- msm_hdmi_phy_resource_enable(phy);
- msm_hdmi_power_on(bridge);
- hdmi->power_on = true;
+ scoped_guard(mutex, &hdmi->state_mutex) {
+ if (!hdmi->power_on) {
+ if (msm_hdmi_phy_resource_enable(phy))
+ return;
+
+ if (msm_hdmi_power_on(bridge)) {
+ msm_hdmi_phy_resource_disable(phy);
+ return;
+ }
+ hdmi->power_on = true;
+ }
}
- mutex_unlock(&hdmi->state_mutex);
if (connector->display_info.is_hdmi)
msm_hdmi_audio_update(hdmi);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 306/869] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 305/869] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 307/869] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g() Greg Kroah-Hartman
` (570 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit 0499f0576e4442d67c164119f9d7f75d3cc945e7 ]
Turning off the power in msm_hdmi_bridge_atomic_post_disable() should
follow reverse order of powering up, not only because it is logical, but
also because msm_hdmi_audio_update() accesses registers thus block
should still be powered on.
Depending on specific timing, existing code could have accesses to MMIO
of powered off block.
Cc: stable@vger.kernel.org
Fixes: c0c0d9eeeb8d ("drm/msm: hdmi audio support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752655/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-3-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index 45bc4db5f66cd..75dea34c43a88 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -354,10 +354,10 @@ static void msm_hdmi_bridge_atomic_post_disable(struct drm_bridge *bridge,
msm_hdmi_phy_powerdown(phy);
if (hdmi->power_on) {
- power_off(bridge);
hdmi->power_on = false;
if (hdmi->connector->display_info.is_hdmi)
msm_hdmi_audio_update(hdmi);
+ power_off(bridge);
msm_hdmi_phy_resource_disable(phy);
}
mutex_unlock(&hdmi->state_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 307/869] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 306/869] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 308/869] staging: greybus: uart: fix racy TIOCMIWAIT implementation Greg Kroah-Hartman
` (569 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Rob Clark,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ab91ba61871a896ca2ecc6e048d80a152136da44 ]
dsi_tx_buf_alloc_6g() takes a reference to the kms VM with
drm_gpuvm_get() and stores it in msm_host->vm. If
msm_gem_kernel_new() fails, the function returns early without
dropping that reference. Since msm_host->tx_gem_obj is cleared on
the error path, msm_dsi_tx_buf_free() will never see a non-NULL
tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM
reference.
Drop the VM reference and clear msm_host->vm on the error path.
Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Rob Clark <rob.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/754332/
Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 4e93f8dd39d7d..1827af24a3fa1 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1254,6 +1254,8 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size)
if (IS_ERR(data)) {
msm_host->tx_gem_obj = NULL;
+ drm_gpuvm_put(msm_host->vm);
+ msm_host->vm = NULL;
return PTR_ERR(data);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 308/869] staging: greybus: uart: fix racy TIOCMIWAIT implementation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 307/869] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 309/869] staging: rtl8723bs: fix RX buffer OOB write from device-reported length Greg Kroah-Hartman
` (568 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Sasha Levin, stable
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e94cda6551d4716b17353fc458baa9e85ddea9ff ]
Check the wakeup condition after adding the task to the waitqueue and
updating the task state to avoid missing a racing modem status update or
disconnect.
Store the old icount on entry and do not update it in the completion
handler to avoid missing events or reporting spurious ones (due to modem
status changes before TIOCMIWAIT was called).
Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
Cc: stable@kernel.org # 4.9
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260907095305.130762-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/uart.c | 30 ++++++++++++++++++------------
1 file changed, 18 insertions(+), 12 deletions(-)
diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
index 78bf8c4031e93..7d2844d9bcd9e 100644
--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -53,7 +53,6 @@ struct gb_tty {
spinlock_t read_lock;
spinlock_t write_lock;
struct async_icount iocount;
- struct async_icount oldcount;
wait_queue_head_t wioctl;
struct mutex mutex;
u8 ctrlin; /* input control lines */
@@ -643,11 +642,16 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
if (!(arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD)))
return -EINVAL;
- do {
+ spin_lock_irq(&gb_tty->read_lock);
+ old = gb_tty->iocount;
+ spin_unlock_irq(&gb_tty->read_lock);
+
+ add_wait_queue(&gb_tty->wioctl, &wait);
+ for (;;) {
+ set_current_state(TASK_INTERRUPTIBLE);
+
spin_lock_irq(&gb_tty->read_lock);
- old = gb_tty->oldcount;
new = gb_tty->iocount;
- gb_tty->oldcount = new;
spin_unlock_irq(&gb_tty->read_lock);
if ((arg & TIOCM_DSR) && (old.dsr != new.dsr))
@@ -657,18 +661,20 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
if ((arg & TIOCM_RI) && (old.rng != new.rng))
break;
- add_wait_queue(&gb_tty->wioctl, &wait);
- set_current_state(TASK_INTERRUPTIBLE);
- schedule();
- remove_wait_queue(&gb_tty->wioctl, &wait);
if (gb_tty->disconnected) {
- if (arg & TIOCM_CD)
- break;
retval = -ENODEV;
- } else if (signal_pending(current)) {
+ break;
+ }
+
+ schedule();
+
+ if (signal_pending(current)) {
retval = -ERESTARTSYS;
+ break;
}
- } while (!retval);
+ }
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&gb_tty->wioctl, &wait);
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 309/869] staging: rtl8723bs: fix RX buffer OOB write from device-reported length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 308/869] staging: greybus: uart: fix racy TIOCMIWAIT implementation Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 310/869] media: tw686x: fix V4L2 device lifetime on probe failure Greg Kroah-Hartman
` (567 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
[ Upstream commit c52929073fccbc149267a2fd7458626a7e9abcfc ]
sd_recv_rxfifo() trusts the device-reported RX0_REQ_LEN value
(hal->SdioRxFIFOSize, a u16 read from the card via CMD52) as the
size of the next RX packet and passes it to sdio_read_port(), which
copies that many bytes into the recvbuf skb whose data area is only
MAX_RECVBUF_SZ (10240) bytes. A bogus device on SDIO can report up to
65535 bytes, causing a heap overflow of up to ~55KB past the skb
buffer.
Bail out when the RX0_REQ_LEN exceeds MAX_RECVBUF_SZ. This is expected
to keep behavior unchanged on normal devices.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8114c3adc1acaea78523cc0fb4d4b25f7665cee9@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/hal/sdio_ops.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/staging/rtl8723bs/hal/sdio_ops.c b/drivers/staging/rtl8723bs/hal/sdio_ops.c
index 54228c41579ee..811720775eb83 100644
--- a/drivers/staging/rtl8723bs/hal/sdio_ops.c
+++ b/drivers/staging/rtl8723bs/hal/sdio_ops.c
@@ -791,6 +791,13 @@ static struct recv_buf *sd_recv_rxfifo(struct adapter *adapter, u32 size)
struct recv_priv *recv_priv;
struct recv_buf *recvbuf;
+ /* RX0_REQ_LEN is device-reported; the skb buffer is only
+ * MAX_RECVBUF_SZ bytes, reject bogus lengths instead of
+ * overflowing past it.
+ */
+ if (size > MAX_RECVBUF_SZ)
+ return NULL;
+
/* Patch for some SDIO Host 4 bytes issue */
/* ex. RK3188 */
readsize = round_up(size, 4);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 310/869] media: tw686x: fix V4L2 device lifetime on probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 309/869] staging: rtl8723bs: fix RX buffer OOB write from device-reported length Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 311/869] media: pvrusb2: Fix USB parent device leak in class_dev_create() Greg Kroah-Hartman
` (566 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ce6c6dd632b3b4a2c2bfc9efd8f656f4d2137dbd ]
tw686x_video_init() registers the V4L2 device, which initializes its
reference count. Successfully registered video devices take additional
references to the V4L2 device as well.
The probe failure paths currently tear down the PCI resources and then
free the channel arrays and the tw686x device directly. This bypasses
the V4L2 device reference count and the tw686x_dev_release() callback.
If a video device still holds a reference, its eventual release will
drop a reference to the already freed V4L2 device. Even when no extra
references remain, directly freeing the device bypasses the lifetime
management established by v4l2_device_register().
After cleaning up the PCI resources, check whether the V4L2 device was
registered. If so, mark the hardware unavailable and drop the driver's
V4L2 device reference, letting tw686x_dev_release() free the backing
objects when the final reference is released. Keep the existing direct
free path for failures that occur before V4L2 device registration.
This issue was found by manual code inspection.
Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/tw686x/tw686x-core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c
index f39e0e34deb68..6dc8af345295f 100644
--- a/drivers/media/pci/tw686x/tw686x-core.c
+++ b/drivers/media/pci/tw686x/tw686x-core.c
@@ -241,6 +241,7 @@ static int tw686x_probe(struct pci_dev *pci_dev,
const struct pci_device_id *pci_id)
{
struct tw686x_dev *dev;
+ unsigned long flags;
int err;
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -352,6 +353,15 @@ static int tw686x_probe(struct pci_dev *pci_dev,
pci_release_regions(pci_dev);
disable_pci:
pci_disable_device(pci_dev);
+ if (dev->v4l2_dev.dev) {
+ spin_lock_irqsave(&dev->lock, flags);
+ dev->pci_dev = NULL;
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+ v4l2_device_put(&dev->v4l2_dev);
+ return err;
+ }
+
free_audio:
kfree(dev->audio_channels);
free_video:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 311/869] media: pvrusb2: Fix USB parent device leak in class_dev_create()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 310/869] media: tw686x: fix V4L2 device lifetime on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 312/869] media: rtl28xxu: fix SDR platform device leak Greg Kroah-Hartman
` (565 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 02421d7278e4a62c3daf37ad6c45d4af96ee4252 ]
class_dev_create() stores a reference to the USB device obtained with
get_device() in class_dev->parent, which class_dev_destroy() releases.
When device_register() fails the function only drops class_dev, so the
reference to the USB parent device is never released.
Drop the parent reference on the failure path as well.
Fixes: 28c4a5e6d324 ("V4L/DVB: pvrusb2: Fix USB parent device reference count")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
index 3077399901aa1..dd6fcc6245afc 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
@@ -633,6 +633,7 @@ static void class_dev_create(struct pvr2_sysfs *sfp)
if (ret) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
"device_register failed");
+ put_device(class_dev->parent);
put_device(class_dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 312/869] media: rtl28xxu: fix SDR platform device leak
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 311/869] media: pvrusb2: Fix USB parent device leak in class_dev_create() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 313/869] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler Greg Kroah-Hartman
` (564 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Hans Verkuil,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 083a92996598a5080965f1baa84175082e14a45b ]
rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but
does not unregister it if no driver is bound. It also does not take a
reference on the bound driver module.
Unregister the platform device when no driver is bound or the module
reference cannot be acquired. Drop the module reference in
rtl28xxu_tuner_detach() before unregistering the device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 487c6ab784abd..d2957e4bf0173 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -1391,8 +1391,16 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
"rtl2832_sdr",
PLATFORM_DEVID_AUTO,
&pdata, sizeof(pdata));
- if (IS_ERR(pdev) || pdev->dev.driver == NULL)
+ if (IS_ERR(pdev))
break;
+ if (!pdev->dev.driver) {
+ platform_device_unregister(pdev);
+ break;
+ }
+ if (!try_module_get(pdev->dev.driver->owner)) {
+ platform_device_unregister(pdev);
+ break;
+ }
dev->platform_device_sdr = pdev;
break;
default:
@@ -1426,8 +1434,10 @@ static int rtl28xxu_tuner_detach(struct dvb_usb_adapter *adap)
/* remove platform SDR */
pdev = dev->platform_device_sdr;
- if (pdev)
+ if (pdev) {
+ module_put(pdev->dev.driver->owner);
platform_device_unregister(pdev);
+ }
/* remove I2C tuner */
client = dev->i2c_client_tuner;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 313/869] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 312/869] media: rtl28xxu: fix SDR platform device leak Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 314/869] media: em28xx: fix double free in em28xx_alloc_urbs Greg Kroah-Hartman
` (563 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ginger Li, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ginger Li <ginger.jzllee@gmail.com>
[ Upstream commit c65eb69f8170975802ddbede84420553eb681d62 ]
fimc_lite_subdev_s_stream(on = 0) sets ST_FLITE_OFF outside of the
fimc->slock protected region, and only then stops the capture in the
hardware. flite_irq_handler() runs under fimc->slock and clears
ST_FLITE_OFF, so an interrupt can be handled in between: the handler finds
ST_FLITE_OFF already set, clears it and wakes up fimc->irq_queue before the
capture has actually been stopped. The wait_event_timeout() right after it
then returns immediately and the driver continues as if the capture had
stopped.
Set ST_FLITE_OFF in the same critical section that stops the capture, as
fimc_lite_stop_capture() already does.
Fixes: 6319d6a002be ("[media] fimc-lite: Add ISP FIFO output support")
Cc: stable@vger.kernel.org
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/samsung/exynos4-is/fimc-lite.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
index 0ce293b0718b6..0862fd14d41e3 100644
--- a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
@@ -1209,9 +1209,8 @@ static int fimc_lite_subdev_s_stream(struct v4l2_subdev *sd, int on)
spin_unlock_irqrestore(&fimc->slock, flags);
}
} else {
- set_bit(ST_FLITE_OFF, &fimc->state);
-
spin_lock_irqsave(&fimc->slock, flags);
+ set_bit(ST_FLITE_OFF, &fimc->state);
flite_hw_capture_stop(fimc);
spin_unlock_irqrestore(&fimc->slock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 314/869] media: em28xx: fix double free in em28xx_alloc_urbs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 313/869] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 315/869] dm: fix a bug in dm_accept_partial_bio Greg Kroah-Hartman
` (562 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+6a04efcebe0fc0ce, Kaho Jiang,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaho Jiang <kj2864@nyu.edu>
[ Upstream commit fd427b8adae437cac78a2332241a03cac56e95c2 ]
When allocation of usb_bufs->buf[i] fails, em28xx_alloc_urbs()
explicitly frees all items within usb_bufs->buf before calling
em28xx_uninit_usb_xfer(), which also frees these items, causing them to be
freed twice.
BUG: KASAN: double-free in usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
Free of addr ffff88802fd37c00 by task kworker/1:2/1182
Workqueue: events request_module_async
Call Trace:
kasan_report_invalid_free (mm/kasan/report.c:557)
check_slab_allocation (mm/kasan/common.c:235)
kfree (./include/linux/kasan.h:199 (discriminator 1) mm/slub.c:2693 (discriminator 1) mm/slub.c:6508 (discriminator 1) mm/slub.c:6801 (discriminator 1))
usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
usb_free_urb (drivers/usb/core/urb.c:95)
em28xx_uninit_usb_xfer (drivers/media/usb/em28xx/em28xx-core.c:964)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1076)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
em28xx_alloc_urbs (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/media/usb/em28xx/em28xx-core.c:1081)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Freed by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1084)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Remove the explicit cleanup loop and let em28xx_uninit_usb_xfer()
handle the cleanup.
Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Cc: stable@vger.kernel.org
Reported-by: co+6a04efcebe0fc0ce@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 1012bfb186460..5552813875132 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -949,9 +949,6 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
- for (i--; i >= 0; i--)
- kfree(usb_bufs->buf[i]);
-
em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 315/869] dm: fix a bug in dm_accept_partial_bio
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 314/869] media: em28xx: fix double free in em28xx_alloc_urbs Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 316/869] dm-writecache: report I/O error if flush failed Greg Kroah-Hartman
` (561 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit a279804752e6c767b7f9ecbb32a15bdfd2b80aea ]
dm-writecache doesn't work in pmem mode - mkfs.ext4 and the following
fsck.ext4 fail with data corruption reported.
The commit 7dd76d1feec7 ("dm: improve bio splitting and associated IO
accounting") introduced a latent bug in dm_accept_partial_bio - it set
tio->io->sectors = n_sectors;. This is incorrect, according to the
diagram in the source code at dm_accept_partial_bio, it should be the
size of regions 1+2, not the region 2 alone.
The latent bug become real bug with the commit 8b211aaccb91 ("dm: add two
stage requeue mechanism").
dm-writecache in pmem mode is the only target that actually advances bio
with bio_advance and then calls dm_accept_partial_bio (so, the region 1
is non-empty). All the other targets call dm_accept_partial_bio with
region 1 empty, so bug went unnoticed for so long.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: 8b211aaccb91 ("dm: add two stage requeue mechanism")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f587b7229ce89..077bf8b16a0bd 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1349,7 +1349,7 @@ void dm_accept_partial_bio(struct bio *bio, unsigned int n_sectors)
* for accounting but it is being reduced so update accordingly.
*/
dm_io_set_flag(io, DM_IO_WAS_SPLIT);
- io->sectors = n_sectors;
+ io->sectors = *tio->len_ptr;
io->sector_offset = bio_sectors(io->orig_bio);
}
EXPORT_SYMBOL_GPL(dm_accept_partial_bio);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 316/869] dm-writecache: report I/O error if flush failed
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 315/869] dm: fix a bug in dm_accept_partial_bio Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 6.18 317/869] dm-writecache: fix a quirk in statistics Greg Kroah-Hartman
` (560 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 78a6afc2999d26e5a30a56db77db34c22b88f5d5 ]
There was a bug that if writecache_flush fails due to I/O error, the
error is not reported in the FUA bio. This commit fixes it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: opencode:big-pickle
Cc: stable@vger.kernel.org
Fixes: 48debafe4f2f ("dm: add writecache target")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 34148aa4df799..1e32053c27172 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1493,10 +1493,13 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
}
} while (bio->bi_iter.bi_size);
- if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks))
+ if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
writecache_flush(wc);
- else
+ if (writecache_has_error(wc))
+ bio->bi_status = BLK_STS_IOERR;
+ } else {
writecache_schedule_autocommit(wc);
+ }
return WC_MAP_SUBMIT;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 317/869] dm-writecache: fix a quirk in statistics
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 316/869] dm-writecache: report I/O error if flush failed Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 318/869] dm-writecache: fix a crash if we attempt to use non-dax device Greg Kroah-Hartman
` (559 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit c1ab80af0d99a906b60b769f2e692c37d2db1323 ]
writecache_bio_copy_ssd() unconditionally adds the number of extra blocks
in the merged bio to stats.writes_allocate. That is only correct when the
entries were taken off the freelist.
When the function is called with search_used == true -- i.e. from the
write_hits_uncommitted / write_hits_committed paths in
writecache_map_write() -- the first entry was found in the rbtree and
every following entry is picked up with rb_next(), so nothing is
allocated at all. Accordingly the writes_allocate++ that accompanies a
successful writecache_pop_from_freelist() is skipped for that case, but
the batch accounting below still adds n - 1.
An in-place overwrite of n contiguous cached blocks therefore reports n -
1 allocations that never happened. Only the dmsetup status output is
affected; there is no functional change.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: b2676e1482af ("dm writecache: count number of blocks written, not number of write bios")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 1e32053c27172..d29f6b3abce4d 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1424,7 +1424,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
dm_accept_partial_bio(bio, bio_size >> SECTOR_SHIFT);
wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
- wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
+ if (!search_used)
+ wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
if (unlikely(wc->uncommitted_blocks >= wc->autocommit_blocks)) {
wc->uncommitted_blocks = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 318/869] dm-writecache: fix a crash if we attempt to use non-dax device
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 6.18 317/869] dm-writecache: fix a quirk in statistics Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 319/869] dm-writecache: fix uncommitted_blocks underflow Greg Kroah-Hartman
` (558 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit b15dc73f60ebf02410bc7014ce34fb7fd1040045 ]
If we specify a non-DAX device as a cache device in the 'P' mode,
dm-writecache crashes on NULL pointer dereference inside dax_synchronous.
Note that this is not a security bug because only root can trigger it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: a46624580376 ("dm writecache: reject asynchronous pmem devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index d29f6b3abce4d..d3f93a871a142 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -2511,6 +2511,11 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
}
if (WC_MODE_PMEM(wc)) {
+ if (!wc->ssd_dev->dax_dev) {
+ r = -EOPNOTSUPP;
+ ti->error = "Cache device is not a DAX device";
+ goto bad;
+ }
if (!dax_synchronous(wc->ssd_dev->dax_dev)) {
r = -EOPNOTSUPP;
ti->error = "Asynchronous persistent memory not supported as pmem cache";
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 319/869] dm-writecache: fix uncommitted_blocks underflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 318/869] dm-writecache: fix a crash if we attempt to use non-dax device Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 320/869] dm-writecache: fix REQ_FUA processing Greg Kroah-Hartman
` (557 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 8a0cc5f3446a324b13f62020eeddb32d6ba1c2db ]
Revert the commit 39495b12ef1cf602e6abd350dce2ef4199906531
writecache_bio_copy_ssd sets wc->uncommitted_blocks = 0; and then queues
the flush work: queue_work(wc->writeback_wq, &wc->flush_work);
It may be possible that discard is dispatched in this window, and the
discard would decrement wc->uncommitted_blocks to -1U.
Note that this bug is benign - wc->uncommitted_blocks is only used to
trigged autocommit, so decrementing it to -1U will trigger a spurious
autocommit, but won't cause any data corruption.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Fixes: 39495b12ef1c ("dm writecache: correct uncommitted_block when discarding uncommitted entry")
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index d3f93a871a142..63e18c6f1325f 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -899,8 +899,6 @@ static void writecache_discard(struct dm_writecache *wc, sector_t start, sector_
}
discarded_something = true;
}
- if (!writecache_entry_is_committed(wc, e))
- wc->uncommitted_blocks--;
writecache_free_entry(wc, e);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 320/869] dm-writecache: fix REQ_FUA processing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 319/869] dm-writecache: fix uncommitted_blocks underflow Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 321/869] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs Greg Kroah-Hartman
` (556 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit c0df022cb0fa2bbee74bd9b90c66790bcd4e3050 ]
REQ_FUA did not flush metadata in SSD mode, this commit fixes it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: c1005322ff02 ("dm writecache: handle REQ_FUA")
Assisted-by: Claude:claude-opus-5
Assisted-by: Codex:gpt-6-sol
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 45 +++++++++++++++++++++++++++++---------
1 file changed, 35 insertions(+), 10 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 63e18c6f1325f..aa758d5ef6013 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -194,6 +194,7 @@ struct dm_writecache {
struct task_struct *endio_thread;
struct task_struct *flush_thread;
+ spinlock_t flush_list_lock;
struct bio_list flush_list;
struct dm_kcopyd_client *dm_kcopyd;
@@ -1288,9 +1289,11 @@ static int writecache_flush_thread(void *data)
struct bio *bio;
wc_lock(wc);
+ spin_lock_irq(&wc->flush_list_lock);
bio = bio_list_pop(&wc->flush_list);
if (!bio) {
set_current_state(TASK_INTERRUPTIBLE);
+ spin_unlock_irq(&wc->flush_list_lock);
wc_unlock(wc);
if (unlikely(kthread_should_stop())) {
@@ -1301,6 +1304,7 @@ static int writecache_flush_thread(void *data)
schedule();
continue;
}
+ spin_unlock_irq(&wc->flush_list_lock);
if (bio_op(bio) == REQ_OP_DISCARD) {
writecache_discard(wc, bio->bi_iter.bi_sector,
@@ -1322,9 +1326,12 @@ static int writecache_flush_thread(void *data)
static void writecache_offload_bio(struct dm_writecache *wc, struct bio *bio)
{
+ unsigned long flags;
+ spin_lock_irqsave(&wc->flush_list_lock, flags);
if (bio_list_empty(&wc->flush_list))
wake_up_process(wc->flush_thread);
bio_list_add(&wc->flush_list, bio);
+ spin_unlock_irqrestore(&wc->flush_list_lock, flags);
}
enum wc_map_op {
@@ -1436,6 +1443,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio *bio)
{
struct wc_entry *e;
+ enum wc_map_op ret = WC_MAP_SUBMIT;
+ bool need_flush = false;
do {
bool found_entry = false;
@@ -1472,7 +1481,8 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
writecache_map_remap_origin(wc, bio, e);
wc->stats.writes_around += bio->bi_iter.bi_size >> wc->block_size_bits;
wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
- return WC_MAP_REMAP_ORIGIN;
+ ret = WC_MAP_REMAP_ORIGIN;
+ goto flush_pmem_and_ret;
}
wc->stats.writes_blocked_on_freelist++;
writecache_wait_on_freelist(wc);
@@ -1486,21 +1496,25 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
if (WC_MODE_PMEM(wc)) {
bio_copy_block(wc, bio, memory_data(wc, e));
wc->stats.writes++;
+ need_flush = true;
} else {
writecache_bio_copy_ssd(wc, bio, e, search_used);
return WC_MAP_REMAP;
}
} while (bio->bi_iter.bi_size);
- if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
- writecache_flush(wc);
- if (writecache_has_error(wc))
- bio->bi_status = BLK_STS_IOERR;
- } else {
- writecache_schedule_autocommit(wc);
+flush_pmem_and_ret:
+ if (need_flush) {
+ if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
+ writecache_flush(wc);
+ if (writecache_has_error(wc))
+ ret = WC_MAP_ERROR;
+ } else {
+ writecache_schedule_autocommit(wc);
+ }
}
- return WC_MAP_SUBMIT;
+ return ret;
}
static enum wc_map_op writecache_map_flush(struct dm_writecache *wc, struct bio *bio)
@@ -1590,7 +1604,10 @@ static int writecache_map(struct dm_target *ti, struct bio *bio)
case WC_MAP_REMAP:
/* make sure that writecache_end_io decrements bio_in_progress: */
- bio->bi_private = (void *)1;
+ if (unlikely(bio->bi_opf & REQ_FUA) && bio_op(bio) == REQ_OP_WRITE)
+ bio->bi_private = (void *)3;
+ else
+ bio->bi_private = (void *)1;
atomic_inc(&wc->bio_in_progress[bio_data_dir(bio)]);
wc_unlock(wc);
return DM_MAPIO_REMAPPED;
@@ -1620,12 +1637,19 @@ static int writecache_end_io(struct dm_target *ti, struct bio *bio, blk_status_t
{
struct dm_writecache *wc = ti->private;
- if (bio->bi_private == (void *)1) {
+ if (bio->bi_private == (void *)1 || bio->bi_private == (void *)3) {
int dir = bio_data_dir(bio);
+ bool fua = bio->bi_private == (void *)3;
if (atomic_dec_and_test(&wc->bio_in_progress[dir]))
if (unlikely(waitqueue_active(&wc->bio_in_progress_wait[dir])))
wake_up(&wc->bio_in_progress_wait[dir]);
+
+ if (fua && likely(*status == BLK_STS_OK)) {
+ bio->bi_private = NULL;
+ writecache_offload_bio(wc, bio);
+ return DM_ENDIO_INCOMPLETE;
+ }
} else if (bio->bi_private == (void *)2) {
dm_iot_io_end(&wc->iot, 1);
}
@@ -2531,6 +2555,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
wc->memory_map_size -= (uint64_t)wc->start_sector << SECTOR_SHIFT;
+ spin_lock_init(&wc->flush_list_lock);
bio_list_init(&wc->flush_list);
wc->flush_thread = kthread_run(writecache_flush_thread, wc, "dm_writecache_flush");
if (IS_ERR(wc->flush_thread)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 321/869] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 320/869] dm-writecache: fix REQ_FUA processing Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 322/869] pps: generators: stop the generator on unregister Greg Kroah-Hartman
` (555 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Donnefort, Fuad Tabba,
Fuad Tabba, Marc Zyngier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
[ Upstream commit 6c29285e78b5e4811145ebda382ac0ba732ce56a ]
Protected VM ID register emulation leaves unlisted fields at 0. This
creates two issues for TGRAN:
* TGRAN16: 0 means non-implemented. It prevents 16KB protected VMs
from booting even when the hardware supports it.
* TGRAN4|TGRAN64: 0 means implemented. This may falsely advertise the
feature even when the hardware does not support it.
Advertise all the TGRAN fields in pvmid_aa64mmfr0 so that the hardware
support is properly propagated.
Cc: stable@vger.kernel.org
Fixes: 6c30bfb18d0b ("KVM: arm64: Add handlers for protected VM System Registers")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260928095454.3255918-2-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/nvhe/sys_regs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
index 3108b5185c204..168d473e084b4 100644
--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c
+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
@@ -115,6 +115,9 @@ static const struct pvm_ftr_bits pvmid_aa64mmfr0[] = {
MAX_FEAT(ID_AA64MMFR0_EL1, SNSMEM, IMP),
MAX_FEAT(ID_AA64MMFR0_EL1, BIGENDEL0, IMP),
MAX_FEAT(ID_AA64MMFR0_EL1, EXS, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN4, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN16, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN64, IMP),
FEAT_END
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 322/869] pps: generators: stop the generator on unregister
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 321/869] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 323/869] block: drop the cached plug time when blk_add_rq_to_plug() flushes Greg Kroah-Hartman
` (554 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodolfo Giometti, Danish Khateeb,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
[ Upstream commit 3e75af9f41c7509884d0955245dec2b791287e8c ]
Both generator drivers stop their timer and then call
pps_gen_unregister_source(): pps_gen_tio_remove() cancels its hrtimer
and disables the TIO, and pps_gen_dummy_exit() deletes its timer. But
/dev/pps-genN and the sysfs "enable" attribute are still there until
the unregister, and a PPS_GEN_SETENABLE or a write to "enable" in
between starts the timer again. Nothing stops it after that: TIO's
hrtimer keeps running in the devm memory freed by the unbind, and the
dummy's timer is left in the unloaded module.
The drivers can't avoid this by unregistering first, as TIO's timer
callback uses pps_gen, which the unregister may free.
Stop the generator in pps_gen_unregister_cdev() instead, under
info_lock after the device and its sysfs files are gone, when nothing
can enable it again. pps_gen_unregister_source() then also does what
its kernel-doc says: "it disables the generator so no pulses are
generated anymore".
Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Suggested-by: Rodolfo Giometti <giometti@enneenne.com>
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-4-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/generators/pps_gen.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index 630a8804d63e7..eda7fd933bec7 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -228,9 +228,18 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
* An open file keeps pps_gen around, but the driver may free info as
* soon as we return. The sysfs files are gone now, so wait for the
* ioctls using info and make later ones fail.
+ *
+ * The driver may have stopped the generator before calling us, but
+ * userspace could have enabled it again since. Nothing can enable it
+ * after this point, so stop it here for good.
*/
- scoped_guard(mutex, &pps_gen->info_lock)
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (pps_gen->enabled) {
+ pps_gen->info->enable(pps_gen, false);
+ pps_gen->enabled = false;
+ }
pps_gen->info = NULL;
+ }
put_device(&pps_gen->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 323/869] block: drop the cached plug time when blk_add_rq_to_plug() flushes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 322/869] pps: generators: stop the generator on unregister Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 324/869] block: amiflop: synchronize flush timer before track flush Greg Kroah-Hartman
` (553 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasileios Almpanis, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
[ Upstream commit e0f2224433b15a57125d6ac5d46182f99c6c9d08 ]
blk_time_get_ns() caches the current time in the task's plug. The idea
is that the cache lives for one plug and is dropped when the plug is
flushed. __blk_flush_plug() and finish_task_switch() do that.
blk_add_rq_to_plug() also flushes, when the plug has too many requests
or the last request is at least BLK_PLUG_FLUSH_SIZE. But it calls
blk_mq_flush_plug_list() directly and never drops the cached time. So
a task that keeps submitting without sleeping stamps every request
after that with the time first cached in the plug. start_time_ns and
io_start_time_ns are stale and the disk stats charge each request for
the whole time since the plug began.
Drop the cached time after the flush, same as __blk_flush_plug() does.
Fixes: da4c8c3d0975 ("block: cache current nsec time in struct blk_plug")
Cc: stable@vger.kernel.org
Signed-off-by: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
Link: https://patch.msgid.link/20260930-blk-plug-ts-flush-v1-1-bf8ca7bc5cd6@virtuozzo.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index ba0c48d58e134..73ee5a9ea51d6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1428,6 +1428,7 @@ static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
(!blk_queue_nomerges(rq->q) &&
blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) {
blk_mq_flush_plug_list(plug, false);
+ blk_plug_invalidate_ts();
last = NULL;
trace_block_plug(rq->q);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 324/869] block: amiflop: synchronize flush timer before track flush
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 323/869] block: drop the cached plug time when blk_add_rq_to_plug() flushes Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 325/869] PCI: Disable MSI for ULi M1575 EHCI controller Greg Kroah-Hartman
` (552 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9690943353cec1690a715e000ba6a74e5139f530 ]
The amiflop track buffer is shared with the timer callback. timer_delete()
does not wait for an in-flight callback, and that callback can rearm itself
when it cannot acquire the floppy controller. A synchronous track flush can
therefore race with the callback.
Stop the timer before synchronous track writes and use timer_delete_sync()
to wait for any callback already running. Keep callback rearming disabled
until the write is complete. Apply this to the FDFMTTRK path as well.
FDFLUSH, FDFMTTRK and close-time flushes run outside the blk-mq
request callback. Freeze their queues so an in-flight request cannot
change the shared track buffer while it is encoded and written. Restart
the timer if a track remains dirty after a failed flush.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930065951.2932739-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/amiflop.c | 71 ++++++++++++++++++++++++++++++++++++-----
1 file changed, 63 insertions(+), 8 deletions(-)
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 2932b6653b6f0..a477ada6b1ef5 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -265,6 +265,8 @@ static struct fd_data_type data_types[] = {
static struct amiga_floppy_struct unit[FD_MAX_UNITS];
static struct timer_list flush_track_timer[FD_MAX_UNITS];
+static DEFINE_SPINLOCK(flush_track_timer_lock);
+static bool flush_track_timer_stopped[FD_MAX_UNITS];
static struct timer_list post_write_timer;
static unsigned long post_write_timer_drive;
static struct timer_list motor_on_timer;
@@ -1370,11 +1372,22 @@ static void flush_track_callback(struct timer_list *timer)
sizeof(flush_track_timer[0]);
nr&=3;
+ spin_lock(&flush_track_timer_lock);
+ if (flush_track_timer_stopped[nr]) {
+ spin_unlock(&flush_track_timer_lock);
+ return;
+ }
+ spin_unlock(&flush_track_timer_lock);
+
writefromint = 1;
if (!try_fdc(nr)) {
/* we might block in an interrupt, so try again later */
- flush_track_timer[nr].expires = jiffies + 1;
- add_timer(flush_track_timer + nr);
+ spin_lock(&flush_track_timer_lock);
+ if (!flush_track_timer_stopped[nr]) {
+ flush_track_timer[nr].expires = jiffies + 1;
+ add_timer(flush_track_timer + nr);
+ }
+ spin_unlock(&flush_track_timer_lock);
return;
}
get_fdc(nr);
@@ -1421,6 +1434,35 @@ static int non_int_flush_track (unsigned long nr)
return 1;
}
+static void flush_track_timer_stop(unsigned int drive)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&flush_track_timer_lock, flags);
+ flush_track_timer_stopped[drive] = true;
+ spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+
+ timer_delete_sync(flush_track_timer + drive);
+}
+
+static void flush_track_timer_start(unsigned int drive)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&flush_track_timer_lock, flags);
+ flush_track_timer_stopped[drive] = false;
+ if (unit[drive].dirty)
+ mod_timer(flush_track_timer + drive, jiffies + 1);
+ spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+}
+
+static void flush_track_timer_sync(unsigned int drive)
+{
+ flush_track_timer_stop(drive);
+ non_int_flush_track(drive);
+ flush_track_timer_start(drive);
+}
+
static int get_track(int drive, int track)
{
int error, errcnt;
@@ -1435,8 +1477,7 @@ static int get_track(int drive, int track)
}
if (unit[drive].dirty == 1) {
- timer_delete(flush_track_timer + drive);
- non_int_flush_track (drive);
+ flush_track_timer_sync(drive);
}
errcnt = 0;
while (errcnt < MAX_ERRORS) {
@@ -1562,6 +1603,12 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
case FDFMTTRK:
if (param < p->type->tracks * p->type->heads)
{
+ flush_track_timer_stop(drive);
+ if (unit[drive].dirty == 1 &&
+ !non_int_flush_track(drive)) {
+ flush_track_timer_start(drive);
+ return -EIO;
+ }
get_fdc(drive);
if (fd_seek(drive,param) != 0){
memset(p->trackbuf, FD_FILL_BYTE,
@@ -1570,6 +1617,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
}
floppy_off(drive);
rel_fdc();
+ flush_track_timer_start(drive);
}
else
return -EINVAL;
@@ -1591,8 +1639,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
case FDDEFPRM:
return -EINVAL;
case FDFLUSH: /* unconditionally, even if not needed */
- timer_delete(flush_track_timer + drive);
- non_int_flush_track(drive);
+ flush_track_timer_sync(drive);
break;
#ifdef RAW_IOCTL
case IOCTL_RAW_TRACK:
@@ -1611,9 +1658,15 @@ static int fd_ioctl(struct block_device *bdev, blk_mode_t mode,
unsigned int cmd, unsigned long param)
{
int ret;
+ unsigned int memflags = 0;
+ bool freeze_queue = cmd == FDFMTTRK || cmd == FDFLUSH;
mutex_lock(&amiflop_mutex);
+ if (freeze_queue)
+ memflags = blk_mq_freeze_queue(bdev->bd_disk->queue);
ret = fd_locked_ioctl(bdev, mode, cmd, param);
+ if (freeze_queue)
+ blk_mq_unfreeze_queue(bdev->bd_disk->queue, memflags);
mutex_unlock(&amiflop_mutex);
return ret;
@@ -1711,11 +1764,12 @@ static void floppy_release(struct gendisk *disk)
{
struct amiga_floppy_struct *p = disk->private_data;
int drive = p - unit;
+ unsigned int memflags;
mutex_lock(&amiflop_mutex);
+ memflags = blk_mq_freeze_queue(disk->queue);
if (unit[drive].dirty == 1) {
- timer_delete(flush_track_timer + drive);
- non_int_flush_track (drive);
+ flush_track_timer_sync(drive);
}
if (!fd_ref[drive]--) {
@@ -1725,6 +1779,7 @@ static void floppy_release(struct gendisk *disk)
#ifdef MODULE
floppy_off (drive);
#endif
+ blk_mq_unfreeze_queue(disk->queue, memflags);
mutex_unlock(&amiflop_mutex);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 325/869] PCI: Disable MSI for ULi M1575 EHCI controller
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 324/869] block: amiflop: synchronize flush timer before track flush Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 326/869] media: uvcvideo: Fix NULL deref on events for uninitialized controls Greg Kroah-Hartman
` (551 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Kaloz, Bjorn Helgaas,
Andy Shevchenko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Kaloz <kaloz@kernel.org>
[ Upstream commit 5f30217ec296fb5742f6fd306586dbca5b81b4eb ]
With MSI, the ULi M1575 EHCI controller (10b9:5239) intermittently stops
executing its asynchronous schedule. Control transfers time out ("device
not accepting address", "device descriptor read/64"), the port is handed to
the companion OHCI controller, and the device ends up at full speed. On a
configured hub the stall shows up as hub descriptor and status read
failures. Only re-initializing the controller recovers it.
On a Sun Ultra 45, 65 of 800 controller initializations stalled with MSI
and none of 200 with INTx. Each initialization is an unbind and bind of
ehci-pci on the EHCI function, with MSI or INTx selected through its
msi_bus attribute; with this quirk, 0 of 100 cycles of the same loop
stalled. The stall reproduces on a kernel that already contains commit
0b60557230ad ("usb: ehci: Prevent missed ehci interrupts with
edge-triggered MSI").
The OHCI functions (10b9:5237) keep MSI. They showed no stall, and the hub
enumerated through them on MSI during the EHCI failures, so only the EHCI
function is quirked.
The illumos EHCI driver also disables MSI on this chip, in
ehci_register_intrs_and_init_mutex() in
usr/src/uts/common/io/usb/hcd/ehci/ehci_util.c.
Until USB HCDs started trying MSI first in v5.9, the controller always used
INTx. Disable MSI so it uses INTx again on this chipset.
Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260930191100.6127-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 199f2a762b22a..d29ff1da29b17 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1944,6 +1944,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi);
+/* ULi M1575 EHCI (10b9:5239): MSI stalls the async schedule */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, 0x5239, quirk_no_msi);
static void quirk_pcie_mch(struct pci_dev *pdev)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 326/869] media: uvcvideo: Fix NULL deref on events for uninitialized controls
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 325/869] PCI: Disable MSI for ULi M1575 EHCI controller Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 327/869] crypto: caam - fix double-free in caam_rsa_set_priv_key_form() Greg Kroah-Hartman
` (550 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Jie Law, Ricardo Ribalda,
Hans de Goede, Laurent Pinchart, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Jie Law <98lawweijie@gmail.com>
[ Upstream commit daa379e2b74d6c10ba4e3b56eeca5aa8c8704fca ]
A null-ptr-deref exists in v6.12.105 and upstream. KASAN crash log:
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
Workqueue: events uvc_ctrl_status_event_work
RIP: 0010:uvc_ctrl_status_event+0x105/0x280
uvc_ctrl_status_event_work+0x82/0x240
process_one_work+0x66f/0x10b0
XU controls are initialized lazily, on the first UVCIOC_CTRL_MAP or
UVCIOC_CTRL_QUERY. Until then ctrl->info is all zeroes, so
info.mappings is not a valid list head, list_empty() returns false, and
uvc_ctrl_status_event() walks it from a NULL next pointer.
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <98lawweijie@gmail.com>
Assisted-by: LLM
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260907121844.2592492-1-98lawweijie@gmail.com
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 2738ef74c7373..7fd2e03f92e6c 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2010,7 +2010,7 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
struct uvc_device *dev = chain->dev;
struct uvc_ctrl_work *w = &dev->async_ctrl;
- if (list_empty(&ctrl->info.mappings))
+ if (!ctrl->initialized || list_empty(&ctrl->info.mappings))
return false;
w->data = data;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 327/869] crypto: caam - fix double-free in caam_rsa_set_priv_key_form()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 326/869] media: uvcvideo: Fix NULL deref on events for uninitialized controls Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 328/869] hwrng: amd - report partial reads in non-blocking mode Greg Kroah-Hartman
` (549 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhaoJinming, Sahil Malhotra,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoJinming <zhaojinming@uniontech.com>
[ Upstream commit a91d9346a70b68f77884cba9d9ec3b70f96bf9d2 ]
caam_rsa_set_priv_key_form() frees the partially allocated key
components (p, q, tmp1, tmp2, dp, dq) with kfree_sensitive() on its
error path, but does not set those pointers to NULL afterward.
When the function returns an error, caam_rsa_set_priv_key() jumps to
its err label and calls caam_rsa_free_key(), which frees all of those
same pointers again, resulting in a double-free.
This is reachable when the allocation of q, tmp1, tmp2, dp, dq or qinv
fails, e.g. under memory pressure, or for a malformed key whose CRT
members decode to zero length and make caam_read_rsa_crt() return NULL.
Set each pointer to NULL right after freeing it so that the subsequent
caam_rsa_free_key() call becomes a no-op for the already-freed fields.
Fixes: 52e26d77b8b3 ("crypto: caam - add support for RSA key form 2")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/caam/caampkc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index cb001aa1de661..ac515ed8c5755 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -1033,16 +1033,22 @@ static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
free_dq:
kfree_sensitive(rsa_key->dq);
+ rsa_key->dq = NULL;
free_dp:
kfree_sensitive(rsa_key->dp);
+ rsa_key->dp = NULL;
free_tmp2:
kfree_sensitive(rsa_key->tmp2);
+ rsa_key->tmp2 = NULL;
free_tmp1:
kfree_sensitive(rsa_key->tmp1);
+ rsa_key->tmp1 = NULL;
free_q:
kfree_sensitive(rsa_key->q);
+ rsa_key->q = NULL;
free_p:
kfree_sensitive(rsa_key->p);
+ rsa_key->p = NULL;
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 328/869] hwrng: amd - report partial reads in non-blocking mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 327/869] crypto: caam - fix double-free in caam_rsa_set_priv_key_form() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 329/869] hwrng: ba431 - fix reported byte count Greg Kroah-Hartman
` (548 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit e7f5ce911efb2017381f28bbedb6243a74a9c285 ]
amd_rng_read() returns 0 if no more data is available, even if some data
was already copied to the output buffer. Return the number of copied
bytes instead.
Fixes: 85962d2248fa ("hwrng: amd - Convert to new hwrng read() API")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/amd-rng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 9a24d19236dc7..cc65d40a55984 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -80,7 +80,7 @@ static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
if (timeout-- == 0)
return read;
} else {
- return 0;
+ return read;
}
} else {
*data = ioread32(priv->iobase + RNGDATA);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 329/869] hwrng: ba431 - fix reported byte count
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 328/869] hwrng: amd - report partial reads in non-blocking mode Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 330/869] hwrng: core - reject unknown RNG names Greg Kroah-Hartman
` (547 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 7e638679883ceff5b6e7b6dcad09c21a105e941f ]
Use the size of the buffer element instead of the pointer size to report
the number of bytes read. Since data is a u32 pointer and sizeof(data)
is 8 bytes on 64-bit systems, using the pointer size reports twice the
number of bytes actually read.
Fixes: 0289e9be5dc2 ("hwrng: ba431 - add support for BA431 hwrng")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/ba431-rng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/ba431-rng.c b/drivers/char/hw_random/ba431-rng.c
index 9de7466e68962..c33fbc25b7cdf 100644
--- a/drivers/char/hw_random/ba431-rng.c
+++ b/drivers/char/hw_random/ba431-rng.c
@@ -148,7 +148,7 @@ static int ba431_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
}
}
- n *= sizeof(data);
+ n *= sizeof(*data);
return (n || !wait) ? n : -EIO;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 330/869] hwrng: core - reject unknown RNG names
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 329/869] hwrng: ba431 - fix reported byte count Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 331/869] crypto: nx - validate ignore before subtracting in decompress Greg Kroah-Hartman
` (546 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Andy Shevchenko,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 7e7be8815143751c20260f80cb4e7fe14dd24b74 ]
In rng_current_store(), err is 0 after successfully locking rng_mutex,
and if the requested RNG name cannot be found, the function reports
success even though the current RNG was not changed.
Set err = -ENODEV before searching the RNG list to reject unknown names.
Fixes: 142a27f0a731 ("hwrng: core - Reset user selected rng by writing "" to rng_current")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 054ffbc9e4220..6412bfa792a29 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -381,6 +381,7 @@ static ssize_t rng_current_store(struct device *dev,
cur_rng_set_by_user = 1;
drop_current_rng();
} else {
+ err = -ENODEV;
list_for_each_entry(rng, &rng_list, list) {
if (sysfs_streq(rng->name, buf)) {
err = set_current_rng(rng);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 331/869] crypto: nx - validate ignore before subtracting in decompress
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 330/869] hwrng: core - reject unknown RNG names Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 332/869] crypto: ecc - Handle exceptional points in Shamir multiplication Greg Kroah-Hartman
` (545 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
[ Upstream commit b5c2df42977390a71f1940def5be9bd5c69ac2e0 ]
The decompress() function subtracts the header-supplied `ignore` value
(a u16 from the compressed stream) from `dlen` (the number of bytes
produced by the decompressor) without checking that ignore <= dlen.
If a caller decompresses a crafted buffer where `hdr->ignore` exceeds
the actual decompressed length, the subtraction wraps around to a
near-UINT_MAX value. The subsequent memcpy() then copies gigabytes of
data past the destination buffer, causing an out-of-bounds kernel write.
Add a bounds check before the subtraction and return -EINVAL if the
value is inconsistent.
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/nx/nx-842.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c
index 8b1dc05df8c8d..ade5361571f14 100644
--- a/drivers/crypto/nx/nx-842.c
+++ b/drivers/crypto/nx/nx-842.c
@@ -421,6 +421,8 @@ static int decompress(struct nx842_crypto_ctx *ctx,
slen -= spadding;
+ if (ignore > dlen)
+ return -EINVAL;
dlen -= ignore;
if (ignore)
pr_debug("ignoring last %x bytes\n", ignore);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 332/869] crypto: ecc - Handle exceptional points in Shamir multiplication
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 331/869] crypto: nx - validate ignore before subtracting in decompress Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 333/869] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM Greg Kroah-Hartman
` (544 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Ignat Korchagin, Stefan Berger, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 6fd70bc8bc01a578c7728b7bd1cb5689c62cc5b7 ]
Shamir multiplication mishandles equal points, opposite points and the
point at infinity. This rejects valid ECDSA signatures and can accept
invalid digest/signature tuples when the public key is G or -G. The
kernel incorrectly rejects 16 valid signatures from Wycheproof.
Handle doubling, cancellation and the point at infinity in precomputation
and accumulation. Add regression tests for P-256 ECDSA and 256/512-bit
EC-RDSA. The valid vectors are Wycheproof P1363 secp256r1/SHA-256 cases
60 and 210 converted to X9.62, two constructed ECDSA signatures for
Q = +/-G with k = 2, and six constructed EC-RDSA signatures for Q = G,
-G and -2G. Also add two invalid P-256 digest/signature tuples for
Q = +/-G that must return -EKEYREJECTED.
Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ecc.c | 33 ++++-
crypto/testmgr.c | 11 +-
crypto/testmgr.h | 327 ++++++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 363 insertions(+), 8 deletions(-)
diff --git a/crypto/ecc.c b/crypto/ecc.c
index f97ff234086ff..a289d47d5651d 100644
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -1410,9 +1410,22 @@ static void ecc_point_add(const struct ecc_point *result,
vli_set(result->x, q->x, ndigits);
vli_set(result->y, q->y, ndigits);
vli_mod_sub(z, result->x, p->x, curve->p, ndigits);
+ if (vli_is_zero(z, ndigits)) {
+ if (vli_cmp(p->y, q->y, ndigits)) {
+ /* P + (-P) is the point at infinity. */
+ vli_clear(result->x, ndigits);
+ vli_clear(result->y, ndigits);
+ return;
+ }
+ /* The co-Z addition formula does not handle P == Q. */
+ z[0] = 1;
+ ecc_point_double_jacobian(result->x, result->y, z, curve);
+ goto out;
+ }
vli_set(px, p->x, ndigits);
vli_set(py, p->y, ndigits);
xycz_add(px, py, result->x, result->y, curve);
+out:
vli_mod_inv(z, z, curve->p, ndigits);
apply_z(result->x, result->y, z, curve);
}
@@ -1452,22 +1465,38 @@ void ecc_point_mult_shamir(const struct ecc_point *result,
vli_set(rx, point->x, ndigits);
vli_set(ry, point->y, ndigits);
vli_clear(z + 1, ndigits - 1);
- z[0] = 1;
+ z[0] = !ecc_point_is_zero(point);
for (--i; i >= 0; i--) {
ecc_point_double_jacobian(rx, ry, z, curve);
idx = !!vli_test_bit(u1, i);
idx |= (!!vli_test_bit(u2, i)) << 1;
point = points[idx];
- if (point) {
+ if (point && !ecc_point_is_zero(point)) {
u64 tx[ECC_MAX_DIGITS];
u64 ty[ECC_MAX_DIGITS];
u64 tz[ECC_MAX_DIGITS];
+ if (vli_is_zero(z, ndigits)) {
+ /* Adding to infinity starts a new accumulator. */
+ vli_set(rx, point->x, ndigits);
+ vli_set(ry, point->y, ndigits);
+ z[0] = 1;
+ continue;
+ }
vli_set(tx, point->x, ndigits);
vli_set(ty, point->y, ndigits);
apply_z(tx, ty, z, curve);
vli_mod_sub(tz, rx, tx, curve->p, ndigits);
+ if (vli_is_zero(tz, ndigits)) {
+ if (!vli_cmp(ry, ty, ndigits))
+ ecc_point_double_jacobian(rx, ry, z,
+ curve);
+ else
+ /* Adding opposite points yields infinity. */
+ vli_clear(z, ndigits);
+ continue;
+ }
xycz_add(tx, ty, rx, ry, curve);
vli_mod_mult_fast(z, z, tz, curve);
}
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 6a490aaa71b9a..8543e21a4259d 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4061,16 +4061,17 @@ static int test_sig_one(struct crypto_sig *tfm, const struct sig_testvec *vecs)
*/
err = crypto_sig_verify(tfm, vecs->c, vecs->c_size,
vecs->m, vecs->m_size);
- if (err) {
- pr_err("alg: sig: verify test failed: err %d\n", err);
- return err;
+ if (err != vecs->verify_error) {
+ pr_err("alg: sig: verify test failed: expected %d, got %d\n",
+ vecs->verify_error, err);
+ return err ?: -EINVAL;
}
/*
* Don't invoke sign test (which requires a private key)
- * for vectors with only a public key.
+ * for vectors with only a public key or an invalid signature.
*/
- if (vecs->public_key_vec)
+ if (vecs->public_key_vec || vecs->verify_error)
return 0;
sig_size = crypto_sig_maxsize(tfm);
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index 2682312272824..210dafb684fd7 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -165,6 +165,7 @@ struct sig_testvec {
unsigned int param_len;
unsigned int m_size;
unsigned int c_size;
+ int verify_error;
bool public_key_vec;
enum OID algo;
};
@@ -1447,6 +1448,140 @@ static const struct sig_testvec x962_ecdsa_nist_p192_tv_template[] = {
};
static const struct sig_testvec x962_ecdsa_nist_p256_tv_template[] = {
+ /* Invalid signature: Q = G, r = s, e = 3r mod n. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+ "\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+ "\xf5",
+ .key_len = 65,
+ .m =
+ "\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+ "\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+ .m_size = 32,
+ .c =
+ "\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+ "\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+ "\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+ "\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+ "\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+ .c_size = 72,
+ .verify_error = -EKEYREJECTED,
+ .public_key_vec = true,
+ },
+ /* Invalid signature: Q = -G, r = s, e = 3r mod n. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+ "\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+ "\x0a",
+ .key_len = 65,
+ .m =
+ "\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+ "\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+ .m_size = 32,
+ .c =
+ "\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+ "\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+ "\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+ "\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+ "\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+ .c_size = 72,
+ .verify_error = -EKEYREJECTED,
+ .public_key_vec = true,
+ },
+ /* Wycheproof secp256r1/SHA-256 tcId 60. */
+ {
+ .key =
+ "\x04\x29\x27\xb1\x05\x12\xba\xe3\xed\xdc\xfe\x46\x78\x28\x12\x8b"
+ "\xad\x29\x03\x26\x99\x19\xf7\x08\x60\x69\xc8\xc4\xdf\x6c\x73\x28"
+ "\x38\xc7\x78\x79\x64\xea\xac\x00\xe5\x92\x1f\xb1\x49\x8a\x60\xf4"
+ "\x60\x67\x66\xb3\xd9\x68\x50\x01\x55\x8d\x1a\x97\x4e\x73\x41\x51"
+ "\x3e",
+ .key_len = 65,
+ .m =
+ "\x70\x23\x9d\xd8\x77\xf7\xc9\x44\xc4\x22\xf4\x4d\xea\x4e\xd1\xa5"
+ "\x2f\x26\x27\x41\x6f\xaf\x2f\x07\x2f\xa5\x0c\x77\x2e\xd6\xf8\x07",
+ .m_size = 32,
+ .c =
+ "\x30\x44\x02\x20\x64\xa1\xaa\xb5\x00\x0d\x0e\x80\x4f\x3e\x2f\xc0"
+ "\x2b\xde\xe9\xbe\x8f\xf3\x12\x33\x4e\x2b\xa1\x6d\x11\x54\x7c\x97"
+ "\x71\x1c\x89\x8e\x02\x20\x6a\xf0\x15\x97\x1c\xc3\x0b\xe6\xd1\xa2"
+ "\x06\xd4\xe0\x13\xe0\x99\x77\x72\xa2\xf9\x1d\x73\x28\x6f\xfd\x68"
+ "\x3b\x9b\xb2\xcf\x4f\x1b",
+ .c_size = 70,
+ .public_key_vec = true,
+ },
+ /* Wycheproof secp256r1/SHA-256 tcId 210. */
+ {
+ .key =
+ "\x04\xc6\xa7\x71\x52\x70\x24\x22\x77\x92\x17\x0a\x6f\x8e\xee\x73"
+ "\x5b\xf3\x2b\x7f\x98\xaf\x66\x9e\xad\x29\x98\x02\xe3\x2d\x7c\x31"
+ "\x07\xbc\x3b\x4b\x5e\x65\xab\x88\x7b\xbd\x34\x35\x72\xb3\xe5\x61"
+ "\x92\x61\xfe\x3a\x07\x3e\x2f\xfd\x78\x41\x2f\x72\x68\x67\xdb\x58"
+ "\x9e",
+ .key_len = 65,
+ .m =
+ "\xbb\x5a\x52\xf4\x2f\x9c\x92\x61\xed\x43\x61\xf5\x94\x22\xa1\xe3"
+ "\x00\x36\xe7\xc3\x2b\x27\x0c\x88\x07\xa4\x19\xfe\xca\x60\x50\x23",
+ .m_size = 32,
+ .c =
+ "\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x21\x00\xb6\xdb\x6d\xb6\x24\x92\x49\x25\x49"
+ "\x24\x92\x49\x24\x92\x49\x24\x62\x5b\xd7\xa0\x9b\xec\x4c\xa8\x1b"
+ "\xcd\xd9\xf8\xfd\x6b\x63\xcc",
+ .c_size = 71,
+ .public_key_vec = true,
+ },
+ /* Q = G, d = 1, k = 2. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+ "\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+ "\xf5",
+ .key_len = 65,
+ .m =
+ "\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+ "\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+ .m_size = 32,
+ .c =
+ "\x30\x44\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x20\x59\x47\xc9\x21\x23\x0e\xd1\x34\x0b\x03"
+ "\xe6\xe3\x45\x6e\xab\x69\xf8\x66\xff\x7e\x8c\x7d\x1e\x13\x23\x17"
+ "\x06\x8a\x84\xec\x1d\x22",
+ .c_size = 70,
+ .public_key_vec = true,
+ },
+ /* Q = -G, d = n - 1, k = 2. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+ "\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+ "\x0a",
+ .key_len = 65,
+ .m =
+ "\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+ "\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+ .m_size = 32,
+ .c =
+ "\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x21\x00\xdc\x55\x4e\x07\x96\x0b\x81\xb6\x80"
+ "\xb1\xae\xe0\x40\xb9\x90\xa5\xf4\xc4\x90\x49\xbb\xa2\xa1\x62\x70"
+ "\xc5\x88\x51\x39\xe8\xa8\xfb",
+ .c_size = 71,
+ .public_key_vec = true,
+ },
{
.key = /* secp256r1(sha1) */
"\x04\xb9\x7b\xbb\xd7\x17\x64\xd2\x7e\xfc\x81\x5d\x87\x06\x83\x41"
@@ -1831,7 +1966,8 @@ static const struct sig_testvec p1363_ecdsa_nist_p256_tv_template[] = {
};
/*
- * EC-RDSA test vectors are generated by gost-engine.
+ * EC-RDSA test vectors generated by gost-engine, followed by constructed
+ * exceptional-point regression vectors.
*/
static const struct sig_testvec ecrdsa_tv_template[] = {
{
@@ -1977,6 +2113,195 @@ static const struct sig_testvec ecrdsa_tv_template[] = {
.m_size = 64,
.public_key_vec = true,
},
+ /*
+ * Constructed EC-RDSA exceptional-point vectors.
+ * With Q = dG, choose k = z1 + d*z2 (mod n), r = x(kG) mod n,
+ * e = -r/z2 (mod n), and s = r*d + k*e (mod n).
+ * The input digest is e, encoded little-endian.
+ */
+ /* cp256a: Q=G, z1 = 3, z2 = 1. */
+ {
+ .key =
+ "\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+ "\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+ "\x91\x8d",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x1a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x49"
+ "\x32\x67\xe0\x26\x16\xfd\xb7\xaf\xa4\xd7\x3e\x61\xd4\xf9\x7b\x94"
+ "\xf7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7"
+ "\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe4\xb7",
+ .c_size = 64,
+ .m =
+ "\xdc\xd3\xfd\x46\xcb\x14\x9d\xe1\x8f\x92\x54\xb2\x0c\xa0\x22\x66"
+ "\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x08",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* cp256a: Q=-G, z1 = 7, z2 = 6. */
+ {
+ .key =
+ "\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x83\xdf\x60\x61\x63\x36\x53\xdd\x4e\x1c\xdc\x20\xd2\xb0"
+ "\xd6\xca\x89\xd4\xc0\xba\xa5\xaf\x20\xd8\x25\x63\x67\x1f\x8e\x1b"
+ "\x6e\x72",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x2a\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+ "\x92\x10\x2d\x68\x19\x8f\x22\xd5\x60\xeb\x59\xd6\xf3\xe5\x9e\xc2"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+ .c_size = 64,
+ .m =
+ "\xc3\x9e\xe5\xf3\xd6\x59\xeb\x60\xd5\x22\x8f\x19\x68\x2d\x10\x92"
+ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x2a",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* cp256a: Q=-2G, z1 = 5, z2 = 2. */
+ {
+ .key =
+ "\x04\x40\x95\xfd\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+ "\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+ "\x91\x8d",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xb6\x30\x88\x38\x4c\xad\x68\x80\x22\xc2\x0d\x84\xdb\xb0\xdc\x47"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+ .c_size = 64,
+ .m =
+ "\x49\xdc\xb0\xdb\x84\x0d\xc2\x22\x80\x68\xad\x4c\x38\x88\x30\xb6"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=G, z1 = 3, z2 = 1. */
+ {
+ .key =
+ "\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\xa4\xf2\x15\x52\xcb\x89\xa5\x89\xb8\xf5\x35\xc2\x5f"
+ "\xfe\x28\x80\xe9\x41\x3a\x0e\xa5\xe6\x75\x3d\xe9\x36\xd0\x4f\xbe"
+ "\x26\x16\xdf\x21\xa9\xef\xcb\xfd\x64\x80\x77\xc1\xab\xf1\xac\x93"
+ "\x1c\x5e\xce\xe6\x50\x54\xe2\x16\x88\x1b\xa6\xe3\x6a\x83\x7a\xe8"
+ "\xcf\x03\x75",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\xd8\xc0\xd7\xe3\xfb\xa6\xca\xff\x6a\xd1\xb4\xb4\x82\x1d\x15\x6f"
+ "\xa7\xc7\xbd\x63\x95\xb8\x29\x0d\xd4\xfa\xb1\x1c\x36\xbd\x32\x8d"
+ "\x1a\xba\xf1\x2e\xbc\x7b\xf2\x02\x96\xf8\xef\x2a\x5e\x72\x64\x86"
+ "\x67\x62\xfb\x62\x8e\x83\x53\x63\xb7\xe6\x78\x3c\x42\xd7\x0d\x1d"
+ "\xb7\xbf\xb8\x09\x56\xc8\x67\x00\x31\xba\x19\x19\x29\xf6\x4e\x30"
+ "\x1d\x68\x16\x34\x23\x6d\x47\xa6\x0e\x57\x1a\x4b\xed\xc0\xef\x25"
+ "\x74\x52\xef\x78\xb5\xb9\x8d\xbb\x3d\x9f\x31\x29\xd9\x34\x94\x33"
+ "\xce\x2a\x3a\x35\xcb\x51\x9c\x91\xe2\xd6\x33\xd7\xb3\x73\xae\x16",
+ .c_size = 128,
+ .m =
+ "\x5f\x04\x9d\x6b\x69\x7d\xf7\xe7\xcb\x1b\x81\x2f\x76\xfe\x20\xcd"
+ "\x2c\xcc\xd0\x74\x63\xfa\x52\x32\x56\xfb\xd3\x3e\xba\xa5\x93\xb3"
+ "\xd9\x10\x3f\x12\xb4\xe5\xa8\xf1\x59\xb8\x92\xdc\xcb\xe9\x97\xe2"
+ "\xcf\xb1\x09\xd6\xe6\xe6\x45\xce\xff\x98\x37\xa9\xf6\x47\x40\x48",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=-G, z1 = 7, z2 = 6. */
+ {
+ .key =
+ "\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x23\x0b\xea\xad\x34\x76\x5a\x76\x47\x0a\xca\x3d\xa0"
+ "\x01\xd7\x7f\x16\xbe\xc5\xf1\x5a\x19\x8a\xc2\x16\xc9\x2f\xb0\x41"
+ "\xd9\xe9\x20\xde\x56\x10\x34\x02\x9b\x7f\x88\x3e\x54\x0e\x53\x6c"
+ "\xe3\xa1\x31\x19\xaf\xab\x1d\xe9\x77\xe4\x59\x1c\x95\x7c\x85\x17"
+ "\x30\xfc\x8a",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+ "\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x37"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+ .c_size = 128,
+ .m =
+ "\x3a\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+ "\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=-2G, z1 = 5, z2 = 2. */
+ {
+ .key =
+ "\x04\x81\x80\x7c\x13\xea\xd2\xd9\xaf\x82\xb9\x1f\xb2\xfd\xe1\x8d"
+ "\xf4\x5b\x37\xe4\xf2\x04\x6a\x2a\x1d\x15\x16\x95\x2a\x5d\x40\xcd"
+ "\xbb\x34\x44\x2f\x2b\x13\x0a\x47\xb0\xf6\xe5\xa5\x58\x3a\xf4\x54"
+ "\x09\xb0\x1d\xf5\x5c\xf1\xbf\x9d\x86\xa5\x97\xab\x96\x29\x62\xfc"
+ "\xdc\x89\x3b\x76\x3d\x50\x6e\x8a\xcf\x02\x4c\x74\x0e\x6e\xe0\x1f"
+ "\x28\xab\x27\x9b\x20\x02\xc8\xc4\x12\xcb\x8a\xe3\xa4\x27\xce\x39"
+ "\x62\xdf\x35\x6d\xc1\x65\x7f\x7b\x48\x90\x11\x8f\x19\x7c\x1e\x67"
+ "\x91\x97\xeb\x90\x85\x25\xfc\x86\xb3\x88\x6e\x5c\x57\x1f\x1d\x1d"
+ "\x3b\xec\x37",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+ "\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x33"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+ .c_size = 128,
+ .m =
+ "\x39\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+ "\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
};
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 333/869] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 332/869] crypto: ecc - Handle exceptional points in Shamir multiplication Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 334/869] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting Greg Kroah-Hartman
` (543 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Vincent Donnefort,
Joey Gouly, Fuad Tabba, Marc Zyngier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit cf533b4d3630b229d78ad55567c5db2f365052a2 ]
On an MTE-capable host under pKVM, enter_exception64() reads the VM's
MTE flag through vcpu->kvm, which for a host vCPU is a host-writable
pointer nothing validates. The host can point it at any address in the
hyp linear map and read back bit 1 of that word through PSR_TCO in the
vCPU's CPSR, or panic the hypervisor with an unmapped one.
Get the VM through a get/put pair around the read: a loaded vCPU's is
the hyp VM, an unloaded host vCPU's is read once and pinned, and a
pointer the host never shared leaves TCO clear.
Fixes: ea7fc1bb1cd1b ("KVM: arm64: Introduce MTE VM feature")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260914070536.877D91F000FF@smtp.kernel.org/
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261001135711.1640520-3-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/exception.c | 5 ++-
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 28 ++++++++++++++++
arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 2 ++
arch/arm64/kvm/hyp/nvhe/pkvm.c | 37 ++++++++++++++++++++++
4 files changed, 71 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/hyp/exception.c b/arch/arm64/kvm/hyp/exception.c
index bef40ddb16dbc..c041142896e35 100644
--- a/arch/arm64/kvm/hyp/exception.c
+++ b/arch/arm64/kvm/hyp/exception.c
@@ -86,6 +86,7 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
enum exception_type type)
{
unsigned long sctlr, vbar, old, new, mode;
+ struct kvm *kvm;
u64 exc_offset;
mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
@@ -125,8 +126,10 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
new |= (old & PSR_C_BIT);
new |= (old & PSR_V_BIT);
- if (kvm_has_mte(kern_hyp_va(vcpu->kvm)))
+ kvm = vcpu_get_kvm(vcpu);
+ if (kvm && kvm_has_mte(kvm))
new |= PSR_TCO_BIT;
+ vcpu_put_kvm(vcpu, kvm);
new |= (old & PSR_DIT_BIT);
diff --git a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
index 4fdfeabefeb43..f55950ee2a7e4 100644
--- a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
+++ b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
@@ -13,6 +13,34 @@
#include <asm/kvm_emulate.h>
#include <asm/kvm_host.h>
+#ifdef __KVM_NVHE_HYPERVISOR__
+#include <nvhe/pkvm.h>
+
+/* Under pKVM a host vCPU's ->kvm is host-writable. */
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ if (is_protected_kvm_enabled())
+ return pkvm_vcpu_get_kvm(vcpu);
+
+ return kern_hyp_va(vcpu->kvm);
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+ if (is_protected_kvm_enabled())
+ pkvm_vcpu_put_kvm(vcpu, kvm);
+}
+#else
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ return vcpu->kvm;
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+}
+#endif
+
static inline void kvm_skip_instr(struct kvm_vcpu *vcpu)
{
if (vcpu_mode_is_32bit(vcpu)) {
diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
index 184ad7a399507..25b2f477bb5b2 100644
--- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
+++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
@@ -79,6 +79,8 @@ struct pkvm_hyp_vcpu *pkvm_load_hyp_vcpu(pkvm_handle_t handle,
unsigned int vcpu_idx);
void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu);
struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void);
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu);
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm);
struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle);
struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle);
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index bf0250806a781..136c4008b9363 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -306,6 +306,43 @@ struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void)
}
+static struct pkvm_hyp_vm *pkvm_get_loaded_hyp_vm(struct kvm_vcpu *vcpu)
+{
+ struct pkvm_hyp_vcpu *hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
+
+ if (hyp_vcpu &&
+ (vcpu == &hyp_vcpu->vcpu || vcpu == hyp_vcpu->host_vcpu))
+ return pkvm_hyp_vcpu_to_hyp_vm(hyp_vcpu);
+
+ return NULL;
+}
+
+/*
+ * A loaded vCPU's VM is the hyp VM. An unloaded host vCPU's is mapped at
+ * EL2 only while pinned, so it's read once and pinned; the pin fails for
+ * memory the host isn't sharing.
+ */
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ struct pkvm_hyp_vm *hyp_vm = pkvm_get_loaded_hyp_vm(vcpu);
+ struct kvm *kvm;
+
+ if (hyp_vm)
+ return &hyp_vm->kvm;
+
+ kvm = kern_hyp_va(READ_ONCE(vcpu->kvm));
+ if (hyp_pin_shared_mem(kvm, kvm + 1))
+ return NULL;
+
+ return kvm;
+}
+
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+ if (kvm && !pkvm_get_loaded_hyp_vm(vcpu))
+ hyp_unpin_shared_mem(kvm, kvm + 1);
+}
+
struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle)
{
struct pkvm_hyp_vm *hyp_vm;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 334/869] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 333/869] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 335/869] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Greg Kroah-Hartman
` (542 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Kim Phillips,
Borislav Petkov (AMD), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@amd.com>
[ Upstream commit 1847c80537891baead3975f3ca969233ff7b2a11 ]
When the kernel lacks retpoline support, spectre_v2_select_retpoline()
emits
"Kernel not compiled with retpoline; no mitigation available!"
before returning SPECTRE_V2_NONE to its callers. SPECTRE_V2_NONE is not
the final answer, though: spectre_v2_update_mitigation() runs afterwards
and can still upgrade the mitigation.
On an Intel CPU affected by RETBleed, built with
CONFIG_MITIGATION_IBRS_ENTRY=y and
CONFIG_MITIGATION_RETPOLINE=n,
and booted with spectre_v2=auto, retbleed_select_mitigation() picks
RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
SPECTRE_V2_NONE to SPECTRE_V2_IBRS. The boot log claims no mitigation is
available immediately before reporting
"Spectre V2 : Mitigation: IBRS",
and sysfs reports the machine as mitigated. The message is alarming and
simply wrong.
Drop "no mitigation available!" because the final mitigation state is printed
afterwards in spectre_v2_update_mitigation() anyway.
[ bp: Drop CC:stable, massage commit message. ]
Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
Suggested-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Link: https://patch.msgid.link/20260831210916.987152-1-kim.phillips@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a39d97eee8bdb..90d0488d54c5c 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2103,7 +2103,7 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
{
if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
- pr_err("Kernel not compiled with retpoline; no mitigation available!");
+ pr_err("Kernel not compiled with retpoline");
return SPECTRE_V2_NONE;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 335/869] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 334/869] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 336/869] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup Greg Kroah-Hartman
` (541 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Fuad Tabba,
Marc Zyngier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 8a88a46b86ca3dbbd24522760d29edfb3f24ac2a ]
vgic_register_redist_iodev() assigns a redistributor region and base
address to the vCPU before adding its iodev to the MMIO bus. However, the
region's free_index is advanced only after registration succeeds.
If kvm_io_bus_register_dev() fails, the vCPU retains the assignment while
free_index still identifies the same slot as free. A later registration can
therefore reuse a slot that remains assigned to the vCPU.
Reserve the slot before registering its iodev. The caller holds slots_lock,
so a registration failure cannot race with a later assignment. Undo the
reservation and clear the cached assignment on failure.
Fixes: dbd9733ab674 ("KVM: arm/arm64: Replace the single rdist region by a list")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260831081005.41346-2-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 051d9bf73879c..7d90e6fe076c3 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -818,16 +818,21 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
rd_dev->nr_regions = ARRAY_SIZE(vgic_v3_rd_registers);
rd_dev->redist_vcpu = vcpu;
+ /* Protected by slots_lock */
+ rdreg->free_index++;
+
mutex_unlock(&kvm->arch.config_lock);
ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, rd_base,
2 * SZ_64K, &rd_dev->dev);
- if (ret)
- return ret;
+ if (ret) {
+ guard(mutex)(&vcpu->kvm->arch.config_lock);
+ vgic_cpu->rdreg->free_index--;
+ vgic_cpu->rdreg = NULL;
+ vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
+ }
- /* Protected by slots_lock */
- rdreg->free_index++;
- return 0;
+ return ret;
out_unlock:
mutex_unlock(&kvm->arch.config_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 336/869] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 335/869] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 337/869] KVM: arm64: vgic-v3: Roll back assignments from the new region Greg Kroah-Hartman
` (540 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Alexey Klimov,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
[ Upstream commit f7b2b6acf658be412b0c4746d07d210a9e18f13b ]
The setup_cpuhp_and_cpuidle() initialisation sequence currently ignores
the return values of cpuhp_setup_state(), cpu_pm_register_notifier(), and
register_reboot_notifier(). If any of these registrations fail during
probe() routine, the driver returns 0, leaving the driver partially
configured.
Furthermore, if anything after setup_cpuhp_and_cpuidle() fails in probe()
routine, for instance devm_mfd_add_devices(), the probe() lacks an error
path and leaves notifiers and cpu hotplug states registered.
Introduce variables for the cpu hotplug state IDs in exynos_pmu_context
struct, that should be initialised to CPUHP_INVALID by default. Check all
return codes in setup_cpuhp_and_cpuidle(), and add an error path to remove
registered states on failure. Finally, add destroy_cpuhp_and_cpuidle()
helper to safely tear down notifiers and cpu hotplug states.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Link: https://patch.msgid.link/20260930-exynos-pmu-cpuhp-idle-fixes-v3-1-4269d8425978@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/samsung/exynos-pmu.c | 61 +++++++++++++++++++++++++++-----
1 file changed, 53 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 0fcbc08633f6b..748be7ff2affb 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -47,6 +47,8 @@ struct exynos_pmu_context {
unsigned long *in_cpuhp;
bool sys_insuspend;
bool sys_inreboot;
+ int cpuhp_prepare_state;
+ int cpuhp_online_state;
};
void __iomem *pmu_base_addr;
@@ -589,16 +591,55 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
gs101_cpuhp_pmu_online(cpu);
/* register CPU hotplug callbacks */
- cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
- gs101_cpuhp_pmu_online, NULL);
+ pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+ pmu_context->cpuhp_online_state = CPUHP_INVALID;
- cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
- NULL, gs101_cpuhp_pmu_offline);
+ ret = cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
+ gs101_cpuhp_pmu_online, NULL);
+ if (ret < 0)
+ return ret;
+
+ pmu_context->cpuhp_prepare_state = ret;
+
+ ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
+ NULL, gs101_cpuhp_pmu_offline);
+ if (ret < 0)
+ goto clean_cpuhp_state_prepare;
+
+ pmu_context->cpuhp_online_state = ret;
/* register CPU PM notifiers for cpuidle */
- cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
- register_reboot_notifier(&exynos_cpupm_reboot_nb);
- return 0;
+ ret = cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
+ if (ret)
+ goto clean_cpuhp_states;
+
+ ret = register_reboot_notifier(&exynos_cpupm_reboot_nb);
+ if (!ret)
+ /* Success */
+ return ret;
+
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+
+clean_cpuhp_states:
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
+ pmu_context->cpuhp_online_state = CPUHP_INVALID;
+
+clean_cpuhp_state_prepare:
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+
+ return ret;
+}
+
+static void destroy_cpuhp_and_cpuidle(void)
+{
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+ unregister_reboot_notifier(&exynos_cpupm_reboot_nb);
+
+ if (pmu_context->cpuhp_prepare_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ if (pmu_context->cpuhp_online_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
}
static int exynos_pmu_probe(struct platform_device *pdev)
@@ -669,8 +710,12 @@ static int exynos_pmu_probe(struct platform_device *pdev)
ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, exynos_pmu_devs,
ARRAY_SIZE(exynos_pmu_devs), NULL, 0, NULL);
- if (ret)
+ if (ret) {
+ if (pmu_context->pmu_data && pmu_context->pmu_data->pmu_cpuhp)
+ destroy_cpuhp_and_cpuidle();
+
return ret;
+ }
if (devm_of_platform_populate(dev))
dev_err(dev, "Error populating children, reboot and poweroff might not work properly\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 337/869] KVM: arm64: vgic-v3: Roll back assignments from the new region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 336/869] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 338/869] media: imagination: Fix value clamping in calculate_qp_tables Greg Kroah-Hartman
` (539 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Marc Zyngier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit a32c01324eb494dda811912eb847b0e907cd7270 ]
A failed REDIST_REGION write unregisters the redistributor iodevs of every
vCPU processed before the failure. This includes vCPUs assigned to older
regions. Their assignments remain cached, so a retry does not register the
iodevs again.
The vCPU whose registration fails has no assignment to roll back. For vCPUs
processed earlier, limit rollback to those assigned to the new region. The
region is removed on failure, so its free_index does not need restoring.
Resetting assignments from older regions is unsafe because a vCPU can own
one before kvm_for_each_vcpu() can see it. Rollback could then move
free_index behind that live assignment.
kvm_vgic_addr() holds slots_lock across the REDIST_REGION write. vCPU
creation takes the same lock before assigning a redistributor. A concurrent
vCPU cannot acquire an assignment from the new region before rollback
completes. The lock also keeps rdreg valid across the config_lock drop
required by MMIO-bus registration.
Fixes: c011f4ea106b ("KVM: arm/arm64: Check vcpu redist base before registering an iodev")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260831081005.41346-3-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 7d90e6fe076c3..79e018cec0f96 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -846,7 +846,8 @@ void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
kvm_io_bus_unregister_dev(vcpu->kvm, KVM_MMIO_BUS, &rd_dev->dev);
}
-static int vgic_register_all_redist_iodevs(struct kvm *kvm)
+static int vgic_register_all_redist_iodevs(struct kvm *kvm,
+ struct vgic_redist_region *rdreg)
{
struct kvm_vcpu *vcpu;
unsigned long c;
@@ -866,7 +867,14 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
for (i = 0; i < c; i++) {
vcpu = kvm_get_vcpu(kvm, i);
+ if (vcpu->arch.vgic_cpu.rdreg != rdreg)
+ continue;
+
vgic_unregister_redist_iodev(vcpu);
+
+ guard(mutex)(&vcpu->kvm->arch.config_lock);
+ vcpu->arch.vgic_cpu.rdreg = NULL;
+ vcpu->arch.vgic_cpu.rd_iodev.base_addr = VGIC_ADDR_UNDEF;
}
}
@@ -975,10 +983,13 @@ void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdre
int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
{
+ struct vgic_redist_region *rdreg;
int ret;
mutex_lock(&kvm->arch.config_lock);
ret = vgic_v3_alloc_redist_region(kvm, index, addr, count);
+ if (!ret)
+ rdreg = vgic_v3_rdist_region_from_index(kvm, index);
mutex_unlock(&kvm->arch.config_lock);
if (ret)
return ret;
@@ -987,12 +998,9 @@ int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
* Register iodevs for each existing VCPU. Adding more VCPUs
* afterwards will register the iodevs when needed.
*/
- ret = vgic_register_all_redist_iodevs(kvm);
+ ret = vgic_register_all_redist_iodevs(kvm, rdreg);
if (ret) {
- struct vgic_redist_region *rdreg;
-
mutex_lock(&kvm->arch.config_lock);
- rdreg = vgic_v3_rdist_region_from_index(kvm, index);
vgic_v3_free_redist_region(kvm, rdreg);
mutex_unlock(&kvm->arch.config_lock);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 338/869] media: imagination: Fix value clamping in calculate_qp_tables
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 337/869] KVM: arm64: vgic-v3: Roll back assignments from the new region Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 339/869] media: v4l2-common: Fix P010 format info Greg Kroah-Hartman
` (538 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Jai Luthra,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit c8454a41da59d51fbcc5743f8c71a03b096a770f ]
The local variable 'val' was never clamped to 1 or 255 because the
return value of clamp() was not used. Fix this by assigning the clamped
value back to 'val'.
Cc: stable@vger.kernel.org
Fixes: a1e294045885 ("media: imagination: Add E5010 JPEG Encoder driver")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/imagination/e5010-jpeg-enc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/imagination/e5010-jpeg-enc.c b/drivers/media/platform/imagination/e5010-jpeg-enc.c
index c4e0097cb8b7f..a36a2acc896c9 100644
--- a/drivers/media/platform/imagination/e5010-jpeg-enc.c
+++ b/drivers/media/platform/imagination/e5010-jpeg-enc.c
@@ -175,12 +175,12 @@ static void calculate_qp_tables(struct e5010_context *ctx)
long long delta = v4l2_jpeg_ref_table_chroma_qt[i] * contrast + luminosity;
int val = (int)(v4l2_jpeg_ref_table_chroma_qt[i] + delta);
- clamp(val, 1, 255);
+ val = clamp(val, 1, 255);
ctx->chroma_qp[i] = quality == -50 ? 1 : val;
delta = v4l2_jpeg_ref_table_luma_qt[i] * contrast + luminosity;
val = (int)(v4l2_jpeg_ref_table_luma_qt[i] + delta);
- clamp(val, 1, 255);
+ val = clamp(val, 1, 255);
ctx->luma_qp[i] = quality == -50 ? 1 : val;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 339/869] media: v4l2-common: Fix P010 format info
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 338/869] media: imagination: Fix value clamping in calculate_qp_tables Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 340/869] media: sti: delta: use unaligned accessors for MJPEG SOF fields Greg Kroah-Hartman
` (537 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nas Chung, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nas Chung <nas.chung@chipsnmedia.com>
[ Upstream commit 8761a87aff8259eab0add8a9428cee2c280fb6eb ]
V4L2_PIX_FMT_P010 is a 10-bit 4:2:0 semi-planar format, but its
v4l2_format_info() entry described a 4:2:2 layout with a half-width
chroma plane. Correct bpp and vdiv to match P010's real layout,
consistent with the other semi-planar formats.
Cc: stable@vger.kernel.org
Fixes: 5374d8fb75f3 ("media: Add P010 video format")
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c
index 524c11e92aec5..0ca98df9e60b5 100644
--- a/drivers/media/v4l2-core/v4l2-common.c
+++ b/drivers/media/v4l2-core/v4l2-common.c
@@ -296,7 +296,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format)
{ .format = V4L2_PIX_FMT_NV20, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 5, 10, 0, 0 }, .bpp_div = { 4, 4, 1, 1 }, .hdiv = 2, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_NV24, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_NV42, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
- { .format = V4L2_PIX_FMT_P010, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 1 },
+ { .format = V4L2_PIX_FMT_P010, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
{ .format = V4L2_PIX_FMT_P012, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
{ .format = V4L2_PIX_FMT_YUV410, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 3, .bpp = { 1, 1, 1, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 4, .vdiv = 4 },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 340/869] media: sti: delta: use unaligned accessors for MJPEG SOF fields
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 339/869] media: v4l2-common: Fix P010 format info Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 341/869] media: chips-media: wave5: Handle polling IRQ thread failure Greg Kroah-Hartman
` (536 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit fdc5bf02aeaef04e7d13895db9b6eaf8083953f9 ]
delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by
byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof().
The SOF parser then reads 16-bit big-endian fields directly from that
byte stream.
The SOF payload is not an aligned object. The marker scan can find the
payload at any byte position, and the SOF layout also puts frame_height
and frame_width after a one-byte sample_precision field. Those fields
therefore sit at odd offsets within the payload even when the payload
base happens to be 2-byte aligned.
Avoid casting the byte stream to __be16 pointers and use
get_unaligned_be16() for the SOF length, height, and width fields.
This issue was detected by our static analysis tool and confirmed by
manual audit. A focused UBSAN alignment validation of the same typed
load shape reported a misaligned __be16 access in delta_mjpeg_read_sof().
Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
index 90e5b2f72c82b..849a5e118aec4 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
@@ -4,6 +4,7 @@
* Author: Hugues Fruchet <hugues.fruchet@st.com> for STMicroelectronics.
*/
+#include <linux/unaligned.h>
#include "delta.h"
#include "delta-mjpeg.h"
@@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx,
goto err_no_more;
memset(header, 0, sizeof(*header));
- header->length = be16_to_cpu(*(__be16 *)(data + offset));
+ header->length = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->sample_precision = *(u8 *)(data + offset);
offset += sizeof(u8);
- header->frame_height = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_height = get_unaligned_be16(data + offset);
offset += sizeof(u16);
- header->frame_width = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_width = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->nb_of_components = *(u8 *)(data + offset);
offset += sizeof(u8);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 341/869] media: chips-media: wave5: Handle polling IRQ thread failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 340/869] media: sti: delta: use unaligned accessors for MJPEG SOF fields Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 342/869] media: chips-media: wave5: Balance runtime PM on encoder close errors Greg Kroah-Hartman
` (535 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 1d563e3d718a1c7c16355843374fbdd4c798ac66 ]
When falling back to polling mode, wave5_vpu_probe() does not check the
return value of kthread_run(). On failure, dev->irq_thread holds an
error pointer instead of a valid task pointer.
Both the probe error path and the remove path only check
dev->irq_thread against NULL before calling kthread_stop() on it, so an
error pointer passes the check and kthread_stop() crashes on it.
Check the kthread_run() result, clear dev->irq_thread and unwind the
probe on failure.
Fixes: e66ff2b08e4e ("media: chips-media: wave5: Fix Null reference while testing fluster")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 3216b49976447..6fa2ff1cbf128 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -340,6 +340,13 @@ static int wave5_vpu_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "failed to get irq resource, falling back to polling\n");
sema_init(&dev->irq_sem, 1);
dev->irq_thread = kthread_run(irq_thread, dev, "irq thread");
+ if (IS_ERR(dev->irq_thread)) {
+ ret = PTR_ERR(dev->irq_thread);
+ dev_err(&pdev->dev, "failed to create irq thread\n");
+ dev->irq_thread = NULL;
+ goto err_vdi_release;
+ }
+
hrtimer_setup(&dev->hrtimer, &wave5_vpu_timer_callback, CLOCK_MONOTONIC,
HRTIMER_MODE_REL_PINNED);
dev->worker = kthread_run_worker(0, "vpu_irq_thread");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 342/869] media: chips-media: wave5: Balance runtime PM on encoder close errors
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 341/869] media: chips-media: wave5: Handle polling IRQ thread failure Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 343/869] media: chips-media: wave5: Check decoder qbuf runtime resume Greg Kroah-Hartman
` (534 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 4009daa5d9a72a67dd497bb4546632b2506a3650 ]
wave5_vpu_enc_close() resumes the device before taking the hardware lock.
Its three error paths call pm_runtime_resume_and_get() again instead of
dropping that reference. Each failure therefore increments the runtime PM
usage count twice and can prevent the device from suspending afterward.
Replace the extra resume calls with pm_runtime_put_sync() to balance the
reference acquired on entry, matching the successful close path. This
aligns wave5_vpu_enc_close() with wave5_vpu_dec_close(), which already
releases the reference on its error paths.
Fixes: 2092b3833487 ("media: chips-media: wave5: Support runtime suspend/resume")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/chips-media/wave5/wave5-vpuapi.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
index e7ea2f6a99d5b..c76d657cf8631 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
@@ -729,7 +729,7 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
ret = mutex_lock_interruptible(&vpu_dev->hw_lock);
if (ret) {
- pm_runtime_resume_and_get(inst->dev->dev);
+ pm_runtime_put_sync(inst->dev->dev);
return ret;
}
@@ -737,16 +737,13 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
ret = wave5_vpu_enc_finish_seq(inst, fail_res);
if (ret < 0 && *fail_res != WAVE5_SYSERR_VPU_STILL_RUNNING) {
dev_warn(inst->dev->dev, "enc_finish_seq timed out\n");
- pm_runtime_resume_and_get(inst->dev->dev);
- mutex_unlock(&vpu_dev->hw_lock);
- return ret;
+ goto unlock_and_return;
}
if (*fail_res == WAVE5_SYSERR_VPU_STILL_RUNNING &&
retry++ >= MAX_FIRMWARE_CALL_RETRY) {
- pm_runtime_resume_and_get(inst->dev->dev);
- mutex_unlock(&vpu_dev->hw_lock);
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto unlock_and_return;
}
} while (ret != 0);
@@ -762,10 +759,12 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
}
wave5_vdi_free_dma_memory(vpu_dev, &p_enc_info->vb_task);
+
+unlock_and_return:
mutex_unlock(&vpu_dev->hw_lock);
pm_runtime_put_sync(inst->dev->dev);
- return 0;
+ return ret;
}
int wave5_vpu_enc_register_frame_buffer(struct vpu_instance *inst, unsigned int num,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 343/869] media: chips-media: wave5: Check decoder qbuf runtime resume
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 342/869] media: chips-media: wave5: Balance runtime PM on encoder close errors Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 344/869] media: meson: vdec: size capture planes from the aligned canvas Greg Kroah-Hartman
` (533 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 158b39a0f7d198454a1fb34dcca5c25de588d54f ]
wave5_vpu_dec_buf_queue_dst() resumes the VPU before it may clear a
decoder display flag. This is needed because clearing the display flag
accesses VPU registers.
However, the return value from pm_runtime_resume_and_get() is ignored.
If the resume fails, pm_runtime_resume_and_get() returns without holding
a runtime PM usage reference. The unconditional
pm_runtime_put_autosuspend() at the end of the function then drops an
unmatched reference.
The failed resume path can also continue into
wave5_vpu_dec_clr_disp_flag() while the device is still suspended.
Check the return value. If the resume fails, complete the queued buffer
with an error and return without touching the hardware or dropping an
unmatched runtime PM reference.
Fixes: cbb9c0d50e47 ("media: chips-media: wave5: Fix SError of kernel panic when closed")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index e1ad685a42e52..6f93fdf28ab3a 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1261,8 +1261,14 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(inst->dev->dev);
+ if (ret < 0) {
+ vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
+ return;
+ }
- pm_runtime_resume_and_get(inst->dev->dev);
vbuf->sequence = inst->queued_dst_buf_num++;
if (inst->state == VPU_INST_STATE_PIC_RUN) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 344/869] media: meson: vdec: size capture planes from the aligned canvas
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 343/869] media: chips-media: wave5: Check decoder qbuf runtime resume Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 345/869] media: amphion: drain message work before releasing core state Greg Kroah-Hartman
` (532 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Freidkin, Dan Carpenter,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Freidkin <freidkin@gmail.com>
[ Upstream commit b3a805dd5a83ba8c85e2085d3411eb9975e0aea4 ]
The decoder writes a whole canvas of ALIGN(width, 32) x ALIGN(height, 32)
(amvdec_set_canvases()) and reports bytesperline = ALIGN(width, 32), but
get_output_size() derives sizeimage from the raw width x height.
When the width is not a multiple of 32 the planes are too small for the
advertised stride: for 720x360 NV12M the luma plane is 262144 bytes while
736 * 360 = 264960 are needed (282624 for the canvas the firmware fills).
The decoder writes past the buffer, and importing the capture dma-buf
into DRM fails: drmModeAddFB2() returns -EINVAL, so e.g. Kodi plays the
sound over a black screen. 1280x720 and 1920x1080 are not affected.
Size the planes from the aligned canvas the hardware actually uses.
Tested on an S905X (GXL p212) board with LibreELEC 12 (6.16.0-rc3):
720x360 and 1920x1080 H.264 play through V4L2 m2m + DRM PRIME with no
AddFB2 errors.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Freidkin <freidkin@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/meson/vdec/vdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index ccb71de22b0a9..49df5c6398b5c 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -34,7 +34,7 @@ struct dummy_buf {
static u32 get_output_size(u32 width, u32 height)
{
- return ALIGN(width * height, SZ_64K);
+ return ALIGN(ALIGN(width, 32) * ALIGN(height, 32), SZ_64K);
}
u32 amvdec_get_output_size(struct amvdec_session *sess)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 345/869] media: amphion: drain message work before releasing core state
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 344/869] media: meson: vdec: size capture planes from the aligned canvas Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 346/869] media: amphion: prevent unbind while video instances are open Greg Kroah-Hartman
` (531 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit ec95ae226f240ed657834fe4114abb7067e1af2d ]
vpu_core_unregister() frees core->msg_buffer before cancelling the message
workers, although core->msg_fifo still uses the buffer as its backing
storage. A queued worker can read it after it has been freed.
Drain the core and instance message work first, then release core->vpu
and the FIFO buffer. This follows the ordering in vpu_core_suspend().
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index da00f5fc0e5da..0501c2383ccf7 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -302,22 +302,23 @@ static void vpu_core_put_vpu(struct vpu_core *core)
core->vpu->put_vpu(core->vpu);
}
+static void vpu_core_cancel_work(struct vpu_core *core);
+
static int vpu_core_unregister(struct device *dev, struct vpu_core *core)
{
list_del_init(&core->list);
- vpu_core_put_vpu(core);
- core->vpu = NULL;
- vfree(core->msg_buffer);
- core->msg_buffer = NULL;
-
if (core->workqueue) {
- cancel_work_sync(&core->msg_work);
- cancel_delayed_work_sync(&core->msg_delayed_work);
+ vpu_core_cancel_work(core);
destroy_workqueue(core->workqueue);
core->workqueue = NULL;
}
+ vpu_core_put_vpu(core);
+ core->vpu = NULL;
+ vfree(core->msg_buffer);
+ core->msg_buffer = NULL;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 346/869] media: amphion: prevent unbind while video instances are open
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 345/869] media: amphion: drain message work before releasing core state Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 347/869] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Greg Kroah-Hartman
` (530 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 96ea6bc6835f1b18b75303d536a7f9a3829c9bc1 ]
An open video instance holds a plain pointer to its devm-allocated core.
Unbinding the core or its parent through sysfs can release that memory
while the instance remains open. A later ioctl or close then uses the
stale pointer.
The video file operations pin the module, but sysfs unbind bypasses that
protection. Suppress manual bind and unbind for both platform drivers,
and warn if core removal ever encounters a live instance.
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 3 +++
drivers/media/platform/amphion/vpu_drv.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 0501c2383ccf7..56f6888f101cb 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -719,6 +719,8 @@ static void vpu_core_remove(struct platform_device *pdev)
struct vpu_core *core = platform_get_drvdata(pdev);
int ret;
+ WARN_ON(!list_empty(&core->instances));
+
vpu_core_remove_dbgfs_file(core);
ret = pm_runtime_resume_and_get(dev);
WARN_ON(ret < 0);
@@ -869,6 +871,7 @@ static struct platform_driver amphion_vpu_core_driver = {
.remove = vpu_core_remove,
.driver = {
.name = "amphion-vpu-core",
+ .suppress_bind_attrs = true,
.of_match_table = vpu_core_dt_match,
.pm = &vpu_core_pm_ops,
},
diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c
index efbfd2652721f..67d48c338fd11 100644
--- a/drivers/media/platform/amphion/vpu_drv.c
+++ b/drivers/media/platform/amphion/vpu_drv.c
@@ -230,6 +230,7 @@ static struct platform_driver amphion_vpu_driver = {
.remove = vpu_remove,
.driver = {
.name = "amphion-vpu",
+ .suppress_bind_attrs = true,
.of_match_table = vpu_dt_match,
.pm = &vpu_pm_ops,
},
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 347/869] media: mediatek: vpu: free IRQ before destroying watchdog workqueue
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 346/869] media: amphion: prevent unbind while video instances are open Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 348/869] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() Greg Kroah-Hartman
` (529 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 2c50b58d4105f6dbaa36d6306087954b9100e9ae ]
mtk_vpu_remove() destroys the watchdog workqueue while the interrupt
handler requested with devm_request_irq() is still registered: the
devres core frees the interrupt only after remove() has returned. If
the VPU watchdog fires in that window, vpu_irq_handler() queues
vpu->wdt.ws on the already destroyed vpu->wdt.wq.
Fix this by calling devm_free_irq() before destroy_workqueue(), which
releases the interrupt and waits for a running handler, so no new work
can be queued while the workqueue is drained and freed.
This issue was found by an in-house static analysis tool.
Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index 8d8319f0cd221..b6bd80b684459 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -962,6 +962,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
#ifdef CONFIG_DEBUG_FS
debugfs_remove(vpu_debugfs);
#endif
+ devm_free_irq(&pdev->dev, vpu->reg.irq, vpu);
if (vpu->wdt.wq)
destroy_workqueue(vpu->wdt.wq);
vpu_free_ext_mem(vpu, P_FW);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 348/869] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 347/869] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 349/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() Greg Kroah-Hartman
` (528 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ff3308afa9c9da0ef9113cb80803588adabef902 ]
mdp_comp_init() takes a reference to the component platform device
with of_find_device_by_node(), but the error path taken when the
clock array cannot be allocated and the one taken for a component
without a GCE EOF event return without dropping it. The caller
frees the mdp_comp in those cases, so the reference is leaked.
Release the reference on both error paths.
Fixes: c4320f9721fd ("media: platform: mtk-mdp3: dynamically allocate component clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
index 7fcb2fbdd64ee..acb2758a7b42d 100644
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
@@ -1730,6 +1730,7 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
struct device *dev = &mdp->pdev->dev;
struct platform_device *pdev_c;
int clk_ofst;
+ int ret;
int i;
s32 event;
@@ -1756,8 +1757,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->clk_num = mdp->mdp_data->comp_data[id].info.clk_num;
comp->clks = devm_kzalloc(dev, sizeof(struct clk *) * comp->clk_num,
GFP_KERNEL);
- if (!comp->clks)
- return -ENOMEM;
+ if (!comp->clks) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
clk_ofst = mdp->mdp_data->comp_data[id].info.clk_ofst;
@@ -1782,7 +1785,8 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
if (of_property_read_u32_index(node, "mediatek,gce-events",
MDP_GCE_EVENT_EOF, &event)) {
dev_err(dev, "Component id %d has no EOF\n", id);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_put_device;
}
} else {
event = MDP_GCE_NO_EVENT;
@@ -1791,6 +1795,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->gce_event[MDP_GCE_EVENT_EOF] = event;
return 0;
+
+err_put_device:
+ put_device(&pdev_c->dev);
+ return ret;
}
static void mdp_comp_deinit(struct mdp_comp *comp)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 349/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 348/869] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 350/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() Greg Kroah-Hartman
` (527 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit befd4506174addc5e85641b4ef304c9247b48c55 ]
pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails. mtk_jpegdec_worker() jumps to
dec_end on that failure, which does not call pm_runtime_put(), so
the reference taken by the failed resume is leaked.
Use pm_runtime_resume_and_get() instead, which drops the reference
again when resuming the device fails.
Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index 5a9ba04d3d480..fa47d2fb94aa0 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1740,7 +1740,7 @@ static void mtk_jpegdec_worker(struct work_struct *work)
jpeg_dst_buf->frame_num = ctx->total_frame_num;
mtk_jpegdec_set_hw_param(ctx, hw_id, src_buf, dst_buf);
- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+ ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
if (ret < 0) {
dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
__func__, __LINE__);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 350/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 349/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 351/869] media: mediatek: vcodec: destroy core workqueue on remove Greg Kroah-Hartman
` (526 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 7ec8fd17f3a8059dcf94101065a35d0136031794 ]
pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails, and a failed clk_prepare_enable()
drops the reference as well. mtk_jpegenc_worker() jumps to enc_end
in both cases, which does not call pm_runtime_put(), so the
reference taken by the successful resume is leaked.
Use pm_runtime_resume_and_get() for the resume failure and release
the reference explicitly when the clock cannot be enabled, as
mtk_jpegdec_worker() already does.
Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index fa47d2fb94aa0..0e2bb13f071af 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1630,7 +1630,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+ ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
if (ret < 0) {
dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
__func__, __LINE__);
@@ -1641,6 +1641,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
if (ret) {
dev_err(jpeg->dev, "%s : %d, jpegenc clk_prepare_enable fail\n",
__func__, __LINE__);
+ pm_runtime_put(comp_jpeg[hw_id]->dev);
goto enc_end;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 351/869] media: mediatek: vcodec: destroy core workqueue on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 350/869] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 352/869] media: mediatek: vpu: release reserved memory " Greg Kroah-Hartman
` (525 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ceb6e96122e1013550f378c738e621a6e82d246b ]
The decoder probe allocates core_workqueue for architectures with a
LAT processor. The probe failure paths destroy the workqueues, but the
remove() function only destroys decode_workqueue.
As a result, removing a decoder on LAT architectures leaves core_workqueue
allocated after the device lifetime has ended.
Destroy core_workqueue during remove for latency-based decoder
architectures, matching the cleanup performed by the probe failure
paths.
This issue was found by manual code inspection.
Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
index 3b81fae9f9135..7fec6b21684f2 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -570,6 +570,8 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
destroy_workqueue(dev->decode_workqueue);
+ if (IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch))
+ destroy_workqueue(dev->core_workqueue);
if (media_devnode_is_registered(dev->mdev_dec.devnode)) {
media_device_unregister(&dev->mdev_dec);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 352/869] media: mediatek: vpu: release reserved memory on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 351/869] media: mediatek: vcodec: destroy core workqueue on remove Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 353/869] media: verisilicon: rockchip: Fix leaks in init Greg Kroah-Hartman
` (524 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8af0e2bdd9791848d9caf3761825ac51a67c2b9c ]
mtk_vpu_probe() may assign a reserved memory region to the VPU device
with of_reserved_mem_device_init(). The probe failure path releases the
assignment with of_reserved_mem_device_release(), but the normal remove
path does not perform the corresponding cleanup.
As a result, removing the VPU driver after a successful probe can leave
the reserved memory assignment associated with the device after its
lifetime has ended.
Release the reserved memory assignment after freeing the VPU external
firmware memory, matching the cleanup performed by the probe failure
path.
This issue was found by manual code inspection.
Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index b6bd80b684459..9dff1d971d37c 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -967,6 +967,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
destroy_workqueue(vpu->wdt.wq);
vpu_free_ext_mem(vpu, P_FW);
vpu_free_ext_mem(vpu, D_FW);
+ of_reserved_mem_device_release(&pdev->dev);
mutex_destroy(&vpu->vpu_mutex);
clk_unprepare(vpu->clk);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 353/869] media: verisilicon: rockchip: Fix leaks in init
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 352/869] media: mediatek: vpu: release reserved memory " Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 354/869] media: mediatek: jpeg: retry HW selection after successful wait Greg Kroah-Hartman
` (523 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michail Tatas, Frank Li,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michail Tatas <michail.tatas@gmail.com>
[ Upstream commit 96f6b5e2295996a9e2dd1e2382d3872f98cbb554 ]
If one of the dma_alloc_coherent in the init function fails then
the previously allocated ones leak.
Fix by freeing them in the error path.
Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../verisilicon/rockchip_vpu981_hw_av1_dec.c | 68 +++++++++++++++----
1 file changed, 55 insertions(+), 13 deletions(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index 00aa566a4ccdb..2a145433e6d17 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -369,6 +369,7 @@ void rockchip_vpu981_av1_dec_exit(struct hantro_ctx *ctx)
int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
{
+ int ret = 0;
struct hantro_dev *vpu = ctx->dev;
struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
@@ -377,39 +378,54 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
av1_dec->global_model.cpu = dma_alloc_coherent(vpu->dev, GLOBAL_MODEL_SIZE,
&av1_dec->global_model.dma,
GFP_KERNEL);
- if (!av1_dec->global_model.cpu)
- return -ENOMEM;
+ if (!av1_dec->global_model.cpu) {
+ ret = -ENOMEM;
+ goto global_model_cpu_err;
+ }
+
av1_dec->global_model.size = GLOBAL_MODEL_SIZE;
av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE,
&av1_dec->tile_info.dma,
GFP_KERNEL);
- if (!av1_dec->tile_info.cpu)
- return -ENOMEM;
+ if (!av1_dec->tile_info.cpu) {
+ ret = -ENOMEM;
+ goto tile_info_cpu_err;
+ }
+
av1_dec->tile_info.size = AV1_TILE_INFO_SIZE;
av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct rockchip_av1_film_grain), 2048),
&av1_dec->film_grain.dma,
GFP_KERNEL);
- if (!av1_dec->film_grain.cpu)
- return -ENOMEM;
+ if (!av1_dec->film_grain.cpu) {
+ ret = -ENOMEM;
+ goto film_grain_cpu_err;
+ }
+
av1_dec->film_grain.size = ALIGN(sizeof(struct rockchip_av1_film_grain), 2048);
av1_dec->prob_tbl.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct av1cdfs), 2048),
&av1_dec->prob_tbl.dma,
GFP_KERNEL);
- if (!av1_dec->prob_tbl.cpu)
- return -ENOMEM;
+ if (!av1_dec->prob_tbl.cpu) {
+ ret = -ENOMEM;
+ goto prob_tbl_cpu_err;
+ }
+
av1_dec->prob_tbl.size = ALIGN(sizeof(struct av1cdfs), 2048);
av1_dec->prob_tbl_out.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct av1cdfs), 2048),
&av1_dec->prob_tbl_out.dma,
GFP_KERNEL);
- if (!av1_dec->prob_tbl_out.cpu)
- return -ENOMEM;
+ if (!av1_dec->prob_tbl_out.cpu) {
+ ret = -ENOMEM;
+ goto prob_tbl_out_cpu_err;
+ }
+
av1_dec->prob_tbl_out.size = ALIGN(sizeof(struct av1cdfs), 2048);
av1_dec->cdfs = &av1_dec->default_cdfs;
av1_dec->cdfs_ndvc = &av1_dec->default_cdfs_ndvc;
@@ -420,11 +436,37 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
AV1_TILE_SIZE,
&av1_dec->tile_buf.dma,
GFP_KERNEL);
- if (!av1_dec->tile_buf.cpu)
- return -ENOMEM;
+ if (!av1_dec->tile_buf.cpu) {
+ ret = -ENOMEM;
+ goto tile_buf_cpu_err;
+ }
+
av1_dec->tile_buf.size = AV1_TILE_SIZE;
- return 0;
+ return ret;
+
+tile_buf_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->prob_tbl_out.size,
+ av1_dec->prob_tbl_out.cpu,
+ av1_dec->prob_tbl_out.dma);
+prob_tbl_out_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->prob_tbl.size,
+ av1_dec->prob_tbl.cpu,
+ av1_dec->prob_tbl.dma);
+prob_tbl_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->film_grain.size,
+ av1_dec->film_grain.cpu,
+ av1_dec->film_grain.dma);
+film_grain_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->tile_info.size,
+ av1_dec->tile_info.cpu,
+ av1_dec->tile_info.dma);
+tile_info_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->global_model.size,
+ av1_dec->global_model.cpu,
+ av1_dec->global_model.dma);
+global_model_cpu_err:
+ return ret;
}
static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 354/869] media: mediatek: jpeg: retry HW selection after successful wait
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 353/869] media: verisilicon: rockchip: Fix leaks in init Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 355/869] media: vicodec: fix NULL deref on oversized frame Greg Kroah-Hartman
` (522 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit eb0bbd0ad679bf363387e3b8be8892cfbedabb72 ]
wait_event_interruptible_timeout() returns a positive value when its
condition becomes true before the timeout. mtk_jpegdec_worker() treats
every nonzero result as a failure, so a normal decoder wakeup finishes
the mem2mem job as though no hardware became available.
Handle interrupted waits and exhausted timeout retries separately, and
retry hardware selection after a successful wakeup. Increment the retry
count only for actual timeouts. The encoder uses
wait_event_interruptible(), whose successful return is zero, so its
existing check is correct; leave that separate no-timeout policy
unchanged.
Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index 0e2bb13f071af..8e52b40e2423b 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1705,9 +1705,15 @@ static void mtk_jpegdec_worker(struct work_struct *work)
ret = wait_event_interruptible_timeout(jpeg->hw_wq,
atomic_read(&jpeg->hw_rdy) > 0,
MTK_JPEG_HW_TIMEOUT_MSEC);
- if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
- dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
- __func__, __LINE__);
+ if (ret < 0) {
+ dev_err(jpeg->dev, "decoder HW wait interrupted: %d\n",
+ ret);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+ return;
+ }
+
+ if (!ret && i++ > MTK_JPEG_MAX_RETRY_TIME) {
+ dev_err(jpeg->dev, "all decoder HW are busy\n");
v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 355/869] media: vicodec: fix NULL deref on oversized frame
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 354/869] media: mediatek: jpeg: retry HW selection after successful wait Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 356/869] media: hantro: Harden MPEG-2 control access against NULL Greg Kroah-Hartman
` (521 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit c657eb609197e289b054bc2c4e86a0fc32dd7ebe ]
job_ready() only honours the is_header_valid() verdict when
ctx->comp_has_frame is set, and comp_has_frame is only set once
comp_size reaches the full frame size. Since the copy is clamped to
ctx->comp_max_size, a header advertising a larger size leaves comp_size
stuck at comp_max_size, so comp_has_frame stays false and the failed
validation is discarded.
Control then falls into the resolution change branch, which calls
update_capture_data_from_header(). That function re-derives info via
info_from_header(), assigns it to q_dst->info and dereferences it as
q_dst->info->sizeimage_mult, with no NULL check of its own.
is_header_valid() does check that same info_from_header() result --
if (!info) return false which is precisely the false verdict
job_ready() discarded above. info_from_header() returns NULL whenever the
header flags resolve to no supported pixel format.
Drop the comp_has_frame conjunct so an invalid header always bails out.
The resolution change path is unaffected, as it is entered with a valid
header. Oversized frames are then rejected by device_process(), which
already returns -EINVAL when comp_frame_size exceeds comp_max_size.
Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 841dc03d0edd2..3052d248a7286 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -652,7 +652,7 @@ static int job_ready(void *priv)
* if the header is invalid the device_run will just drop the frame
* with an error
*/
- if (!is_header_valid(&ctx->state.header) && ctx->comp_has_frame)
+ if (!is_header_valid(&ctx->state.header))
return 1;
flags = ntohl(ctx->state.header.flags);
hdr_width_div = (flags & V4L2_FWHT_FL_CHROMA_FULL_WIDTH) ? 1 : 2;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 356/869] media: hantro: Harden MPEG-2 control access against NULL
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 355/869] media: vicodec: fix NULL deref on oversized frame Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 357/869] media: hantro: release runtime resources when device_run fails Greg Kroah-Hartman
` (520 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 2b685dba4226792933f45b1cbf8991e89ccd21ce ]
The MPEG-2 sequence and picture controls are validated
before a job is queued, so hantro_get_ctrl() is not expected to return
NULL in hantro_g1_mpeg2_dec_run(). The controls are nonetheless
dereferenced unconditionally.
Harden the invariant by checking the sequence and picture controls with
WARN_ON().
Found by code inspection.
Fixes: f329e21e9dad ("media: uapi: mpeg2: Split sequence and picture parameters")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
index e0d6bd0a6e44f..6a942f4b8a2dd 100644
--- a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
+++ b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
@@ -161,8 +161,13 @@ int hantro_g1_mpeg2_dec_run(struct hantro_ctx *ctx)
seq = hantro_get_ctrl(ctx,
V4L2_CID_STATELESS_MPEG2_SEQUENCE);
+ if (WARN_ON(!seq))
+ return -EINVAL;
+
pic = hantro_get_ctrl(ctx,
V4L2_CID_STATELESS_MPEG2_PICTURE);
+ if (WARN_ON(!pic))
+ return -EINVAL;
reg = G1_REG_DEC_AXI_RD_ID(0) |
G1_REG_DEC_TIMEOUT_E(1) |
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 357/869] media: hantro: release runtime resources when device_run fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 356/869] media: hantro: Harden MPEG-2 control access against NULL Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 358/869] media: amphion: fix runtime PM imbalance on probe failure Greg Kroah-Hartman
` (519 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul, Frank Li,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 556ab0b2741d653455637ffdd453d65c0439914a ]
device_run() acquires a runtime PM reference and enables the VPU clocks
before invoking the codec-specific run callback.
If clk_bulk_enable() fails, the runtime PM reference is left held. If
the codec-specific run callback fails, both the enabled clocks and the
runtime PM reference are left held.
Make the clocks part of the device's runtime PM state by enabling them
from the runtime-resume callback and disabling them from the
runtime-suspend callback.
Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/verisilicon/hantro_drv.c | 66 +++++++++++--------
1 file changed, 39 insertions(+), 27 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 418cfe3a14146..d2d88d0d7eeff 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -59,8 +59,7 @@ static const struct v4l2_event hantro_eos_event = {
.type = V4L2_EVENT_EOS
};
-static void hantro_job_finish_no_pm(struct hantro_dev *vpu,
- struct hantro_ctx *ctx,
+static void hantro_job_finish_no_pm(struct hantro_ctx *ctx,
enum vb2_buffer_state result)
{
struct vb2_v4l2_buffer *src, *dst;
@@ -86,15 +85,13 @@ static void hantro_job_finish_no_pm(struct hantro_dev *vpu,
result);
}
-static void hantro_job_finish(struct hantro_dev *vpu,
- struct hantro_ctx *ctx,
+static void hantro_job_finish(struct hantro_ctx *ctx,
enum vb2_buffer_state result)
{
- pm_runtime_put_autosuspend(vpu->dev);
-
- clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
+ struct hantro_dev *vpu = ctx->dev;
- hantro_job_finish_no_pm(vpu, ctx, result);
+ pm_runtime_put_autosuspend(vpu->dev);
+ hantro_job_finish_no_pm(ctx, result);
}
void hantro_irq_done(struct hantro_dev *vpu,
@@ -111,7 +108,7 @@ void hantro_irq_done(struct hantro_dev *vpu,
if (cancel_delayed_work(&vpu->watchdog_work)) {
if (result == VB2_BUF_STATE_DONE && ctx->codec_ops->done)
ctx->codec_ops->done(ctx);
- hantro_job_finish(vpu, ctx, result);
+ hantro_job_finish(ctx, result);
}
}
@@ -127,7 +124,7 @@ void hantro_watchdog(struct work_struct *work)
vpu_err("frame processing timed out!\n");
if (ctx->codec_ops->reset)
ctx->codec_ops->reset(ctx);
- hantro_job_finish(vpu, ctx, VB2_BUF_STATE_ERROR);
+ hantro_job_finish(ctx, VB2_BUF_STATE_ERROR);
}
}
@@ -170,29 +167,24 @@ void hantro_end_prepare_run(struct hantro_ctx *ctx)
static void device_run(void *priv)
{
struct hantro_ctx *ctx = priv;
+ struct hantro_dev *vpu = ctx->dev;
struct vb2_v4l2_buffer *src, *dst;
int ret;
src = hantro_get_src_buf(ctx);
dst = hantro_get_dst_buf(ctx);
- ret = pm_runtime_resume_and_get(ctx->dev->dev);
- if (ret < 0)
- goto err_cancel_job;
-
- ret = clk_bulk_enable(ctx->dev->variant->num_clocks, ctx->dev->clocks);
- if (ret)
- goto err_cancel_job;
+ ret = pm_runtime_resume_and_get(vpu->dev);
+ if (ret < 0) {
+ hantro_job_finish_no_pm(ctx, VB2_BUF_STATE_ERROR);
+ return;
+ }
v4l2_m2m_buf_copy_metadata(src, dst, true);
- if (ctx->codec_ops->run(ctx))
- goto err_cancel_job;
-
- return;
-
-err_cancel_job:
- hantro_job_finish_no_pm(ctx->dev, ctx, VB2_BUF_STATE_ERROR);
+ ret = ctx->codec_ops->run(ctx);
+ if (ret)
+ hantro_job_finish(ctx, VB2_BUF_STATE_ERROR);
}
static const struct v4l2_m2m_ops vpu_m2m_ops = {
@@ -1296,10 +1288,30 @@ static void hantro_remove(struct platform_device *pdev)
static int hantro_runtime_resume(struct device *dev)
{
struct hantro_dev *vpu = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_bulk_enable(vpu->variant->num_clocks, vpu->clocks);
+ if (ret)
+ return ret;
+
+ if (vpu->variant->runtime_resume) {
+ ret = vpu->variant->runtime_resume(vpu);
+ if (ret)
+ goto err_disable_clocks;
+ }
+
+ return 0;
- if (vpu->variant->runtime_resume)
- return vpu->variant->runtime_resume(vpu);
+err_disable_clocks:
+ clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
+ return ret;
+}
+static int hantro_runtime_suspend(struct device *dev)
+{
+ struct hantro_dev *vpu = dev_get_drvdata(dev);
+
+ clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
return 0;
}
#endif
@@ -1307,7 +1319,7 @@ static int hantro_runtime_resume(struct device *dev)
static const struct dev_pm_ops hantro_pm_ops = {
SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
pm_runtime_force_resume)
- SET_RUNTIME_PM_OPS(NULL, hantro_runtime_resume, NULL)
+ SET_RUNTIME_PM_OPS(hantro_runtime_suspend, hantro_runtime_resume, NULL)
};
static struct platform_driver hantro_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 358/869] media: amphion: fix runtime PM imbalance on probe failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 357/869] media: hantro: release runtime resources when device_run fails Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 359/869] media: hantro: disable runtime PM before hardware teardown Greg Kroah-Hartman
` (518 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiawen Liu, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Liu <1298662399@qq.com>
[ Upstream commit 0cabf27cf1e6f7ee5f3c5893c0f1930814d949af ]
vpu_core_probe() enables runtime PM before calling
pm_runtime_resume_and_get().
If pm_runtime_resume_and_get() fails, it has already dropped the runtime PM
usage counter that it acquired before trying to resume the device. Calling
pm_runtime_put_noidle() again on this error path drops the counter one
extra time.
Remove the extra put and keep the existing cleanup that marks the device
suspended before disabling runtime PM.
Fixes: 9f599f351e86ac ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 56f6888f101cb..538ef56823b4c 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -690,7 +690,6 @@ static int vpu_core_probe(struct platform_device *pdev)
pm_runtime_enable(dev);
ret = pm_runtime_resume_and_get(dev);
if (ret) {
- pm_runtime_put_noidle(dev);
pm_runtime_set_suspended(dev);
goto err_runtime_disable;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 359/869] media: hantro: disable runtime PM before hardware teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 358/869] media: amphion: fix runtime PM imbalance on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 360/869] power: supply: core: Honor supplied-from with CONFIG_OF=y Greg Kroah-Hartman
` (517 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul,
Benjamin Gaignard, Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 8e26d4c20ed218db6c3123480a4a4e2545680566 ]
Removing the Hantro driver may trigger an SError on RK3588:
SError Interrupt on CPU6, code 0x00000000be000011 -- SError
...
do_serror+0x5c/0x74
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
regmap_mmio_read32le+0x10/0x20 (P)
_regmap_bus_reg_read+0x6c/0xb4
_regmap_read+0x60/0xdc
regmap_read+0x4c/0x80
rockchip_pd_power+0xe4/0x600
rockchip_pd_power_off+0x1c/0x60
_genpd_power_off+0x98/0x198
genpd_power_off.part.0+0x178/0x288
genpd_runtime_suspend+0x210/0x300
__rpm_callback+0x48/0x1e0
rpm_callback+0x74/0x80
rpm_suspend+0x10c/0x580
rpm_idle+0x134/0x1b8
update_autosuspend+0x30/0xc4
__pm_runtime_use_autosuspend+0x48/0x64
hantro_remove+0x8c/0xa8 [hantro_vpu]
...
hantro_remove() currently asserts the device resets before disabling
runtime PM.
Calling pm_runtime_dont_use_autosuspend() causes an idle device to be
runtime-suspended immediately. At that point the Hantro hardware has
already been torn down, while the generic power-domain genpd code
still performs the power-off sequence. genpd regmap_mmio_read causes panic
subsequently because the reset lines were asserted.
Disable runtime PM before asserting the reset lines so that no runtime-PM
transition can race with hardware teardown.
Apply the same ordering to the probe error paths as well.
Fixes: ea71631b7129 ("media: hantro: add support for reset lines")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro_drv.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index d2d88d0d7eeff..32197f00c0bb5 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1204,7 +1204,7 @@ static int hantro_probe(struct platform_device *pdev)
ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks);
if (ret) {
dev_err(&pdev->dev, "Failed to prepare clocks\n");
- goto err_rst_assert;
+ goto err_pm_disable_assert_reset;
}
ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev);
@@ -1258,8 +1258,11 @@ static int hantro_probe(struct platform_device *pdev)
v4l2_device_unregister(&vpu->v4l2_dev);
err_clk_unprepare:
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
-err_rst_assert:
+err_pm_disable_assert_reset:
+ pm_runtime_dont_use_autosuspend(vpu->dev);
+ pm_runtime_disable(vpu->dev);
reset_control_assert(vpu->resets);
+ return ret;
err_pm_disable:
pm_runtime_dont_use_autosuspend(vpu->dev);
pm_runtime_disable(vpu->dev);
@@ -1279,9 +1282,9 @@ static void hantro_remove(struct platform_device *pdev)
v4l2_m2m_put(vpu->m2m_dev);
v4l2_device_unregister(&vpu->v4l2_dev);
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
- reset_control_assert(vpu->resets);
pm_runtime_dont_use_autosuspend(vpu->dev);
pm_runtime_disable(vpu->dev);
+ reset_control_assert(vpu->resets);
}
#ifdef CONFIG_PM
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 360/869] power: supply: core: Honor supplied-from with CONFIG_OF=y
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 359/869] media: hantro: disable runtime PM before hardware teardown Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 361/869] fsverity: hoist statx reporting of fs-verity flag Greg Kroah-Hartman
` (516 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Casciano, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Casciano <mauriziocasciano7@gmail.com>
[ Upstream commit 6bd80f22c764fe8c56c62c118387f86a3ca98cff ]
The supplied-from device property is the name-based counterpart to
firmware-node power-supplies references. It was added for non-DT platforms,
but its parser is compiled only when CONFIG_OF is disabled. CONFIG_OF is
a global kernel option, so x86 systems commonly enable it even when
individual power supplies are described by software nodes.
Consequently, these consumers never populate supplied_from and supplier
notifications do not reach their external_power_changed() callbacks. On a
Lenovo Yoga Book YB1-X91L, ftrace showed the Whiskey Cove supplier
notification running without invoking the BQ25892 callback, leaving the
input current limit at its boot-time value.
Use a single power_supply_check_supplies() implementation for all
configurations. Preserve firmware-node power-supplies references as the
preferred firmware description and use the name-based supplied-from
property only when no references are specified. Continue to honor an
explicitly provided supplied_from list first and propagate errors from
specified firmware references.
With the fix, ftrace shows the BQ25892 callback on hotplug. A boot-offline
test changes its input current limit from 500 mA to 2 A.
Fixes: 58a36bb06891 ("power: supply: core: Add support for supplied-from device-property")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Maurizio Casciano <mauriziocasciano7@gmail.com>
Link: https://patch.msgid.link/20260924225152.985489-1-mauriziocasciano7@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/power_supply_core.c | 84 ++++++++++++------------
1 file changed, 42 insertions(+), 42 deletions(-)
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 615dc27089a3a..7edca0694eb7f 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -190,7 +190,35 @@ static void power_supply_deferred_register_work(struct work_struct *work)
device_unlock(psy->dev.parent);
}
-#ifdef CONFIG_OF
+static int power_supply_check_supplies_by_name(struct power_supply *psy)
+{
+ struct device *parent = psy->dev.parent;
+ int nval, ret;
+
+ if (!parent)
+ return 0;
+
+ nval = device_property_string_array_count(parent, "supplied-from");
+ if (nval <= 0)
+ return 0;
+
+ psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
+ sizeof(*psy->supplied_from),
+ GFP_KERNEL);
+ if (!psy->supplied_from)
+ return -ENOMEM;
+
+ ret = device_property_read_string_array(parent, "supplied-from",
+ (const char **)psy->supplied_from,
+ nval);
+ if (ret < 0)
+ return ret;
+
+ psy->num_supplies = nval;
+
+ return 0;
+}
+
static int __power_supply_populate_supplied_from(struct power_supply *epsy,
void *data)
{
@@ -262,22 +290,21 @@ static int power_supply_find_supply_from_fwnode(struct fwnode_handle *supply_nod
static int power_supply_check_supplies(struct power_supply *psy)
{
struct fwnode_handle *np;
- int cnt = 0;
+ int cnt, ret;
/* If there is already a list honor it */
if (psy->supplied_from && psy->num_supplies > 0)
return 0;
- /* No device node found, nothing to do */
- if (!psy->dev.fwnode)
- return 0;
-
- do {
- int ret;
+ for (cnt = 0; psy->dev.fwnode; cnt++) {
+ np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt);
+ if (IS_ERR(np)) {
+ ret = PTR_ERR(np);
+ if (ret != -ENOENT)
+ return ret;
- np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt++);
- if (IS_ERR(np))
break;
+ }
ret = power_supply_find_supply_from_fwnode(np);
fwnode_handle_put(np);
@@ -286,48 +313,21 @@ static int power_supply_check_supplies(struct power_supply *psy)
dev_dbg(&psy->dev, "Failed to find supply!\n");
return ret;
}
- } while (!IS_ERR(np));
+ }
- /* Missing valid "power-supplies" entries */
- if (cnt == 1)
- return 0;
+ /* Fall back to the name-based property if no references were specified. */
+ if (!cnt)
+ return power_supply_check_supplies_by_name(psy);
/* All supplies found, allocate char * array for filling */
psy->supplied_from = devm_kcalloc(&psy->dev,
- cnt - 1, sizeof(*psy->supplied_from),
+ cnt, sizeof(*psy->supplied_from),
GFP_KERNEL);
if (!psy->supplied_from)
return -ENOMEM;
return power_supply_populate_supplied_from(psy);
}
-#else
-static int power_supply_check_supplies(struct power_supply *psy)
-{
- int nval, ret;
-
- if (!psy->dev.parent)
- return 0;
-
- nval = device_property_string_array_count(psy->dev.parent, "supplied-from");
- if (nval <= 0)
- return 0;
-
- psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
- sizeof(char *), GFP_KERNEL);
- if (!psy->supplied_from)
- return -ENOMEM;
-
- ret = device_property_read_string_array(psy->dev.parent,
- "supplied-from", (const char **)psy->supplied_from, nval);
- if (ret < 0)
- return ret;
-
- psy->num_supplies = nval;
-
- return 0;
-}
-#endif
struct psy_am_i_supplied_data {
struct power_supply *psy;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 361/869] fsverity: hoist statx reporting of fs-verity flag
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 360/869] power: supply: core: Honor supplied-from with CONFIG_OF=y Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 362/869] ALSA: aloop: Dont constrain playback params in notify mode Greg Kroah-Hartman
` (515 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Albershteyn, Eric Biggers,
Christoph Hellwig, Darrick J. Wong, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Albershteyn <aalbersh@kernel.org>
[ Upstream commit f9e450420da2624c93ce9585deebfabb87932774 ]
All filesystems, supporting fsverity, report this status by checking
inode flag. Also, BTRFS was missing stat->attributes_mask, which is
fixed now.
Fixes: 146054090b08 ("btrfs: initial fsverity support")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261002223705.2175542-7-aalbersh@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 3 ---
fs/ext4/inode.c | 5 +----
fs/f2fs/file.c | 5 +----
fs/stat.c | 6 +++++-
4 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 62858d8d66bd6..6287e15bce110 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -8143,7 +8143,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
struct inode *inode = d_inode(path->dentry);
u32 blocksize = btrfs_sb(inode->i_sb)->sectorsize;
u32 bi_flags = BTRFS_I(inode)->flags;
- u32 bi_ro_flags = BTRFS_I(inode)->ro_flags;
stat->result_mask |= STATX_BTIME;
stat->btime.tv_sec = BTRFS_I(inode)->i_otime_sec;
@@ -8156,8 +8155,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (bi_flags & BTRFS_INODE_NODUMP)
stat->attributes |= STATX_ATTR_NODUMP;
- if (bi_ro_flags & BTRFS_INODE_RO_VERITY)
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_APPEND |
STATX_ATTR_COMPRESSED |
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index c3fb5f16f6e39..ed51c11f43ffb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6216,15 +6216,12 @@ int ext4_getattr(struct mnt_idmap *idmap, const struct path *path,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (flags & EXT4_NODUMP_FL)
stat->attributes |= STATX_ATTR_NODUMP;
- if (flags & EXT4_VERITY_FL)
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_APPEND |
STATX_ATTR_COMPRESSED |
STATX_ATTR_ENCRYPTED |
STATX_ATTR_IMMUTABLE |
- STATX_ATTR_NODUMP |
- STATX_ATTR_VERITY);
+ STATX_ATTR_NODUMP);
generic_fillattr(idmap, request_mask, inode, stat);
return 0;
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 791f1cf198c16..49febaa660815 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1058,15 +1058,12 @@ int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (flags & F2FS_NODUMP_FL)
stat->attributes |= STATX_ATTR_NODUMP;
- if (IS_VERITY(inode))
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_COMPRESSED |
STATX_ATTR_APPEND |
STATX_ATTR_ENCRYPTED |
STATX_ATTR_IMMUTABLE |
- STATX_ATTR_NODUMP |
- STATX_ATTR_VERITY);
+ STATX_ATTR_NODUMP);
generic_fillattr(idmap, request_mask, inode, stat);
diff --git a/fs/stat.c b/fs/stat.c
index 8c110555b3d7b..3bc049f0bc3dd 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -203,8 +203,12 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
if (IS_DAX(inode))
stat->attributes |= STATX_ATTR_DAX;
+ if (IS_VERITY(inode))
+ stat->attributes |= STATX_ATTR_VERITY;
+
stat->attributes_mask |= (STATX_ATTR_AUTOMOUNT |
- STATX_ATTR_DAX);
+ STATX_ATTR_DAX |
+ STATX_ATTR_VERITY);
idmap = mnt_idmap(path->mnt);
if (inode->i_op->getattr) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 362/869] ALSA: aloop: Dont constrain playback params in notify mode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 361/869] fsverity: hoist statx reporting of fs-verity flag Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 363/869] power: supply: ab8500_fg: Accept status from supplied power Greg Kroah-Hartman
` (514 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Hofman, Henrik Enquist,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Enquist <henrik.enquist@gmail.com>
[ Upstream commit ded106036984a9dd766e7e1451b02e2d15c81438 ]
With notify enabled (the pcm_notify module parameter or the "PCM
Notify" control), the playback side of a cable may change format, rate
and channels while a capture is running. loopback_check_format() then
stops the capture and notifies the "PCM Slave" controls, so that the
capture application can reopen with the new parameters. For this
reason loopback_open() still gives a notify mode playback the
unconstrained loopback_pcm_hardware.
Since commit 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints
adjustment") the hw rules refine against the shared cable->hw instead
of the substream's own runtime->hw. This pins the playback side to the
parameters of an open capture whatever the notify setting is. A player
probing the device sees only the capture's rate, format and channels,
and the format change path in loopback_check_format() can't be reached
by a new playback.
Skip the format, rate and channels rules for the playback substream
when notify is enabled. Skip the period bytes rule as well: with a
sound timer source, params_change() already takes the period size from
a notify mode playback, and keeping the old capture's period bytes
leaves a playback at another rate with a period that doesn't match the
timer. The capture side stays constrained to the cable parameters.
The capture stop this makes reachable again was hardened by commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") and
commit e5c33cdc6f40 ("ALSA: aloop: Fix peer runtime UAF during
format-change stop"), which need to be applied first when backporting.
Reproducer, with notify enabled on the cable:
arecord -D hw:Loopback,1,0 -r 44100 -f S32_LE -c 2 /dev/null &
aplay -D hw:Loopback,0,0 96k.wav
Before: aplay is forced to 44100 Hz and the capture keeps running.
After: aplay runs at 96000 Hz, the capture is stopped and "PCM Slave
Rate" reports 96000.
Fixes: 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints adjustment")
Reported-by: Pavel Hofman <pavel.hofman@ivitera.com>
Closes: https://lore.kernel.org/all/b4af9071-f8d7-5b47-4d7a-c5743bd67394@ivitera.com/
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Henrik Enquist <henrik.enquist@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261003-aloop-notify-fix-v1-1-ba5dfb831bf5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/aloop.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index d08027681c373..eefc41f628462 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -988,6 +988,18 @@ static unsigned int get_cable_index(struct snd_pcm_substream *substream)
return !substream->stream;
}
+/*
+ * In notify mode the playback side may change format, rate, channels and,
+ * with a sound timer, the period size. A running capture that no longer
+ * matches is stopped by loopback_check_format().
+ * call in loopback->cable_lock
+ */
+static bool loopback_playback_unconstrained(struct loopback_pcm *dpcm)
+{
+ return dpcm->substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+ get_notify(dpcm);
+}
+
static int rule_format(struct snd_pcm_hw_params *params,
struct snd_pcm_hw_rule *rule)
{
@@ -997,6 +1009,8 @@ static int rule_format(struct snd_pcm_hw_params *params,
snd_mask_none(&m);
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
m.bits[0] = (u_int32_t)cable->hw.formats;
m.bits[1] = (u_int32_t)(cable->hw.formats >> 32);
}
@@ -1011,6 +1025,8 @@ static int rule_rate(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.rate_min;
t.max = cable->hw.rate_max;
}
@@ -1027,6 +1043,8 @@ static int rule_channels(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.channels_min;
t.max = cable->hw.channels_max;
}
@@ -1043,6 +1061,8 @@ static int rule_period_bytes(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.period_bytes_min;
t.max = cable->hw.period_bytes_max;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 363/869] power: supply: ab8500_fg: Accept status from supplied power
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 362/869] ALSA: aloop: Dont constrain playback params in notify mode Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 364/869] power: supply: ab8500_fg: Report sub-percent charge changes Greg Kroah-Hartman
` (513 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 16f506a13b58a55308449bbcbec89c817d619ca2 ]
Commit dc77721ea4aa ("power: supply: ab8500: Set typing and props")
changed the charging algorithm power supply type from battery to unknown
so userspace would not mistake it for a second battery. The fuel gauge,
however, processes status changes only from battery-type supplies. It
therefore never learns that charging started and keeps running its
discharge state machine.
The power supply relationship already limits the callback to supplies
naming the fuel gauge in supplied_to. Accept status from any such supply
while retaining the battery type checks for battery-specific properties.
The Samsung-GT-I8160-Codina and Samsung-GT-I8160_HD-Codina product trees
keep the charging algorithm typed as a battery. The
Samsung-GT-I8530-Gavini, Samsung-GT-S7710-Skomer,
Samsung-SGH-I407-Kyle and Samsung-SGH-T599-Codina-TMO alternative
fuel-gauge drivers instead pass cable state directly. Both approaches
preserve the charging state handoff that was lost in mainline.
Fixes: dc77721ea4aa ("power: supply: ab8500: Set typing and props")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-1-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/ab8500_fg.c | 60 ++++++++++++++------------------
1 file changed, 27 insertions(+), 33 deletions(-)
diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index 969a75f4c016d..b122bd473c773 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -2205,42 +2205,36 @@ static int ab8500_fg_get_ext_psy_data(struct power_supply *ext, void *data)
switch (prop) {
case POWER_SUPPLY_PROP_STATUS:
- switch (ext->desc->type) {
- case POWER_SUPPLY_TYPE_BATTERY:
- switch (ret.intval) {
- case POWER_SUPPLY_STATUS_UNKNOWN:
- case POWER_SUPPLY_STATUS_DISCHARGING:
- case POWER_SUPPLY_STATUS_NOT_CHARGING:
- if (!di->flags.charging)
- break;
- di->flags.charging = false;
- di->flags.fully_charged = false;
- if (di->bm->capacity_scaling)
- ab8500_fg_update_cap_scalers(di);
- queue_work(di->fg_wq, &di->fg_work);
+ switch (ret.intval) {
+ case POWER_SUPPLY_STATUS_UNKNOWN:
+ case POWER_SUPPLY_STATUS_DISCHARGING:
+ case POWER_SUPPLY_STATUS_NOT_CHARGING:
+ if (!di->flags.charging)
break;
- case POWER_SUPPLY_STATUS_FULL:
- if (di->flags.fully_charged)
- break;
- di->flags.fully_charged = true;
- di->flags.force_full = true;
- /* Save current capacity as maximum */
- di->bat_cap.max_mah = di->bat_cap.mah;
- queue_work(di->fg_wq, &di->fg_work);
- break;
- case POWER_SUPPLY_STATUS_CHARGING:
- if (di->flags.charging &&
- !di->flags.fully_charged)
- break;
- di->flags.charging = true;
- di->flags.fully_charged = false;
- if (di->bm->capacity_scaling)
- ab8500_fg_update_cap_scalers(di);
- queue_work(di->fg_wq, &di->fg_work);
+ di->flags.charging = false;
+ di->flags.fully_charged = false;
+ if (di->bm->capacity_scaling)
+ ab8500_fg_update_cap_scalers(di);
+ queue_work(di->fg_wq, &di->fg_work);
+ break;
+ case POWER_SUPPLY_STATUS_FULL:
+ if (di->flags.fully_charged)
break;
- }
+ di->flags.fully_charged = true;
+ di->flags.force_full = true;
+ /* Save current capacity as maximum */
+ di->bat_cap.max_mah = di->bat_cap.mah;
+ queue_work(di->fg_wq, &di->fg_work);
break;
- default:
+ case POWER_SUPPLY_STATUS_CHARGING:
+ if (di->flags.charging &&
+ !di->flags.fully_charged)
+ break;
+ di->flags.charging = true;
+ di->flags.fully_charged = false;
+ if (di->bm->capacity_scaling)
+ ab8500_fg_update_cap_scalers(di);
+ queue_work(di->fg_wq, &di->fg_work);
break;
}
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 364/869] power: supply: ab8500_fg: Report sub-percent charge changes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 363/869] power: supply: ab8500_fg: Accept status from supplied power Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 365/869] perf: xgene: initialize lock before requesting IRQ Greg Kroah-Hartman
` (512 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 4d40dba1815d46c6ef9019ed80e3b998b0fc443d ]
The fuel gauge updates bat_cap.mah from the coulomb counter but exposes
bat_cap.prev_mah through CHARGE_NOW and ENERGY_NOW. It only refreshes
prev_mah when the rounded integer capacity percentage changes, making the
momentary properties appear frozen between percentage steps.
Refresh prev_mah and notify userspace whenever the new charge remains
within the currently accepted percentage. If a discharge estimate tries
to cross upward into a higher percentage, the existing rejection still
leaves both the reported percentage and charge unchanged.
The AB8500 fuel-gauge implementations in the Samsung-GT-I8160-Codina,
Samsung-GT-I8160_HD-Codina, Samsung-GT-I8530-Gavini,
Samsung-GT-S7710-Skomer, Samsung-SGH-I407-Kyle and
Samsung-SGH-T599-Codina-TMO product trees retain the same percentage-gated
prev_mah update and contain no finer-grained reporting workaround.
Fixes: 13151631b5bd ("ab8500-fg: A8500 fuel gauge driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-2-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/ab8500_fg.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index b122bd473c773..3b0a5bdd352b5 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -1387,6 +1387,13 @@ static void ab8500_fg_check_capacity_limits(struct ab8500_fg *di, bool init)
}
}
+ /* Keep the charge properties current between percentage changes. */
+ if (di->bat_cap.prev_percent == percent &&
+ di->bat_cap.prev_mah != di->bat_cap.mah) {
+ di->bat_cap.prev_mah = di->bat_cap.mah;
+ changed = true;
+ }
+
if (changed) {
if (di->bm->capacity_scaling) {
di->bat_cap.cap_scale.scaled_cap =
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 365/869] perf: xgene: initialize lock before requesting IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 364/869] power: supply: ab8500_fg: Report sub-percent charge changes Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 366/869] svcrdma: Grant credits from the clamped sc_max_requests Greg Kroah-Hartman
` (511 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Will Deacon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit d4b7b0c77142b3bc535192fa65130474a129c487 ]
xgene_pmu_probe() requests the PMU IRQ before initializing
xgene_pmu->lock. request_irq() enables IRQ handling before it returns,
so xgene_pmu_isr() can run in this window and acquire the uninitialized
raw spinlock.
Initialize the lock before requesting the IRQ so the handler always sees a
valid lock.
Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/xgene_pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index 33b5497bdc06e..ecbcd2d39f9ed 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1873,6 +1873,8 @@ static int xgene_pmu_probe(struct platform_device *pdev)
if (irq < 0)
return -EINVAL;
+ raw_spin_lock_init(&xgene_pmu->lock);
+
rc = devm_request_irq(&pdev->dev, irq, xgene_pmu_isr,
IRQF_NOBALANCING | IRQF_NO_THREAD,
dev_name(&pdev->dev), xgene_pmu);
@@ -1883,8 +1885,6 @@ static int xgene_pmu_probe(struct platform_device *pdev)
xgene_pmu->irq = irq;
- raw_spin_lock_init(&xgene_pmu->lock);
-
/* Check for active MCBs and MCUs */
rc = xgene_pmu_probe_active_mcb_mcu_l3c(xgene_pmu, pdev);
if (rc) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 366/869] svcrdma: Grant credits from the clamped sc_max_requests
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 365/869] perf: xgene: initialize lock before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 367/869] ASoC: codecs: rt5682s: disable jack detection work on shutdown Greg Kroah-Hartman
` (510 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit b7037e5da3fb81abcd6309daecb112f1d5926760 ]
svc_rdma_accept() computes sc_fc_credits from sc_max_requests before
the Receive Queue depth is checked against the device's max_qp_wr.
When that check lowers sc_max_requests, the credit grant keeps the
original value, so the server advertises more credits than it has
Receives posted. A client that uses the full grant overruns the
Receive Queue, and the connection is lost with an RNR error.
Set sc_fc_credits after the clamp so the grant matches the number
of Receives the server posts.
Fixes: fc2e69db82c1 ("svcrdma: Clean up comment in svc_rdma_accept()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260828135036.796842-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 4afa662430cae..d9bc86fa09bce 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -469,7 +469,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
newxprt->sc_max_requests = svcrdma_max_requests;
newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
newxprt->sc_recv_batch = RPCRDMA_MAX_RECV_BATCH;
- newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
/* Qualify the transport's resource defaults with the
* capabilities of this particular device.
@@ -490,6 +489,8 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
newxprt->sc_max_bc_requests = 2;
}
+ newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
+
/* Estimate the needed number of rdma_rw contexts. The maximum
* Read and Write chunks have one segment each. Each request
* can involve one Read chunk and either a Write chunk or Reply
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 367/869] ASoC: codecs: rt5682s: disable jack detection work on shutdown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 366/869] svcrdma: Grant credits from the clamped sc_max_requests Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 368/869] floppy: dont store a stack buffer in timeout_message Greg Kroah-Hartman
` (509 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit ca552e3140e736ed6704fe5d47439d8f2d40b42e ]
The jack detection and button check works can queue each other. The
shutdown path cancels jack_detect_work first, but jd_check_work can
queue it again after that cancellation returns. Canceling jd_check_work
then leaves jack_detect_work pending or running while the device is
reset and, on removal, its managed resources are released.
Disable and drain both delayed works so neither callback can revive the
other after its cancellation. The I2C remove callback uses the same
shutdown path.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: c07ac3ee76e5 ("ASoC: rt5682s: Fix the wrong jack type detected")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261003041045.650207-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt5682s.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
index 1d80a4b862e27..1147b332c83a3 100644
--- a/sound/soc/codecs/rt5682s.c
+++ b/sound/soc/codecs/rt5682s.c
@@ -3300,8 +3300,8 @@ static void rt5682s_i2c_shutdown(struct i2c_client *client)
struct rt5682s_priv *rt5682s = i2c_get_clientdata(client);
disable_irq(client->irq);
- cancel_delayed_work_sync(&rt5682s->jack_detect_work);
- cancel_delayed_work_sync(&rt5682s->jd_check_work);
+ disable_delayed_work_sync(&rt5682s->jack_detect_work);
+ disable_delayed_work_sync(&rt5682s->jd_check_work);
rt5682s_reset(rt5682s);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 368/869] floppy: dont store a stack buffer in timeout_message
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 367/869] ASoC: codecs: rt5682s: disable jack detection work on shutdown Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 369/869] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT Greg Kroah-Hartman
` (508 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+874c2707f97fac24b090,
Denis Efremov (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov (Oracle) <efremov@linux.com>
[ Upstream commit 66be62ee5d64b6ad1285978644798d8611add931 ]
request_done() formats "request done %d" into a buffer on its stack and
passes it to reschedule_timeout(), which keeps the pointer in
timeout_message. show_floppy() prints timeout_message long after
request_done() has returned, e.g. from result() in the interrupt
handler, and reads a dead stack frame:
BUG: KASAN: stack-out-of-bounds in string+0x39c/0x3d0 lib/vsprintf.c:720
Read of size 1 at addr ffffc900003cfc70 by task swapper/3/0
Call Trace:
<IRQ>
...
show_floppy+0xb1/0x45f drivers/block/floppy.c:1838
result.cold+0x2b/0x30 drivers/block/floppy.c:1183
floppy_interrupt+0x191/0x340 drivers/block/floppy.c:1755
floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66
uptodate is either 0 or 1, so pass one of two string literals instead.
Cc: stable@vger.kernel.org
Fixes: 73507e6cd8dc ("drivers/block/floppy.c: remove unnecessary argument from [__]reschedule_timeout")
Reported-by: syzbot+874c2707f97fac24b090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=874c2707f97fac24b090
Link: https://patch.msgid.link/20260924094839.3239569-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/floppy.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index c28786e0fe1c8..3ec5453672c15 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2278,11 +2278,10 @@ static void request_done(int uptodate)
{
struct request *req = current_req;
int block;
- char msg[sizeof("request done ") + sizeof(int) * 3];
probing = 0;
- snprintf(msg, sizeof(msg), "request done %d", uptodate);
- reschedule_timeout(MAXTIMEOUT, msg);
+ reschedule_timeout(MAXTIMEOUT,
+ uptodate ? "request done 1" : "request done 0");
if (!req) {
pr_info("floppy.c: no request in request_done\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 369/869] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 368/869] floppy: dont store a stack buffer in timeout_message Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 370/869] dlm: fix send buffer backpressure handling Greg Kroah-Hartman
` (507 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Denis Efremov (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov (Oracle) <efremov@linux.com>
[ Upstream commit bb38473f1bcb287567f2fa7980e483a778092504 ]
compat_getdrvstat() copies every field of the drive state to a 32-bit
caller except ->flags, which stays zero. 32-bit FDGETDRVSTAT and
FDPOLLDRVSTAT therefore never report FD_DISK_WRITABLE, FD_DISK_CHANGED
or FD_VERIFY: i386 fdutils (floppycontrol -P, fdmount), and other
32-bit users see every disk as write-protected and never see a disk
change. The compat code in block/compat_ioctl.c copied the field;
it was lost when that code moved into floppy.c
Also declare the field as compat_ulong_t: the 32-bit struct
floppy_drive_struct starts with an unsigned long, and a signed char at
offset 0 only lines up with its low byte on little-endian machines. The
size and offsets of the compat structure, and so FDGETDRVSTAT32, do not
change.
Cc: stable@vger.kernel.org
Fixes: 229b53c9bf4e ("take floppy compat ioctls to sodding floppy.c")
Link: https://patch.msgid.link/20260924112825.3525931-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/floppy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 3ec5453672c15..eed7de727e547 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3602,7 +3602,7 @@ struct compat_floppy_drive_params {
};
struct compat_floppy_drive_struct {
- signed char flags;
+ compat_ulong_t flags;
compat_ulong_t spinup_date;
compat_ulong_t select_date;
compat_ulong_t first_read_date;
@@ -3786,6 +3786,7 @@ static int compat_getdrvstat(int drive, bool poll,
goto Eintr;
process_fd_request();
}
+ v.flags = drive_state[drive].flags;
v.spinup_date = drive_state[drive].spinup_date;
v.select_date = drive_state[drive].select_date;
v.first_read_date = drive_state[drive].first_read_date;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 370/869] dlm: fix send buffer backpressure handling
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 369/869] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 371/869] PCI/DOE: Fix double free of a duplicate features sysfs name Greg Kroah-Hartman
` (506 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Teigland, Alexander Aring,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@kernel.org>
[ Upstream commit e234d7625598b2eaded84fa99f53c8062650828f ]
lowcomms.c tests and clears SOCKWQ_ASYNC_NOSPACE in con->sock->flags,
but this bit has not been stored there for ten years.
Commit 9cd3e072b0be ("net: rename SOCK_ASYNC_NOSPACE and
SOCK_ASYNC_WAITDATA") mechanically renamed the two dlm users, then
commit ceb5d58b2170 ("net: fix sock_wake_async() rcu protection") moved
the bit from socket->flags to the RCU protected socket_wq->flags, where
it is reachable only through sk_set_bit() and sk_clear_bit(), and is
only maintained for sockets having SOCK_FASYNC set. dlm uses kernel
sockets, which never have SOCK_FASYNC set, and never sets the bit
itself, so the test in send_to_sock() has been false ever since.
The consequence is that when sock_sendmsg() returns -EAGAIN because the
socket send buffer is full, dlm no longer sets CF_APP_LIMITED, does not
increment sk_write_pending, and does not return DLM_IO_END to wait for
lowcomms_write_space(). It returns DLM_IO_RESCHED instead, and
process_send_sockets() immediately requeues the send work. A connection
to a peer that is slow to drain thus keeps cycling through
sock_sendmsg() and -EAGAIN, burning CPU, instead of sleeping until TCP
reports that space is available again.
Test SOCK_NOSPACE instead. This is the bit that lives in socket->flags,
that TCP sets whenever sendmsg() returns -EAGAIN for lack of send buffer
space (tcp_sendmsg_locked() and sk_stream_wait_memory()), and that
lowcomms_write_space() already clears. This restores the semantics dlm
had before the bit moved.
Also remove the clear_bit() of SOCKWQ_ASYNC_NOSPACE from
lowcomms_write_space(), for the same reason.
SCTP connections are deliberately left as they are. SCTP does not set
SOCK_NOSPACE, and it never calls sk->sk_write_space(): sctp_wfree() ends
up in sctp_wake_up_waiters(), which calls sctp_write_space() directly.
lowcomms_write_space() is thus never invoked for an SCTP connection, and
the test added here stays false, so send_to_sock() keeps returning
DLM_IO_RESCHED as it does today. This is the only safe behavior, as
returning DLM_IO_END would wait for a callback that never comes.
Fixes: ceb5d58b2170 ("net: fix sock_wake_async() rcu protection")
Cc: stable@vger.kernel.org
Cc: David Teigland <teigland@redhat.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20260929071743.23624-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 9a0b6c2b6b01e..dd68198f34dde 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -520,10 +520,8 @@ static void lowcomms_write_space(struct sock *sk)
clear_bit(SOCK_NOSPACE, &con->sock->flags);
spin_lock_bh(&con->writequeue_lock);
- if (test_and_clear_bit(CF_APP_LIMITED, &con->flags)) {
+ if (test_and_clear_bit(CF_APP_LIMITED, &con->flags))
con->sock->sk->sk_write_pending--;
- clear_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags);
- }
lowcomms_queue_swork(con);
spin_unlock_bh(&con->writequeue_lock);
@@ -1389,7 +1387,7 @@ static int send_to_sock(struct connection *con)
if (ret == -EAGAIN || ret == 0) {
lock_sock(con->sock->sk);
spin_lock_bh(&con->writequeue_lock);
- if (test_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags) &&
+ if (test_bit(SOCK_NOSPACE, &con->sock->flags) &&
!test_and_set_bit(CF_APP_LIMITED, &con->flags)) {
/* Notify TCP that we're limited by the
* application window size.
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 371/869] PCI/DOE: Fix double free of a duplicate features sysfs name
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 370/869] dlm: fix send buffer backpressure handling Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 372/869] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow Greg Kroah-Hartman
` (505 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alistair Francis, Donggeun Yoo,
Bjorn Helgaas, Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 624ee129620a054466b6a29d98cd7a40ccc239cd ]
When a DOE feature is reported twice, sysfs_add_file_to_group() fails
with -EEXIST for the second copy and pci_doe_sysfs_feature_populate()
frees that attribute's name, but leaves the pointer in place.
pci_doe_sysfs_feature_remove() frees every name again when the device
is removed, or when a later feature fails to register, so the name is
freed twice:
BUG: KASAN: double-free in pci_doe_sysfs_feature_remove+0x117/0x1b0
Call Trace:
kfree+0x11a/0x420
pci_doe_sysfs_feature_remove+0x117/0x1b0
pci_doe_sysfs_teardown+0x90/0xf0
pci_remove_bus_device+0x128/0x2e0
pci_stop_and_remove_bus_device_locked+0x1d/0x30
remove_store+0xd2/0xf0
Clear the pointer after freeing the name.
Fixes: 2311ab1820fe ("PCI/DOE: Expose DOE features via sysfs")
Suggested-by: Alistair Francis <alistair@alistair23.me>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261003102221.59894-1-donggeunyoo.kernel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/doe.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c
index aae9a8a00406e..3b0cc6db4402d 100644
--- a/drivers/pci/doe.c
+++ b/drivers/pci/doe.c
@@ -210,8 +210,9 @@ static int pci_doe_sysfs_feature_populate(struct pci_dev *pdev,
pci_warn(pdev, "Failed adding %s to sysfs group\n",
attrs[i].attr.name);
goto fail;
- } else
- kfree(attrs[i].attr.name);
+ }
+ kfree(attrs[i].attr.name);
+ attrs[i].attr.name = NULL;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 372/869] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 371/869] PCI/DOE: Fix double free of a duplicate features sysfs name Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 373/869] xfs: cross-reference the primary superblock Greg Kroah-Hartman
` (504 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Priyank Rathod, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyank Rathod <rathodpriyank@google.com>
[ Upstream commit 07938f8a3cbf3e9cc27553b8982e2d56c15b354a ]
When ACPI APEI/GHES processes PCIe AER error records, it allocates memory
for aer_capability_regs (aer_regs) from ghes_estatus_pool and passes it to
aer_recover_queue() to be enqueued into aer_recover_ring.
If kfifo_in_spinlocked() fails due to a buffer overflow,
aer_recover_queue() logged an error message but returned without freeing
aer_regs. Because the entry was rejected and never inserted into the queue,
aer_recover_work_func() could never dequeue or free it, leaking the
allocated ghes_estatus_pool memory.
aer_recover_queue() returns void, so the caller ghes_handle_aer() cannot
free the buffer itself: ownership is transferred to the AER code, which
until now only released it on the success path.
Free aer_regs via ghes_estatus_pool_region_free() when
kfifo_in_spinlocked() fails on buffer overflow.
Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections")
Signed-off-by: Priyank Rathod <rathodpriyank@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260928-b4-fix-aer-memleaks-v5-1-ba6b94c9c9a6@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/aer.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index 9f90abe3e88ed..ad3fea4b56f88 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -1379,11 +1379,14 @@ void aer_recover_queue(int domain, unsigned int bus, unsigned int devfn,
};
if (kfifo_in_spinlocked(&aer_recover_ring, &entry, 1,
- &aer_recover_ring_lock))
+ &aer_recover_ring_lock)) {
schedule_work(&aer_recover_work);
- else
+ } else {
pr_err("buffer overflow in recovery for %04x:%02x:%02x.%x\n",
domain, bus, PCI_SLOT(devfn), PCI_FUNC(devfn));
+ ghes_estatus_pool_region_free((unsigned long)aer_regs,
+ sizeof(struct aer_capability_regs));
+ }
}
EXPORT_SYMBOL_GPL(aer_recover_queue);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 373/869] xfs: cross-reference the primary superblock
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 372/869] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 374/869] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz Greg Kroah-Hartman
` (503 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 0c61016006ab08f8346f9e7b1e38559bd4ea499e ]
Make sure we cross-reference the primary superblock against the rest of
the AG 0 space metadata. Drop the unused @bp parameter of
xchk_superblock_xref to avoid complaints about uninitialized variables.
Cc: stable@vger.kernel.org # v4.16
Fixes: 52dc4b44af7419 ("xfs: cross-reference with the bnobt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--git a/fs/xfs/scrub/agheader.c b/fs/xfs/scrub/agheader.c
index 5b8d66b20159e..80de731070f47 100644
--- a/fs/xfs/scrub/agheader.c
+++ b/fs/xfs/scrub/agheader.c
@@ -35,8 +35,7 @@ xchk_setup_agheader(
/* Cross-reference with the other btrees. */
STATIC void
xchk_superblock_xref(
- struct xfs_scrub *sc,
- struct xfs_buf *bp)
+ struct xfs_scrub *sc)
{
struct xfs_mount *mp = sc->mp;
xfs_agnumber_t agno = sc->sm->sm_agno;
@@ -106,16 +105,12 @@ xchk_superblock(
struct xfs_dsb *sb;
struct xfs_perag *pag;
size_t sblen;
- xfs_agnumber_t agno;
+ xfs_agnumber_t agno = sc->sm->sm_agno;
uint32_t v2_ok;
__be32 features_mask;
int error;
__be16 vernum_mask;
- agno = sc->sm->sm_agno;
- if (agno == 0)
- return 0;
-
/*
* Grab an active reference to the perag structure. If we can't get
* it, we're racing with something that's tearing down the AG, so
@@ -125,6 +120,9 @@ xchk_superblock(
if (!pag)
return -ENOENT;
+ if (agno == 0)
+ goto out_xref;
+
error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp);
/*
* The superblock verifier can return several different error codes
@@ -430,7 +428,8 @@ xchk_superblock(
if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
xchk_block_set_corrupt(sc, bp);
- xchk_superblock_xref(sc, bp);
+out_xref:
+ xchk_superblock_xref(sc);
out_pag:
xfs_perag_put(pag);
return error;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 374/869] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 373/869] xfs: cross-reference the primary superblock Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 375/869] mm/ksm: mark migration stores with WRITE_ONCE() Greg Kroah-Hartman
` (502 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Arend van Spriel,
Johannes Berg, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit f7463a9c99a506b3308a852f9aaaf2a26b659e95 ]
After a recent change in clang to warn on signed char conversions within
array initializers [1], there is a warning (or error with
CONFIG_WERROR=y / W=e) from nphy_ipa_rxcal_gaintbl_2GHz:
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c:224:18: error: implicit conversion from 'int' to 's8' (aka 'signed char') changes value from 128 to -128 [-Werror,-Wconstant-conversion]
224 | {0, 0, 0, 0, 0, 128},
| ~ ^~~
1 error generated.
This value was introduced in the original staging merge of brcmsmac in
commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom
802.11n wireless LAN driver.") and it is the same in the proprietary
driver [2]. Presumably it is correct since there have been no reported issues,
so update the value to '-128' to be type correct and clear up the warning.
Cc: stable@vger.kernel.org
Fixes: a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.")
Link: https://github.com/llvm/llvm-project/commit/a5ef934a8d295dc03be3960f2b3744ec2e53238e [1]
Link: https://lore.kernel.org/1a107e21b08.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com/ [2]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20261005-brcmsmac-clang-24-constant-conversion-v1-1-a30c5692d582@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index b03d5a1f1a936..7fd3e018affe2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -221,7 +221,7 @@ static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_5GHz[] = {
};
static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_2GHz[] = {
- {0, 0, 0, 0, 0, 128},
+ {0, 0, 0, 0, 0, -128},
{0, 0, 0, 0, 0, 70},
{0, 0, 0, 0, 0, 20},
{0, 0, 0, 3, 0, 20},
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 375/869] mm/ksm: mark migration stores with WRITE_ONCE()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 374/869] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 376/869] mm/page_isolation: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
` (501 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Andrew Morton, Xu Xin,
David Hildenbrand (Arm), Hugh Dickins, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
[ Upstream commit d3863210464f69c18615cbe400d48a6e53e770d4 ]
ksm_get_folio() deliberately samples stable_node->kpfn and folio->mapping
without taking the folio lock because the KSM folio may be migrated
concurrently. folio_migrate_ksm() updates the same state using plain
assignments.
The reader can load the old kpfn, then the migrator can store the new
kpfn, execute smp_wmb(), and clear the old folio's mapping before the
reader checks that mapping. Thus the initial kpfn load can overlap its
update and the subsequent mapping load can overlap the clear, with no
common lock. This leaves marked READ_ONCE() accesses racing with plain
stores.
The kernel reported:
BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio
read (marked) to 0xffff8ce401421330 of 8 bytes by task 48 on cpu 3:
ksm_get_folio+0x7f/0x2a0
ksm_scan_thread+0x1635/0x3330
kthread+0x1af/0x1f0
write to 0xffff8ce401421330 of 8 bytes by task 102 on cpu 1:
folio_migrate_ksm+0x6a/0xd0
folio_migrate_flags+0x193/0x420
__migrate_folio.isra.0+0x162/0x1a0
migrate_folio+0x4c/0x70
move_to_new_folio+0xd6/0x170
Use WRITE_ONCE() for both stores to pair them with the existing lockless
reads. This preserves the existing smp_wmb()/smp_rmb() migration protocol
and control flow while preventing compiler transformations of the shared
accesses.
Link: https://lore.kernel.org/20260824112433.191301-1-nicoyip.dev@gmail.com
Fixes: c8d6553b9580 ("ksm: make KSM page migration possible")
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/ksm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/mm/ksm.c b/mm/ksm.c
index 4f672f4f21407..80274ace8155e 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1065,7 +1065,8 @@ static inline void folio_set_stable_node(struct folio *folio,
struct ksm_stable_node *stable_node)
{
VM_WARN_ON_FOLIO(folio_test_anon(folio) && PageAnonExclusive(&folio->page), folio);
- folio->mapping = (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM);
+ WRITE_ONCE(folio->mapping,
+ (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM));
}
#ifdef CONFIG_SYSFS
@@ -3248,7 +3249,7 @@ void folio_migrate_ksm(struct folio *newfolio, struct folio *folio)
stable_node = folio_stable_node(folio);
if (stable_node) {
VM_BUG_ON_FOLIO(stable_node->kpfn != folio_pfn(folio), folio);
- stable_node->kpfn = folio_pfn(newfolio);
+ WRITE_ONCE(stable_node->kpfn, folio_pfn(newfolio));
/*
* newfolio->mapping was set in advance; now we need smp_wmb()
* to make sure that the new stable_node->kpfn is visible
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 376/869] mm/page_isolation: fix UBSAN shift-out-of-bounds warning
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 375/869] mm/ksm: mark migration stores with WRITE_ONCE() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 6.18 377/869] mm/page_isolation: guard compound_order() against racing Greg Kroah-Hartman
` (500 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Xi, Andrew Morton, Zi Yan,
Johannes Weiner, Kefeng Wang, Michal Hocko, Nanyong Sun,
Suren Baghdasaryan, Vlastimil Babka, Brendan Jackman, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Xi <xiqi2@huawei.com>
[ Upstream commit eba0e6297edd60a85bc96ff5cfb734d066af62dd ]
Patch series "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock", v3.
Patch 1 fixes a UBSAN shift-out-of-bounds warning in the PageBuddy branch
of isolate_single_pageblock() triggered by concurrent buddy allocation.
Patch 2 addresses the same class of issue in the PageCompound branch,
where racy compound_order() and compound_head() reads could lead to
out-of-range shifts or incorrect page skipping.
This patch (of 2):
A contig-range allocation racing with buddy allocation on the adjacent
pageblock can trigger:
UBSAN: shift-out-of-bounds in mm/page_isolation.c:393:15
shift exponent -749042176 is negative
Call trace:
isolate_single_pageblock
start_isolate_page_range
alloc_contig_frozen_range_noprof
alloc_contig_range_noprof
isolate_single_pageblock() first calls set_migratetype_isolate() with
zone->lock held, which marks the pageblock MIGRATE_ISOLATE and moves any
free page straddling the boundary out of the way. Once the lock is
dropped, it scans the MAX_ORDER_NR_PAGES-aligned window [start_pfn,
boundary_pfn) locklessly, only to skip the free pages already handled
above and to detect in-use pages straddling the boundary. Since this
scan only reads page state to decide how far to skip and returns -EBUSY
on a straddling in-use page, it does not take the lock.
The window also covers the adjacent pageblock, whose free pages stay on
the normal movable/CMA freelist and can be allocated concurrently. So
after the scan observes PageBuddy(page), another CPU can allocate the
page, leaving a stale value in page->private that makes "1 << order" shift
out of range.
Use buddy_order_unsafe() with READ_ONCE to read the order, and validate
it is within MAX_PAGE_ORDER before shifting to prevent UBSAN warnings.
Since pageblock_isolate_and_move_free_pages() already handles free pages
straddling boundary_pfn under zone->lock, bail out with -EBUSY instead
of VM_WARN_ON_ONCE() when a PageBuddy page appears to cross the boundary
during the lockless scan.
Link: https://lore.kernel.org/20260825120549.966271-2-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_isolation.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index f72b6cd38b958..2ec974fa9726d 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -380,13 +380,19 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
}
if (PageBuddy(page)) {
- int order = buddy_order(page);
+ unsigned int order = buddy_order_unsafe(page);
- /* pageblock_isolate_and_move_free_pages() handled this */
- VM_WARN_ON_ONCE(pfn + (1 << order) > boundary_pfn);
-
- pfn += 1UL << order;
- continue;
+ /* buddy_order_unsafe() is racy. Validate the order before shifting. */
+ if (order <= MAX_PAGE_ORDER &&
+ /*
+ * pageblock_isolate_and_move_free_pages() splits
+ * cross-boundary PageBuddy, verify it.
+ */
+ pfn + (1UL << order) <= boundary_pfn) {
+ pfn += 1UL << order;
+ continue;
+ }
+ goto failed;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 377/869] mm/page_isolation: guard compound_order() against racing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 376/869] mm/page_isolation: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 378/869] mm/mempolicy: take a cpuset cookie for the interleave node count Greg Kroah-Hartman
` (499 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Xi, Andrew Morton, Zi Yan,
Brendan Jackman, Johannes Weiner, Kefeng Wang, Michal Hocko,
Nanyong Sun, Suren Baghdasaryan, Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Xi <xiqi2@huawei.com>
[ Upstream commit 4c767c5dd9bc3521fed11e6fe1d52621fe5abf7b ]
The PageCompound branch reads compound_head() without holding a reference.
A racing split or free can cause compound_head() to return a stale
pointer, and compound_nr() reads the order from that stale head, leading
to out-of-range shifts and making the skip distance meaningless.
Read the order explicitly with compound_order() and validate it is within
MAX_FOLIO_ORDER before shifting. Also verify the derived head_pfn against
the legitimate pfn: the head must not be past pfn, must be aligned to
nr_pages, and pfn must fall within the compound page. Bail out with
-EBUSY if any check fails.
Link: https://lore.kernel.org/20260825120549.966271-3-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_isolation.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 2ec974fa9726d..2e366e7bd5e93 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -411,10 +411,28 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
if (PageCompound(page)) {
struct page *head = compound_head(page);
unsigned long head_pfn = page_to_pfn(head);
- unsigned long nr_pages = compound_nr(head);
+ unsigned int order = compound_order(head);
+ unsigned long nr_pages;
+
+ /* compound_order() is racy. Cap it at MAX_FOLIO_ORDER. */
+ if (order > MAX_FOLIO_ORDER)
+ goto failed;
+
+ nr_pages = 1UL << order;
+
+ /*
+ * compound_head() is also racy, so the derived head_pfn
+ * needs additional checks to make sure it is valid.
+ * Otherwise, just fail the check. pfn comes from
+ * __first_valid_page() as a legitimate PFN, so use it to
+ * check head_pfn.
+ */
+ if (head_pfn > pfn || !IS_ALIGNED(head_pfn, nr_pages) ||
+ pfn - head_pfn >= nr_pages)
+ goto failed;
if (head_pfn + nr_pages <= boundary_pfn ||
- PageHuge(page)) {
+ PageHuge(head)) {
pfn = head_pfn + nr_pages;
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 378/869] mm/mempolicy: take a cpuset cookie for the interleave node count
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 6.18 377/869] mm/page_isolation: guard compound_order() against racing Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 379/869] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming Greg Kroah-Hartman
` (498 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
Chelsy Ratnawat, Huang Ying, Alistair Popple, Byungchul Park,
Chenwandun, David Hildenbrand, Joshua Hahn, Matthew Brost,
Rakie Kim, Uladzislau Rezki (Sony), Zi Yan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit bbeeb4a29dc4ca6ac18ab3bafa3728bc984a4cde ]
alloc_pages_bulk_interleave() counts pol->nodes without a cpuset cookie:
nodes = nodes_weight(pol->nodes);
nr_pages_per_node = nr_pages / nodes;
nodemask_t spans several words once MAX_NUMNODES exceeds BITS_PER_LONG, so
a concurrent cpuset rebind can tear that read and yield an empty mask even
though neither version of it was empty. The call then allocates nothing
and returns 0.
Some compilers will hoist the loop entry test above the division,
because nr_pages_per_node is dead when the loop does not run.
682e: call ... <- nodes_weight()
6838: test %eax,%eax
683a: jle 692d <- nodes <= 0 skips the loop
684a: div %rcx
So in most deployments, this div/0 is unreachable - but nothing in the
source guarantees that, it's just not easily exercised.
Take the cookie around the count and bail if the mask really is empty.
Only the count needs it, interleave_nodes() takes the cookie itself so so
a torn read there is already retried.
A rebind landing mid-loop can still leave the count disagreeing with the
mask, so the loop may revisit a node or skip one - but a rebind where
nodes change causes migration, so a handful of misplaced pages isn't
catastrophic in any sense.
Measured on a 72 node VM (NODES_SHIFT=10) with a cgroup v2 cpuset flipping
cpuset.mems between a word 0 and a word 1 node set, and the two word read
artificially widened: 330 zero counts in 130414 calls without the cookie,
and 401 retries with it.
Link: https://lore.kernel.org/20260828193111.1023497-1-gourry@gourry.net
Fixes: c00b6b961099 ("mm/vmalloc: introduce alloc_pages_bulk_array_mempolicy to accelerate memory allocation")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Closes: https://lore.kernel.org/all/20250907160829.91628-1-chelsyratnawat2001@gmail.com/
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Assisted-by: Claude:claude-opus-5
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chenwandun <chenwandun@huawei.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mempolicy.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 2a84cecf54355..197a5ea0d76d9 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2519,6 +2519,7 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
struct mempolicy *pol, unsigned long nr_pages,
struct page **page_array)
{
+ unsigned int cpuset_mems_cookie;
int nodes;
unsigned long nr_pages_per_node;
int delta;
@@ -2526,7 +2527,16 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
unsigned long nr_allocated;
unsigned long total_allocated = 0;
- nodes = nodes_weight(pol->nodes);
+ /* count the nodes, retry if a rebind happened during the read */
+ do {
+ cpuset_mems_cookie = read_mems_allowed_begin();
+ nodes = nodes_weight(pol->nodes);
+ } while (read_mems_allowed_retry(cpuset_mems_cookie));
+
+ /* if the nodemask has become invalid, we cannot do anything */
+ if (!nodes)
+ return 0;
+
nr_pages_per_node = nr_pages / nodes;
delta = nr_pages - nodes * nr_pages_per_node;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 379/869] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 378/869] mm/mempolicy: take a cpuset cookie for the interleave node count Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 380/869] mm/page_table_check: skip zero pages Greg Kroah-Hartman
` (497 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Damato, Andrew Morton,
Shakeel Butt, Johannes Weiner, Michal Hocko, Muchun Song,
Roman Gushchin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <joe@dama.to>
[ Upstream commit 374f65b1481992eb6b9c6bffd53f3afa5c2e94cf ]
Charges that exceed memory.max and return through the nomem label can
raise no event and simply return -ENOMEM.
A non-blocking charge can hit the limit, get rejected, but is not visible
in memory.events.
This was noticed in a production setting where bpf_mem_alloc() attempted
to refill its per-cpu freelists, which triggered a non-blocking charge
while at the limit.
Commit d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for
enforced allocations") added raised_max_event to cover charges that are
force charged without ever reaching reclaim, but charges that are rejected
outright were left out. Getting an allocation failure without the
corresponding MEMCG_MAX event is unexpected and makes debugging and
monitoring harder.
Raise the event on the way out for rejected charges as well, by routing
the -ENOMEM return through the same exit path that already covers forced
charges. The existing behavior of raising a MEMCG_MAX event on every
charge/reclaim/retry iteration is left unchanged.
Tested with a module that performs accounted GFP_NOWAIT page allocations
from a task in a cgroup at its memory.max, and measures the resulting
memory.events:max delta. Without this patch the rejected charges raise no
event at all; with it the delta matches the number of rejected charges
exactly. A GFP_KERNEL|__GFP_NORETRY control, which reaches reclaim,
raises the same two events per failed charge before and after, confirming
the existing charge/reclaim/retry accounting is unchanged.
Link: https://lore.kernel.org/20260831174836.3102406-1-joe@dama.to
Fixes: d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations")
Signed-off-by: Joe Damato <joe@dama.to>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 82ad23d689c7f..2aa741316b49f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2311,10 +2311,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
bool raised_max_event = false;
unsigned long pflags;
bool allow_spinning = gfpflags_allow_spinning(gfp_mask);
+ int ret = 0;
retry:
if (consume_stock(memcg, nr_pages))
- return 0;
+ return ret;
if (!allow_spinning)
/* Avoid the refill and flush of the older stock */
@@ -2424,16 +2425,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
* put the burden of reclaim on regular allocation requests
* and let these go through as privileged allocations.
*/
- if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH)))
- return -ENOMEM;
+ if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH))) {
+ ret = -ENOMEM;
+ goto out;
+ }
force:
- /*
- * If the allocation has to be enforced, don't forget to raise
- * a MEMCG_MAX event.
- */
- if (!raised_max_event)
- __memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
-
/*
* The allocation either can't fail or will lead to more memory
* being freed very soon. Allow memory usage go over the limit
@@ -2443,7 +2439,15 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
if (do_memsw_account())
page_counter_charge(&memcg->memsw, nr_pages);
- return 0;
+out:
+ /*
+ * Don't forget to raise a MEMCG_MAX event for forced or rejected
+ * requests.
+ */
+ if (!raised_max_event)
+ __memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
+
+ return ret;
done_restock:
if (batch > nr_pages)
@@ -2502,7 +2506,7 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
!(current->flags & PF_MEMALLOC) &&
gfpflags_allow_blocking(gfp_mask))
__mem_cgroup_handle_over_high(gfp_mask);
- return 0;
+ return ret;
}
static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 380/869] mm/page_table_check: skip zero pages
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 379/869] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 381/869] mm/damon/paddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
` (496 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhiling Zou, Ren Wei, Andrew Morton,
Vega, Ye Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <roxy520tt@gmail.com>
[ Upstream commit 33afd07412a1efe5b750a3fd5eb0272ebdd12761 ]
page_table_check_set() accounts pages by whether they are PageAnon(). The
shared zero page is a special page, not an ordinary file-backed page.
Read faults on private anonymous mappings can install many read-only PTEs
that point at the zero page, but page_table_check currently accounts them
in file_map_count.
That lets an unprivileged process populate enough zero-page mappings to
overflow file_map_count and trip the BUG_ON() in page_table_check_set().
Skip zero pages in page_table_check accounting. They do not need the
anonymous/file mapping conflict checks that page_table_check performs for
ordinary pages, and this keeps the existing counter size and page_ext
layout unchanged.
Link: https://lore.kernel.org/1f8848512d2e3ded944f8d595c29faee8fdaeab0.1784645969.git.roxy520tt@gmail.com
Fixes: df4e817b7108 ("mm: page table check")
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Cc: Ye Liu <liuye@kylinos.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_table_check.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/page_table_check.c b/mm/page_table_check.c
index 91c4dacc41fb8..fa2c12e76a9e7 100644
--- a/mm/page_table_check.c
+++ b/mm/page_table_check.c
@@ -67,7 +67,7 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
@@ -102,7 +102,7 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt,
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 381/869] mm/damon/paddr: respect folio end for DAMOS_STAT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 380/869] mm/page_table_check: skip zero pages Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 382/869] mm/damon/paddr: respect folio end for DAMOS actions except STAT Greg Kroah-Hartman
` (495 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit ac733f921d4fc02da70a98b175a6055a206b2a36 ]
The function for applying DAMOS_STAT in DAMON physical address space
operation set (paddr), namely damon_pa_stat(), applies DAMOS filters to
folios of the given region. For that, it gets folios of addresses in the
region. It starts from the region start address and advances the address
by the size of the folio of the address until it goes out of the region.
If the start address is in the middle of a large folio, and if the next
folios are small, some of the next folios could be skipped. Fix the issue
by advancing the address to exactly the start address of the next folio.
The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate. Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem. It is arguably
not critical since it is only monitoring quality degradation.
Link: https://lore.kernel.org/20260901131850.98037-3-sj@kernel.org
Fixes: bdbe1d7bc325 ("mm/damon/paddr: increment pa_stat damon address range by folio size")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.14.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/paddr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 1854b4bb6bd29..5720e73930f84 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -300,7 +300,7 @@ static unsigned long damon_pa_stat(struct damon_region *r,
if (!damos_pa_filter_out(s, folio))
*sz_filter_passed += folio_size(folio) / addr_unit;
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
s->last_applied = folio;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 382/869] mm/damon/paddr: respect folio end for DAMOS actions except STAT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 381/869] mm/damon/paddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 383/869] mm/damon/vaddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
` (494 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 1613ac9edf385c35f171a25610e2706a7e6afad6 ]
A few functions for applying DAMOS actions including pageout, lru_[de]prio
and migrate_{hot,cold} in DAMON physical address space operation set
(paddr) collect folios of the given region by getting the folios of
region-internal addresses. Then, those functions apply the action to the
collected folios at once. The collection starts from the region start
address and advances the address by the size of the folio of the address
until it goes out of the region. If the start address is in the middle of
a large folio, and if the next folios are small, some of the next folios
could be skipped. Fix the issue by advancing the address to exactly the
start address of the next folio.
The user impact is that DAMOS action is applied to less than expected
amount of memory. Given the best effort nature of DAMON, it is no big
problem, but it is clearly a bug that is better to be fixed.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-4-sj@kernel.org
Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1]
Fixes: 3a06696305e7 ("mm/damon/ops: have damon_get_folio return folio even for tail pages")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.15.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/paddr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 5720e73930f84..ddd26a78a9bc6 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -183,7 +183,7 @@ static unsigned long damon_pa_pageout(struct damon_region *r,
else
list_add(&folio->lru, &folio_list);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
if (install_young_filter)
@@ -221,7 +221,7 @@ static inline unsigned long damon_pa_mark_accessed_or_deactivate(
folio_deactivate(folio);
applied += folio_nr_pages(folio);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
s->last_applied = folio;
@@ -271,7 +271,7 @@ static unsigned long damon_pa_migrate(struct damon_region *r,
folio_is_file_lru(folio));
list_add(&folio->lru, &folio_list);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
applied = damon_migrate_pages(&folio_list, s->target_nid);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 383/869] mm/damon/vaddr: respect folio end for DAMOS_STAT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 382/869] mm/damon/paddr: respect folio end for DAMOS actions except STAT Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 384/869] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp() Greg Kroah-Hartman
` (493 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 946351a5fc5d4e3afec2bdf735935d17d6c9ceb2 ]
For applying DAMOS_STAT action to a region, DAMON virtual address space
operation set (vaddr) calls walk_page_range[_vma]() for the region. The
pmd walk entry function, namely damon_va_stat_pmd_entry(), applies DAMOS
filters to folios of addresses of the region in the pmd. It starts from
the walking address and advances the address by the size of the folio of
the address until it goes out of the pmd or the region.
Let's suppose it is for the first pmd of the region, and the region start
address is in the middle of a large folio. Also, the next folios are
small. Then, some of the next folios could be skipped. Fix the issue by
advancing the address to exactly the start address of the next folio.
The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate. Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem. It is arguably
not critical since it is only monitoring quality degradation.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-5-sj@kernel.org
Link: https://lore.kernel.org/20260514015053.149396-1-sj@kernel.org [1]
Fixes: 63f39737d1e3 ("mm/damon/vaddr: support stat-purpose DAMOS filters")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/vaddr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index cfa7849041ad9..7d4d7565e8ee3 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -925,6 +925,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
return 0;
for (; addr < next; pte += nr, addr += nr * PAGE_SIZE) {
+ unsigned long page_idx;
+
nr = 1;
ptent = ptep_get(pte);
@@ -938,7 +940,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
if (!damos_va_filter_out(s, folio, vma, addr, pte, NULL))
*sz_filter_passed += folio_size(folio);
- nr = folio_nr_pages(folio);
+ page_idx = folio_page_idx(folio, pte_page(ptent));
+ nr = folio_nr_pages(folio) - page_idx;
s->last_applied = folio;
}
pte_unmap_unlock(start_pte, ptl);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 384/869] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 383/869] mm/damon/vaddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 385/869] mm/damon/sysfs: set next refresh jiffies per sysfs context Greg Kroah-Hartman
` (492 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 485a9149ad406e00949327a3231b9084d7073706 ]
In an extreme and unlikely situation, si_meminfo_node() might let the
caller show zero total ram. That could cause a divide by zero in
damon_get_node_mem_bp(). It could also show free memory larger than the
total memory. This could cause underflow and make DAMOS temporarily make
unexpected behavior. Thanks to safety guards in the auto-tuning feedback
loop, that should not be a real problem, though. Fix the problems by
respectively returning 100% and 0% for used and free memory queries in the
corner cases.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-7-sj@kernel.org
Link: https://lore.kernel.org/20260328133216.9697-1-sj@kernel.org [1]
Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.16.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 8fa788b0d709c..0bed1cd9e3a23 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2145,6 +2145,13 @@ static __kernel_ulong_t damos_get_node_mem_bp(
}
si_meminfo_node(&i, goal->nid);
+ if (!i.totalram || i.totalram < i.freeram) {
+ if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
+ return 10000;
+ else /* DAMOS_QUOTA_NODE_MEM_FREE_BP */
+ return 0;
+ }
+
if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
numerator = i.totalram - i.freeram;
else /* DAMOS_QUOTA_NODE_MEM_FREE_BP */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 385/869] mm/damon/sysfs: set next refresh jiffies per sysfs context
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 384/869] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 386/869] resource: fix lost wakeup when waiting for a muxed region Greg Kroah-Hartman
` (491 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Lian Wang,
Kunwu Chan, Brendan Higgins, David Gow, Quanmin Yan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit b9100ecb5411d2de79175ed534df72ec41e94998 ]
When 'refresh_ms' is set, DAMON sysfs interface periodically updates
auto-tuned parameters and DAMOS stats. The timestamp for the next refresh
is initialized when a DAMON context starts, and updated in its
damon_call() callback function. That is, each DAMON context updates it.
However, the timestamp is a global variable that is shared with all the
contexts. When there are multiple DAMON contexts having different
refresh_ms, the update frequency will be changed, depending on the order
of the contexts. When there are multiple kdamonds, it will be even more
chaotic. Fix the problem by having the timestamp per each context.
The user impact is not very critical. It does not leak, corrupt or crash.
The update will not be faster or slower than the lowest and largest
refresh_ms values of the contexts, respectively. The user can also
manually ask the updates on demand using kdamond state commands. That
said, clearly this is a bug and can easily be reproduced.
Link: https://lore.kernel.org/20260902002725.108635-5-sj@kernel.org
Fixes: 9fd7bb5083d1 ("mm/damon/sysfs: change next_update_jiffies to a global variable")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/sysfs.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
index 3a79d8c89b5bb..1ae026d099a2e 100644
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1199,6 +1199,7 @@ struct damon_sysfs_kdamond {
struct damon_sysfs_contexts *contexts;
struct damon_ctx *damon_ctx;
unsigned int refresh_ms;
+ unsigned long next_refresh_jiffies;
};
static struct damon_sysfs_kdamond *damon_sysfs_kdamond_alloc(void)
@@ -1567,17 +1568,15 @@ static struct damon_ctx *damon_sysfs_build_ctx(
return ctx;
}
-static unsigned long damon_sysfs_next_update_jiffies;
-
static int damon_sysfs_repeat_call_fn(void *data)
{
struct damon_sysfs_kdamond *sysfs_kdamond = data;
if (!sysfs_kdamond->refresh_ms)
return 0;
- if (time_before(jiffies, damon_sysfs_next_update_jiffies))
+ if (time_before(jiffies, sysfs_kdamond->next_refresh_jiffies))
return 0;
- damon_sysfs_next_update_jiffies = jiffies +
+ sysfs_kdamond->next_refresh_jiffies = jiffies +
msecs_to_jiffies(sysfs_kdamond->refresh_ms);
if (!mutex_trylock(&damon_sysfs_lock))
@@ -1645,8 +1644,8 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
}
kdamond->damon_ctx = ctx;
- damon_sysfs_next_update_jiffies =
- jiffies + msecs_to_jiffies(kdamond->refresh_ms);
+ kdamond->next_refresh_jiffies = jiffies +
+ msecs_to_jiffies(kdamond->refresh_ms);
repeat_call_control->fn = damon_sysfs_repeat_call_fn;
repeat_call_control->data = kdamond;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 386/869] resource: fix lost wakeup when waiting for a muxed region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 385/869] mm/damon/sysfs: set next refresh jiffies per sysfs context Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 387/869] fat: fix fat_ent_write() for reverting the value Greg Kroah-Hartman
` (490 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, DAI RENJIE, Andrew Morton,
Bradley Morgan, Mark Brown, Kees Cook, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: DAI RENJIE <drj19981414013@gmail.com>
[ Upstream commit 405c00e43a9c72a0b9b318cc2d2e298386ffb58e ]
A task waiting for a muxed region can sleep forever in
TASK_UNINTERRUPTIBLE even though the region it waits for is already free.
__request_region_locked() queues itself on muxed_resource_wait and drops
resource_lock before setting TASK_UNINTERRUPTIBLE, while
__release_region() wakes the queue after dropping the same lock. A wakeup
landing in between finds TASK_RUNNING, does not match TASK_NORMAL and is
discarded; callers hold a muxed region only across a bounded transaction,
so no further release is coming. The task is unkillable and its caller
never returns.
The window is one store wide, but an interrupt is enough to hold the
waiter in it, and the machine this was seen on runs PREEMPT_DYNAMIC in its
voluntary default. Since v6.11 spd5118 exports the DDR5 sensors of AMD
boards through i2c-piix4, which takes a muxed region per SMBus
transaction; a third of the in-tree users of request_muxed_region() are
hwmon drivers, so reading a world-readable attribute is all an
unprivileged user needs to drive the contention. The blocked task sleeps
holding the i2c adapter bus lock, and 27 more piled up behind it.
Reproduced by building a kernel with the two orderings selectable at
runtime and a 2ms delay inside the window. Switching only that knob, a
two-thread barriered reproducer loses the wakeup 200 times out of 200
before the fix and 0 out of 200 after it; without the delay it goes 20000
times through the wait path and loses none.
Fix it by setting the task state before dropping resource_lock, as
prepare_to_wait() does: the releasing side needs resource_lock to unlink
the resource, so it cannot reach the wakeup before the state is published.
Link: https://lore.kernel.org/20260821-b4-resource-muxed-lost-wakeup-v1-1-37eb6473a76c@gmail.com
Fixes: 8b6d043b7ee2 ("resource: shared I/O region support")
Signed-off-by: DAI RENJIE <drj19981414013@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Mark Brown <broonie@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/resource.c b/kernel/resource.c
index fe1327753a135..139fb5e19cbe0 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1300,8 +1300,8 @@ static int __request_region_locked(struct resource *res, struct resource *parent
}
if (conflict->flags & flags & IORESOURCE_MUXED) {
add_wait_queue(&muxed_resource_wait, &wait);
- write_unlock(&resource_lock);
set_current_state(TASK_UNINTERRUPTIBLE);
+ write_unlock(&resource_lock);
schedule();
remove_wait_queue(&muxed_resource_wait, &wait);
write_lock(&resource_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 387/869] fat: fix fat_ent_write() for reverting the value
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 386/869] resource: fix lost wakeup when waiting for a muxed region Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 388/869] fault-inject: fix dentry leak Greg Kroah-Hartman
` (489 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, OGAWA Hirofumi, Andrew Morton,
syzbot+e64c6472a3d96a75172a, syzbot+26461e903494e689c24f, Yemu Lu,
Ren Wei, Yuan Tan, Yifan Wu, Juefei Pu, Xin Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[ Upstream commit 63c4b67ee163b2a67a7561314bf2106d6c79c53c ]
commit 64d9183203ee ("fat: restore original value when fat_ent_write
failed") try to revert the fatent value to old value when got the error on
mirror FAT.
However it didn't work if the error is when writing the fatent bh. In
that case, the bh is cleared the uptodate flag, so reuse bh is invalid.
Fix this by reverting the fatent only if got the error on mirror FAT.
Link: https://lore.kernel.org/87ik4yz9fv.fsf_-_@mail.parknet.co.jp
Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed")
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e64c6472a3d96a75172a
Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
Cc: Yemu Lu <prcups@krgm.moe>
Cc: Ren Wei <n05ec@lzu.edu.cn>
Cc: Yuan Tan <yuantan098@gmail.com>
Cc: Yifan Wu <yifanwucs@gmail.com>
Cc: Juefei Pu <tomapufckgml@gmail.com>
Cc: Xin Liu <bird@lzu.edu.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fat/fat.h | 2 +-
fs/fat/fatent.c | 21 ++++++++++++++++++---
fs/fat/file.c | 3 ++-
fs/fat/misc.c | 6 ++----
4 files changed, 23 insertions(+), 9 deletions(-)
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index d3e426de5f016..6748dea6cd216 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -389,7 +389,7 @@ extern void fat_ent_access_init(struct super_block *sb);
extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
int entry);
extern int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
- int new, int wait);
+ int new, int old, int wait);
extern int fat_alloc_clusters(struct inode *inode, int *cluster,
int nr_cluster);
extern int fat_free_clusters(struct inode *inode, int cluster);
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index a7061c2ad8e4d..515bc0cfc64f1 100644
--- a/fs/fat/fatent.c
+++ b/fs/fat/fatent.c
@@ -408,7 +408,7 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
}
int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
- int new, int wait)
+ int new, int old, int wait)
{
struct super_block *sb = inode->i_sb;
const struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops;
@@ -417,10 +417,25 @@ int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
ops->ent_put(fatent, new);
if (wait) {
err = fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
- if (err)
+ if (err) {
+ /*
+ * bhs are not uptodate after I/O error. So we
+ * can't simply re-dirty to revert. And it
+ * would not have value to write again on I/O
+ * error.
+ */
return err;
+ }
}
- return fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+
+ err = fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+ if (err) {
+ /* Try to revert if got the error on mirror FAT */
+ ops->ent_put(fatent, old);
+ if (wait)
+ fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
+ }
+ return err;
}
static inline int fat_ent_next(struct msdos_sb_info *sbi,
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 4fc49a614fb8f..ca2f9db34da5c 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -360,7 +360,8 @@ static int fat_free(struct inode *inode, int skip)
__func__, MSDOS_I(inode)->i_pos);
ret = -EIO;
} else if (ret > 0) {
- err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait);
+ err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, ret,
+ wait);
if (err)
ret = err;
}
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index 5c45603bf77ea..c0bc4356eded3 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -133,11 +133,9 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster)
ret = fat_ent_read(inode, &fatent, last);
if (ret >= 0) {
int wait = inode_needs_sync(inode);
- int old = ret;
- ret = fat_ent_write(inode, &fatent, new_dclus, wait);
- if (ret < 0)
- fat_ent_write(inode, &fatent, old, wait);
+ ret = fat_ent_write(inode, &fatent, new_dclus, ret,
+ wait);
fatent_brelse(&fatent);
}
if (ret < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 388/869] fault-inject: fix dentry leak
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 387/869] fat: fix fat_ent_write() for reverting the value Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 389/869] USB: gadgetfs: do not WARN about excessively large memory allocations Greg Kroah-Hartman
` (488 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Liang, Andrew Morton,
Akinbou Mita, Dennis Dalessandro, Jason Gunthorpe,
Leon Romanovsky, Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Liang <mliang@purestorage.com>
[ Upstream commit ceb43516a9aae0d969a4ec5ab40d45bd09e64229 ]
fault_create_debugfs_attr() has always taken an extra dentry reference on
the created directory (attr->dname = dget(dir)) so that fail_dump() could
print the name via %pd from any context. Nothing anywhere in the tree
ever calls dput() on attr->dname.
For callers with a matching teardown, that unmatched reference causes one
dentry plus its attached inode to leak per fault_create_debugfs_attr /
debugfs_remove_recursive cycle. simple_recursive_removal() drops
debugfs's own +1 ref on the child dentry, but the dget()'d ref keeps its
refcount at 1: the dentry ends up unhashed but pinned, and its inode is
never freed.
Boot-once callers (mm/failslab, block/blk-core, etc.) leak exactly once at
init and never destroy the tree, so the impact there is bounded. But
per-lifecycle callers (drivers/nvme, drivers/infiniband/hw/hfi1,
drivers/mmc, drivers/iommu/iommufd, drivers/media, drivers/misc,
drivers/gpu/drm/msm, drivers/crypto, net/sunrpc) leak on every
create/destroy cycle.
We observed this in production: an NVMe/RDMA host repeatedly reconnecting
to a target that rejected the CRTO Property Get went through ~50 nvme
controller create/destroy cycles per second, and dentry and inode_cache
grew by ~13k pinned objects per 240 s -- unrecoverable through
drop_caches. Byte math matched a per-cycle 1-dentry / 1-inode leak from
the "fault_inject" directory dentry.
Fix this by not holding any external reference in fault_attr. Embed the
directory name as a fixed-size char array (FAULT_ATTR_DNAME_LEN, 64 bytes)
inside struct fault_attr, copied by strscpy() at
fault_create_debugfs_attr() time. fail_dump() prints it via %s.
Advantages of an embedded array over kstrdup() + kfree() paired with a new
destroy API:
- Zero API footprint. No new export and no caller changes required:
callers already own their fault_attr's memory and free it when
they are done, and now that suffices.
- No allocation on the create path.
- fault_create_debugfs_attr() cannot fail from the name-copy step.
- No lifetime coupling between attr->dname and debugfs; the string
is valid for exactly as long as the containing struct.
The 64-byte length accommodates every in-tree caller with generous
headroom (the longest current name is "fail_dma_array_full", 19 chars).
The user-visible fail_dump() format changes from "name %pd" to "name %s",
but the printed content is identical -- %pd on the created directory
renders the same string that was passed in as @name.
drivers/infiniband/hw/hfi1/fault.c drops a now-invalid "attr.dname = NULL"
statement; the surrounding kzalloc() already zero-initialises the array.
Link: https://lore.kernel.org/20260821181527.3271414-1-mliang@purestorage.com
Fixes: 6adc4a22f20b ("fault-inject: add ratelimit option")
Signed-off-by: Michael Liang <mliang@purestorage.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Akinbou Mita <akinobu.mita@gmail.com>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/fault.c | 1 -
include/linux/fault-inject.h | 10 ++++++++--
lib/fault-inject.c | 7 +++++--
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index a45cbffd52c71..b6acc0edb116e 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -216,7 +216,6 @@ int hfi1_fault_init_debugfs(struct hfi1_ibdev *ibd)
ibd->fault->attr.interval = 1;
ibd->fault->attr.require_end = ULONG_MAX;
ibd->fault->attr.stacktrace_depth = 32;
- ibd->fault->attr.dname = NULL;
ibd->fault->attr.verbose = 0;
ibd->fault->enable = false;
ibd->fault->opcode = false;
diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h
index 8c829d28dcf35..f55b51f333467 100644
--- a/include/linux/fault-inject.h
+++ b/include/linux/fault-inject.h
@@ -14,6 +14,13 @@ struct kmem_cache;
#include <linux/configfs.h>
#include <linux/ratelimit.h>
+/*
+ * Length of the debugfs directory name embedded in struct fault_attr.
+ * Chosen to accommodate every in-tree caller of fault_create_debugfs_attr()
+ * (the longest is "fail_dma_array_full", 19 chars) with generous headroom.
+ */
+#define FAULT_ATTR_DNAME_LEN 64
+
/*
* For explanation of the elements of this struct, see
* Documentation/fault-injection/fault-injection.rst
@@ -33,7 +40,7 @@ struct fault_attr {
unsigned long count;
struct ratelimit_state ratelimit_state;
- struct dentry *dname;
+ char dname[FAULT_ATTR_DNAME_LEN];
};
enum fault_flags {
@@ -47,7 +54,6 @@ enum fault_flags {
.stacktrace_depth = 32, \
.ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \
.verbose = 2, \
- .dname = NULL, \
}
#define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index 999053fa133e3..02916ef2761c6 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -5,6 +5,7 @@
#include <linux/debugfs.h>
#include <linux/sched.h>
#include <linux/stat.h>
+#include <linux/string.h>
#include <linux/types.h>
#include <linux/fs.h>
#include <linux/export.h>
@@ -64,7 +65,7 @@ static void fail_dump(struct fault_attr *attr)
{
if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) {
printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
- "name %pd, interval %lu, probability %lu, "
+ "name %s, interval %lu, probability %lu, "
"space %d, times %d\n", attr->dname,
attr->interval, attr->probability,
atomic_read(&attr->space),
@@ -261,7 +262,9 @@ struct dentry *fault_create_debugfs_attr(const char *name,
debugfs_create_xul("reject-end", mode, dir, &attr->reject_end);
#endif /* CONFIG_FAULT_INJECTION_STACKTRACE_FILTER */
- attr->dname = dget(dir);
+ if (strscpy(attr->dname, name, sizeof(attr->dname)) == -E2BIG)
+ pr_warn("FAULT_INJECTION: name '%s' truncated to '%s'\n",
+ name, attr->dname);
return dir;
}
EXPORT_SYMBOL_GPL(fault_create_debugfs_attr);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 389/869] USB: gadgetfs: do not WARN about excessively large memory allocations
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 388/869] fault-inject: fix dentry leak Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 390/869] init: fix early boot crash with bare hostname parameter Greg Kroah-Hartman
` (487 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zi Yan, Andrew Morton,
syzbot+805630f1453e490427fa, Alan Stern, Vlastimil Babka (SUSE),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <ziy@nvidia.com>
[ Upstream commit a156148976eac47bee7210097afbb609cafe88b6 ]
GadgetFS passes an excessively large user input len to kmalloc and kmalloc
gives a WARN (see below for details). Suppress it by passing __GFP_NOWARN
to kmalloc used by both ep_write_iter() and ep_read_iter(). Follow the
same method as commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about
excessively large memory allocations").
kmalloc is used to allocate physically contiguous memory for kernel
allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc
uses the page allocator and can only support up to KMALLOC_MAX_SIZE. For
request sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a
WARN because kmalloc allocates an order greater than MAX_PAGE_ORDER.
Link: https://lore.kernel.org/DKTTMAS94IMH.2C6ERY0ZIVWVZ@nvidia.com
Fixes: b3c466ce5129 ("page allocator: do not sanity check order in the fast path")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/legacy/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 677cd236f079c..c14e8e250037d 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -615,7 +615,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
return -EBADMSG;
}
- buf = kmalloc(len, GFP_KERNEL);
+ buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
if (unlikely(!buf)) {
mutex_unlock(&epdata->lock);
return -ENOMEM;
@@ -677,7 +677,7 @@ ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
return -EBADMSG;
}
- buf = kmalloc(len, GFP_KERNEL);
+ buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
if (unlikely(!buf)) {
mutex_unlock(&epdata->lock);
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 390/869] init: fix early boot crash with bare hostname parameter
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 389/869] USB: gadgetfs: do not WARN about excessively large memory allocations Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 391/869] ocfs2: exit recovery thread on mount error path Greg Kroah-Hartman
` (486 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Andrew Morton,
Dan Moulding, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit b6bec5b63a5b812145e53aaad1e63661c7214f93 ]
When a bare hostname parameter is specified on the kernel command line
without the '=' separator, early parameter parsing passes NULL to
early_hostname(), which dereferences it in strscpy() and can crash the
system during early boot.
Reject NULL values in early_hostname() and return -EINVAL instead.
Link: https://lore.kernel.org/20260826100904.296151-2-blum@kernel.org
Fixes: 5a704629f2c1 ("init: add "hostname" kernel parameter")
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Moulding <dmoulding@me.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
init/version.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/init/version.c b/init/version.c
index 94c96f6fbfe6a..0bd5c45aabc46 100644
--- a/init/version.c
+++ b/init/version.c
@@ -23,6 +23,9 @@ static int __init early_hostname(char *arg)
size_t maxlen = bufsize - 1;
ssize_t arglen;
+ if (!arg)
+ return -EINVAL;
+
arglen = strscpy(init_uts_ns.name.nodename, arg, bufsize);
if (arglen < 0) {
pr_warn("hostname parameter exceeds %zd characters and will be truncated",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 391/869] ocfs2: exit recovery thread on mount error path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 390/869] init: fix early boot crash with bare hostname parameter Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 392/869] ocfs2: free replay slots in ocfs2_recovery_exit() Greg Kroah-Hartman
` (485 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Changwei Ge, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 6163a859649e9432e9c79c541f36dbf3bba9172f ]
When a mount fails after the cluster connection has been established, e.g.
in ocfs2_mount_volume(), ocfs2_fill_super() unwinds via
out_debugfs/out_super and frees the osb without disabling recovery.
A node failure event can concurrently launch the recovery thread, which
blocks in __ocfs2_wait_on_mount() waiting for the volume state to become
VOLUME_MOUNTED or VOLUME_DISABLED. As the mount error path neither sets
VOLUME_DISABLED nor wakes osb_mount_event, the thread can never make
progress: the kthread leaks and stays blocked on the wait queue embedded
in the freed osb, which may then be accessed as freed memory.
Fix it by setting VOLUME_DISABLED and waking osb_mount_event on this path
so the thread bails out, and replace the plain kfree(osb->recovery_map)
with ocfs2_recovery_exit(), which waits for a running recovery thread to
exit before the recovery map is freed.
Link: https://lore.kernel.org/20260828112825.666097-1-joseph.qi@linux.alibaba.com
Fixes: f1e75d128b46 ("ocfs2: rewrite error handling of ocfs2_fill_super")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/super.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index dc252b53c7dcf..433b673ae5158 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1170,8 +1170,17 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
out_debugfs:
debugfs_remove_recursive(osb->osb_debug_root);
out_super:
+ /*
+ * A recovery thread launched by a node failure event may still be
+ * waiting for the volume to be mounted. Set VOLUME_DISABLED and
+ * wake it up, then wait for it to exit before osb is freed,
+ * otherwise the kthread would leak and stay blocked on the wait
+ * queue embedded in the freed osb.
+ */
+ atomic_set(&osb->vol_state, VOLUME_DISABLED);
+ wake_up(&osb->osb_mount_event);
ocfs2_release_system_inodes(osb);
- kfree(osb->recovery_map);
+ ocfs2_recovery_exit(osb);
ocfs2_delete_osb(osb);
kfree(osb);
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 392/869] ocfs2: free replay slots in ocfs2_recovery_exit()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 391/869] ocfs2: exit recovery thread on mount error path Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 393/869] selftests/core: fix unshare_test with large fs.nr_open Greg Kroah-Hartman
` (484 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Changwei Ge, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 1ddadc6d41c1a29fd8fad1891bdcd2956e08b7f0 ]
Commit ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
added ocfs2_free_replay_slots() calls to the mount error paths
out_dismount and out_check_volume to fix a leak of osb->replay_map.
However these calls are unlocked while the bail path of the recovery
thread, which is woken up by out_dismount right before the call, also
frees the replay slots under osb->recovery_lock. Both sides can thus
observe a non-NULL osb->replay_map and trigger a double free.
Fix this by moving ocfs2_free_replay_slots() into ocfs2_recovery_exit()
after ocfs2_recovery_disable(), which waits for a running recovery thread
to exit under osb->recovery_lock, and drop the unlocked call sites. Both
ocfs2_dismount_volume() and the out_super path of ocfs2_fill_super() call
ocfs2_recovery_exit(), so the replay slots are freed on every path. Since
super.c no longer references it, make ocfs2_free_replay_slots() static
again.
Link: https://lore.kernel.org/20260828112825.666097-2-joseph.qi@linux.alibaba.com
Fixes: ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/journal.c | 3 ++-
fs/ocfs2/journal.h | 1 -
fs/ocfs2/super.c | 5 +----
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 8c07610692d06..2b8b57e914f08 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -158,7 +158,7 @@ static void ocfs2_queue_replay_slots(struct ocfs2_super *osb,
replay_map->rm_state = REPLAY_DONE;
}
-void ocfs2_free_replay_slots(struct ocfs2_super *osb)
+static void ocfs2_free_replay_slots(struct ocfs2_super *osb)
{
struct ocfs2_replay_map *replay_map = osb->replay_map;
@@ -246,6 +246,7 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
/* XXX: Should we bug if there are dirty entries? */
kfree(rm);
+ ocfs2_free_replay_slots(osb);
}
static int __ocfs2_recovery_map_test(struct ocfs2_super *osb,
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index f8b3b2a3d6309..19fc920d26b1c 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -151,7 +151,6 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb);
void ocfs2_recovery_disable_quota(struct ocfs2_super *osb);
int ocfs2_compute_replay_slots(struct ocfs2_super *osb);
-void ocfs2_free_replay_slots(struct ocfs2_super *osb);
/*
* Journal Control:
* Initialize, Load, Shutdown, Wipe a journal.
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 433b673ae5158..fe4ab1659e0d9 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1163,7 +1163,6 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
out_dismount:
atomic_set(&osb->vol_state, VOLUME_DISABLED);
wake_up(&osb->osb_mount_event);
- ocfs2_free_replay_slots(osb);
ocfs2_dismount_volume(sb, 1);
goto out;
@@ -1778,14 +1777,12 @@ static int ocfs2_mount_volume(struct super_block *sb)
status = ocfs2_truncate_log_init(osb);
if (status < 0) {
mlog_errno(status);
- goto out_check_volume;
+ goto out_system_inodes;
}
ocfs2_super_unlock(osb, 1);
return 0;
-out_check_volume:
- ocfs2_free_replay_slots(osb);
out_system_inodes:
if (osb->local_alloc_state == OCFS2_LA_ENABLED)
ocfs2_shutdown_local_alloc(osb);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 393/869] selftests/core: fix unshare_test with large fs.nr_open
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 392/869] ocfs2: free replay slots in ocfs2_recovery_exit() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 394/869] fork: honor task_structs declared alignment Greg Kroah-Hartman
` (483 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Khorenko, Eva Kurchatova,
Andrew Morton, Shuah Khan, Wei Yang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khorenko <khorenko@virtuozzo.com>
[ Upstream commit df0b7e0ea59c43708cff8c7e34da5e2f8d430e5e ]
The test assumes fs.nr_open is close to the default 1048576, but some
systems set it much higher (e.g. 1073741816). This is systemd's doing:
since systemd v240 (2018), PID 1 bumps fs.nr_open and fs.file-max to their
largest possible values on boot, as file descriptors are already accounted
for by memcg [1].
In that case, dup2() to nr_open + 64 requires the kernel to allocate a
file descriptor table with ~1 billion entries, which fails with ENOMEM.
On a kernel that already carries 04a2c4b4511d1, dup2() no longer fails
with ENOMEM. The allocation is now rejected up front and the caller
gets EMFILE instead, without the WARNING, but the test still fails.
Cap the nr_open value used for the test's own arithmetic to a known
reasonable base value (1048576) and restore the true original value once
the test has completed.
Link: https://lore.kernel.org/20260814165709.513263-1-khorenko@virtuozzo.com
Link: https://github.com/systemd/systemd/commit/a8b627aaed409a15260c25988970c795bf963812 [1]
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/core/unshare_test.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/core/unshare_test.c b/tools/testing/selftests/core/unshare_test.c
index 7fec9dfb1b0e3..6716e0f74d7da 100644
--- a/tools/testing/selftests/core/unshare_test.c
+++ b/tools/testing/selftests/core/unshare_test.c
@@ -40,6 +40,14 @@ TEST(unshare_EMFILE)
ASSERT_EQ(sscanf(buf, "%d", &nr_open), 1);
+ /*
+ * Cap nr_open for the duration of the test to avoid ENOMEM from a
+ * huge fd table allocation; buf/n keep the real original value so
+ * fs.nr_open can be restored to it once the test is done.
+ */
+ if (nr_open > 1024 * 1024)
+ nr_open = 1024 * 1024;
+
ASSERT_EQ(0, getrlimit(RLIMIT_NOFILE, &rlimit));
/* bump fs.nr_open */
@@ -73,10 +81,13 @@ TEST(unshare_EMFILE)
if (pid == 0) {
int err;
+ char buf3[32];
+ ssize_t n3;
- /* restore fs.nr_open */
+ /* restore fs.nr_open to the (possibly capped) test baseline */
+ n3 = sprintf(buf3, "%d\n", nr_open);
lseek(fd, 0, SEEK_SET);
- write(fd, buf, n);
+ write(fd, buf3, n3);
/* ... and now unshare(CLONE_FILES) must fail with EMFILE */
err = unshare(CLONE_FILES);
EXPECT_EQ(err, -1)
@@ -89,6 +100,10 @@ TEST(unshare_EMFILE)
EXPECT_EQ(waitpid(pid, &status, 0), pid);
EXPECT_EQ(true, WIFEXITED(status));
EXPECT_EQ(0, WEXITSTATUS(status));
+
+ /* restore the real fs.nr_open value */
+ lseek(fd, 0, SEEK_SET);
+ write(fd, buf, n);
}
TEST_HARNESS_MAIN
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 394/869] fork: honor task_structs declared alignment
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 393/869] selftests/core: fix unshare_test with large fs.nr_open Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 395/869] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes Greg Kroah-Hartman
` (482 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Andrew Morton,
Bradley Morgan, Ingo Molnar, Kees Cook, Peter Zijlstra,
Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 9decb604dc064099a6249150f0c4909525ed657c ]
Since commit cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant
size"), struct task_struct is declared __attribute__((aligned(64))) on all
architectures.
But fork_init() still sets the task_struct slab cache's alignment to
align = max(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN)
which is smaller than 64 on architectures whose cache lines are below 64
bytes: e.g. 32 on ARMv5.
In practice plain SLUB happens to hand out 64-byte-aligned objects anyway.
With CONFIG_SLUB_DEBUG_ON the red-zone padding shifts objects to the
requested alignment.
With CONFIG_UBSAN_ALIGNMENT=y a boot on QEMU versatilepb (ARM926EJ-S,
v7.2-rc2, gcc 13.3) floods the console with reports like:
UBSAN: misaligned-access in include/linux/sched.h:2087:9
member access within misaligned address c295d7e0 for type 'struct task_struct'
which requires 64 byte alignment
CPU: 0 UID: 0 PID: 15 Comm: pr/ttyAMA-1 Not tainted 7.2.0-rc2 #1 VOLUNTARY
Set the slab alignment to at least the type's declared alignment.
Link: https://lore.kernel.org/20260710123957.31774-1-kmehltretter@gmail.com
Fixes: cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant size")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Assisted-by: Claude:claude-fable-5
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/fork.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index b7543a93f269a..bc6078b910a6a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -810,7 +810,8 @@ void __init fork_init(void)
#ifndef ARCH_MIN_TASKALIGN
#define ARCH_MIN_TASKALIGN 0
#endif
- int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
+ int align = max3(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN,
+ __alignof__(struct task_struct));
unsigned long useroffset, usersize;
/* create a slab on which task_structs can be allocated */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 395/869] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 394/869] fork: honor task_structs declared alignment Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 396/869] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing() Greg Kroah-Hartman
` (481 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Changwei Ge, Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 25bf9e549360b656a6763232e0e9e58a00c3aff7 ]
Patch series "ocfs2: validate suballoc slot and bit of metadata blocks", v3.
The ocfs2 metadata validators trust the on-disk suballoc slot and bit
without checking them against the slot range of the mounted filesystem and
the capacity of the block group bitmap. A corrupted image can carry
OCFS2_INVALID_SLOT or another out-of-range slot, or a suballoc bit beyond
the bitmap, and once the corresponding inode, extent block, xattr block,
dir index root or refcount block gets freed, the bad value goes straight
into ocfs2_get_system_file_inode() or _ocfs2_free_suballoc_bits() and hits
a BUG_ON() or runs off the end of local_system_inodes[].
This series rejects such values at read time, in the existing validators,
so corrupted objects fail with -EROFS (and a read-only remount) instead of
crashing:
patch 1 restricts OCFS2_INVALID_SLOT dinodes to system inodes,
completing fe7a283b3916 ("ocfs2: add suballoc slot check in
ocfs2_validate_inode_block()"), and turns the "system file
state is ambiguous" BUG_ON() in ocfs2_read_locked_inode() into
an ocfs2_error();
patch 2 rejects oversized dinode suballoc bits;
patch 3 validates the suballoc slot and bit of xattr and dir index
blocks;
patch 4 validates the suballoc slot and bit of extent and refcount
blocks.
The checks only enforce what the kernel and mkfs.ocfs2 already write: a
valid slot from meta_ac->ac_alloc_slot and a bit within the block group
bitmap, with system inodes carrying OCFS2_INVALID_SLOT plus
OCFS2_SYSTEM_FL and extent blocks using slot 0. Nothing changes for
healthy filesystems.
Each new check was exercised under QEMU by corrupting the field in
question with an out-of-range value; with the series applied the access
fails with -EROFS and the filesystem remounts read-only instead of hitting
the BUG_ON().
This patch (of 4):
ocfs2_validate_inode_block() currently permits i_suballoc_slot to be
OCFS2_INVALID_SLOT for any dinode. Only system inodes created by
mkfs.ocfs2 are allocated from the global allocator and thus legitimately
carry this value; regular inodes are always allocated from a per-slot
suballocator and hence must have a valid slot.
If a corrupted regular inode with OCFS2_INVALID_SLOT is accepted,
ocfs2_remove_inode() will pass the slot to ocfs2_get_system_file_inode()
and get_local_system_inode() will hit BUG_ON(slot == OCFS2_INVALID_SLOT)
when the inode is deleted. This can be triggered by an unprivileged user
unlinking such a corrupted file.
Reject OCFS2_INVALID_SLOT for non-system dinodes during validation, while
still accepting it for system inodes. Note that a crafted dinode carrying
OCFS2_SYSTEM_FL passes the check above, yet a plain lookup of it still
used to BUG() in ocfs2_read_locked_inode() ("system file state is
ambiguous"). Since i_flags comes from disk, handle that mismatch with
ocfs2_error() instead of BUG_ON() as well.
Link: https://lore.kernel.org/20260901125221.1634686-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20260901125221.1634686-2-joseph.qi@linux.alibaba.com
Fixes: fe7a283b3916 ("ocfs2: add suballoc slot check in ocfs2_validate_inode_block()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/inode.c | 37 ++++++++++++++++++++++++++++---------
1 file changed, 28 insertions(+), 9 deletions(-)
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 835c00b90b7c8..c1ac673ca456d 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -637,14 +637,18 @@ static int ocfs2_read_locked_inode(struct inode *inode,
fe = (struct ocfs2_dinode *) bh->b_data;
/*
- * This is a code bug. Right now the caller needs to
- * understand whether it is asking for a system file inode or
- * not so the proper lock names can be built.
+ * The caller must know whether it is asking for a system file inode
+ * or not so the proper lock names can be built. Since i_flags comes
+ * from disk, a mismatch is filesystem corruption instead of a code
+ * bug, so handle it with ocfs2_error() rather than BUG_ON().
*/
- mlog_bug_on_msg(!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
- !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE),
- "Inode %llu: system file state is ambiguous\n",
- (unsigned long long)args->fi_blkno);
+ if (!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
+ !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE)) {
+ status = ocfs2_error(osb->sb,
+ "Inode %llu: system file state is ambiguous\n",
+ (unsigned long long)args->fi_blkno);
+ goto bail;
+ }
if (S_ISCHR(le16_to_cpu(fe->i_mode)) ||
S_ISBLK(le16_to_cpu(fe->i_mode)))
@@ -1530,8 +1534,23 @@ int ocfs2_validate_inode_block(struct super_block *sb,
goto bail;
}
- if (le16_to_cpu(di->i_suballoc_slot) != (u16)OCFS2_INVALID_SLOT &&
- (u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
+ /*
+ * Only system inodes created by mkfs.ocfs2 are allocated from the
+ * global allocator and thus legitimately carry OCFS2_INVALID_SLOT.
+ * Regular inodes are always allocated from a per-slot suballocator.
+ * If a regular inode with OCFS2_INVALID_SLOT was accepted here,
+ * deleting it would pass the slot to get_local_system_inode() via
+ * ocfs2_remove_inode() and trigger BUG_ON(slot == OCFS2_INVALID_SLOT).
+ */
+ if (le16_to_cpu(di->i_suballoc_slot) == (u16)OCFS2_INVALID_SLOT) {
+ if (!(le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL)) {
+ rc = ocfs2_error(sb,
+ "Invalid dinode %llu: suballoc slot %u for non-system inode\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_suballoc_slot));
+ goto bail;
+ }
+ } else if ((u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
rc = ocfs2_error(sb, "Invalid dinode %llu: suballoc slot %u\n",
(unsigned long long)bh->b_blocknr,
le16_to_cpu(di->i_suballoc_slot));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 396/869] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 395/869] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 397/869] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff Greg Kroah-Hartman
` (480 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton, ZW Tang,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 6a3ed6b290513859bd27d9fcb67739347d6315fa ]
A hard readonly mount skips ocfs2_dlm_init(), so the per-osb lock
resources are never initialized and osb->cconn stays NULL. Before commit
550842cc60987 ("ocfs2: fix freeing uninitialized resource on
ocfs2_dlm_shutdown") ocfs2_dismount_volume() only called
ocfs2_dlm_shutdown() when osb->cconn was set. It now calls it
unconditionally, so unmounting a hard readonly mount drops the osb locks
and takes the never initialized l_lock in ocfs2_mark_lockres_freeing().
With lockdep enabled this triggers:
INFO: trying to register non-static key. The code is fine but needs
lockdep annotation, or maybe you didn't initialize this object before use?
turning off the locking correctness validator.
ocfs2_drop_lock() and ocfs2_lock_res_free() already skip lock resources
without OCFS2_LOCK_INITIALIZED. Add the same check to
ocfs2_mark_lockres_freeing(), which is reachable before them through
ocfs2_simple_drop_lockres(), so an uninitialized lockres is never touched.
Link: https://lore.kernel.org/20260903104744.2164235-1-joseph.qi@linux.alibaba.com
Fixes: 550842cc6098 ("ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: ZW Tang <tangzw515@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlmglue.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index b4055ced93d96..90d23dd7d4c8f 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3527,6 +3527,10 @@ void ocfs2_mark_lockres_freeing(struct ocfs2_super *osb,
struct ocfs2_mask_waiter mw;
unsigned long flags, flags2;
+ /* We didn't get anywhere near actually using this lockres. */
+ if (!(lockres->l_flags & OCFS2_LOCK_INITIALIZED))
+ return;
+
ocfs2_init_mask_waiter(&mw);
spin_lock_irqsave(&lockres->l_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 397/869] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 396/869] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 398/869] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Greg Kroah-Hartman
` (479 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Mark Anthony Agarro,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
[ Upstream commit fbd12e8dabc8a9d2e81f427906749b4cff85d641 ]
mt76x02_mac_process_tx_rate() extracts the rate index straight from
the hardware's raw TX-status word with no bounds check for the
HT/HT_GF/VHT cases, and mt76x02_mac_fill_tx_status() ignores its
return value. A stale or corrupt hardware index reaches mac80211's
minstrel_ht rate control, whose per-group rate array is a fixed 10
entries (MCS_GROUP_RATES), causing an out-of-bounds write.
Validate the index in mt76x02_mac_process_tx_rate() (HT: 0-31,
VHT: MCS nibble 0-9) and have mt76x02_mac_fill_tx_status() bail out
cleanly on failure instead of passing an invalid index through.
Fixes: 7c1f88812690 ("mt76: unify send_tx_status and related helpers")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Link: https://patch.msgid.link/20260826092755.480190-1-markanthonyagarro@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt76x02_mac.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 17c9782915315..eef131c05f763 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -302,10 +302,14 @@ mt76x02_mac_process_tx_rate(struct ieee80211_tx_rate *txrate, u16 rate,
txrate->flags |= IEEE80211_TX_RC_GREEN_FIELD;
fallthrough;
case MT_PHY_TYPE_HT:
+ if (idx > 31)
+ return -EINVAL;
txrate->flags |= IEEE80211_TX_RC_MCS;
txrate->idx = idx;
break;
case MT_PHY_TYPE_VHT:
+ if ((idx & 0xf) > 9)
+ return -EINVAL;
txrate->flags |= IEEE80211_TX_RC_VHT_MCS;
txrate->idx = idx;
break;
@@ -493,18 +497,21 @@ mt76x02_mac_fill_tx_status(struct mt76x02_dev *dev, struct mt76x02_sta *msta,
first_rate = st->rate & ~MT_PKTID_RATE;
first_rate |= st->pktid & MT_PKTID_RATE;
- mt76x02_mac_process_tx_rate(&rate[0], first_rate,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&rate[0], first_rate,
+ dev->mphy.chandef.chan->band))
+ return;
} else if (rate[0].idx < 0) {
if (!msta)
return;
- mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
+ dev->mphy.chandef.chan->band))
+ return;
}
- mt76x02_mac_process_tx_rate(&last_rate, st->rate,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&last_rate, st->rate,
+ dev->mphy.chandef.chan->band))
+ return;
for (i = 0; i < ARRAY_SIZE(info->status.rates); i++) {
retry--;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 398/869] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 397/869] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 399/869] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory Greg Kroah-Hartman
` (478 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orly Orge, Inanix,
Mark Anthony Agarro, Devin Wittmayer, Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
[ Upstream commit f7517b3d8b7f1008e07edcb8bb692c6ca53ef23b ]
Tearing down a monitor interface oopses:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:mt76_connac_mcu_uni_add_bss+0x144/0x370 [mt76_connac_lib]
Call Trace:
mt7615_remove_interface+0x6a/0x200 [mt7615_common]
drv_remove_interface+0x60/0x140 [mac80211]
ieee80211_del_virtual_monitor+0x8f/0xc0 [mac80211]
ieee80211_do_open+0x550/0x7d0 [mac80211]
ieee80211_open+0xaa/0xb0 [mac80211]
__dev_open+0x11b/0x280
mt7615_remove_interface() tears down BSS and STA state for every vif type.
On MT7663 with offload firmware that reaches mt76_connac_mcu_uni_add_bss(),
which has no monitor case in its iftype switch. It takes WARN_ON(1), then
copies ETH_ALEN from vif->bss_conf.bssid, which is NULL for a monitor vif.
mt76_connac_mcu_bss_basic_tlv() in the same file handles this. It has an
NL80211_IFTYPE_MONITOR case and it copies phy->macaddr in place of the
bssid. The uni variant has neither.
There is nothing to tear down. mt7615_add_interface() only calls
mt7615_mcu_add_dev_info(). The BSS and STA state comes from beacon enable
in mt7615_bss_info_changed(), from mt7615_set_key() and from
mt7615_mac_sta_add(), so a monitor vif never has any.
Reported on mt7615e going from monitor back to managed, and on mt7663u on
an "ip link set down", both through ieee80211_del_virtual_monitor().
Fixes: d9852ab2f362 ("mt76: mt7615: keep mcu_add_bss_info enabled till interface removal")
Cc: stable@vger.kernel.org
Reported-by: Orly Orge <orlyorge2004@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CANj5C4mTOHs6riyWee=dFdkE5p=714J8xs-x3hq3ewQ+r6O_Nw@mail.gmail.com/
Reported-by: Inanix <contact@inanix.fr>
Closes: https://github.com/morrownr/mt76/issues/79
Tested-by: Inanix <contact@inanix.fr>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260813152059.15747-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
index 25936fb309fbd..a6667e3a66d0b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -254,8 +254,10 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw,
mt7615_mutex_acquire(dev);
- mt7615_mcu_add_bss_info(phy, vif, NULL, false);
- mt7615_mcu_sta_add(phy, vif, NULL, false);
+ if (vif->type != NL80211_IFTYPE_MONITOR) {
+ mt7615_mcu_add_bss_info(phy, vif, NULL, false);
+ mt7615_mcu_sta_add(phy, vif, NULL, false);
+ }
mt76_testmode_reset(phy->mt76, true);
if (vif == phy->monitor_vif)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 399/869] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 398/869] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 400/869] wifi: mt76: fix memory leak in USB TX path Greg Kroah-Hartman
` (477 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Eason Lai,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <eason.lai@mediatek.com>
[ Upstream commit f5dd4833463ed45794027e33928539b3c532f82d ]
Using __skb_pad() instead of skb_pad() in mt76_skb_adjust_pad()
to prevent double-free, as the caller handles cleanup.
Free the MCU message skb in __mt76x02u_mcu_send_msg() as well, which
relied on skb_pad() to release it.
Fixes: 808f2767d421 ("wifi: mt76: mt792x: Fix memory leak in SDIO TX path")
Cc: stable@vger.kernel.org
Closes: https://github.com/morrownr/mt76/issues/83
Co-developed-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Link: https://patch.msgid.link/20260914021920.32246-2-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/tx.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
index b2cc449142945..d06cc5ee07b2b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
@@ -90,7 +90,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
MT_MCU_MSG_TYPE_CMD;
ret = mt76x02u_skb_dma_info(skb, CPU_TX_PORT, info);
if (ret)
- return ret;
+ goto out;
ret = mt76u_bulk_msg(dev, skb->data, skb->len, NULL, 500,
MT_EP_OUT_INBAND_CMD);
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 93275bb692fa5..3fef2ad45dee4 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -885,7 +885,7 @@ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad)
}
}
- if (skb_pad(last, pad))
+ if (__skb_pad(last, pad, false))
return -ENOMEM;
__skb_put(last, pad);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 400/869] wifi: mt76: fix memory leak in USB TX path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 399/869] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 401/869] wifi: mt76: mt7615: restore DBDC state after ext PHY failure Greg Kroah-Hartman
` (476 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Eason Lai,
Hans Buchheim, Sergei Melnichenko, Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <eason.lai@mediatek.com>
[ Upstream commit 82856da2d3b6a30011f4db6ea5f34c13484e0ef8 ]
When errors occur in mt76u_tx_queue_skb(), the skb is not properly
freed, leading to memory leaks. This happens when:
- The queue is full
- tx_prepare_skb() drops zero-length frames (such as WMM NULL frames)
to prevent hardware TX hangs
- Buffer setup fails
Fix by properly releasing the skb with ieee80211_tx_status_ext() when
the queue is full or tx_prepare_skb() fails, and using
mt76_tx_complete_skb() when mt76u_tx_setup_buffers() fails (since
tx_prepare_skb() has already succeeded and may have allocated resources
that need cleanup)
Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Closes: https://github.com/morrownr/mt76/issues/83
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Tested-by: Hans Buchheim <hbuchheim@gmail.com>
Reported-by: Sergei Melnichenko <sergei.melnichenko@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260914021920.32246-3-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/usb.c | 31 ++++++++++++++++++++----
1 file changed, 26 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index f9e67b8c3b3c8..b39dbf22dfc1d 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -854,6 +854,9 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
enum mt76_txq_id qid, struct sk_buff *skb,
struct mt76_wcid *wcid, struct ieee80211_sta *sta)
{
+ struct ieee80211_tx_status status = {
+ .sta = sta,
+ };
struct mt76_tx_info tx_info = {
.skb = skb,
};
@@ -861,17 +864,27 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
u16 idx = q->head;
int err;
- if (q->queued == q->ndesc)
- return -ENOSPC;
+ if (q->queued == q->ndesc) {
+ err = -ENOSPC;
+ goto err_free_skb;
+ }
skb->prev = skb->next = NULL;
err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info);
if (err < 0)
- return err;
+ goto err_free_skb;
err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb);
- if (err < 0)
- return err;
+ if (err < 0) {
+ /*
+ * mt76_tx_status_skb_get() walks the idr and dereferences
+ * a freed skb. This SKB is not counted in non-AQL counter
+ * due to error return, so using 0xffff as wcid to keep
+ * balanced.
+ */
+ mt76_tx_complete_skb(dev, 0xffff, tx_info.skb);
+ goto err_ret;
+ }
mt76u_fill_bulk_urb(dev, USB_DIR_OUT, q->ep, q->entry[idx].urb,
mt76u_complete_tx, &q->entry[idx]);
@@ -882,6 +895,14 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
q->queued++;
return idx;
+
+err_free_skb:
+ status.skb = tx_info.skb;
+ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(dev->hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
+err_ret:
+ return err;
}
static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 401/869] wifi: mt76: mt7615: restore DBDC state after ext PHY failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 400/869] wifi: mt76: fix memory leak in USB TX path Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 402/869] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path Greg Kroah-Hartman
` (475 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 7907d5270dc5c13b6a95754c08a77d5b06bbc786 ]
mt7615_register_ext_phy() limits the primary PHY to DBDC capabilities
before allocating and registering the secondary PHY. If allocation,
EEPROM override, or PHY registration fails, it returns without restoring
the primary PHY capabilities. The EEPROM override failure also leaks the
newly allocated ieee80211_hw.
Route all failures through common labels that free the secondary hardware
when it was allocated and restore the primary PHY capabilities.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 0f2173f093b3 ("mt76: mt7615: add support for registering a second wiphy via debugfs")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910215441.76683-1-mhun512@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7615/init.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index c4f5f6ee916af..4b41462413bcf 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -541,8 +541,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
mt7615_cap_dbdc_enable(dev);
mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops, MT_BAND1);
- if (!mphy)
- return -ENOMEM;
+ if (!mphy) {
+ ret = -ENOMEM;
+ goto error;
+ }
phy = mphy->priv;
phy->dev = dev;
@@ -572,7 +574,7 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
ret = mt76_eeprom_override(mphy);
if (ret)
- return ret;
+ goto error_free_hw;
/* second phy can only handle 5 GHz */
mphy->cap.has_5ghz = true;
@@ -590,7 +592,14 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
ret = mt76_register_phy(mphy, true, mt76_rates,
ARRAY_SIZE(mt76_rates));
if (ret)
- ieee80211_free_hw(mphy->hw);
+ goto error_free_hw;
+
+ return 0;
+
+error_free_hw:
+ ieee80211_free_hw(mphy->hw);
+error:
+ mt7615_cap_dbdc_disable(dev);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 402/869] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 401/869] wifi: mt76: mt7615: restore DBDC state after ext PHY failure Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 403/869] wifi: mt76: mt7615: cancel reset work during unregister Greg Kroah-Hartman
` (474 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit 9f299215d1d835aeeee8b269dad09e1be06f856e ]
Every other teardown path cancels this work, PCIe unbind included. USB
unbind does not: PCIe has its own unregister hook for it, while USB
shares a generic one and the stop callback that would have covered it is
replaced in probe.
That cancel came in commit 81faf578320d ("wifi: mt76: mt7925: cancel
mlo_pm_work on stop"), whose last line says it covers both buses. That's
mine and it's a boo-boo.
Give the USB path its own stop that cancels the work first.
Two-link MLO on a Netgear A9000, work armed then the interface down:
stock patched
stop ran 3/3 3/3
work still ran 3/3 0/3
Skipping the stop entirely leaves both builds running it, so the zero is
the cancel.
Fixes: 276a56883257 ("wifi: mt76: mt7925: update the power-saving flow")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20261003234944.96066-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index 95047ee48a425..0ad86526dddc8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -132,6 +132,15 @@ static int mt7925u_mac_reset(struct mt792x_dev *dev)
return err;
}
+static void mt7925u_stop(struct ieee80211_hw *hw, bool suspend)
+{
+ struct mt792x_dev *dev = mt792x_hw_dev(hw);
+
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
+
+ mt792xu_stop(hw, suspend);
+}
+
static int mt7925u_probe(struct usb_interface *usb_intf,
const struct usb_device_id *id)
{
@@ -178,7 +187,7 @@ static int mt7925u_probe(struct usb_interface *usb_intf,
if (!ops)
return -ENOMEM;
- ops->stop = mt792xu_stop;
+ ops->stop = mt7925u_stop;
mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
if (!mdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 403/869] wifi: mt76: mt7615: cancel reset work during unregister
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 402/869] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 404/869] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() Greg Kroah-Hartman
` (473 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 5b779c63fb1e20e6729d3241b78be7502759296d ]
The MCU error interrupt handler queues reset_work on the device workqueue.
Device removal can reach mt76_unregister_device() while that work is still
pending, since the workqueue is not destroyed until mt76_free_device().
If reset_work runs in this window, it operates on an unregistered hw and
can requeue mac_work after ieee80211_unregister_hw() has torn the device
down. Cancel it before unregistering the device so it cannot outlive the
registered hw.
Fixes: 61c4fa721968 ("mt76: mt7615: implement hardware reset support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927101041.957362-1-yaojiale02@163.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
index f607eee3fb479..5e09f43926e02 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
@@ -116,6 +116,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev)
mcu_running = mt7615_wait_for_mcu_init(dev);
mt7615_unregister_ext_phy(dev);
+ cancel_work_sync(&dev->reset_work);
mt76_unregister_device(&dev->mt76);
if (mcu_running)
mt7615_mcu_exit(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 404/869] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 403/869] wifi: mt76: mt7615: cancel reset work during unregister Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 405/869] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2() Greg Kroah-Hartman
` (472 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 8d604c899f7bd1a76a2eb21c0b706c02878abd36 ]
mt76_find_power_limits_node() and mt76_find_channel_node() return nodes
with the reference held, but mt76_get_rate_power_limits() overwrites the
"txpower-<band>" node reference and never releases the channel node
reference, leaking both.
Drop the intermediate and the channel node reference on every exit path,
and take a reference on the fallback node returned by
mt76_find_power_limits_node() so the caller's of_node_put() is balanced.
Fixes: 22b980badc0f ("mt76: add functions for parsing rate power limits from DT")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917121944.2150737-1-vulab@iscas.ac.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/eeprom.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
index 6ce8e4af18fe5..281b2c3e9e7cf 100644
--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
@@ -224,12 +224,14 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
struct property *regd = of_find_property(cur, "regdomain", NULL);
if (!country && !regd) {
- fallback = cur;
+ of_node_put(fallback);
+ fallback = of_node_get(cur);
continue;
}
if (mt76_string_prop_find(country, dev->alpha2) ||
mt76_string_prop_find(regd, region_name)) {
+ of_node_put(fallback);
of_node_put(np);
return cur;
}
@@ -356,7 +358,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
s8 target_power)
{
struct mt76_dev *dev = phy->dev;
- struct device_node *np;
+ struct device_node *np, *band_np;
const s8 *val;
char name[16];
u32 mcs_rates = dev->drv->mcs_rates;
@@ -389,15 +391,18 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
band = '6';
break;
default:
+ of_node_put(np);
return target_power;
}
snprintf(name, sizeof(name), "txpower-%cg", band);
- np = of_get_child_by_name(np, name);
- if (!np)
+ band_np = of_get_child_by_name(np, name);
+ of_node_put(np);
+ if (!band_np)
return target_power;
- np = mt76_find_channel_node(np, chan);
+ np = mt76_find_channel_node(band_np, chan);
+ of_node_put(band_np);
if (!np)
return target_power;
@@ -422,6 +427,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
ARRAY_SIZE(dest->ru), val, len,
target_power, txs_delta, &max_power);
+ of_node_put(np);
+
return max_power;
}
EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 405/869] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 404/869] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 406/869] clocksource/drivers/fttmr010: Fix clk reference leak in error paths Greg Kroah-Hartman
` (471 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linlin Yang, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linlin Yang <yanglinlin@kylinos.cn>
[ Upstream commit d92bac6b6af2602516ee82ae112709c71af27cf6 ]
pci_get_device() increments the reference count on the returned
struct pci_dev. In mt7996_pci_init_hif2(), three pci_get_device()
calls are made but their return values are only checked for NULL
and then discarded. pci_dev_put() is never called, causing a PCI
device reference count leak.
Fix this by storing the return value and calling pci_dev_put()
before returning, following the same pattern already used in the
sibling driver mt7915/pci.c.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Linlin Yang <yanglinlin@kylinos.cn>
Link: https://patch.msgid.link/20260824092937.683240-1-yanglinlin@kylinos.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
index 3f49bbbba3b9c..1d9102b5e556a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
@@ -63,12 +63,18 @@ static void mt7996_put_hif2(struct mt7996_hif *hif)
static struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev)
{
+ struct pci_dev *tmp_pdev;
+
hif_idx++;
- if (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL) &&
- !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL) &&
- !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL))
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
return NULL;
+ pci_dev_put(tmp_pdev);
writel(hif_idx | MT_PCIE_RECOG_ID_SEM,
pcim_iomap_table(pdev)[0] + MT_PCIE_RECOG_ID);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 406/869] clocksource/drivers/fttmr010: Fix clk reference leak in error paths
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 405/869] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 407/869] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure Greg Kroah-Hartman
` (470 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Daniel Lezcano,
Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 277e5657237a92e279ee28da2f5c07902cc6aa0b ]
fttmr010_common_init() obtains the PCLK reference with
of_clk_get_by_name() but never calls clk_put(). If clk_prepare_enable()
fails the reference is leaked directly, and every error path that jumps
to out_disable_clock only calls clk_disable_unprepare(), which releases
the prepare/enable state but not the reference obtained from
of_clk_get_by_name().
Add clk_put() to the clk_prepare_enable() failure path and to the
out_disable_clock label so the clock reference is no longer leaked. The
success path keeps PCLK enabled for the lifetime of the timer and is
left untouched.
Fixes: dd98442e17a6 ("clocksource/drivers/fttmr010: Drop Gemini specifics")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260915045426.1726805-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-fttmr010.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
index 126fb1f259b28..0003d49768f62 100644
--- a/drivers/clocksource/timer-fttmr010.c
+++ b/drivers/clocksource/timer-fttmr010.c
@@ -292,6 +292,7 @@ static int __init fttmr010_common_init(struct device_node *np,
ret = clk_prepare_enable(clk);
if (ret) {
pr_err("failed to enable PCLK\n");
+ clk_put(clk);
return ret;
}
@@ -432,6 +433,7 @@ static int __init fttmr010_common_init(struct device_node *np,
kfree(fttmr010);
out_disable_clock:
clk_disable_unprepare(clk);
+ clk_put(clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 407/869] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 406/869] clocksource/drivers/fttmr010: Fix clk reference leak in error paths Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 408/869] spi: stm32: fix double free of SRAM buffer on MDMA fallback Greg Kroah-Hartman
` (469 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Daniel Lezcano,
Baruch Siach, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 9cc2e18b32f12d26ae6729c62a03640423956b17 ]
digicolor_timer_init() obtains the timer clock with of_clk_get() and
enables it, but the request_irq() failure path returns without releasing
the clock reference, leaking both the enable/prepare state and the
reference itself.
Disable and put the clock before returning on the request_irq() failure
path. The success path keeps the clock enabled for the lifetime of the
timer and is left untouched.
Fixes: 9b8bb7736b78 ("clocksource: Driver for Conexant Digicolor SoC timer")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Link: https://patch.msgid.link/20260915045242.1726702-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-digicolor.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clocksource/timer-digicolor.c b/drivers/clocksource/timer-digicolor.c
index 559aa96089c34..46e0c329957a2 100644
--- a/drivers/clocksource/timer-digicolor.c
+++ b/drivers/clocksource/timer-digicolor.c
@@ -190,6 +190,8 @@ static int __init digicolor_timer_init(struct device_node *node)
&dc_timer_dev.ce);
if (ret) {
pr_warn("request of timer irq %d failed (%d)\n", irq, ret);
+ clk_disable_unprepare(clk);
+ clk_put(clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 408/869] spi: stm32: fix double free of SRAM buffer on MDMA fallback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 407/869] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 409/869] aoe: pull in the headers each received packet type reads Greg Kroah-Hartman
` (468 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pin-Hao Chen, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-Hao Chen <billy920225@gmail.com>
[ Upstream commit 0c5b0c3eb1d6daa1117dacd32589196f52109cab ]
When the "rxm2m" MDMA channel cannot be obtained, the driver frees the
SRAM buffer and falls back to DMA-only mode. However, sram_rx_buf is
left pointing to the freed buffer.
As a result, stm32_spi_unprepare_msg() may clear the released SRAM
area, while stm32_spi_remove() or a later probe error path may free the
buffer again, triggering BUG_ON() in gen_pool_free_owner().
The probe error path also checks sram_pool instead of sram_rx_buf. If
the SRAM allocation failed and a later probe step fails,
gen_pool_free() may therefore be called with an unallocated buffer.
Clear sram_rx_buf after freeing it on the MDMA fallback path and use
the buffer pointer to determine whether cleanup is needed.
Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
Cc: stable@vger.kernel.org
Signed-off-by: Pin-Hao Chen <billy920225@gmail.com>
Link: https://patch.msgid.link/20261005220528.7199-1-billy920225@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-stm32.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 7a6ee93be9bd4..e5d483a9d38b1 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -2454,6 +2454,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
gen_pool_free(spi->sram_pool,
(unsigned long)spi->sram_rx_buf,
spi->sram_rx_buf_size);
+ spi->sram_rx_buf = NULL;
dev_warn(&pdev->dev,
"failed to request rx mdma channel, DMA only\n");
}
@@ -2491,7 +2492,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
if (spi->mdma_rx)
dma_release_channel(spi->mdma_rx);
err_pool_free:
- if (spi->sram_pool)
+ if (spi->sram_rx_buf)
gen_pool_free(spi->sram_pool, (unsigned long)spi->sram_rx_buf,
spi->sram_rx_buf_size);
err_dma_release:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 409/869] aoe: pull in the headers each received packet type reads
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 408/869] spi: stm32: fix double free of SRAM buffer on MDMA fallback Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 410/869] PCI/sysfs: Pass the device name length in UTF-16 code units Greg Kroah-Hartman
` (467 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e1274a6bc40a4618f6fbaebbdc51cca865d51bed ]
aoenet_rcv() only pulls the AoE and ATA headers into the skb head when
the packet is long enough to hold both. A shorter packet goes through
unpulled, and aoenet_rcv() reads the AoE header from it anyway. CFG
responses go on to aoecmd_cfg_rsp(), which reads the config header
after it, and ATA responses get queued for ktiocomplete(), which
skb_pull()s both headers. Ethernet pads frames to 60 bytes, so this
mostly takes a virtual link, but nothing stops a short frame from
getting here.
Pull the AoE header up front and drop the packet if it isn't there,
then pull the ATA or config header in the switch arm that hands the
packet on, so each path gets the headers it reads. This also replaces
the open-coded __pskb_pull_tail() with pskb_may_pull().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261007-b4-aoe-short-packets-v1-1-db5155f7bb9c@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/aoe/aoenet.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 66e617664c143..cd7c735bb43b7 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -131,9 +131,7 @@ static int
aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt, struct net_device *orig_dev)
{
struct aoe_hdr *h;
- struct aoe_atahdr *ah;
u32 n;
- int sn;
if (dev_net(ifp) != &init_net)
goto exit;
@@ -144,12 +142,8 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
if (!is_aoe_netif(ifp))
goto exit;
skb_push(skb, ETH_HLEN); /* (1) */
- sn = sizeof(*h) + sizeof(*ah);
- if (skb->len >= sn) {
- sn -= skb_headlen(skb);
- if (sn > 0 && !__pskb_pull_tail(skb, sn))
- goto exit;
- }
+ if (!pskb_may_pull(skb, sizeof(*h)))
+ goto exit;
h = (struct aoe_hdr *) skb->data;
n = get_unaligned_be32(&h->tag);
if ((h->verfl & AOEFL_RSP) == 0 || (n & 1<<31))
@@ -171,10 +165,14 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
switch (h->cmd) {
case AOECMD_ATA:
+ if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_atahdr)))
+ goto exit;
/* ata_rsp may keep skb for later processing or give it back */
skb = aoecmd_ata_rsp(skb);
break;
case AOECMD_CFG:
+ if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_cfghdr)))
+ goto exit;
aoecmd_cfg_rsp(skb);
break;
default:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 410/869] PCI/sysfs: Pass the device name length in UTF-16 code units
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 409/869] aoe: pull in the headers each received packet type reads Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 411/869] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM Greg Kroah-Hartman
` (466 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit af5ca2d75147bf283239e8ef0fbf6e5e0488ca91 ]
Currently, dsm_label_utf16s_to_utf8s() passes the ACPI buffer length to
utf16s_to_utf8s() unchanged. The Device Name _DSM may return the device
name as a buffer holding a UTF-16 string, and the ACPI length counts bytes
while the converter counts wchar_t elements. The converter therefore
receives a count twice the number of code units the buffer holds, and that
count is its only bound on the input.
A NUL code unit ends the conversion early, so a name that carries one is
converted correctly and the error stays hidden. ACPICA zeroes the entire
result allocation, and the padding placed after the buffer supplies that
NUL for most lengths. Lengths that leave no padding, or a single byte of
it, do not, and the conversion then runs up to its own length in bytes past
the end of the allocation. The bytes beyond the allocation are decoded
into the "label" attribute, which is world readable.
Divide the buffer length by the size of wchar_t so that the converter
receives a count of code units. The division truncates, so the converter
is never told to read more bytes than the buffer holds, including for an
odd length.
Reaching the out of bounds read needs firmware that returns the name as a
buffer and omits the terminator.
Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260814070522.2327975-5-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci-label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index 0c64465196404..c224619b9a266 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -144,7 +144,7 @@ static int dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
int len;
len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
- obj->buffer.length,
+ obj->buffer.length / sizeof(wchar_t),
UTF16_LITTLE_ENDIAN,
buf, PAGE_SIZE - 1);
buf[len++] = '\n';
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 411/869] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 410/869] PCI/sysfs: Pass the device name length in UTF-16 code units Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 412/869] crypto: algif_skcipher - rewind rounded output bytes Greg Kroah-Hartman
` (465 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Ping-Ke Shih,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 6c17c57d45ef1652d80f79a9834597b25412fd26 ]
__rtw89_wow_parse_akm() computes a pointer to the IE area from an
association request frame:
ies = mgmt->u.assoc_req.variable;
but then passes skb->len as the IE data length to cfg80211_find_ie().
Since skb->len covers the entire frame including the 28-byte management
header and fixed fields, cfg80211_find_ie() may read past the end of the
actual IE data.
Fix by computing the correct IE data length as skb->len minus the
header offset, and validating the minimum frame length before parsing.
Fixes: 92790c4e50d2 ("wifi: rtw89: wow: parsing Auth Key Management from associate request")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20261007161721.261452-3-tristmd@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/wow.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 90046d6f620ef..144c4c2801bdb 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,14 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
struct rtw89_rsn_ie *rsn_ie;
- rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len - hdr_len);
if (!rsn)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 412/869] crypto: algif_skcipher - rewind rounded output bytes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 411/869] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 413/869] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn Greg Kroah-Hartman
` (464 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daehyeon Ko, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 2f90facc7b94934653eb7ebfadcc25d503b89196 ]
af_alg_get_rsgl() advances the receive iterator by the unrounded RX
scatterlist length. For a continuing skcipher request,
_skcipher_recvmsg() then rounds its local length down to a whole chunksize
without restoring the iterator.
A later chunk starts after bytes which the provider never wrote, while the
syscall returns only the processed length. When copy_splice_read()
supplies non-zeroed pages and publishes that return as a dense prefix, the
gap exposes stale bytes from a previous page lifetime.
With unprivileged xts(aes), a 31-byte MSG_MORE request followed by one
final byte advances a 47-byte destination while returning 32 bytes. A
hardened v7.2-rc5 image retained all 15 seeded stale bytes in 4,829 of
4,829 records. With init_on_alloc enabled, all 72,345 gap bytes observed
were zero.
Rewind the iterator by the tail excluded during rounding, before rejecting
a zero processed length. The crypto request uses only the rounded length;
af_alg_free_resources() releases the entire RX list before another receive
iteration.
The fixed target-like kernel returned byte-identical dense 48-byte output
in 4,771 of 4,771 rounds. The unmodified kernel returned the vulnerable
32-byte short record in 2,409 of 2,409 rounds.
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/algif_skcipher.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 35ebc3e0201b0..b245d37db76b7 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -116,12 +116,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
* full block size buffers.
*/
if (ctx->more || len < ctx->used) {
- if (len < bs) {
+ size_t excess = len % bs;
+
+ len -= excess;
+ iov_iter_revert(&msg->msg_iter, excess);
+
+ if (!len) {
err = -EINVAL;
goto free;
}
- len -= len % bs;
cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 413/869] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 412/869] crypto: algif_skcipher - rewind rounded output bytes Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 414/869] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler Greg Kroah-Hartman
` (463 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 6cf3ab38b0d53d41f00fe594b2986849bdf994ae ]
hdmi_add_cvt() stores each converter's NID into the fixed-size
spec->cvt_nids[] array (used only by the Intel Haswell pin-connection
fixup), but only when spec->num_cvts is still within
ARRAY_SIZE(cvt_nids); the num_cvts counter itself is incremented
unconditionally regardless of whether the store happened. A codec
that reports more converters than cvt_nids[] can hold therefore ends
up with num_cvts > ARRAY_SIZE(cvt_nids).
hdmi_read_pin_conn(), on the intel_hsw_fixup path, copies num_cvts
elements from cvt_nids[] with memcpy(), so once num_cvts exceeds the
array size this reads past cvt_nids[] and writes the resulting
garbage NIDs into per_pin->mux_nids[].
Clamp the copy length to the actual size of cvt_nids[] instead of
trusting num_cvts, which is also used unbounded as the size of the
separate, dynamically-sized spec->cvts array and must not be
truncated at the source.
Fixes: bce0d2a80e42 ("ALSA: hda - Allow unlimited pins and converters in patch_hdmi.c")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085122.9442-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/hdmi/hdmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index 480d1c5f129fd..a30072139f352 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -983,7 +983,8 @@ static int hdmi_read_pin_conn(struct hda_codec *codec, int pin_idx)
snd_hda_set_dev_select(codec, pin_nid, dev_id);
if (spec->intel_hsw_fixup) {
- conns = spec->num_cvts;
+ /* spec->cvt_nids[] only has ARRAY_SIZE(spec->cvt_nids) slots */
+ conns = min_t(int, spec->num_cvts, ARRAY_SIZE(spec->cvt_nids));
memcpy(per_pin->mux_nids, spec->cvt_nids,
sizeof(hda_nid_t) * conns);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 414/869] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 413/869] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 415/869] fanotify: report names longer than NAME_MAX Greg Kroah-Hartman
` (462 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit b3e7ddd694f8429217ba509b55b910a0e4361dfb ]
snd_hdmi_write_eld_info() parses a "sad_count N" line from the
root-writable ELD proc interface and assigns N directly to
e->sad_count with no upper bound, unlike the per-index "sadN_*" lines
a few lines below which are already bounded to ELD_MAX_SAD.
snd_hdmi_eld_update_pcm_info() later iterates
"for (i = 0; i < e->sad_count; i++)" over the fixed
e->sad[ELD_MAX_SAD] array, so an oversized sad_count read from the
proc file causes it to walk past the array.
Reject sad_count values above ELD_MAX_SAD, matching the existing
per-index guard.
Fixes: acb059938810 ("ALSA: hda - ELD proc interface write updates")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085133.9528-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/hdmi/eld.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/hda/codecs/hdmi/eld.c b/sound/hda/codecs/hdmi/eld.c
index 1464fd1c675bc..fc6fe1b0873c3 100644
--- a/sound/hda/codecs/hdmi/eld.c
+++ b/sound/hda/codecs/hdmi/eld.c
@@ -155,9 +155,11 @@ void snd_hdmi_write_eld_info(struct hdmi_eld *eld,
e->aud_synch_delay = val;
else if (!strcmp(name, "speakers"))
e->spk_alloc = val;
- else if (!strcmp(name, "sad_count"))
+ else if (!strcmp(name, "sad_count")) {
+ if (val > ELD_MAX_SAD)
+ continue;
e->sad_count = val;
- else if (!strncmp(name, "sad", 3)) {
+ } else if (!strncmp(name, "sad", 3)) {
sname = name + 4;
n = name[3] - '0';
if (name[4] >= '0' && name[4] <= '9') {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 415/869] fanotify: report names longer than NAME_MAX
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 414/869] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 416/869] ext4: only update tune mount options when requested Greg Kroah-Hartman
` (461 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Jan Kara,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit ff05910cb1b77c2b229c5e6e260c6173a17b579b ]
fanotify keeps the length of a reported name in a u8, so it drops any
name longer than NAME_MAX and warns:
WARNING: fs/notify/fanotify/fanotify.h:217 at fanotify_handle_event+0x2e82/0x39f0
Such names are legitimate on some filesystems. vfat mounted with utf8
takes up to 255 UTF-16 characters, which are up to 765 bytes of UTF-8,
and FUSE accepts names up to PATH_MAX - 1. readdir() and inotify report
them in full. fanotify sends the event without the name, and for
FAN_RENAME it trips a second warning in copy_fid_info_to_user(), after
which read() fails with EFAULT and the event is lost.
When syzbot hit this, Jan suggested accommodating names up to PATH_MAX
[1], the limit readdir() already applies to a name
(verify_dirent_name()). Store the name lengths as u16, which keeps
struct fanotify_info at 8 bytes, and drop without a warning only names
of PATH_MAX bytes or more, which no path can refer to. An event with
such a name can exceed a page, so allocate name events with kvmalloc(),
as Jan also suggested. Names up to NAME_MAX are reported exactly as
before, and the record format is unchanged: an event with a long name is
just longer.
Link: https://lore.kernel.org/all/20241112115059.ecvomkalee5m4i4i@quack3/ [1]
Fixes: 2d9374f09513 ("fanotify: use macros to get the offset to fanotify_info buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Link: https://patch.msgid.link/20260926020851.2938961-1-matthias.goergens@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify.c | 7 +++++--
fs/notify/fanotify/fanotify.h | 21 ++++++++++++---------
2 files changed, 17 insertions(+), 11 deletions(-)
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index cdb69c23e2e6c..bb12baebd0c94 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -650,6 +650,9 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
unsigned long name2_len = name2 ? name2->len : 0;
unsigned int len, size;
+ if (WARN_ON_ONCE(name_len >= PATH_MAX || name2_len >= PATH_MAX))
+ return NULL;
+
/* Reserve terminating null byte even for empty name */
size = sizeof(*fne) + name_len + name2_len + 2;
if (dir_fh_len)
@@ -658,7 +661,7 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
size += FANOTIFY_FH_HDR_LEN + dir2_fh_len;
if (child_fh_len)
size += FANOTIFY_FH_HDR_LEN + child_fh_len;
- fne = kmalloc(size, gfp);
+ fne = kvmalloc(size, gfp);
if (!fne)
return NULL;
@@ -1048,7 +1051,7 @@ static void fanotify_free_fid_event(struct fanotify_event *event)
static void fanotify_free_name_event(struct fanotify_event *event)
{
- kfree(FANOTIFY_NE(event));
+ kvfree(FANOTIFY_NE(event));
}
static void fanotify_free_error_event(struct fsnotify_group *group,
diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h
index eb2ba71d5c81a..775f55080dd4d 100644
--- a/fs/notify/fanotify/fanotify.h
+++ b/fs/notify/fanotify/fanotify.h
@@ -42,9 +42,16 @@ struct fanotify_info {
u8 dir_fh_totlen;
u8 dir2_fh_totlen;
u8 file_fh_totlen;
- u8 name_len;
- u8 name2_len;
- u8 pad[3];
+ u8 pad;
+ /*
+ * Deliberately not limited to NAME_MAX: some filesystems return longer
+ * names (vfat up to 255 UTF-16 characters, as Windows allows, which is
+ * up to 765 bytes of UTF-8; FUSE up to PATH_MAX - 1), and readdir() and
+ * inotify report them in full. Only names of PATH_MAX bytes or more,
+ * which no path can refer to, are dropped.
+ */
+ u16 name_len;
+ u16 name2_len;
unsigned char buf[];
/*
* (struct fanotify_fh) dir_fh starts at buf[0]
@@ -167,7 +174,7 @@ static inline char *fanotify_info_name2(struct fanotify_info *info)
static inline void fanotify_info_init(struct fanotify_info *info)
{
BUILD_BUG_ON(FANOTIFY_FH_HDR_LEN + MAX_HANDLE_SZ > U8_MAX);
- BUILD_BUG_ON(NAME_MAX > U8_MAX);
+ BUILD_BUG_ON(PATH_MAX > U16_MAX);
info->dir_fh_totlen = 0;
info->dir2_fh_totlen = 0;
@@ -213,8 +220,7 @@ static inline void fanotify_info_set_file_fh(struct fanotify_info *info,
static inline void fanotify_info_copy_name(struct fanotify_info *info,
const struct qstr *name)
{
- if (WARN_ON_ONCE(name->len > NAME_MAX) ||
- WARN_ON_ONCE(info->name2_len > 0))
+ if (WARN_ON_ONCE(info->name2_len > 0))
return;
info->name_len = name->len;
@@ -224,9 +230,6 @@ static inline void fanotify_info_copy_name(struct fanotify_info *info,
static inline void fanotify_info_copy_name2(struct fanotify_info *info,
const struct qstr *name)
{
- if (WARN_ON_ONCE(name->len > NAME_MAX))
- return;
-
info->name2_len = name->len;
strcpy(fanotify_info_name2(info), name->name);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 416/869] ext4: only update tune mount options when requested
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 415/869] fanotify: report names longer than NAME_MAX Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 417/869] ext4: fix fast commit replay failing on a read-only mount Greg Kroah-Hartman
` (460 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, guzebing, Darrick J. Wong,
Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: guzebing <guzebing1612@gmail.com>
[ Upstream commit 981eec6c300bd4e84ffac8f3c28b762d00f13e9c ]
EXT4_IOC_SET_TUNE_SB_PARAM uses set_flags to indicate which superblock
fields the caller wants to update. ext4_sb_setparams() checks set_flags
before updating the other supported fields, but always copied mount_opts
into the on-disk s_mount_opts field.
As a result, callers that do not set EXT4_TUNE_FL_MOUNT_OPTS can still
clear or alter the on-disk default mount options through their unused
mount_opts buffer. This can affect subsequent mounts by changing the
filesystem's stored default mount options.
Only copy mount_opts into s_mount_opts when EXT4_TUNE_FL_MOUNT_OPTS is set,
matching the set_flags semantics used by the other tuneable superblock
fields.
Cc: stable@kernel.org
Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters")
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20260810151200.1405562-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 9aec4ee780a7e..cc85786be2704 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1360,7 +1360,8 @@ static void ext4_sb_setparams(struct ext4_sb_info *sbi,
es->s_encoding = cpu_to_le16(params->encoding);
if (params->set_flags & EXT4_TUNE_FL_ENCODING_FLAGS)
es->s_encoding_flags = cpu_to_le16(params->encoding_flags);
- strscpy_pad(es->s_mount_opts, params->mount_opts);
+ if (params->set_flags & EXT4_TUNE_FL_MOUNT_OPTS)
+ strscpy_pad(es->s_mount_opts, params->mount_opts);
if (params->set_flags & EXT4_TUNE_FL_EDIT_FEATURES) {
es->s_feature_compat |=
cpu_to_le32(params->set_feature_compat_mask);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 417/869] ext4: fix fast commit replay failing on a read-only mount
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 416/869] ext4: only update tune mount options when requested Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 418/869] ext4: reject delalloc to nodelalloc before applying remount options Greg Kroah-Hartman
` (459 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsiu-Hsien Lee, Jan Kara,
Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsiu-Hsien Lee <swinds24@gmail.com>
[ Upstream commit e1a881ea4674876721cab97680d1d8308f90e9a4 ]
A filesystem with fast_commit that needs recovery cannot be mounted
read-only:
EXT4-fs (dm-0): INFO: recovery required on readonly filesystem
EXT4-fs (dm-0): write access will be enabled during recovery
WARNING: CPU: 22 PID: 5544 at fs/ext4/ext4_jbd2.c:73
ext4_journal_check_start
__ext4_journal_start_sb
__ext4_unlink
ext4_fc_replay
do_one_pass
jbd2_journal_recover
jbd2_journal_load
__ext4_fill_super
JBD2: journal recovery failed
EXT4-fs (dm-0): error loading journal
Fast commit replay runs ext4 metadata operations instead of writing
blocks through the buffer cache: ext4_fc_replay_{unlink,link,create}()
reach __ext4_unlink() and __ext4_link(), which start a handle.
ext4_journal_check_start() returns -EROFS on a read-only sb, and as
that is not -ENOENT it propagates out of jbd2_journal_recover() and
kills the whole recovery. The EXT4_FC_REPLAY check that would hand
out a no-journal handle sits after the sb_rdonly() test, so replay can
never complete read-only.
ext4_load_journal() has already promised that write access will be
enabled during recovery, so make that true for the superblock as well:
clear SB_RDONLY across jbd2_journal_load() when recovery is needed on a
read-only mount and the devices are writable, as ext4_orphan_cleanup()
does. Unlike ext4_handle_error(), which avoids SB_RDONLY because it
would need s_umount, the sb here is still inside ext4_fill_super() and
not published, so nothing can observe it.
The failure is not clean either: the replay handlers passing a NULL
handle (ext4_fc_replay_inode(), _add_range(), _del_range()) never hit
ext4_journal_check_start() and do write, leaving a partially applied
fast commit behind.
Reproducer, where the unlink only ever reaches the fast commit area:
mke2fs -q -F -t ext4 -O fast_commit -b 4096 /dev/sdb3 262144
mount /dev/sdb3 /mnt
dd if=/dev/zero of=/mnt/victim bs=4k count=1 conv=fsync
sync # victim now in a full commit
rm /mnt/victim
dd if=/dev/zero of=/mnt/trigger bs=4k count=1 conv=fsync
<crash, or snapshot the device while mounted and write it back>
mount -o ro /dev/sdb3 /mnt
Without this patch that mount fails; with it recovery completes and
victim is gone, i.e. the UNLINK record was really replayed.
Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Cc: stable@vger.kernel.org
Signed-off-by: Hsiu-Hsien Lee <swinds24@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260812044353.1018268-1-swinds24@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b4ff7e692986b..2762628bbfc95 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6016,6 +6016,7 @@ static int ext4_load_journal(struct super_block *sb,
int err = 0;
int really_read_only;
int journal_dev_ro;
+ bool enable_write = false;
if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
return -EFSCORRUPTED;
@@ -6072,6 +6073,7 @@ static int ext4_load_journal(struct super_block *sb,
}
ext4_msg(sb, KERN_INFO, "write access will "
"be enabled during recovery");
+ enable_write = true;
}
}
@@ -6088,7 +6090,19 @@ static int ext4_load_journal(struct super_block *sb,
if (save)
memcpy(save, ((char *) es) +
EXT4_S_ERR_START, EXT4_S_ERR_LEN);
+ /*
+ * Fast commit replay performs regular ext4 metadata updates
+ * (see ext4_fc_replay()) which refuse to run on a read-only
+ * superblock. We promised write access above, so make that
+ * true for the duration of the recovery, the same way
+ * ext4_orphan_cleanup() does. The superblock is not published
+ * yet, so nothing can observe the transient state.
+ */
+ if (enable_write)
+ sb->s_flags &= ~SB_RDONLY;
err = jbd2_journal_load(journal);
+ if (enable_write)
+ sb->s_flags |= SB_RDONLY;
if (save && memcmp(((char *) es) + EXT4_S_ERR_START,
save, EXT4_S_ERR_LEN)) {
memcpy(((char *) es) + EXT4_S_ERR_START,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 418/869] ext4: reject delalloc to nodelalloc before applying remount options
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 417/869] ext4: fix fast commit replay failing on a read-only mount Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 419/869] jbd2: dont advance j_fc_off before the buffer is recorded Greg Kroah-Hartman
` (458 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, guzebing, Ojaswin Mujoo, Jan Kara,
Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: guzebing <guzebing1612@gmail.com>
[ Upstream commit 26a3ff309c91986dbedb05d0e0f0050ea0aa629c ]
Commit 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on
remount") rejects switching a mounted filesystem from delalloc to
nodelalloc. However, it performs the check after ext4_apply_options()
has already cleared EXT4_MOUNT_DELALLOC in the live superblock. The
failure path eventually restores the bit, but leaves a window where
other CPUs can observe nodelalloc.
test_opt() reads s_mount_opt directly without a lock shared with
remount. If a concurrent truncate's __es_remove_extent() hits this
window and observes nodelalloc, it sets count_reserved to false.
Delayed extent status entries are then removed without calculating
their cluster reservations, leaving reserved at zero.
ext4_es_remove_extent() therefore calls ext4_da_release_space() with
zero, leaving i_reserved_data_blocks and s_dirtyclusters_counter
elevated. When the inode is later evicted after unlink,
ext4_destroy_inode() reports:
i_reserved_data_blocks (...) not cleared!
CPU 0 CPU 1
ksys_truncate()
...
ext4_es_remove_extent()
ext4_reconfigure()
ext4_check_opt_consistency()
__ext4_remount()
ext4_apply_options()
clear EXT4_MOUNT_DELALLOC
__es_remove_extent()
test_opt() sees !DELALLOC
count_reserved = false
reject delalloc -> nodelalloc
restore EXT4_MOUNT_DELALLOC
remove delayed ES
ext4_da_release_space(0)
Follow the pre-apply validation approach used by
ext4_check_quota_consistency() and reject the transition in
ext4_check_opt_consistency(), before ext4_apply_options() changes live
state. Use mask_s_mount_opt to determine whether delalloc/nodelalloc
was specified and ctx_test_mount_opt() to check the final parsed value.
Fixes: 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on remount")
Cc: stable@vger.kernel.org
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260814034855.1573759-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2762628bbfc95..613b04b64b14d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2783,6 +2783,14 @@ static int ext4_check_opt_consistency(struct fs_context *fc,
}
if (is_remount) {
+ if (test_opt(sb, DELALLOC) &&
+ (ctx->mask_s_mount_opt & EXT4_MOUNT_DELALLOC) &&
+ !ctx_test_mount_opt(ctx, EXT4_MOUNT_DELALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "can't disable delalloc during remount");
+ return -EINVAL;
+ }
+
if (!sbi->s_journal &&
ctx_test_mount_opt(ctx, EXT4_MOUNT_DATA_ERR_ABORT)) {
ext4_msg(NULL, KERN_WARNING,
@@ -6595,13 +6603,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
goto restore_opts;
}
- if ((old_opts.s_mount_opt & EXT4_MOUNT_DELALLOC) &&
- !test_opt(sb, DELALLOC)) {
- ext4_msg(sb, KERN_ERR, "can't disable delalloc during remount");
- err = -EINVAL;
- goto restore_opts;
- }
-
sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 419/869] jbd2: dont advance j_fc_off before the buffer is recorded
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 418/869] ext4: reject delalloc to nodelalloc before applying remount options Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 420/869] ext4: skip extra isize expansion while unmounting Greg Kroah-Hartman
` (457 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yu Junzhe, Daejun Park,
Jan Kara, Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit 9f359c031885bb50add7d23c7a5a0e9755b134c9 ]
jbd2_fc_get_buf() increments journal->j_fc_off before jbd2_journal_bmap()
and __getblk() have had a chance to fail. When either does, the slot
j_fc_wbuf[fc_off] is never assigned, but j_fc_off already counts it.
ext4 then fails the fast commit and falls back, and the fallback path
reaches jbd2_fc_release_bufs() via ext4_fc_commit ->
jbd2_fc_end_commit_fallback -> __jbd2_fc_end_commit -> ext4_fc_cleanup.
That walks down from j_fc_off - 1 and put_bh()es every slot until it
sees NULL, so it also touches the slot that was never written.
j_fc_wbuf comes from a plain kmalloc() and is never zeroed, so a slot
used for the first time holds uninitialised heap data.
Advance j_fc_off only after the buffer head has been stored. That
restores the invariant that j_fc_off covers exactly the filled slots,
which is what jbd2_fc_release_bufs() relies on: the live buffers of the
current fast commit sit above the NULLs the previous one released, so
stopping at the first NULL is correct.
Reproduced on a KASAN kernel with an ext4 fast_commit filesystem on a
loop device, truncating the backing file under the live mount so that
only the journal's fast-commit region falls past the end of the device.
__getblk() then fails for the first fast-commit block while the rest of
the journal is still addressable, so the journal is not aborted and the
fast commit reaches the fallback path. j_fc_wbuf was poisoned to make
the read of the never-written slot visible:
BUG: KASAN: wild-memory-access in jbd2_fc_release_bufs+0x6b/0xd0
Write of size 4 at addr 5a5a5a5a5a5a5ab2 by task sync/961
jbd2_fc_release_bufs+0x6b/0xd0
ext4_fc_cleanup+0x97/0x830
__jbd2_fc_end_commit+0x37/0xc0
ext4_fc_commit+0x524/0x560
ext4_sync_file+0x3c4/0x4b0
__x64_sys_fsync+0x20/0x30
With this patch the same run leaves j_fc_off at 0 across repeated
__getblk() failures and completes cleanly.
Fixes: ff780b91efe9 ("jbd2: add fast commit machinery")
Cc: stable@kernel.org
Reported-by: Yu Junzhe <junzheyu1@gmail.com>
Closes: https://lore.kernel.org/linux-ext4/7e4b109d-64c3-444f-a5dc-93c2ca4576cc@gmail.com/
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260819060939epcms2p37bb8589b2f8a52a2b14bef38fadcf69d@epcms2p3
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/journal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index fa0fb738db0c4..1184dbad43e57 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -844,7 +844,6 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
fc_off = journal->j_fc_off;
blocknr = journal->j_fc_first + fc_off;
- journal->j_fc_off++;
ret = jbd2_journal_bmap(journal, blocknr, &pblock);
if (ret)
return ret;
@@ -854,6 +853,7 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
return -ENOMEM;
journal->j_fc_wbuf[fc_off] = bh;
+ journal->j_fc_off++;
*bh_out = bh;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 420/869] ext4: skip extra isize expansion while unmounting
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 419/869] jbd2: dont advance j_fc_off before the buffer is recorded Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 421/869] ext4: dont report delalloc data as a hole on indirect-mapped inodes Greg Kroah-Hartman
` (456 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+4b03894b6ec5753ddf24,
Hemanth Selam, Jan Kara, Jun Nie, Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hemanth Selam <hemanth.selam@gmail.com>
[ Upstream commit 418adcde99032194416248168df810535a1a93f9 ]
syzbot reports a WARN from ext4_xattr_inode_create() reached through the
unmount path:
EXT4-fs warning (device loop0): ext4_xattr_inode_create:1485: refuse to
create EA inode when umounting
WARNING: fs/ext4/xattr.c:1486 at ext4_xattr_inode_lookup_create
ext4_xattr_block_set
ext4_expand_extra_isize_ea
__ext4_expand_extra_isize
__ext4_mark_inode_dirty
ext4_dirty_inode
__mark_inode_dirty
sync_lazytime
iput
dentry_kill
shrink_dentry_list
shrink_dcache_for_umount
generic_shutdown_super
kill_block_super
ext4_kill_sb
shrink_dcache_for_umount() clears s_root before generic_shutdown_super()
clears SB_ACTIVE, so during the dcache shrink the last iput() of a
lazytime inode still redirties it and reaches the isize expansion. The
expansion can move xattrs out to a block, and creating the EA inode for
them needs s_root, which ext4_xattr_inode_create() refuses without.
ext4_try_to_expand_extra_isize() already declines to expand when the
superblock is not active, but that test does not cover this window.
Decline while s_root is gone as well. The expansion is best effort and
__ext4_mark_inode_dirty() ignores its return value, so nothing else
changes; the inode can be expanded on a later mount.
Running the syzbot reproducer for 60 seconds produced 3583 splats before
this change and none after it, with the same number of mount cycles.
Cc: stable@kernel.org
Reported-by: syzbot+4b03894b6ec5753ddf24@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b03894b6ec5753ddf24
Fixes: f31173c19901 ("ext4: refuse to create ea block when umounted")
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Jun Nie <jun.nie@linaro.org>
Link: https://patch.msgid.link/20260824094512.2436628-1-hemanth.selam@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ed51c11f43ffb..47ce682ae17fa 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6479,8 +6479,14 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode,
* When !SB_ACTIVE, iput triggers write_inode_now() which acquires
* s_writepages_rwsem, causing a deadlock with the caller's active
* jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle).
+ *
+ * Skip it while unmounting as well. shrink_dcache_for_umount()
+ * clears s_root before generic_shutdown_super() clears SB_ACTIVE, and
+ * the last iput() of a lazytime inode in that window redirties it and
+ * lands here. Moving xattrs out to a block then needs a new EA inode,
+ * which ext4_xattr_inode_create() refuses without s_root.
*/
- if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE)))
+ if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE) || !inode->i_sb->s_root))
return -EBUSY;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 421/869] ext4: dont report delalloc data as a hole on indirect-mapped inodes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 420/869] ext4: skip extra isize expansion while unmounting Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 422/869] ext4: fix ABBA deadlock in ext4_rmdir() Greg Kroah-Hartman
` (455 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Monakov, Jan Kara,
Daejun Park, Zhang Yi, Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit aed43f47e1edeee1454eea86006a8c09480e5ed3 ]
When a plain lookup finds no block, ext4_ind_map_blocks() sizes the hole
it reports by counting the empty subtrees under 'partial' in the on-disk
indirect tree. That count knows nothing about delayed allocation, so a
range holding delalloc data that has not been written back yet is
reported as a plain hole. The extent-mapped path does not have this
problem: it trims the hole it found at the first delayed extent before
returning it.
ext4_map_blocks() consults the extent status tree before it calls into
the mapping layer, so a query that starts exactly on the delayed block
still finds it. A query that starts earlier does not, because the hole
reported for the earlier block already spans the delayed one. On a
4k-block filesystem, lseek(SEEK_DATA) from offset 0 on a file whose only
data block is at logical block N and is still dirty returns:
N = 0..11 direct blocks N << 12
N = 12 first single-indirect block N << 12
N = 13..1035 inside that indirect block -1 ENXIO
N = 1036 first double-indirect block N << 12
Blocks 12 and 1036 survive because the query lands on the delayed block
itself. Blocks 13..1035 are swallowed by the 1024-block hole reported
for block 12. fiemap loses the same data for the same reason.
An ext3 filesystem mounted as ext4 hits this during ordinary use: ext3
inodes stay indirect mapped, while mount -t ext4 turns on delayed
allocation even though mounting ext3 with -o delalloc is explicitly
rejected. install(1) from coreutils uses SEEK_DATA to locate data in
its source file, so installing a sparse file that has not been written
back silently produces a destination of the right size holding none of
the data:
truncate -s 1G img && mkfs.ext3 -F img && mount -t ext4 img mnt
echo | dd of=mnt/src bs=1 count=1 seek=64K
install mnt/src mnt/dst
cmp mnt/src mnt/dst # differ: char 65537
Reconciling a hole with the extent status tree does not depend on how
the hole was found, so instead of open coding it a second time, split
the delalloc handling out of ext4_ext_determine_insert_hole() into
ext4_determine_insert_hole(), which takes the hole the caller located,
and call that from ext4_ind_map_blocks() as well. All the special cases
and the comments explaining them stay in one place.
Two things change for indirect-mapped inodes. They now cache the holes
they report, as the extent-mapped path already does: ext4_punch_hole()
already puts EXTENT_STATUS_HOLE on such inodes, ext4_map_blocks() and
ext4_da_map_blocks() already handle a cached hole, the latter by
replacing it with the delayed extent, and consecutive hole entries
merge, so the tree does not grow with the length of a scan. And when a
delayed extent covers the queried block itself - a race, since
ext4_map_blocks() found nothing in the tree just before - the hole is
now reported only up to the end of that extent instead of in full.
The indirect path passes hole_start == lblk, so the "delalloc extent in
front of the queried range" case cannot be reached there:
__es_tree_search() never returns an extent ending before the block it
was searched for.
With this the sweep above returns N << 12 for every N, while the
nodelalloc and extent-mapped controls are unchanged. generic/225,
generic/285, generic/448 and generic/490 pass on ext4 made both with and
without the extent feature. generic/286 and generic/436 pass on
extent-mapped ext4 and are skipped without it, since they need
fallocate.
Fixes: facab4d9711e ("ext4: return hole from ext4_map_blocks()")
Reported-by: Alexander Monakov <amonakov@ispras.ru>
Closes: https://lore.kernel.org/linux-ext4/594c17d9-c00f-e485-96fb-cedf27ce3aa3@ispras.ru/
Suggested-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827084829epcms2p6ecc0c39a71d0c3eebf9cb1ade77314f6@epcms2p6
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ext4.h | 3 +++
fs/ext4/extents.c | 26 +++++++++++++-------------
fs/ext4/indirect.c | 17 +++++++++++++++++
3 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ed546c52ebc32..9c67a2c28faf5 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3809,6 +3809,9 @@ extern void ext4_ext_tree_init(handle_t *handle, struct inode *inode);
extern int ext4_ext_index_trans_blocks(struct inode *inode, int extents);
extern int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t hole_start,
+ ext4_lblk_t hole_len);
extern int ext4_ext_truncate(handle_t *, struct inode *);
extern int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
ext4_lblk_t end);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 21fba12520a8e..80d41be515644 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4160,21 +4160,19 @@ static int get_implied_cluster_alloc(struct super_block *sb,
}
/*
- * Determine hole length around the given logical block, first try to
- * locate and expand the hole from the given @path, and then adjust it
- * if it's partially or completely converted to delayed extents, insert
- * it into the extent cache tree if it's indeed a hole, finally return
- * the length of the determined extent.
+ * Adjust the hole [@hole_start, @hole_start + @hole_len) the caller found
+ * around the queried block @lblk if it's partially or completely converted
+ * to delayed extents, insert it into the extent cache tree if it's indeed a
+ * hole, finally return the length of the determined extent starting at
+ * @lblk. @hole_start must not be behind @lblk.
*/
-static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode,
- struct ext4_ext_path *path,
- ext4_lblk_t lblk)
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t hole_start,
+ ext4_lblk_t hole_len)
{
- ext4_lblk_t hole_start, len;
+ ext4_lblk_t len = hole_len;
struct extent_status es;
- hole_start = lblk;
- len = ext4_ext_find_hole(inode, path, &hole_start);
again:
ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
hole_start + len - 1, &es);
@@ -4342,9 +4340,11 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
* we couldn't try to create block if flags doesn't contain EXT4_GET_BLOCKS_CREATE
*/
if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
- ext4_lblk_t len;
+ ext4_lblk_t hole_start = map->m_lblk, len;
- len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk);
+ len = ext4_ext_find_hole(inode, path, &hole_start);
+ len = ext4_determine_insert_hole(inode, map->m_lblk,
+ hole_start, len);
map->m_pblk = 0;
map->m_len = min_t(unsigned int, map->m_len, len);
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index da76353b3a575..50c567123b42d 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -586,6 +586,23 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
for (i = partial - chain + 1; i < depth; i++)
count = count * epb + (epb - offsets[i] - 1);
count++;
+
+ /*
+ * The count knows nothing about delayed allocation, so let
+ * the common helper reconcile it with the extent status
+ * tree. Only when the lookup really did find a hole:
+ * ext4_get_branch() also returns a non-NULL partial when it
+ * failed, and caching a hole for a range it could not read
+ * would answer every later read from that cache instead of
+ * retrying. Clamp the count first, a subtree can be bigger
+ * than the logical block space when the block size is large.
+ */
+ if (!err) {
+ count = umin(count, EXT_MAX_BLOCKS - map->m_lblk);
+ count = ext4_determine_insert_hole(inode, map->m_lblk,
+ map->m_lblk, count);
+ }
+
/* Fill in size of a hole we found */
map->m_pblk = 0;
map->m_len = umin(map->m_len, count);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 422/869] ext4: fix ABBA deadlock in ext4_rmdir()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 421/869] ext4: dont report delalloc data as a hole on indirect-mapped inodes Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 423/869] ext4: fix out-of-bounds read in ext4_get_group_info() Greg Kroah-Hartman
` (454 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sarthak Kukreti,
Sergey Senozhatsky, Jan Kara, Baokun Li, Zhang Yi, Theodore Tso,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
[ Upstream commit 19e16597f9baf1b5719a3a6c710486446f6808fd ]
We observe the following ABBA deadlock (casefolding enabled):
INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
jbd2_journal_wait_updates+0x8f/0xf0
jbd2_journal_commit_transaction+0x321/0x1850
kjournald2+0xa9/0x230
kthread+0x226/0x2a0
ret_from_fork+0x101/0x1e0
ret_from_fork_asm+0x1a/0x30
INFO: task Thread-10:4161 blocked for more than 720 seconds.
task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
wait_transaction_locked+0x8c/0xd0
start_this_handle+0x252/0x870
jbd2__journal_start+0x120/0x280
__ext4_journal_start_sb+0x11a/0x250
ext4_evict_inode+0x208/0x760
iput+0x222/0x5c0
dput+0x293/0x690
____fput+0x145/0x2b0
task_work_run+0x7a/0xb0
exit_to_user_mode_loop+0xc0/0xd0
do_syscall_64+0x14b/0xf10
entry_SYSCALL_64_after_hwframe+0x76/0x7e
NMI backtrace for cpu 0
CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
RIP: 0010:d_walk+0x0/0x290
[..]
Call Trace:
<TASK>
shrink_dcache_parent+0xb2/0x100
d_invalidate+0x50/0x110
ext4_rmdir+0x3a2/0x3d0
vfs_rmdir+0x9d/0x1d0
do_rmdir+0xf0/0x330
__x64_sys_unlinkat+0x34/0x50
do_syscall_64+0x61/0xf10
The problem is that ext4_rmdir() calls d_invalidate() before stopping
the jbd2 transaction handle. Because d_invalidate() traverses child
dentries it can encounter dying or in-use dentries. If a concurrent
thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
it requests a new transaction handle via ext4_journal_start(), which
waits for all running handles to close. However, the thread executing
ext4_rmdir() still holds its active transaction handle while looping
in shrink_dcache_parent() waiting for the dying child dentry to complete
eviction.
Stop transaction handle in ext4_rmdir() before calling d_invalidate().
Cc: stable@kernel.org
Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827125158.4030598-1-senozhatsky@chromium.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/namei.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 2c661155158f8..49bd70aab2255 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3204,19 +3204,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
ext4_fc_track_unlink(handle, dentry);
retval = ext4_mark_inode_dirty(handle, dir);
+end_rmdir:
+ brelse(bh);
+ if (handle)
+ ext4_journal_stop(handle);
+
/* VFS negative dentries are incompatible with Encoding and
* Case-insensitiveness. Eventually we'll want avoid
* invalidating the dentries here, alongside with returning the
* negative dentries at ext4_lookup(), when it is better
* supported by the VFS for the CI case.
*/
- if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
+ if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
d_invalidate(dentry);
-end_rmdir:
- brelse(bh);
- if (handle)
- ext4_journal_stop(handle);
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 423/869] ext4: fix out-of-bounds read in ext4_get_group_info()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 422/869] ext4: fix ABBA deadlock in ext4_rmdir() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 424/869] nilfs2: validate directory position after llseek in readdir Greg Kroah-Hartman
` (453 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Theodore Tso, Andreas Dilger,
Baokun Li, Jan Kara, Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, Jinjie Ruan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit b067d3c1f90b536e9aa9f48b19580475a0b34f0f ]
A plain read of s_groups_count in ext4_get_group_info() allows CPU
load-load reordering. On weak memory models, speculative prefetch of
s_group_info prior to the boundary check could lead to an out-of-bounds
read if a concurrent online resize expands the array and increments
s_groups_count.
The data race occurs between the ioctl configuration path (holding the
resize lock via ext4_resize_begin) and the lockless metadata lookup path:
CPU 0 (Writer, Resize Lock) CPU 1 (Reader, Lockless)
--------------------------- ------------------------
ext4_ioctl()
[EXT4_IOC_GROUP_ADD]
ext4_ioctl_group_add()
ext4_resize_begin() // Takes lock
ext4_group_add()
ext4_mb_alloc_groupinfo()
// Publishes expanded array via RCU
rcu_assign_pointer(s_group_info, ...)
ext4_flex_group_add()
ext4_update_super()
ext4_get_group_info()
// Speculative / out-of-order read
[Loads old/smaller s_group_info pointer]
[Plain C store / smp_wmb()]
sbi->s_groups_count += ...;
// Reads new s_groups_count,
// boundary check passes
if (group >= s_groups_count)
// Out-of-bounds array access!
sbi_array_rcu_deref(..., s_group_info)
Fix this by using ext4_get_groups_count() to enforce acquire semantics.
Cc: stable@vger.kernel.org
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Baokun Li <libaokun@linux.alibaba.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Zhang Yi <yi.zhang@huawei.com>
Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://patch.msgid.link/20260902074805.398540-8-ruanjinjie@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/balloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 08556dd45760d..b7d59eec7b3f6 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -329,7 +329,7 @@ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
struct ext4_group_info **grp_info;
long indexv, indexh;
- if (unlikely(group >= EXT4_SB(sb)->s_groups_count))
+ if (unlikely(group >= ext4_get_groups_count(sb)))
return NULL;
if (unlikely(!EXT4_SB(sb)->s_group_info))
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 424/869] nilfs2: validate directory position after llseek in readdir
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 423/869] ext4: fix out-of-bounds read in ext4_get_group_info() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 425/869] md: dont hand out the array before md_alloc() has added mddev->kobj Greg Kroah-Hartman
` (452 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jake Labelle, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jake Labelle <southampton.jake.labelle@gmail.com>
[ Upstream commit de7f49c12566cc5c7437a2f26c6c754b9d4d5648 ]
nilfs_readdir() uses ctx->pos, which userspace can set to an arbitrary
value via llseek, as an offset into the directory folio and parses
whatever bytes sit there as a directory entry. A position pointing
into the middle of an entry -- or at unused bytes of a corrupted image
that the page validator never inspected -- makes dir_emit() copy up to
255 (name_len) bytes from a bogus entry, possibly reading past the end
of the folio and returning unrelated memory contents to userspace.
Snap unaligned positions onto a valid entry boundary by walking the
rec_len chain from the chunk start before parsing, as ext2 does in
ext2_validate_entry().
[ryusuke: fixed offset wrap-around in nilfs_validate_entry() and
conformed AI tag to guidelines]
Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations")
Assisted-by: Claude:claude-mythos-5
Signed-off-by: Jake Labelle <southampton.jake.labelle@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/dir.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 6ca3d74be1e16..3e137c9ca1382 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -231,11 +231,27 @@ static struct nilfs_dir_entry *nilfs_next_entry(struct nilfs_dir_entry *p)
nilfs_rec_len_from_disk(p->rec_len));
}
+static inline unsigned int
+nilfs_validate_entry(char *base, unsigned int offset, unsigned int mask)
+{
+ struct nilfs_dir_entry *de = (struct nilfs_dir_entry *)(base + offset);
+ struct nilfs_dir_entry *p =
+ (struct nilfs_dir_entry *)(base + (offset & mask));
+
+ while ((char *)p < (char *)de) {
+ if (p->rec_len == 0)
+ break;
+ p = nilfs_next_entry(p);
+ }
+ return (char *)p - base;
+}
+
static int nilfs_readdir(struct file *file, struct dir_context *ctx)
{
loff_t pos = ctx->pos;
struct inode *inode = file_inode(file);
struct super_block *sb = inode->i_sb;
+ unsigned int chunk_size = nilfs_chunk_size(inode);
unsigned int offset = pos & ~PAGE_MASK;
unsigned long n = pos >> PAGE_SHIFT;
unsigned long npages = dir_pages(inode);
@@ -254,6 +270,24 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx)
ctx->pos += PAGE_SIZE - offset;
return -EIO;
}
+ /*
+ * ctx->pos comes from userspace via llseek and may point
+ * into the middle of an entry -- or at unvalidated bytes
+ * of a crafted image. offset is only nonzero here on the
+ * very first iteration (subsequent pages always start at
+ * offset 0, which -- like any chunk boundary -- is always
+ * a legitimate entry start, since no rec_len chain crosses
+ * a chunk boundary). Snap a non-chunk-aligned offset onto
+ * a real entry boundary by walking the chain from the
+ * enclosing chunk's start, as ext2 does; otherwise
+ * dir_emit() copies name_len bytes from a fake entry,
+ * reading past the end of the folio.
+ */
+ if (offset & (chunk_size - 1)) {
+ offset = nilfs_validate_entry(kaddr, offset,
+ ~(chunk_size - 1));
+ ctx->pos = ((loff_t)n << PAGE_SHIFT) + offset;
+ }
de = (struct nilfs_dir_entry *)(kaddr + offset);
limit = kaddr + nilfs_last_byte(inode, n) -
NILFS_DIR_REC_LEN(1);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 425/869] md: dont hand out the array before md_alloc() has added mddev->kobj
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 424/869] nilfs2: validate directory position after llseek in readdir Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 426/869] mm/memory: constrain generic_access_phys() to page boundary Greg Kroah-Hartman
` (451 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+95eeb4ada2349a2170ea, Yu Kuai,
Yogesh Gaur, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Gaur <yogeshgaur.83@gmail.com>
[ Upstream commit d1472ca2ca5de8ecd2b358411eb14c031404ecf0 ]
md_alloc() publishes the gendisk before it is done setting the mddev up:
disk->private_data = mddev;
...
error = add_disk(disk);
if (error)
goto out_put_disk;
kobject_init(&mddev->kobj, &md_ktype);
error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
add_disk() makes /dev/mdN openable. mddev comes from mddev_alloc() and
is zeroed, so anything that gets in between add_disk() and kobject_add()
sees an mddev->kobj that has never been through kobject_init() - no
ktype, no kref, state_initialized clear.
syzbot opens the array in that window and issues ADD_NEW_DISK:
kobject: '(null)' (ffff8880120640f0): is not initialized, yet
kobject_get() is being called.
WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0 lib/kobject.c:225
kobject_add_varg lib/kobject.c:374 [inline]
kobject_add+0x163/0x240 lib/kobject.c:426
bind_rdev_to_array+0x80c/0xdd0 drivers/md/md.c:2621
md_add_new_disk+0xe3b/0x1850 drivers/md/md.c:7684
md_ioctl+0x200a/0x2610 drivers/md/md.c:8499
bind_rdev_to_array() is not the only way in. md_run() calls
sysfs_create_group(&mddev->kobj, &md_redundancy_group), and
internal_create_group() has its own WARN_ON(!kobj->sd), so RUN_ARRAY in
the same window warns too.
Every ioctl that can reach mddev->kobj runs under reconfig_mutex, so
hold it across add_disk() and kobject_add(). An ioctl issued in the
window now waits for md_alloc() to finish instead of seeing a
half-built mddev, and opening the array still succeeds. The ioctls
md_ioctl() serves without the mutex only read array state and return
-ENODEV on an array with no disks.
Hoisting kobject_init() above add_disk() is not an option: commit
ca39f7502425 ("md: fix mddev->kobj lifetime") moved it below add_disk()
so that md_alloc()'s error paths, which free the mddev directly, never
see an initialised kobject.
Fixes: ca39f7502425 ("md: fix mddev->kobj lifetime")
Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6aaf3284.514bccd6.255447.0003.GAE@google.com/
Suggested-by: Yu Kuai <yukuai@fygo.io>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20261006122904.1538-1-yogeshgaur.83@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8d9e111939f64..937a2f4da84ba 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6258,12 +6258,22 @@ struct mddev *md_alloc(dev_t dev, char *name)
disk->events |= DISK_EVENT_MEDIA_CHANGE;
mddev->gendisk = disk;
+
+ /*
+ * add_disk() makes the array openable before mddev->kobj exists.
+ * Hold reconfig_mutex until kobject_add() is done so that ioctls
+ * issued in between wait instead of using an uninitialised kobj.
+ */
+ mddev_lock_nointr(mddev);
error = add_disk(disk);
- if (error)
+ if (error) {
+ mddev_unlock(mddev);
goto out_put_disk;
+ }
kobject_init(&mddev->kobj, &md_ktype);
error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
+ mddev_unlock(mddev);
if (error) {
/*
* The disk is already live at this point. Clear the hold flag
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 426/869] mm/memory: constrain generic_access_phys() to page boundary
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 425/869] md: dont hand out the array before md_alloc() has added mddev->kobj Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 427/869] mm/execmem: free ROX cache chunks only when they span an entire vm area Greg Kroah-Hartman
` (450 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luxiao Xu, Ren Wei, Andrew Morton,
Vega, David Hildenbrand, Grazvydas Ignotas, Liam R. Howlett,
Lorenzo Stoakes, Michal Hocko, Mike Rapoport, Suren Baghdasaryan,
Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <rakukuip@gmail.com>
[ Upstream commit ae0298a5fbeff32951c0d31398ccec97ec6aa0ea ]
This patch addresses an issue in generic_access_phys() where accessing
memory across page boundaries in PFNMAP VMAs assumes physical pages are
contiguous, which can lead to accessing unintended physical memory or
exceeding VMA boundaries.
generic_access_phys() improperly validates the memory access range: it
only validates the start address using follow_pfnmap_start() and passes
PAGE_ALIGN(len + offset) to ioremap_prot().
This poses two problems:
1. In PFNMAP VMAs, consecutive virtual pages are not guaranteed to be
physically contiguous, and individual PTEs may have different access
permissions or writability.
2. The mapping may cross VMA boundaries if len extends beyond vma->vm_end.
Constrain the access in generic_access_phys() to at most the current page
boundary (PAGE_SIZE - offset) and map only a single PAGE_SIZE via
ioremap_prot(). Since the caller __access_remote_vm() already loops over
the requested length and handles partial transfers, it will naturally
iterate over the remaining pages.
Also add a missing (resource_size_t) cast during PFN re-validation to
avoid truncation on 32-bit PAE systems.
Link: https://lore.kernel.org/e06e28a46c2a176238f03b5740df0913e57c2861.1788842306.git.rakukuip@gmail.com
Fixes: 9cb12d7b4cca ("mm/memory.c: actually remap enough memory")
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: David Hildenbrand <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Grazvydas Ignotas <notasas@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memory.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c
index 72793ec631072..d755b5c1f1287 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6813,6 +6813,12 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
bool writable;
struct follow_pfnmap_args args = { .vma = vma, .address = addr };
+ /*
+ * Limit access to one page at a time, as that's what follow_pfnmap_start()
+ * guarantees; expect the caller to retry to read larger ranges.
+ */
+ len = min_t(int, len, PAGE_SIZE - offset);
+
retry:
if (follow_pfnmap_start(&args))
return -EINVAL;
@@ -6824,7 +6830,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
if ((write & FOLL_WRITE) && !writable)
return -EINVAL;
- maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+ maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
if (!maddr)
return -ENOMEM;
@@ -6832,7 +6838,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
goto out_unmap;
if ((pgprot_val(prot) != pgprot_val(args.pgprot)) ||
- (phys_addr != (args.pfn << PAGE_SHIFT)) ||
+ (phys_addr != ((resource_size_t)args.pfn << PAGE_SHIFT)) ||
(writable != args.writable)) {
follow_pfnmap_end(&args);
iounmap(maddr);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 427/869] mm/execmem: free ROX cache chunks only when they span an entire vm area
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 426/869] mm/memory: constrain generic_access_phys() to page boundary Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 428/869] mm/nommu: reject wrapping ranges in access_remote_vm() Greg Kroah-Hartman
` (449 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Rapoport (Microsoft),
Andrew Morton, Benjamin Tissoires, Jiri Kosina, Luis Chamberalin,
Uladzislau Rezki (Sony), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit 52d95a55a0113408acd2d4ce0294a72c527f5092 ]
Patch series "mm/execmem: fixes and cleanups for the ROX cache".
Sashiko review of the ROX cache refill path asked what happens when the
PMD_SIZE allocation fails there. Pulling that thread uncovered a bit more
than the fallback.
Patch 1 fixes a real bug, although rare bug: execmem_cache_clean() can
free a chunk that is still partially in use, because a PMD sized and PMD
aligned free range in the middle of a larger chunk looks exactly like a
chunk that nobody uses.
Patch 2 handles maple tree allocation failures in the cache. They are
unlikely, but silently dropping an area from the tree is not a great way
to deal with them.
Patch 3 deals with the fallback that started all this. The cache exists
to keep the direct map free of unnecessary splits, and the fallback
happily filled it with base page mapped areas that could never be freed
from the cache again. Ask vmalloc for a huge mapping or nothing, and
serve whatever does not fit outside the cache.
Patches 4 and 5 convert the ROX cache to scope based cleanup.
The series was tested on x86 with module load/unload cycles, with PTDUMP
confirming that the cache is using 2M mappings, and with nohugevmalloc to
exercise the uncached fallback.
This patch (of 5):
When execmem refills the ROX cache, it vmalloc()s multiples of PMD_SIZE
aligned to PMD_SIZE. For every such allocation vmalloc creates a vm area.
The first part of the vmalloc()ed chunk is returned to the allocation that
triggered the cache refill and the remaining part is added to the cache
and handed out for subsequent allocations with execmem_alloc().
When only the first part is freed, the entire vm area remains in the ROX
cache and can be handed out again.
In the case when the first allocation is larger than PMD_SIZE and the
second allocation from the freed first part of the chunk is exactly
PMD_SIZE, execmem_cache_clean() will free the entire chunk while part of
it is still in use.
For example:
/*
* vmalloc(4M), return p0 to the caller
* add [p0 + 3M, p0 + 4M) to the cache
*/
p0 = execmem_alloc(3M);
/* return p0 + 3M from the cache to the caller */
p1 = execmem_alloc(1M);
/* put [p0, p0 + 3M) back into the cache */
execmem_free(p0);
/* return p0 from the cache to the caller */
p2 = execmem_alloc(2M);
/* return p0 + 2M from the cache to the caller */
p3 = execmem_alloc(1M);
/* bah! execmem_cache_clean() frees the entire 4M chunk */
execmem_free(p2);
Make sure that the ranges that execmem_cache_clean() frees cover the
entire vm area.
Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-0-11beb2a3d249@kernel.org
Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-1-11beb2a3d249@kernel.org
Fixes: 2e45474ab14f ("execmem: add support for cache of large ROX pages")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: copilot:claude-opus-5
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Luis Chamberalin <mcgrof@kernel.org>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/execmem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/execmem.c b/mm/execmem.c
index 084a207e4278b..9560441e57ab1 100644
--- a/mm/execmem.c
+++ b/mm/execmem.c
@@ -164,9 +164,11 @@ static void execmem_cache_clean(struct work_struct *work)
mutex_lock(mutex);
mas_for_each(&mas, area, ULONG_MAX) {
+ struct vm_struct *vm = find_vm_area(area);
size_t size = mas_range_len(&mas);
- if (IS_ALIGNED(size, PMD_SIZE) &&
+ if (vm && get_vm_area_size(vm) == size &&
+ IS_ALIGNED(size, PMD_SIZE) &&
IS_ALIGNED(mas.index, PMD_SIZE)) {
struct vm_struct *vm = find_vm_area(area);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 428/869] mm/nommu: reject wrapping ranges in access_remote_vm()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 427/869] mm/execmem: free ROX cache chunks only when they span an entire vm area Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 429/869] mm/hugetlb: fix subpool minimum reservation rollback Greg Kroah-Hartman
` (448 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anastasios Papagiannis,
Andrew Morton, Lorenzo Stoakes (ARM), Liam R. Howlett,
Hajime Tazaki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
[ Upstream commit 51a8de81fd2edbf87d8046e352060329bb216fad ]
The NOMMU implementation of access_process_vm() rejects address ranges
whose end wraps around, but access_remote_vm() bypasses this check even
though both functions delegate to __access_remote_vm().
Move the wraparound check into __access_remote_vm() so it applies to both
entry points.
This is originally reported in [1].
Link: https://lore.kernel.org/20260909064231.18693-1-tasos.papagiannnis@gmail.com
Fixes: f55f199b7d76 ("NOMMU: implement access_remote_vm")
Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://lore.kernel.org/bpf/4ef240a5bea36ff84df9589671367832860795159386a4c8fba546a0fa8b786f@mail.kernel.org/ [1]
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Hajime Tazaki <thehajime@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/nommu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/nommu.c b/mm/nommu.c
index c3a23b082adb9..d609ecdcf022b 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1644,6 +1644,9 @@ static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
struct vm_area_struct *vma;
int write = gup_flags & FOLL_WRITE;
+ if (addr + len < addr)
+ return 0;
+
if (mmap_read_lock_killable(mm))
return 0;
@@ -1697,9 +1700,6 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in
{
struct mm_struct *mm;
- if (addr + len < addr)
- return 0;
-
mm = get_task_mm(tsk);
if (!mm)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 429/869] mm/hugetlb: fix subpool minimum reservation rollback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 428/869] mm/nommu: reject wrapping ranges in access_remote_vm() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 430/869] mm/zswap: publish the initial pool with list_add_rcu() Greg Kroah-Hartman
` (447 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinmeng Zhou, Andrew Morton,
Muchun Song, Ackerley Tng, David Hildenbrand, Ma Wupeng,
Oscar Salvador, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinmeng Zhou <jinmengzhou22@gmail.com>
[ Upstream commit e4949a80f3b07e52dca76c34ce353633927a28a5 ]
When a reservation request is partially covered by a subpool minimum and
the remaining global reservation fails, the error path first calls
hugepage_subpool_put_pages() for the subpool-backed portion. It removes
the failed global portion from used_hpages only afterwards.
hugepage_subpool_put_pages() uses used_hpages to decide whether rsv_hpages
should be restored. Since used_hpages still includes the global portion,
it can remain at or above min_hpages and prevent that restoration. It
then reports the subpool reservation as releasable, causing
hugetlb_acct_memory() to incorrectly decrement h->resv_huge_pages.
This was reproduced with four 2 MB huge pages and a hugetlbfs mount with
size=10M,min_size=8M. After a successful three-page reservation, a
two-page reservation which needed one subpool page and one global page
failed with -ENOMEM. HugePages_Rsvd incorrectly dropped from four to
three even though the subpool minimum was still four pages.
Roll back the failed global portion from used_hpages first, so that
hugepage_subpool_put_pages() evaluates the minimum reservation against the
current usage and returns the correct global adjustment.
Link: https://lore.kernel.org/20260907132055.26696-1-zhoujinmeng@bytedance.com
Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: Jinmeng Zhou <zhoujinmeng@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ebc78406335b3..8832923dfbcd8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -7427,15 +7427,6 @@ long hugetlb_reserve_pages(struct inode *inode,
out_put_pages:
spool_resv = chg - gbl_reserve;
- if (spool_resv) {
- /* put sub pool's reservation back, chg - gbl_reserve */
- gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
- /*
- * subpool's reserved pages can not be put back due to race,
- * return to hstate.
- */
- hugetlb_acct_memory(h, -gbl_resv);
- }
/* Restore used_hpages for pages that failed global reservation */
if (gbl_reserve && spool) {
unsigned long flags;
@@ -7445,6 +7436,15 @@ long hugetlb_reserve_pages(struct inode *inode,
spool->used_hpages -= gbl_reserve;
unlock_or_release_subpool(spool, flags);
}
+ if (spool_resv) {
+ /* put sub pool's reservation back, chg - gbl_reserve */
+ gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
+ /*
+ * subpool's reserved pages can not be put back due to race,
+ * return to hstate.
+ */
+ hugetlb_acct_memory(h, -gbl_resv);
+ }
out_uncharge_cgroup:
hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h),
chg * pages_per_huge_page(h), h_cg);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 430/869] mm/zswap: publish the initial pool with list_add_rcu()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 429/869] mm/hugetlb: fix subpool minimum reservation rollback Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 431/869] mm/zswap: enable zswap_ever_enabled in zswap_pool_create() Greg Kroah-Hartman
` (446 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Andrew Morton, Sashiko,
Yosry Ahmed, Nhat Pham, Chengming Zhou, Johannes Weiner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
[ Upstream commit c1dd5e24a82d19bff8eef50ba8205d4776584aff ]
zswap_setup() publishes the pool on the zswap_pools list with a plain
list_add(), but the list is walked by concurrent RCU readers holding
nothing but rcu_read_lock() through zswap_total_pages(), e.g.
/proc/meminfo and the shrinker count path.
CPU 0 (writer) CPU 1 (reader)
-------------- --------------
zswap_pool_create():
pool->zs_pool = zs_create_pool(); (1)
list_add() -> __list_add():
WRITE_ONCE(zswap_pools.next,
&pool->list); (2) zswap_total_pages():
pool = READ_ONCE( (a)
zswap_pools.next);
zs_get_total_pages( (b)
pool->zs_pool);
If (2) becomes visible to CPU 1 before (1), CPU 1 finds the pool at (a)
but dereferences a wild pointer at (b). Publish the node with
list_add_rcu().
Link: https://lore.kernel.org/20260908012801.1864430-1-xialonglong2025@163.com
Fixes: 91cdcd8d624b ("mm: zswap: optimize zswap pool size tracking")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260906133601.3563324-1-xialonglong2025%40163.com
Acked-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Nhat Pham <nphamcs@gmail.com>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zswap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/zswap.c b/mm/zswap.c
index 18249dd96ef86..e4b2f6abefafb 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1818,7 +1818,7 @@ static int zswap_setup(void)
pool = __zswap_pool_create_fallback();
if (pool) {
pr_info("loaded using pool %s\n", pool->tfm_name);
- list_add(&pool->list, &zswap_pools);
+ list_add_rcu(&pool->list, &zswap_pools);
zswap_has_pool = true;
static_branch_enable(&zswap_ever_enabled);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 431/869] mm/zswap: enable zswap_ever_enabled in zswap_pool_create()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 430/869] mm/zswap: publish the initial pool with list_add_rcu() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 432/869] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name() Greg Kroah-Hartman
` (445 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Andrew Morton,
Yosry Ahmed, Chengming Zhou, Johannes Weiner, Nhat Pham,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
[ Upstream commit 91b4edb993e1549afdc3c2495216734b9f13f00e ]
If zswap is enabled by default at boot and pool creation fails, then a
pool is later created by updating the compressor, data written to zswap is
corrupted on swapin.
Enable the static key in zswap_pool_create(), covering boot-time and
runtime pool creation with a single site.
Verified with fault injection on a stock kernel (compressor builtin,
CONFIG_ZSWAP_DEFAULT_ON=n):
1. Boot with zswap.enabled=1; pool creation fails, init completes
pool-less (static key off).
2. Echo an available compressor name to zswap.compressor.
3. Enable zswap.
4. madvise(MADV_PAGEOUT) a pattern-verified 512 MiB region, then
fault it back in and verify.
Step 4 reads back 131072/131072 zeroed pages (zswpin=0, zswpout=131072)
without this patch; all pages intact (zswpin=131072) with it.
Link: https://lore.kernel.org/20260906135938.3568108-1-xialonglong2025@163.com
Fixes: 2d4d2b1cfb85 ("mm: zswap: add zswap_never_enabled()")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Yosry Ahmed <yosry@kernel.org>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zswap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/zswap.c b/mm/zswap.c
index e4b2f6abefafb..d2e5f0cff71db 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -288,6 +288,8 @@ static struct zswap_pool *zswap_pool_create(char *compressor)
zswap_pool_debug("created", pool);
+ static_branch_enable(&zswap_ever_enabled);
+
return pool;
ref_fail:
@@ -1820,7 +1822,6 @@ static int zswap_setup(void)
pr_info("loaded using pool %s\n", pool->tfm_name);
list_add_rcu(&pool->list, &zswap_pools);
zswap_has_pool = true;
- static_branch_enable(&zswap_ever_enabled);
} else {
pr_err("pool creation failed\n");
zswap_enabled = false;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 432/869] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 431/869] mm/zswap: enable zswap_ever_enabled in zswap_pool_create() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 433/869] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw() Greg Kroah-Hartman
` (444 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Abel Vesa, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 8e177ca735761a1f03e1dedffd7ab00d6d0540ae ]
imx_get_clk_hw_by_name() obtains a consumer clock with
of_clk_get_by_name(), extracts the hardware pointer with __clk_get_hw()
and returns it without ever calling clk_put(), leaking the consumer
reference on both return paths.
Extract the hardware pointer first and drop the clock reference with
clk_put() before returning.
Fixes: 3b315214e091 ("clk: imx: implement new clk_hw based APIs")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055515.1730145-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index df83bd939492e..542b58ccf120b 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -119,12 +119,16 @@ struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,
struct clk_hw *imx_get_clk_hw_by_name(struct device_node *np, const char *name)
{
struct clk *clk;
+ struct clk_hw *hw;
clk = of_clk_get_by_name(np, name);
if (IS_ERR(clk))
return ERR_PTR(-ENOENT);
- return __clk_get_hw(clk);
+ hw = __clk_get_hw(clk);
+ clk_put(clk);
+
+ return hw;
}
EXPORT_SYMBOL_GPL(imx_get_clk_hw_by_name);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 433/869] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 432/869] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 434/869] xen/gntdev: prevent private mappings from becoming writable Greg Kroah-Hartman
` (443 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Abel Vesa, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 52d4d1b26a5bc64de95099d0a3dd8b90dba1f3a3 ]
imx_obtain_fixed_clock_hw() obtains the clock through
imx_obtain_fixed_clock_from_dt(), which creates a consumer reference
via of_clk_get_from_provider(). The reference is discarded right after
__clk_get_hw() returns the hardware pointer, leaking it.
Keep the imx_clk_fixed() fallback unchanged and drop the DT-obtained
consumer reference with clk_put() once the hardware pointer has been
extracted.
Fixes: a4a4069f4523 ("clk: imx: Add imx_obtain_fixed_clock clk_hw based variant")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055631.1730231-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index 542b58ccf120b..153e7405eae4d 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -95,11 +95,16 @@ struct clk_hw *imx_obtain_fixed_clock_hw(
const char *name, unsigned long rate)
{
struct clk *clk;
+ struct clk_hw *hw;
clk = imx_obtain_fixed_clock_from_dt(name);
if (IS_ERR(clk))
- clk = imx_clk_fixed(name, rate);
- return __clk_get_hw(clk);
+ return __clk_get_hw(imx_clk_fixed(name, rate));
+
+ hw = __clk_get_hw(clk);
+ clk_put(clk);
+
+ return hw;
}
struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 434/869] xen/gntdev: prevent private mappings from becoming writable
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 433/869] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 435/869] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() Greg Kroah-Hartman
` (442 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Juergen Gross,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
[ Upstream commit 2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a ]
gntdev_mmap() rejects writable private (non-shared) mappings of foreign
grant pages, because a private writable mapping takes the COW path on
pages that have no proper struct-page backing. However, VM_MAYWRITE is
left set, so userspace can map the grant read-only and then upgrade the
mapping to writable with mprotect(), hitting the same COW path the
check was written to prevent.
Clear VM_MAYWRITE for private mappings, as i915 does for its read-only
objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor
(CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260819084217.1577-1-suruurism@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/gntdev.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1e21b75114e5e..02ebbdba86101 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1072,6 +1072,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED))
return -EINVAL;
+ /*
+ * Private mappings of foreign grant pages must never become
+ * writable: they would take the COW path on granted pages.
+ */
+ if (!(vma->vm_flags & VM_SHARED))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
pr_debug("map %d+%d at %lx (pgoff %lx)\n",
index, count, vma->vm_start, vma->vm_pgoff);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 435/869] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 434/869] xen/gntdev: prevent private mappings from becoming writable Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 436/869] soc: fsl: dpio: Fix cleanup on IRQ registration failure Greg Kroah-Hartman
` (441 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Herve Codina,
Christophe Leroy (CS GROUP), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 46201d760c48e771fa2febfcb0787f22c3b71387 ]
The error cleanup loop puts l1rsync_clk and l1rclk_clk a second time
and never puts l1tsync_clk or l1tclk_clk, because the branches that
guard the transmit clocks use the receive clock field names.
Use the matching field in each branch so every clock acquired by
tsa_of_parse_tdms() is released exactly once.
Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://lore.kernel.org/r/20260917152719.2160395-1-vulab@iscas.ac.cn
[chleroy: Fixed the same in tsa_remove()]
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/qe/tsa.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/fsl/qe/tsa.c b/drivers/soc/fsl/qe/tsa.c
index 4a88e54d25b94..502e2ffe86898 100644
--- a/drivers/soc/fsl/qe/tsa.c
+++ b/drivers/soc/fsl/qe/tsa.c
@@ -865,12 +865,12 @@ static int tsa_of_parse_tdms(struct tsa *tsa, struct device_node *np)
clk_put(tsa->tdm[i].l1rclk_clk);
}
if (tsa->tdm[i].l1tsync_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
- clk_put(tsa->tdm[i].l1rsync_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+ clk_put(tsa->tdm[i].l1tsync_clk);
}
if (tsa->tdm[i].l1tclk_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
- clk_put(tsa->tdm[i].l1rclk_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+ clk_put(tsa->tdm[i].l1tclk_clk);
}
}
return ret;
@@ -1039,12 +1039,12 @@ static void tsa_remove(struct platform_device *pdev)
clk_put(tsa->tdm[i].l1rclk_clk);
}
if (tsa->tdm[i].l1tsync_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
- clk_put(tsa->tdm[i].l1rsync_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+ clk_put(tsa->tdm[i].l1tsync_clk);
}
if (tsa->tdm[i].l1tclk_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
- clk_put(tsa->tdm[i].l1rclk_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+ clk_put(tsa->tdm[i].l1tclk_clk);
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 436/869] soc: fsl: dpio: Fix cleanup on IRQ registration failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 435/869] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 6.18 437/869] soc: fsl: dpio: Free the IRQ before releasing the I/O object Greg Kroah-Hartman
` (440 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Ioana Ciornei, Christophe Leroy (CS GROUP), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 45ecea8c55521d424513178fb612cefffb09a9f5 ]
IRQ registration happens after dpaa2_io_create(), but its failure path
only releases the IRQ resources and the MC portal. The I/O object stays
allocated and published in the service list and per-CPU lookup table,
while devres unmaps its portal registers after probe fails.
Call dpaa2_io_down() on IRQ registration failure to remove the object
from those lookup structures and free it. Reorder the error labels so
that a failed dpaa2_io_create() still skips this cleanup.
Remove unregister_dpio_irq_handlers() from the probe error path, since
no IRQ handler or affinity hint has been installed when registration
fails.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: fe8fe7723a3a ("soc: fsl: dpio: register dpio irq handlers after dpio create")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-2-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/dpio/dpio-driver.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index 9e3fddd8f5a91..7dc65f38d2fdb 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -248,9 +248,9 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
return 0;
-err_dpaa2_io_create:
- unregister_dpio_irq_handlers(dpio_dev);
err_register_dpio_irq:
+ dpaa2_io_down(priv->io);
+err_dpaa2_io_create:
fsl_mc_free_irqs(dpio_dev);
err_allocate_irqs:
dpio_disable(dpio_dev->mc_io, 0, dpio_dev->mc_handle);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 437/869] soc: fsl: dpio: Free the IRQ before releasing the I/O object
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 436/869] soc: fsl: dpio: Fix cleanup on IRQ registration failure Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 438/869] xen/privcmd: Only claim ioreqs matching an ioeventfd Greg Kroah-Hartman
` (439 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Ioana Ciornei, Christophe Leroy (CS GROUP), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit a7831c657c90e8f9165f6bbe0cc56262fee075e8 ]
The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
releases that object before tearing down the interrupts. The IRQ was
requested with devm_request_irq(), and unregister_dpio_irq_handlers()
only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
to the MC resource pool without freeing the handler. An interrupt can
therefore access the freed I/O object before devres releases the IRQ.
Explicitly free the managed IRQ in unregister_dpio_irq_handlers() before
returning its resource to the pool, and perform IRQ teardown before
releasing the I/O object. This also waits for an in-flight handler while
the object is still valid.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-3-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/dpio/dpio-driver.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index 7dc65f38d2fdb..2962e66e2e413 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -88,6 +88,7 @@ static void unregister_dpio_irq_handlers(struct fsl_mc_device *dpio_dev)
/* clear the affinity hint */
irq_set_affinity_hint(irq->virq, NULL);
+ devm_free_irq(&dpio_dev->dev, irq->virq, &dpio_dev->dev);
}
static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
@@ -280,10 +281,10 @@ static void dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev)
priv = dev_get_drvdata(dev);
cpu = dpaa2_io_get_cpu(priv->io);
- dpaa2_io_down(priv->io);
-
dpio_teardown_irqs(dpio_dev);
+ dpaa2_io_down(priv->io);
+
cpumask_set_cpu(cpu, cpus_unused_mask);
err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 438/869] xen/privcmd: Only claim ioreqs matching an ioeventfd
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 6.18 437/869] soc: fsl: dpio: Free the IRQ before releasing the I/O object Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 439/869] xen/pcifront: check that an AER callback exists before calling it Greg Kroah-Hartman
` (438 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Juergen Gross,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 908019e5999161ca89da310c05ddbf7fc89c129e ]
The ioeventfd handler shares its event channel with the userspace device
model. It must only claim requests that match a registered ioeventfd.
Other requests are left for userspace.
ioeventfd_interrupt() currently marks every MMIO write INPROCESS before
looking for a match. For an unmatched request it drops the lock and
restores READY. Userspace may see INPROCESS and skip it. Restoring READY
does not send another notification. If userspace handles the request at
the same time, the READY store may overwrite its state.
Find a matching ioeventfd before changing the request state.
The lock now protects only the ioeventfd list. Use explicit virt_*mb()
barriers for the ioreq shared with Xen.
Fixes: f0d7db7b3324 ("xen: privcmd: Add support for ioeventfd")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260821084112.2374949-1-den@valinux.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/privcmd.c | 47 +++++++++++++++++--------------------------
1 file changed, 18 insertions(+), 29 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index f37d8d212c066..fc21473672d4b 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1168,51 +1168,40 @@ static irqreturn_t ioeventfd_interrupt(int irq, void *dev_id)
struct privcmd_kernel_ioreq *kioreq = port->kioreq;
struct ioreq *ioreq = &kioreq->ioreq[port->vcpu];
struct privcmd_kernel_ioeventfd *kioeventfd;
- unsigned int state = STATE_IOREQ_READY;
+ bool matched = false;
- if (ioreq->state != STATE_IOREQ_READY ||
- ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+ if (ioreq->state != STATE_IOREQ_READY)
return IRQ_NONE;
- /*
- * We need a barrier, smp_mb(), here to ensure reads are finished before
- * `state` is updated. Since the lock implementation ensures that
- * appropriate barrier will be added anyway, we can avoid adding
- * explicit barrier here.
- *
- * Ideally we don't need to update `state` within the locks, but we do
- * that here to avoid adding explicit barrier.
- */
+ /* Xen publishes the request before changing its state to READY. */
+ virt_rmb();
- spin_lock(&kioreq->lock);
- ioreq->state = STATE_IOREQ_INPROCESS;
+ if (ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+ return IRQ_NONE;
+ spin_lock(&kioreq->lock);
list_for_each_entry(kioeventfd, &kioreq->ioeventfds, list) {
if (ioreq->addr == kioeventfd->addr + VIRTIO_MMIO_QUEUE_NOTIFY &&
ioreq->size == kioeventfd->addr_len &&
(ioreq->data & QUEUE_NOTIFY_VQ_MASK) == kioeventfd->vq) {
+ /* Finish reading the request before claiming it. */
+ virt_mb();
+ ioreq->state = STATE_IOREQ_INPROCESS;
eventfd_signal(kioeventfd->eventfd);
- state = STATE_IORESP_READY;
+ matched = true;
break;
}
}
spin_unlock(&kioreq->lock);
- /*
- * We need a barrier, smp_mb(), here to ensure writes are finished
- * before `state` is updated. Since the lock implementation ensures that
- * appropriate barrier will be added anyway, we can avoid adding
- * explicit barrier here.
- */
-
- ioreq->state = state;
-
- if (state == STATE_IORESP_READY) {
- notify_remote_via_evtchn(port->port);
- return IRQ_HANDLED;
- }
+ if (!matched)
+ return IRQ_NONE;
- return IRQ_NONE;
+ /* Publish the response only after signaling the eventfd. */
+ virt_wmb();
+ ioreq->state = STATE_IORESP_READY;
+ notify_remote_via_evtchn(port->port);
+ return IRQ_HANDLED;
}
static void ioreq_free(struct privcmd_kernel_ioreq *kioreq)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 439/869] xen/pcifront: check that an AER callback exists before calling it
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 438/869] xen/privcmd: Only claim ioreqs matching an ioeventfd Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 440/869] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() Greg Kroah-Hartman
` (437 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Juergen Gross,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 3b4854b69ee70fffb2fa7acac09e715a7efcbae1 ]
pcifront_common_process() handles an AER request from the backend by
dispatching on aer_op.cmd to the bound driver's PCI error handler. It
only checks that err_handler and err_handler->error_detected are present,
then for the mmio_enabled, slot_reset and resume commands it calls the
corresponding callback unconditionally. Those three callbacks are
optional -- the PCI core NULL-checks each of them individually before
use -- and many drivers (for example igb, igc, ice and ixgbevf) install
error_detected without all of them.
aer_op.cmd comes from the shared ring, so a malicious or buggy backend
can send XEN_PCI_OP_aer_mmio (or _slotreset/_resume) for a device whose
driver leaves that callback NULL and make the frontend call through a
NULL pointer, crashing the guest.
Check each callback before calling it. When mmio_enabled or slot_reset is
absent, return PCI_ERS_RESULT_RECOVERED so recovery proceeds, as the PCI
core does for a missing callback; returning PCI_ERS_RESULT_NONE would
instead make xen-pciback tear the guest domain down.
Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006023443.338194-1-yhlee@isslab.korea.ac.kr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/xen-pcifront.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index 11636634ae512..451476ce10ae9 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -599,11 +599,16 @@ static pci_ers_result_t pcifront_common_process(int cmd,
case XEN_PCI_OP_aer_detected:
return pdrv->err_handler->error_detected(pcidev, state);
case XEN_PCI_OP_aer_mmio:
- return pdrv->err_handler->mmio_enabled(pcidev);
+ if (pdrv->err_handler->mmio_enabled)
+ return pdrv->err_handler->mmio_enabled(pcidev);
+ return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_slotreset:
- return pdrv->err_handler->slot_reset(pcidev);
+ if (pdrv->err_handler->slot_reset)
+ return pdrv->err_handler->slot_reset(pcidev);
+ return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_resume:
- pdrv->err_handler->resume(pcidev);
+ if (pdrv->err_handler->resume)
+ pdrv->err_handler->resume(pcidev);
return PCI_ERS_RESULT_NONE;
default:
dev_err(&pdev->xdev->dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 440/869] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 439/869] xen/pcifront: check that an AER callback exists before calling it Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 441/869] iommu/dma: Catch scatterlist length overflows Greg Kroah-Hartman
` (436 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Juergen Gross,
Jiqian Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit cfaf31becde901f7a2376d36db628f8be0bc7283 ]
pcistub_get_gsi_from_sbdf() obtains the stub device with
pcistub_device_find(), which returns it with its kref incremented, and
returns psdev->gsi without dropping that reference again. The caller
cannot release it either, so every lookup leaks one reference to the
stub device.
Release the reference after reading gsi.
Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jiqian Chen <Jiqian.Chen@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260916171141.2086627-1-vulab@iscas.ac.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 7de2fa67743c6..b128ceeee21bc 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
int bus = PCI_BUS_NUM(sbdf);
int slot = PCI_SLOT(sbdf);
int func = PCI_FUNC(sbdf);
+ int gsi;
psdev = pcistub_device_find(domain, bus, slot, func);
-
if (!psdev)
return -ENODEV;
- return psdev->gsi;
+ gsi = psdev->gsi;
+ pcistub_device_put(psdev);
+
+ return gsi;
}
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 441/869] iommu/dma: Catch scatterlist length overflows
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 440/869] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 442/869] drm/ttm: return an error when kmapping a BO without pages Greg Kroah-Hartman
` (435 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Karas, Robin Murphy,
Sebastian Brzezinka, Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <krzysztof.karas@intel.com>
[ Upstream commit 1c8f6308e557f32412e9d4678b3f029f47f6d9aa ]
It is possible, when a very large mapping uses only one
scatterlist, that padding overflows scatterlist's length field.
This results in:
1) silently wrapping the value
2) smaller than desired mappings produced by iommu_map_sg
3) leaving mapped bytes in memory (no iommu_unmap)
Address this issue by adding overflow detection for scatterlist
length field.
Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 9da773ba550ba..aa9ebf2bc96ed 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1453,6 +1453,11 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
sg_dma_len(s) = s_length;
s->offset -= s_iova_off;
s_length = iova_align(iovad, s_length + s_iova_off);
+ if (overflows_type(s_length, s->length)) {
+ ret = -EOVERFLOW;
+
+ goto out_restore_sg;
+ }
s->length = s_length;
/*
@@ -1469,7 +1474,20 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
* time through here (i.e. before it has a meaningful value).
*/
if (pad_len && pad_len < s_length - 1) {
- prev->length += pad_len;
+ unsigned int new_prev_len;
+
+ /*
+ * For large mappings spanning multiple GBs we
+ * may not be able to fit all needed padding into
+ * sg->length.
+ */
+ if (check_add_overflow(prev->length, pad_len, &new_prev_len)) {
+ ret = -EOVERFLOW;
+
+ goto out_restore_sg;
+ }
+
+ prev->length = new_prev_len;
iova_len += pad_len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 442/869] drm/ttm: return an error when kmapping a BO without pages
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 441/869] iommu/dma: Catch scatterlist length overflows Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 443/869] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200 Greg Kroah-Hartman
` (434 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Jesse Zhang,
Arunpravin Paneer Selvam, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit fd485d47437ba1700dd47205a63b9f389a00aa36 ]
ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
ttm->pages for them, so a driver that tries to CPU map such a BO oopses
instead of getting an error:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
Call Trace:
amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]
Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
checks for a missing pages array.
Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
Cc: stable@vger.kernel.org
Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20261009103419.4122940-1-Jesse.Zhang@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7aa35899e33ce..7c1edf8c5c2df 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -359,6 +359,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
if (ret)
return ret;
+ /* Imported sg tables only come with DMA addresses, no pages to map. */
+ if (!ttm->pages)
+ return -EINVAL;
+
if (num_pages == 1 && ttm->caching == ttm_cached &&
!(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
/*
@@ -422,7 +426,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_kmap(struct ttm_buffer_object *bo,
unsigned long start_page, unsigned long num_pages,
@@ -496,7 +500,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
{
@@ -543,6 +547,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
if (ret)
return ret;
+ if (!ttm->pages)
+ return -EINVAL;
+
/*
* We need to use vmap to get the desired page protection
* or to make the buffer object look contiguous.
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 443/869] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 442/869] drm/ttm: return an error when kmapping a BO without pages Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 444/869] wifi: ath12k: validate MAC/PHY capability count before saving Greg Kroah-Hartman
` (433 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olivier Kaloudoff, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
[ Upstream commit 874323b68c93c6808e034dc0113681e822e6fb42 ]
The C200 (046d:0802) reports a mic capture volume range of
1536..7680 with a resolution of 1 (6144 steps), triggering
"Warning! Unlikely big volume step count (=6144), linear volume or
wrong cval->res?" at probe and exposing a uselessly fine-grained
mixer control. This is the same firmware behavior as the other
UVC-era Logitech webcams already carrying QUIRK_FLAG_MIC_RES_384
(C500, C600, C210, C270, C310, C510, C525, ...), so apply the same
quirk: CTL_MSG_DELAY_1M (which the Logitech VENDOR_FLG would provide
if the device-specific entry did not short-circuit the lookup) plus
MIC_RES_384.
Verified on real hardware: with the quirk the warning disappears and
the driver logs "set resolution quirk: cval->res = 384".
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261008230844.11246-1-olivier.kaloudoff@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index be80d9d14e0ad..01a5564eda7af 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2161,6 +2161,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_DISABLE_AUTOSUSPEND),
DEVICE_FLG(0x045e, 0x070f, /* MS LifeChat LX-3000 Headset */
QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
+ DEVICE_FLG(0x046d, 0x0802, /* Logitech Webcam C200 */
+ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */
QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 444/869] wifi: ath12k: validate MAC/PHY capability count before saving
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 443/869] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200 Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 445/869] USB: cdc-acm: fix urb leak on disconnect Greg Kroah-Hartman
` (432 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Rameshkumar Sundaram,
Baochen Qiang, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 86f2537877d6029487811bc3e0cd9e086a196000 ]
Firmware supplies the hardware mode count and the PHY bitmap for each
mode in the service-ready-ext event. ath12k_wmi_save_all_mac_phy_info()
uses those bitmaps to populate svc_ext_info->mac_phy_info, but the
destination is a fixed array of ATH12K_MAX_MAC_PHY_CAP elements.
If the total number of advertised PHY entries exceeds that limit, the
loop writes beyond mac_phy_info and corrupts adjacent memory.
ath12k_wmi_mac_phy_caps_parse() allocates the source array for
tot_phy_id entries and rejects excess capability TLVs. However, if the
event contains fewer capability TLVs than advertised, the remaining
allocated entries stay zeroed and are saved as invalid PHY information.
After parsing the MAC/PHY capability TLVs, validate the destination
capacity and reject an incomplete capability list before saving any
entries.
Fixes: 062ade23991e ("wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20261003101944.596546-1-yaojiale02@163.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 91f293ab70137..67c9174a30aab 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4814,6 +4814,7 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
u16 tag, u16 len,
const void *ptr, void *data)
{
+ struct ath12k_svc_ext_info *svc_ext_info = &ab->wmi_ab.svc_ext_info;
struct ath12k_wmi_pdev *wmi_handle = &ab->wmi_ab.wmi[0];
struct ath12k_wmi_svc_rdy_ext_parse *svc_rdy_ext = data;
int ret;
@@ -4858,6 +4859,22 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
return ret;
}
+ if (svc_rdy_ext->tot_phy_id >
+ ARRAY_SIZE(svc_ext_info->mac_phy_info)) {
+ ath12k_warn(ab, "too many PHY entries %u (max %zu)\n",
+ svc_rdy_ext->tot_phy_id,
+ ARRAY_SIZE(svc_ext_info->mac_phy_info));
+ return -EINVAL;
+ }
+
+ if (svc_rdy_ext->n_mac_phy_caps < svc_rdy_ext->tot_phy_id) {
+ ath12k_warn(ab,
+ "not enough MAC/PHY caps %u, expected %u\n",
+ svc_rdy_ext->n_mac_phy_caps,
+ svc_rdy_ext->tot_phy_id);
+ return -EINVAL;
+ }
+
ath12k_wmi_save_all_mac_phy_info(ab, svc_rdy_ext);
svc_rdy_ext->mac_phy_done = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 445/869] USB: cdc-acm: fix urb leak on disconnect
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 444/869] wifi: ath12k: validate MAC/PHY capability count before saving Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 446/869] USB: serial: option: add Rolling Wireless RN947R Greg Kroah-Hartman
` (431 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Johan Hovold,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 648b08aa37c1b24a61662ad78964f2bca659ca26 ]
Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.
Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260917161217.2161883-1-vulab@iscas.ac.cn/
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261009122934.464142-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-acm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index b980cb08d675b..884dc80868ca9 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -782,6 +782,7 @@ static void acm_port_shutdown(struct tty_port *port)
urb = usb_get_from_anchor(&acm->delayed);
if (!urb)
break;
+ usb_put_urb(urb);
wb = urb->context;
wb->use = false;
usb_autopm_put_interface_async(acm->control);
@@ -1710,7 +1711,7 @@ static int acm_resume(struct usb_interface *intf)
urb = usb_get_from_anchor(&acm->delayed);
if (!urb)
break;
-
+ usb_put_urb(urb);
acm_start_wb(acm, urb->context);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 446/869] USB: serial: option: add Rolling Wireless RN947R
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 445/869] USB: cdc-acm: fix urb leak on disconnect Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 447/869] USB: serial: option: add support for ASR 1286:4e3c modem Greg Kroah-Hartman
` (430 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Reinhard Speyerer, Johan Hovold,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinhard Speyerer <rspmn@arcor.de>
[ Upstream commit 931aad81f3f2d26276fff6b7bda6793267a65725 ]
Add Rolling Wireless RN947R 0x9300 compositions:
Standard mode: DIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 6 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=9300 Rev= 0.00
S: Manufacturer=Rolling Wireless
S: Product=RN947R
S: SerialNumber=xxxxxxxxxxx
C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=21 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=22 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
QDL mode:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 12 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=9300 Rev= 0.00
S: Manufacturer=Rolling Wireless
S: Product=RN947R
S: SerialNumber=xxxxxxxxxxx
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr= 2mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/option.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 0f9a7a4c1f66e..416ec012b0ace 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2511,6 +2511,10 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff), /* Rolling RW135R-GL (laptop MBIM) */
.driver_info = RSVD(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x30) }, /* Rolling RN947R */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
{ USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) }, /* TDTECH MT5710-CN */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 447/869] USB: serial: option: add support for ASR 1286:4e3c modem
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 446/869] USB: serial: option: add Rolling Wireless RN947R Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 448/869] USB: serial: usb_wwan: fix urb leak on disconnect Greg Kroah-Hartman
` (429 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Wyraz, Johan Hovold,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Wyraz <michael@wyraz.de>
[ Upstream commit 87c56085bcdfec305f5c350fe1c58a62a7f65843 ]
The ASR modem used in the Tuoshi LT22M exposes an RNDIS function on
interfaces 0 and 1, a diagnostic port on interface 2, and AT ports on
interfaces 3 and 4. Match only the vendor-specific serial interfaces
so option does not bind to the RNDIS function.
Link: https://lore.kernel.org/all/d12635f9-9706-4dbd-8adb-d673c6a77202@wyraz.de/
Signed-off-by: Michael Wyraz <michael@wyraz.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 416ec012b0ace..2f83e7b866f60 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2444,6 +2444,7 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x30) }, /* Compal EXM-G1x */
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1286, 0x4e3c, 0xff) }, /* ASR modem */
{ USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
.driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
{ USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 448/869] USB: serial: usb_wwan: fix urb leak on disconnect
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 447/869] USB: serial: option: add support for ASR 1286:4e3c modem Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 449/869] slimbus: messaging: fix leaked PM vote on tid allocation failure Greg Kroah-Hartman
` (428 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Oliver Neukum,
Johan Hovold, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit c78dd373b5c56a5a02da591b583c6b48d0d62954 ]
Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.
Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the option driver")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165608.2085613-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org # 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/usb_wwan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 0017f6e969e12..67e1820bbbafe 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -402,6 +402,7 @@ void usb_wwan_close(struct usb_serial_port *port)
urb = usb_get_from_anchor(&portdata->delayed);
if (!urb)
break;
+ usb_put_urb(urb);
unbusy_queued_urb(urb, portdata);
usb_autopm_put_interface_async(serial->interface);
}
@@ -579,6 +580,8 @@ static int usb_wwan_submit_delayed_urbs(struct usb_serial_port *port)
if (!urb)
break;
+ usb_put_urb(urb);
+
err = usb_submit_urb(urb, GFP_ATOMIC);
if (err) {
dev_err(&port->dev, "%s: submit urb failed: %d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 449/869] slimbus: messaging: fix leaked PM vote on tid allocation failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 448/869] USB: serial: usb_wwan: fix urb leak on disconnect Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 450/869] xen-blkfront: Fix IO race during unplug Greg Kroah-Hartman
` (427 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zongmin Zhou, Srinivas Kandagatla,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <zhouzongmin@kylinos.cn>
[ Upstream commit c26cc979e28f5193310e4379e14aa6417375c565 ]
In slim_do_transfer(), when a transaction needs a tid and
slim_alloc_txn_tid() fails, the function returns directly instead of
jumping to slim_xfer_err. The runtime PM vote taken earlier with
pm_runtime_get_sync() is then never released, leaving the controller
permanently powered up.
As txn->tid is still 0 at that point, jumping to slim_xfer_err drops
the vote exactly like it is done for other failed transactions.
Fixes: d3062a2109309 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
Cc: stable@vger.kernel.org
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101448.1084691-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/messaging.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index e2dbe4a66b703..ee127ef42046b 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
if (need_tid) {
ret = slim_alloc_txn_tid(ctrl, txn);
if (ret)
- return ret;
+ goto slim_xfer_err;
if (!txn->msg->comp)
txn->comp = &done;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 450/869] xen-blkfront: Fix IO race during unplug
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 449/869] slimbus: messaging: fix leaked PM vote on tid allocation failure Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 451/869] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id Greg Kroah-Hartman
` (426 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ross Lagerwall, Roger Pau Monné,
Juergen Gross, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <ross.lagerwall@citrix.com>
[ Upstream commit 61b6d1df1d6234c38a6ea7e4f58e7da035ef6ab4 ]
During unplug, blkfront stops the hw queues and marks the disk as dead,
then later during removal calls del_gendisk(). However, IO issued after
the hw queues are stopped but before the call to del_gendisk() will be
queued but never handled. This causes del_gendisk() to hang forever
waiting for the queue refcount to drop to zero.
This can be reproduced by issuing IO during an artificial delay after
stopping the hw queues.
Fix this by simply not stopping the hw queues directly. Marking the disk
as dead already freezes the queue which prevents new requests being
added and it synchronously runs the hw queues to clear anything pending.
If the hw queues are stopped when calling blk_mark_disk_dead(), running
the hw queues is a no-op and can leave queued requests unprocessed.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006163411.2583538-1-ross.lagerwall@citrix.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/xen-blkfront.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index f37290fd3c5db..79fe0b107887c 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2133,10 +2133,8 @@ static void blkfront_closing(struct blkfront_info *info)
return;
/* No more blkif_request(). */
- if (info->rq && info->gd) {
- blk_mq_stop_hw_queues(info->rq);
+ if (info->gd)
blk_mark_disk_dead(info->gd);
- }
for_each_rinfo(info, rinfo, i) {
/* No more gnttab callback work. */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 451/869] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 450/869] xen-blkfront: Fix IO race during unplug Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 452/869] vfio/mlx5: Fix boundary check in set_report_output() Greg Kroah-Hartman
` (425 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Jones, Xiaofeng Yuan,
Nutty Liu, Troy Mitchell, Anup Patel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
[ Upstream commit c367d3bf721f2bc391d6cfb47f6884e99d563df0 ]
The SBI IPI handler walks vCPUs with kvm_for_each_vcpu(), which
iterates by vcpu_idx (creation order) rather than vcpu_id order.
Since vcpu_id can be assigned out of order by userspace, a vCPU whose
hart_bit falls outside the XLEN-bit hart_mask range may be reached
before vCPUs the mask actually targets. In that case the handler jumps
to "done" and stops sending IPIs, leaving valid target vCPUs without
an interrupt.
Replace the early "goto done" with "continue" so vCPUs outside the
hart_mask range are skipped without aborting the loop.
Reproduced with a minimal userspace VMM driving KVM inside a QEMU
(RISC-V virt) guest: three vCPUs are created with ids 100, 0, 1 (in
creation order) and sbi_send_ipi(hart_mask=bit0, hbase=0) is called
from vcpu_id 1. Before this change the IPI is dropped and the ecall
returns SBI_ERR_INVALID_PARAM; with this change the IPI is delivered
and the ecall returns SBI_SUCCESS.
Fixes: 0611f78f83c9 ("riscv: KVM: Fix SBI IPI error generation")
Cc: stable@vger.kernel.org
Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260917122012.2577-1-yuanxiaofeng@eswincomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kvm/vcpu_sbi_replace.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c
index b490ed1428a68..df3818fec0bfa 100644
--- a/arch/riscv/kvm/vcpu_sbi_replace.c
+++ b/arch/riscv/kvm/vcpu_sbi_replace.c
@@ -64,8 +64,17 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
if (tmp->vcpu_id < hbase)
continue;
hart_bit = tmp->vcpu_id - hbase;
+ /*
+ * kvm_for_each_vcpu() walks kvm->vcpus[] by
+ * vcpu_idx, i.e. the creation order, which has
+ * nothing to do with the vcpu_id (hart id) space
+ * that the SBI IPI operates on. vcpu_ids need not
+ * increase along the iteration, so harts outside
+ * the hart_mask window must be skipped instead of
+ * aborting the loop.
+ */
if (hart_bit >= __riscv_xlen)
- goto done;
+ continue;
if (!(hmask & (1UL << hart_bit)))
continue;
}
@@ -76,7 +85,6 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
kvm_riscv_vcpu_pmu_incr_fw(tmp, SBI_PMU_FW_IPI_RCVD);
}
-done:
if (hbase != -1UL && (hmask ^ sentmask))
retdata->err_val = SBI_ERR_INVALID_PARAM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 452/869] vfio/mlx5: Fix boundary check in set_report_output()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 451/869] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 453/869] cxl/pci: Program the Port GPF timeouts before caching the DVSEC Greg Kroah-Hartman
` (424 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yishai Hadas, Seongjun Hong,
Alex Williamson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seongjun Hong <hsj0512@snu.ac.kr>
[ Upstream commit 37b2ee6747b7857920ebc71eabc25208a39164a4 ]
Use > instead of >= on boundary check of recv_buf to avoid the bug which
the full message in the last slot of recv_buf is ignored even though the
received data size does not overflow the recv_buf.
Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
Cc: stable@vger.kernel.org
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
Link: https://lore.kernel.org/r/20261005-vfio-mlx5-fix-boundary-check-v2-1-75599d2f4497@snu.ac.kr
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/mlx5/cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
index a92b095b90f6a..a870ea1c0e9d3 100644
--- a/drivers/vfio/pci/mlx5/cmd.c
+++ b/drivers/vfio/pci/mlx5/cmd.c
@@ -1627,7 +1627,7 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
int i;
buf_offset = index * qp->max_msg_size;
- if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
+ if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
(nent > qp->max_msg_size / entry_size)))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 453/869] cxl/pci: Program the Port GPF timeouts before caching the DVSEC
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 452/869] vfio/mlx5: Fix boundary check in set_report_output() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 454/869] cxl/port: Convert PCIe link latency to nanoseconds Greg Kroah-Hartman
` (423 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Jonathan Cameron,
Dave Jiang, Alison Schofield, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit ec2e30a682945616d194d7999cf96606b7ee5a88 ]
cxl_gpf_port_setup() caches the Port GPF DVSEC offset in the dport
before programming the phase timeouts, and ignores the return value
of both update_gpf_port_dvsec() calls: the function always reports
success.
A failing config write is therefore not only silent, it is also
permanent: the timeouts stay at the hardware defaults instead of the
maximum flush window the kernel is asking for, and the cached offset
keeps any later endpoint attach from retrying the update.
Propagate the errors and cache the offset only after both phases are
programmed, so the next endpoint attach retries the setup.
Fixes: 6af941db6a60 ("cxl/pci: Update Port GPF timeout only when the first EP attaching")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20261008034619.28059-3-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/pci.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 68859eba30db3..3e88c2e3304a3 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -860,7 +860,7 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
rc = pci_read_config_word(pdev, dvsec + offset, &ctrl);
if (rc)
- return rc;
+ return pcibios_err_to_errno(rc);
if (FIELD_GET(base, ctrl) == GPF_TIMEOUT_BASE_MAX &&
FIELD_GET(scale, ctrl) == GPF_TIMEOUT_SCALE_MAX)
@@ -870,11 +870,17 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
ctrl |= FIELD_PREP(scale, GPF_TIMEOUT_SCALE_MAX);
rc = pci_write_config_word(pdev, dvsec + offset, ctrl);
- if (!rc)
- pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
- phase, GPF_TIMEOUT_BASE_MAX);
+ if (rc) {
+ rc = pcibios_err_to_errno(rc);
+ pci_warn(pdev, "Port GPF phase %d timeout write failed: %d\n",
+ phase, rc);
+ return rc;
+ }
+
+ pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
+ phase, GPF_TIMEOUT_BASE_MAX);
- return rc;
+ return 0;
}
int cxl_gpf_port_setup(struct cxl_dport *dport)
@@ -884,16 +890,22 @@ int cxl_gpf_port_setup(struct cxl_dport *dport)
if (!dport->gpf_dvsec) {
struct pci_dev *pdev;
- int dvsec;
+ int dvsec, rc;
dvsec = cxl_gpf_get_dvsec(dport->dport_dev);
if (!dvsec)
return -EINVAL;
- dport->gpf_dvsec = dvsec;
pdev = to_pci_dev(dport->dport_dev);
- update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 1);
- update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 2);
+ rc = update_gpf_port_dvsec(pdev, dvsec, 1);
+ if (rc)
+ return rc;
+
+ rc = update_gpf_port_dvsec(pdev, dvsec, 2);
+ if (rc)
+ return rc;
+
+ dport->gpf_dvsec = dvsec;
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 454/869] cxl/port: Convert PCIe link latency to nanoseconds
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 453/869] cxl/pci: Program the Port GPF timeouts before caching the DVSEC Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 455/869] cxl: Account for link width in latency calculation Greg Kroah-Hartman
` (422 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 16440d6e4bf1175cda83438d9f9a8ae84bfcf0ee ]
Commit 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
converted CDAT latencies to nanoseconds and removed the conversion in
cxl_region_perf_data_calculate(), but left PCIe link latencies in
picoseconds.
This inflates the FlitLatency contribution to region and node latencies
by a factor of 1000, exposing incorrect values in sysfs. The resulting
abstract distances can incorrectly reverse the memory tier ordering of
nodes.
Convert the FlitLatency contribution to nanoseconds before adding it to
the access coordinates, rounding up as cdat_normalize() does.
Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-2-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/port.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 8d2dc4b741781..599aa9d9eddca 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -2286,6 +2286,9 @@ EXPORT_SYMBOL_NS_GPL(schedule_cxl_memdev_detach, "CXL");
static void add_latency(struct access_coordinate *c, long latency)
{
+ /* Convert link latency from picoseconds to nanoseconds. */
+ latency = DIV_ROUND_UP(latency, 1000);
+
for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
c[i].write_latency += latency;
c[i].read_latency += latency;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 455/869] cxl: Account for link width in latency calculation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 454/869] cxl/port: Convert PCIe link latency to nanoseconds Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 456/869] cxl/acpi: Convert QTG _DSM latencies to picoseconds Greg Kroah-Hartman
` (421 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin, Bjorn Helgaas
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit db4503d4575cdd2fad7e8a13a8a8ffcbc86d152d ]
cxl_pci_get_latency() derives bandwidth from the per-lane speed returned
by pcie_link_speed_mbps(), ignoring the negotiated link width. This
overestimates the FlitLatency contribution for multi-lane links.
Sections 2.11.3 and 2.11.4 of the Intel CXL Memory Device Software Guide
describe the link bandwidth as the product of the negotiated speed and
width.
Replace pcie_link_speed_mbps() with pcie_link_bandwidth_mbps() and
migrate both CXL callers (the only users of the API). The new helper
obtains speed and width from a single Link Status read. The CXL
bandwidth calculation no longer needs a separate width read and
multiplication.
While at it, make error handling more robust by converting PCI config
read errors to negative errno values and checking for zero bandwidth
before calculating latency.
Fixes: 4d07a05397c8 ("cxl: Calculate and store PCI link latency for the downstream ports")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci/pci.c
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-3-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/pci.c | 22 ++++++++--------------
drivers/pci/pci.c | 23 ++++++++++++++++++-----
include/linux/pci.h | 2 +-
3 files changed, 27 insertions(+), 20 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 3e88c2e3304a3..48c1f3854b799 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -738,8 +738,8 @@ long cxl_pci_get_latency(struct pci_dev *pdev)
{
long bw;
- bw = pcie_link_speed_mbps(pdev);
- if (bw < 0)
+ bw = pcie_link_bandwidth_mbps(pdev);
+ if (bw <= 0)
return 0;
bw /= BITS_PER_BYTE;
@@ -777,18 +777,12 @@ EXPORT_SYMBOL_NS_GPL(cxl_endpoint_decoder_reset_detected, "CXL");
int cxl_pci_get_bandwidth(struct pci_dev *pdev, struct access_coordinate *c)
{
- int speed, bw;
- u16 lnksta;
- u32 width;
-
- speed = pcie_link_speed_mbps(pdev);
- if (speed < 0)
- return speed;
- speed /= BITS_PER_BYTE;
-
- pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
- width = FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
- bw = speed * width;
+ int bw;
+
+ bw = pcie_link_bandwidth_mbps(pdev);
+ if (bw < 0)
+ return bw;
+ bw /= BITS_PER_BYTE;
for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
c[i].read_bandwidth = bw;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index bab3213bafbda..8cfcd71163031 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5892,18 +5892,31 @@ static enum pci_bus_speed to_pcie_link_speed(u16 lnksta)
return pcie_link_speed[FIELD_GET(PCI_EXP_LNKSTA_CLS, lnksta)];
}
-int pcie_link_speed_mbps(struct pci_dev *pdev)
+/**
+ * pcie_link_bandwidth_mbps - get the current bandwidth of a single PCIe link
+ * @pdev: PCI device to query
+ *
+ * The bandwidth includes all negotiated lanes and does not account for
+ * encoding overhead. A negotiated width of zero gives zero bandwidth.
+ *
+ * Return: Bandwidth in Mb/s, or a negative errno on failure.
+ */
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev)
{
u16 lnksta;
- int err;
+ int speed, err;
err = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
if (err)
- return err;
+ return pcibios_err_to_errno(err);
+
+ speed = pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+ if (speed < 0)
+ return speed;
- return pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+ return speed * FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
}
-EXPORT_SYMBOL(pcie_link_speed_mbps);
+EXPORT_SYMBOL(pcie_link_bandwidth_mbps);
/**
* pcie_bandwidth_available - determine minimum link settings of a PCIe
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 95c77e2a1d1f5..72d1ca12aaa8c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1413,7 +1413,7 @@ int pcie_set_mps(struct pci_dev *dev, int mps);
u32 pcie_bandwidth_available(struct pci_dev *dev, struct pci_dev **limiting_dev,
enum pci_bus_speed *speed,
enum pcie_link_width *width);
-int pcie_link_speed_mbps(struct pci_dev *pdev);
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev);
void pcie_print_link_status(struct pci_dev *dev);
int pcie_reset_flr(struct pci_dev *dev, bool probe);
int pcie_flr(struct pci_dev *dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 456/869] cxl/acpi: Convert QTG _DSM latencies to picoseconds
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 455/869] cxl: Account for link width in latency calculation Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 457/869] lib/plist: fix plist_requeue() corrupting order in the last bucket Greg Kroah-Hartman
` (420 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 2658c66a5efb5f30f5ced708a5de831845b43f6d ]
The QTG _DSM expects read and write latencies in picoseconds, as
specified in CXL 3.0, Table 9-30.
The code base originally kept the latencies passed to the QTG _DSM in
picoseconds in effect. Commit 51293c565cf4 ("cxl: Fix incorrect region
perf data calculation") normalized CDAT and host bridge latencies to
nanoseconds, but did not add a conversion back to picoseconds when
constructing the _DSM input. Firmware can therefore select QTG IDs using
understated latencies.
Convert the latencies to picoseconds when constructing the _DSM input
package. Multiply in 64 bits and reject latencies that cannot fit in the
DWORD inputs defined by the specification.
Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-4-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/acpi.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 5e9bb0df46dd8..eeb6921950fc2 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -205,9 +205,10 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
int entries, int *qos_class)
{
union acpi_object *out_obj, *out_buf, *obj;
+ /* QTG _DSM expects latencies in picoseconds. */
union acpi_object in_array[4] = {
- [0].integer = { ACPI_TYPE_INTEGER, coord->read_latency },
- [1].integer = { ACPI_TYPE_INTEGER, coord->write_latency },
+ [0].integer = { ACPI_TYPE_INTEGER, coord->read_latency * 1000ULL },
+ [1].integer = { ACPI_TYPE_INTEGER, coord->write_latency * 1000ULL },
[2].integer = { ACPI_TYPE_INTEGER, coord->read_bandwidth },
[3].integer = { ACPI_TYPE_INTEGER, coord->write_bandwidth },
};
@@ -225,6 +226,11 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
if (!entries)
return -EINVAL;
+ /* Latency inputs must fit in the DWORD fields defined by the spec. */
+ if (coord->read_latency > U32_MAX / 1000 ||
+ coord->write_latency > U32_MAX / 1000)
+ return -ERANGE;
+
out_obj = acpi_evaluate_dsm(handle, &acpi_cxl_qtg_id_guid, 1, 1, &in_obj);
if (!out_obj)
return -ENXIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 457/869] lib/plist: fix plist_requeue() corrupting order in the last bucket
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 456/869] cxl/acpi: Convert QTG _DSM latencies to picoseconds Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 458/869] USB: cdc-acm: add VeriFone VX820 device ID Greg Kroah-Hartman
` (419 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Harshbarger, Andrew Morton,
Nickolai Zeldovich, I Hsin Cheng, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Harshbarger <handyhandyman.adam@gmail.com>
[ Upstream commit 43c91b1522435429a63d175f5a953e6f727a4f88 ]
plist_requeue() is meant to move a node to the end of its own priority
run. When the node heads the *last* priority bucket it is instead placed
at the head of the whole list, leaving the plist unsorted:
built: A(prio 0) B(prio 1) C(prio 1)
requeue(B): B(prio 1) A(prio 0) C(prio 1)
expected: A(prio 0) C(prio 1) B(prio 1)
prio_list is a *headless* circular ring of the nodes that lead each
priority bucket. The shortcut added by commit 95d4b3450ebe ("lib/plist.c:
add shortcut for plist_requeue()") takes
iter = list_entry(iter->prio_list.next, struct plist_node,
prio_list);
node_next = &iter->node_list;
which from the last bucket wraps round to the *first* bucket, so node_next
ends up pointing at the head of the list rather than at its end. The
plist_for_each_continue() loop immediately below it computes the correct
answer (&head->node_list) for that case.
With any bucket after it the shortcut is correct, which is why this went
unnoticed: the benchmark in that commit measured elapsed time and never
checked the resulting order.
Keep the shortcut -- it is a real win -- but exclude the case where iter's
bucket is the last one, which is exactly when its ring successor is the
first bucket again.
Reachable from mm/swapfile.c, which rotates swap_avail_heads[] with
plist_requeue(). It takes three or more swap devices: at least two
distinct priorities, so that a later bucket exists for the ring to wrap
round from, and two or more devices sharing the lowest priority, so that
plist_requeue() does not return early. One device per priority returns
early at the node->prio != iter->prio test. A single priority is also
safe, but for a different reason worth stating: with one bucket no node is
ever linked onto prio_list at all -- plist_add() skips it for the first
node and for every node whose predecessor shares its priority -- so
list_empty(&iter->prio_list) holds and the shortcut is never entered.
Tested by driving three implementations -- the pre-95d4b3450ebe code,
current mainline, and this patch -- through 1,084,492 identical random
add/del/requeue operations over 24 nodes and 1..5 distinct priorities,
comparing the resulting node_list node for node after every operation:
variant differs from pre-95d4b3450ebe left list unsorted
pre-95d4b3450ebe -- (reference) 0
mainline 289,297 276,660
this patch 0 0
Link: https://lore.kernel.org/20260903222456.1881786-1-handyhandyman.adam@gmail.com
Fixes: 95d4b3450ebe ("lib/plist.c: add shortcut for plist_requeue()")
Signed-off-by: Adam Harshbarger <handyhandyman.adam@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Assisted-by: Claude:claude-opus-5
Cc: I Hsin Cheng <richard120310@gmail.com>
Cc: <stable@vger.kernel.org> # v6.15+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/plist.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/plist.c b/lib/plist.c
index 330febb4bd7d7..1e9cb0e35af7f 100644
--- a/lib/plist.c
+++ b/lib/plist.c
@@ -174,8 +174,15 @@ void plist_requeue(struct plist_node *node, struct plist_head *head)
/*
* After plist_del(), iter is the replacement of the node. If the node
* was on prio_list, take shortcut to find node_next instead of looping.
+ *
+ * prio_list is a headless ring, so from the LAST bucket ->next wraps
+ * round to the first one; in that case node_next is the list head.
*/
if (!list_empty(&iter->prio_list)) {
+ struct plist_node *first = plist_first(head);
+
+ if (iter->prio_list.next == &first->prio_list)
+ goto queue;
iter = list_entry(iter->prio_list.next, struct plist_node,
prio_list);
node_next = &iter->node_list;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 458/869] USB: cdc-acm: add VeriFone VX820 device ID
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 457/869] lib/plist: fix plist_requeue() corrupting order in the last bucket Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 459/869] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE Greg Kroah-Hartman
` (418 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Drobyshev Vladimir, stable,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Drobyshev Vladimir <enigma_137@icloud.com>
[ Upstream commit ddbddee6592ecf6cf6c24d888780f9ad45a3e30b ]
Add USB ID 11ca:0219 for the VeriFone VX820 to the cdc-acm device
table and apply the SINGLE_RX_URB quirk.
Signed-off-by: Drobyshev Vladimir <enigma_137@icloud.com>
Link: https://patch.msgid.link/20260929173833.105208-1-enigma_137@icloud.com
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 884dc80868ca9..990482982a28e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1819,6 +1819,9 @@ static const struct usb_device_id acm_ids[] = {
{ USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
.driver_info = SINGLE_RX_URB,
},
+ { USB_DEVICE(0x11ca, 0x0219), /* VeriFone Vx820 Gadget Serial */
+ .driver_info = SINGLE_RX_URB,
+ },
{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
},
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 459/869] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 458/869] USB: cdc-acm: add VeriFone VX820 device ID Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 460/869] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response Greg Kroah-Hartman
` (417 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ali Resool Tuama,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Resool Tuama <aliresool567@gmail.com>
[ Upstream commit 40224df29729618ecd88c5c0077e71b1e82c7a3a ]
The GameSir G7 SE wired controller first enumerates as 3537:10a0 and
then re-enumerates in a mode it picks from how the host enumerated it.
When the configuration descriptor is fetched the Linux way, 9 bytes
followed by the full 80, the controller disconnects about 1 ms after
its string descriptors have been read, before SET_CONFIGURATION, and
comes back as 3537:1082, a generic HID gamepad without force feedback.
When the configuration descriptor is fetched in one 255-byte request,
as Windows does, it comes back as 3537:1010 in Xbox One (GIP) mode,
which xpad already supports, including rumble.
Skipping the device qualifier requests (USB_QUIRK_DEVICE_QUALIFIER)
makes no difference; the configuration descriptor request size alone
decides the mode. Add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for the 10a0
identity, as is already done for the ShanWan Wireless Gamepad.
Cc: stable <stable@kernel.org>
Assisted-by: claude-opus-5-5
Signed-off-by: Ali Resool Tuama <aliresool567@gmail.com>
Link: https://patch.msgid.link/20261002-master-v2-1-24b05d8792b5@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0f804a52ab763..a8e5016fee982 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -613,6 +613,9 @@ static const struct usb_device_id usb_quirk_list[] = {
/* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */
{ USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS },
+ /* GameSir G7 SE */
+ { USB_DEVICE(0x3537, 0x10a0), .driver_info = USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE },
+
/* DELL USB GEN2 */
{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 460/869] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 459/869] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 461/869] usb: xhci: Fix bounce buffer overflow Greg Kroah-Hartman
` (416 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Nathan Rebello, Seungjin Bae,
Heikki Krogerus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 02ee864e8d2142c5648998944c3306ea6a763c26 ]
When the PPM reports more than one DisplayPort alternate mode for a
connector, ucsi_ccg_update_altmodes() merges them into a single entry
in uc->updated[] and sets uc->has_multiple_dp. In that case,
ucsi_ccg_update_get_current_cam_cmd() rewrites the response of the
GET_CURRENT_CAM command. The response is a single byte holding the
index of the currently active alternate mode, and it is provided by
the PPM firmware.
The function uses this byte directly as an index into uc->orig[], and
then uses the linked_idx read from that entry as the translated index
into uc->updated[]. Both arrays have UCSI_MAX_ALTMODES entries, but
neither index is checked against that size.
If a malicious or buggy PPM reports a value of UCSI_MAX_ALTMODES or
larger, e.g. 0xFF, uc->orig[cam].linked_idx reads over the end of
uc->orig[]. The byte read from there is then used as the index for
writing cam into uc->updated[new_cam].active_idx, so the out-of-bounds
read is followed by an out-of-bounds write. This happens without any
userspace action, since the UCSI core issues GET_CURRENT_CAM on its own
when handling connector changes.
Fix this by rejecting responses whose index is out of range, printing an
error and returning -EPROTO, so that the caller cannot accept this.
Also check linked_idx before using it as an index, so that the write into
uc->updated[] is always within bounds.
The response is now only processed when the command completed without
an error. ucsi_sync_control_common() only reads the response when the
CCI reports command completion, so otherwise the buffer is not filled
and must not be mistaken for an invalid index.
This bug was found with a Python script that traces where firmware input
is used.
Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Cc: stable <stable@kernel.org>
Reported-by: Nathan Rebello <nathan.c.rebello.27@dartmouth.edu>
Assisted-by: LLM
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20261003215520.611083-2-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 6c1f62c78ac25..18236d5c30922 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -383,14 +383,28 @@ static int ucsi_ccg_init(struct ucsi_ccg *uc)
return -ETIMEDOUT;
}
-static void ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
+static int ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
{
u8 cam, new_cam;
cam = data[0];
+ if (cam >= UCSI_MAX_ALTMODES) {
+ dev_err(uc->dev, "PPM returned invalid alternate mode index %u\n",
+ cam);
+ return -EPROTO;
+ }
+
new_cam = uc->orig[cam].linked_idx;
+ if (new_cam >= UCSI_MAX_ALTMODES) {
+ dev_err(uc->dev, "invalid linked alternate mode index %u for %u\n",
+ new_cam, cam);
+ return -EPROTO;
+ }
+
uc->updated[new_cam].active_idx = cam;
data[0] = new_cam;
+
+ return 0;
}
static bool ucsi_ccg_update_altmodes(struct ucsi *ucsi,
@@ -633,8 +647,10 @@ static int ucsi_ccg_sync_control(struct ucsi *ucsi, u64 command, u32 *cci,
switch (UCSI_COMMAND(command)) {
case UCSI_GET_CURRENT_CAM:
- if (uc->has_multiple_dp)
- ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
+ if (!ret && uc->has_multiple_dp &&
+ (*cci & UCSI_CCI_COMMAND_COMPLETE) &&
+ !(*cci & UCSI_CCI_ERROR))
+ ret = ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
break;
case UCSI_GET_ALTERNATE_MODES:
if (UCSI_ALTMODE_RECIPIENT(command) == UCSI_RECIPIENT_SOP) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 461/869] usb: xhci: Fix bounce buffer overflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 460/869] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 462/869] xhci: Prevent invalid vdev dereference during sideband unregister Greg Kroah-Hartman
` (415 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+fd80bc5967eb22c3, Michal Pecio,
Mathias Nyman, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <michal.pecio@gmail.com>
[ Upstream commit 68c5cb7574c567e83ba95258cb146db95e069a87 ]
High-speed devices with out of spec 1024 byte bulk endpoints exist and
are allowed by USB core, but xhci-hcd always sets packet size to 512.
The exact nature of these devices isn't documented, commit fb5ee84ea72c
("USB: Accept bulk endpoints with 1024-byte maxpacket") only states
that they "don't work with xHCI host controllers", whatever it means.
But somebody (or a malicious device) can try, and then the driver will
allocate a 512 byte bounce buffer for this endpoint and may write up to
1024 bytes into it if particular scatter-gather URBs are used, because
xhci_align_td() obtains packet size from the descriptor. Fix this.
As a side effect, TRBs will be aligned to the packet size chosen by the
driver on all endpoints of all speeds. Alignment serves the xHC, not
device, so this is fine. Only out of spec devices are affected anyway.
Reported-by: co+fd80bc5967eb22c3@bugs.sh
Link: https://lore.kernel.org/linux-usb/D4tcSGerkYkIV1DmaUo1t8TaR5qQElDLkidn@bugs.sh/
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-ring.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index dc18da8385a21..071a0310d6100 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3600,15 +3600,13 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
- u32 *trb_buff_len, struct xhci_segment *seg)
+ u32 *trb_buff_len, struct xhci_segment *seg, u32 max_pkt)
{
struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
unsigned int unalign;
- unsigned int max_pkt;
u32 new_buff_len;
size_t len;
- max_pkt = xhci_usb_endpoint_maxp(urb->dev, urb->ep);
unalign = (enqd_len + *trb_buff_len) % max_pkt;
/* we got lucky, last normal TRB data on segment is packet aligned */
@@ -3753,9 +3751,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
if (enqd_len + trb_buff_len < full_len) {
field |= TRB_CHAIN;
if (trb_is_link(ring->enqueue + 1)) {
- if (xhci_align_td(xhci, urb, enqd_len,
- &trb_buff_len,
- ring->enq_seg)) {
+ if (xhci_align_td(xhci, urb, enqd_len, &trb_buff_len,
+ ring->enq_seg, ring->bounce_buf_len)) {
send_addr = ring->enq_seg->bounce_dma;
/* TD bounced at least, and last on this seg */
td->bounce_seg = ring->enq_seg;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 462/869] xhci: Prevent invalid vdev dereference during sideband unregister
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 461/869] usb: xhci: Fix bounce buffer overflow Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 463/869] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read Greg Kroah-Hartman
` (414 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lianqin Hu, Mathias Nyman,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit fd616dc74e8f58f351f2b295620027116cd6e92e ]
Offloaded USB audio devices using the xhci-sideband API store a pointer to
the xhci virtual device (vdev) in the sideband structure when registering.
This pointer typically remains valid throughout the lifetime of the USB
device. If a configured offloaded device requires a reset, the USB core
usually unbinds or notifies the audio driver beforehand, ensuring that the
sideband is unregistered before the vdev is freed.
An exception occurs when the USB core resets a device to recover from a
failed resume, but a subsequent 'address device' request also fails. To
recover in this specific scenario, the xHCI driver disables and re-enables
the slot, which frees and re-allocates the vdev.
xhci_sideband_unregister() later dereferences the stale, previously freed
vdev pointer during disconnect, triggering a kernel oops:
Unable to handle kernel paging request at virtual address dead000000000122
Call trace:
xhci_get_ep_ctx+0x0/0x38
xhci_sideband_unregister+0x68/0xf0
uaudio_disconnect+0x70/0x144
usb_audio_disconnect+0x7c/0x268
usb_unbind_interface+0x13c/0x340
device_release_driver_internal+0x1c4/0x2bc
usb_disable_device+0x84/0x190
usb_disconnect+0xe8/0x338
hub_event+0xbd8/0x19ac
Fix this by preventing the reallocation of the vdev in this specific error
path if the device is registered for sideband use.
Just propagate the error directly to the USB core. It should either retry
enumeration or detect the disconnected device, and handle it accordingly.
Debugging this issue to the dangling vdev pointer, reporting it, testing,
and initial patch with different solution by Lianqin Hu
Reported-by: Lianqin Hu <hulianqin@vivo.com>
Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217000B59003EDF233D7246D2B22@TYUPR06MB6217.apcprd06.prod.outlook.com/
Tested-by: Lianqin Hu <hulianqin@vivo.com>
Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a4fab82da76b6..b894ba988a3d9 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4435,10 +4435,13 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
dev_warn(&udev->dev, "Device not responding to setup %s.\n", act);
mutex_unlock(&xhci->mutex);
- ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
- if (!ret) {
- if (xhci_alloc_dev(hcd, udev) == 1)
- xhci_setup_addressable_virt_dev(xhci, udev);
+
+ if (!virt_dev->sideband) {
+ ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
+ if (!ret) {
+ if (xhci_alloc_dev(hcd, udev) == 1)
+ xhci_setup_addressable_virt_dev(xhci, udev);
+ }
}
kfree(command->completion);
kfree(command);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 463/869] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 462/869] xhci: Prevent invalid vdev dereference during sideband unregister Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 464/869] mailbox: altera: shut down RX polling timer on channel teardown Greg Kroah-Hartman
` (413 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wayne Chang, Jon Hunter,
Heikki Krogerus, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <waynec@nvidia.com>
[ Upstream commit bbf6b99a57b2479bf51c3c8ad0946f4b8c33ed69 ]
CCG4 firmware occasionally fails to respond to I2C read requests,
especially when reading cci and intr_reg from the ISR path. In these
cases, i2c_transfer() returns -EREMOTEIO.
The CCG4 is EOL, and Infineon no longer supports firmware updates, so
a software workaround is necessary.
Attempt the read up to CCG_READ_MAX_RETRIES (4) times in total when
-EREMOTEIO is returned, sleeping ~1 ms via fsleep() between attempts.
This allows recovery from transient I2C failures without affecting
other error paths.
The sleep is safe because ccg_read() is called both from process
context and from ccg_irq_handler(), which runs in threaded IRQ
context (registered via request_threaded_irq() with a NULL hard-IRQ
handler), so sleeping is allowed in both cases.
Fixes: 247c554a14aa ("usb: typec: ucsi: add support for Cypress CCGx")
Cc: stable <stable@kernel.org>
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260916061858.1471606-1-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 18236d5c30922..55dbe7508ea7f 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -134,6 +134,8 @@ struct version_format {
#define NVIDIA_FTB_DP_OFFSET (2)
#define NVIDIA_FTB_DBG_OFFSET (3)
+#define CCG_READ_MAX_RETRIES 4
+
struct version_info {
struct version_format base;
struct version_format app;
@@ -254,6 +256,7 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
};
u32 rlen, rem_len = len, max_read_len = len;
int status;
+ int retry_count;
/* check any max_read_len limitation on i2c adapter */
if (quirks && quirks->max_read_len)
@@ -265,7 +268,17 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
rlen = min_t(u16, rem_len, max_read_len);
msgs[1].len = rlen;
put_unaligned_le16(rab, buf);
- status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+ for (retry_count = 0; retry_count < CCG_READ_MAX_RETRIES; retry_count++) {
+ status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+ /* Only retry on -EREMOTEIO, and not after the last attempt */
+ if (status != -EREMOTEIO || retry_count == CCG_READ_MAX_RETRIES - 1)
+ break;
+
+ fsleep(1000);
+ }
+
if (status < 0) {
dev_err(uc->dev, "i2c_transfer failed %d\n", status);
pm_runtime_put_sync(uc->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 464/869] mailbox: altera: shut down RX polling timer on channel teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 463/869] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 465/869] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM Greg Kroah-Hartman
` (412 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jassi Brar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 0cf10e65639cba32d05994f85e6a8f08dd0ffe08 ]
The RX polling callback unconditionally rearms the timer after it
processes mailbox data. altera_mbox_shutdown() uses
timer_delete_sync(), which waits for a running callback but does not
prevent that callback from rearming the timer after the deletion.
Use timer_shutdown_sync() for the final polling teardown so the timer
cannot be queued again while the mailbox channel is being released.
The timer is reinitialized with timer_setup() on a later channel startup,
so polling mode remains reusable.
Fixes: f62092f6d77d ("mailbox: Add Altera mailbox driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-altera.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox-altera.c b/drivers/mailbox/mailbox-altera.c
index 17278c2571d34..7cb91413ef7fc 100644
--- a/drivers/mailbox/mailbox-altera.c
+++ b/drivers/mailbox/mailbox-altera.c
@@ -270,7 +270,7 @@ static void altera_mbox_shutdown(struct mbox_chan *chan)
writel_relaxed(~0, mbox->mbox_base + MAILBOX_INTMASK_REG);
free_irq(mbox->irq, chan);
} else if (!mbox->is_sender) {
- timer_delete_sync(&mbox->rxpoll_timer);
+ timer_shutdown_sync(&mbox->rxpoll_timer);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 465/869] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 464/869] mailbox: altera: shut down RX polling timer on channel teardown Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 466/869] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() Greg Kroah-Hartman
` (411 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Danesh Petigara,
Justin Chen, Jassi Brar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
[ Upstream commit eb2ee504757674450a5e03e36e6b9340f064e599 ]
bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every
BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it
to rx_svc_init_list with no cap on list length. The only consumers of
this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are
called only during probe and at shutdown respectively; after probe
completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words,
exhausting GFP_ATOMIC reserves and causing a whole-device denial of
service.
Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth.
bcm74110_rx_push_init_msg() now checks the count under the existing
rx_svc_list_lock before allocating; if the cap is reached the message is
dropped and a rate-limited warning is emitted. The new rx_svc_init_count
field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue
and reset to zero by bcm74110_rx_flush_msg() on shutdown.
Fixes: 52436007b862 ("mailbox: Add support for bcm74110")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Assisted-by: Anthropic:claude-sonnet-4.6 cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Acked-by: Justin Chen <justin.chen@broadcom.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/bcm74110-mailbox.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/mailbox/bcm74110-mailbox.c b/drivers/mailbox/bcm74110-mailbox.c
index 2e7e86f3e6a4a..0ae6c56b87869 100644
--- a/drivers/mailbox/bcm74110-mailbox.c
+++ b/drivers/mailbox/bcm74110-mailbox.c
@@ -97,6 +97,8 @@ struct bcm74110_mbox_chan {
int type;
};
+#define BCM74110_INIT_MSG_MAX 16
+
struct bcm74110_mbox {
struct platform_device *pdev;
void __iomem *base;
@@ -105,6 +107,7 @@ struct bcm74110_mbox {
int rx_chan;
int rx_irq;
struct list_head rx_svc_init_list;
+ unsigned int rx_svc_init_count;
spinlock_t rx_svc_list_lock;
struct mbox_controller controller;
@@ -148,7 +151,15 @@ static void bcm74110_rx_push_init_msg(struct bcm74110_mbox *mbox, u32 val)
msg->msg = val;
spin_lock(&mbox->rx_svc_list_lock);
+ if (mbox->rx_svc_init_count >= BCM74110_INIT_MSG_MAX) {
+ spin_unlock(&mbox->rx_svc_list_lock);
+ kfree(msg);
+ dev_warn_ratelimited(&mbox->pdev->dev,
+ "PMC INIT msg list full, dropping message\n");
+ return;
+ }
list_add_tail(&msg->list_entry, &mbox->rx_svc_init_list);
+ mbox->rx_svc_init_count++;
spin_unlock(&mbox->rx_svc_list_lock);
}
@@ -225,6 +236,7 @@ static int bcm74110_rx_pop_init_msg(struct bcm74110_mbox *mbox, u32 func_type,
list_entry) {
if (BCM_MSG_GET_FIELD(msg->msg, FUNC) == func_type) {
list_del(&msg->list_entry);
+ mbox->rx_svc_init_count--;
found = true;
break;
}
@@ -248,6 +260,7 @@ static void bcm74110_rx_flush_msg(struct bcm74110_mbox *mbox)
spin_lock_irqsave(&mbox->rx_svc_list_lock, flags);
list_splice_init(&mbox->rx_svc_init_list, &list_temp);
+ mbox->rx_svc_init_count = 0;
spin_unlock_irqrestore(&mbox->rx_svc_list_lock, flags);
list_for_each_entry_safe(msg, msg_tmp, &list_temp, list_entry) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 466/869] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 465/869] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 467/869] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data() Greg Kroah-Hartman
` (410 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Jassi Brar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 18e3e979826795b62e8916743bec4de660e7cb22 ]
pm_runtime_get_sync() leaves the runtime PM usage counter incremented
even when it fails, but cmdq_mbox_flush() returns the error without
dropping it. The same happens when the GCE thread does not drain in
time and the function bails out with -EFAULT.
Undo the reference on both error paths.
Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mtk-cmdq-mailbox.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
index a1360b70b83fb..6e915ec5deaae 100644
--- a/drivers/mailbox/mtk-cmdq-mailbox.c
+++ b/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -506,8 +506,10 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
int ret;
ret = pm_runtime_get_sync(cmdq->mbox.dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(cmdq->mbox.dev);
return ret;
+ }
spin_lock_irqsave(&thread->chan->lock, flags);
if (list_empty(&thread->task_busy_list))
@@ -544,6 +546,9 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
dev_err(cmdq->mbox.dev, "Fail to wait GCE thread 0x%x done\n",
(u32)(thread->base - cmdq->base));
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
return -EFAULT;
}
pm_runtime_mark_last_busy(cmdq->mbox.dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 467/869] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 466/869] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 468/869] USB: serial: sierra: fix urb leak on write completion Greg Kroah-Hartman
` (409 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anup Vishwakarma, Konrad Dybcio,
Jassi Brar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
[ Upstream commit 7b3cc361b5942ac600f38e5dff7aed009be34964 ]
qcom_ipcc_mbox_shutdown() clears chan->con_priv with no locking.
qcom_ipcc_mbox_send_data() dereferences the same field without
checking for NULL first, so a send racing a concurrent shutdown can
crash:
mchan = chan->con_priv;
...
hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
Add the same NULL guard mbox_send_message() already uses for
chan->cl, and bail out before dereferencing a cleared con_priv.
To close the remaining race where send_data() reads con_priv a moment
before a concurrent shutdown clears it, acquire the spinlock in
qcom_ipcc_mbox_shutdown() using the modern guard(spinlock_irqsave)
primitive before setting con_priv to NULL.
Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/qcom-ipcc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
index dead907aa7a28..b0b4e40d9202a 100644
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -10,6 +10,7 @@
#include <linux/mailbox_controller.h>
#include <linux/module.h>
#include <linux/platform_device.h>
+#include <linux/spinlock.h>
#include <dt-bindings/mailbox/qcom-ipcc.h>
@@ -151,6 +152,9 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
struct qcom_ipcc_chan_info *mchan = chan->con_priv;
u32 hwirq;
+ if (!mchan)
+ return -EINVAL;
+
hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
writel(hwirq, ipcc->base + IPCC_REG_SEND_ID);
@@ -159,6 +163,8 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
static void qcom_ipcc_mbox_shutdown(struct mbox_chan *chan)
{
+ guard(spinlock_irqsave)(&chan->lock);
+
chan->con_priv = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 468/869] USB: serial: sierra: fix urb leak on write completion
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 467/869] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 469/869] dm-snapshot: fix crash if dm_io_client_create fails Greg Kroah-Hartman
` (408 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Oliver Neukum,
Johan Hovold, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e7daa54802c566ed3f22e81513f84c8c9197c5d1 ]
Make sure to drop the reference taken by usb_anchor_urb() also on
successful submission of delayed write URBs during runtime resume to
prevent them from leaking on completion.
Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while online")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165352.2085480-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org # 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/sierra.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 741e68e461396..bac926cfee282 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -972,12 +972,13 @@ static int sierra_submit_delayed_urbs(struct usb_serial_port *port)
intfdata->in_flight--;
usb_unanchor_urb(urb);
kfree(urb->transfer_buffer);
- usb_free_urb(urb);
spin_lock(&portdata->lock);
portdata->outstanding_urbs--;
spin_unlock(&portdata->lock);
}
+
+ usb_put_urb(urb);
}
if (ec)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 469/869] dm-snapshot: fix crash if dm_io_client_create fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 468/869] USB: serial: sierra: fix urb leak on write completion Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 470/869] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO Greg Kroah-Hartman
` (407 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 829c4d21148a205eca864429e06530319e1f92d5 ]
If dm_io_client_create() fails, it stores error into the ps->io_client
variable. The code would try to free it later with
dm_io_client_destroy(ps->io_client), causing an invalid pointer
dereference. Fix this by setting ps->io_client = NULL.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-snap-persistent.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 0dc429eb26924..989f958c229bc 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -325,8 +325,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
}
ps->io_client = dm_io_client_create();
- if (IS_ERR(ps->io_client))
- return PTR_ERR(ps->io_client);
+ if (IS_ERR(ps->io_client)) {
+ r = PTR_ERR(ps->io_client);
+ ps->io_client = NULL;
+ return r;
+ }
r = alloc_area(ps);
if (r)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 470/869] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 469/869] dm-snapshot: fix crash if dm_io_client_create fails Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 471/869] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone() Greg Kroah-Hartman
` (406 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Catalin Marinas,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 215d7b6622733603751f546b9faf9b84b0c281d4 ]
set_permissions() sets PTE_RDONLY for regions that the Memory Attributes
Table describes as read-only, but leaves PTE_WRITE set. PTE_WRITE is
the DBM bit, so when hardware dirty state management is enabled
(TCR_EL1.HD), such a descriptor is writable-clean rather than read-only,
and a write by the firmware will be permitted by the hardware (which
marks the entry dirty) instead of faulting.
Clear PTE_WRITE as well, as pte_wrprotect() does.
Cc: stable@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/efi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 6c371b158b99f..a3c0d5c2e9f74 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -116,8 +116,14 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
const efi_memory_desc_t *md = spd->md;
pte_t pte = __ptep_get(ptep);
+ /*
+ * Clear PTE_WRITE as well: it doubles as the DBM bit, and leaving it
+ * set would permit the hardware to make the mapping writable again
+ * when TCR_EL1.HD is set.
+ */
if (md->attribute & EFI_MEMORY_RO)
- pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+ pte = set_pte_bit(clear_pte_bit(pte, __pgprot(PTE_WRITE)),
+ __pgprot(PTE_RDONLY));
if (md->attribute & EFI_MEMORY_XP)
pte = set_pte_bit(pte, __pgprot(PTE_PXN));
else if (system_supports_bti_kernel() && spd->has_bti)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 471/869] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 470/869] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 472/869] btrfs: return -ENOTTY for unknown ioctls on the control device Greg Kroah-Hartman
` (405 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Wentao Liang,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 886f1aa6e6b30a02901aa7f140149d466e10a873 ]
btrfs_repair_one_zone() hands the block group reference taken by
btrfs_lookup_block_group() over to relocating_repair_kthread(), which
drops it. However the return value of kthread_run() is not checked, so
when the kernel thread fails to spawn, nothing executes the put and the
block group reference is leaked.
Check kthread_run() and drop the reference if the thread failed to
start.
Fixes: f7ef5287a63d ("btrfs: zoned: relocate block group to repair IO failure in zoned filesystems")
CC: stable@vger.kernel.org
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 200b4e4a07994..a07b5a4d6e4df 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -8302,6 +8302,7 @@ static int relocating_repair_kthread(void *data)
bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
{
struct btrfs_block_group *cache;
+ struct task_struct *task;
if (!btrfs_is_zoned(fs_info))
return false;
@@ -8319,8 +8320,9 @@ bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
return true;
}
- kthread_run(relocating_repair_kthread, cache,
- "btrfs-relocating-repair");
+ task = kthread_run(relocating_repair_kthread, cache, "btrfs-relocating-repair");
+ if (IS_ERR(task))
+ btrfs_put_block_group(cache);
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 472/869] btrfs: return -ENOTTY for unknown ioctls on the control device
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 471/869] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 473/869] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() Greg Kroah-Hartman
` (404 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Hengyu Liang,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit 9985f1643ac3f8595862e2f82108f0ccae4cf959 ]
Commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name") made btrfs_control_ioctl() store the result
of btrfs_check_ioctl_vol_args_path() in ret before it looks at the
command.
However, ret is initialized to -ENOTTY and the switch has no default
case, so this initial value was what an unknown command returned. As of
now, every unknown ioctl on /dev/btrfs-control returns 0. A tool that
tries a control ioctl which the running kernel does not have is told
that the ioctl succeeded.
The issue can be reproduced with a simple C program, run as root:
#include <fcntl.h>
#include <stdio.h>
#include <sys/ioctl.h>
int main(void)
{
static char buf[4096];
int fd = open("/dev/btrfs-control", O_RDWR);
if (ioctl(fd, TCGETS, buf) < 0)
perror("ioctl");
else
printf("ioctl succeeded\n");
return 0;
}
Before commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name"), the result is:
ioctl: Inappropriate ioctl for device
After that commit, the result is:
ioctl succeeded
This patch will add a default case that returns -ENOTTY.
Fixes: 5ab2b180884c ("btrfs: factor out validation of btrfs_ioctl_vol_args::name")
CC: stable@vger.kernel.org
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/super.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 6cc4fe2ccd8a7..61a0575fd162a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2284,6 +2284,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
case BTRFS_IOC_GET_SUPPORTED_FEATURES:
ret = btrfs_ioctl_get_supported_features((void __user*)arg);
break;
+ default:
+ ret = -ENOTTY;
+ break;
}
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 473/869] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 472/869] btrfs: return -ENOTTY for unknown ioctls on the control device Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 474/869] mtd: parsers: qcom: fix offset/size overflow on large partitions Greg Kroah-Hartman
` (403 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
[ Upstream commit 94623942a66e031826756f9c92dbde9a12e2b4d2 ]
On QPIC v2 controllers, when the last codeword is being read, the read
location values must be programmed into the READ_LOCATION_LAST_CW_*
registers. Prior to commit 8c52932da5e6 ("mtd: rawnand: qcom: cleanup
qcom_nandc driver"), the config_nand_cw_read() function did it right,
but since then it always writes the read location values to the
READ_LOCATION_* registers even if the actual codeword is the last one.
Change the function to always configure the registers corresponding to
the actual codeword to restore the correct behaviour.
Cc: stable@vger.kernel.org
Fixes: 8c52932da5e6 ("mtd: rawnand: qcom: cleanup qcom_nandc driver")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/qcom_nandc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index 4dd6f1a4e7978..b469c01aacf97 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -328,14 +328,16 @@ config_nand_cw_read(struct nand_chip *chip, bool use_ecc, int cw)
{
struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
struct nand_ecc_ctrl *ecc = &chip->ecc;
-
__le32 *reg = &nandc->regs->read_location0;
+ int reg_base = NAND_READ_LOCATION_0;
- if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw))
+ if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) {
reg = &nandc->regs->read_location_last0;
+ reg_base = NAND_READ_LOCATION_LAST_CW_0;
+ }
if (nandc->props->supports_bam)
- qcom_write_reg_dma(nandc, reg, NAND_READ_LOCATION_0, 4, NAND_BAM_NEXT_SGL);
+ qcom_write_reg_dma(nandc, reg, reg_base, 4, NAND_BAM_NEXT_SGL);
qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 474/869] mtd: parsers: qcom: fix offset/size overflow on large partitions
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 473/869] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 475/869] xprtrdma: prevent disconnect feedback during endpoint teardown Greg Kroah-Hartman
` (402 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit 2f7fa8d90694d21dce68ceabd8383252b111cfea ]
In parse_qcomsmem_part() the partition offset and size are computed as
parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
Both le32_to_cpu() and mtd->erasesize are 32-bit (u32). The multiply is
therefore evaluated in 32-bit arithmetic and the product is truncated to
32 bits before being widened and stored into the 64-bit (u64)
parts[j].offset / parts[j].size fields, so the 64-bit destinations are
never used at their full width.
The SMEM partition table is firmware-provided and the per-entry offset
and length are not bounds-checked against the device geometry (only
numparts is capped). On a sufficiently large flash, a partition whose
(offset|length) * erasesize is >= 2^32 gets a silently truncated
offset/size and is mapped to the wrong region of the master MTD, which
can overlap or extend into an unintended area.
Cast one operand to u64 so the multiplication is performed in 64-bit and
the result fits the 64-bit fields without truncation.
Found by static analysis tool CodeQL.
Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/parsers/qcomsmempart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
index 4311b89d8df00..b12d87c3b0232 100644
--- a/drivers/mtd/parsers/qcomsmempart.c
+++ b/drivers/mtd/parsers/qcomsmempart.c
@@ -143,9 +143,9 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
*c = tolower(*c);
parts[j].name = name;
- parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
+ parts[j].offset = (u64)le32_to_cpu(pentry->offset) * mtd->erasesize;
parts[j].mask_flags = pentry->attr;
- parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
+ parts[j].size = (u64)le32_to_cpu(pentry->length) * mtd->erasesize;
pr_debug("%d: %s offs=0x%08x size=0x%08x attr:0x%08x\n",
i, pentry->name, le32_to_cpu(pentry->offset),
le32_to_cpu(pentry->length), pentry->attr);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 475/869] xprtrdma: prevent disconnect feedback during endpoint teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 474/869] mtd: parsers: qcom: fix offset/size overflow on large partitions Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 476/869] xprtrdma: trim head iovec when the payload arrives via a Write chunk Greg Kroah-Hartman
` (401 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Menninger, Chuck Lever,
Anna Schumaker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Menninger <tmenninger@everpuredata.com>
[ Upstream commit 0b5bb4e586f7b0a449f4d90a524f76a3be5db355 ]
xprt_autoclose() clears XPRT_CLOSE_WAIT before invoking the transport's
->close() operation. For RPC/RDMA, ->close() calls
rpcrdma_xprt_disconnect(), which disconnects the RDMA CM endpoint and
drains its QP.
Since commit 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on
connect"), RDMA_CM_EVENT_DISCONNECTED requests a SUNRPC transport
disconnect. Today that path, along with failed completion handling,
reaches xprt_force_disconnect() through rpcrdma_force_disconnect().
Commit c487eb7d8e41 ("xprtrdma: Clean up disconnect") later added
re_force_disconnect to ensure that multiple failure indications request
only one SUNRPC disconnect. However, the gate remains open when SUNRPC
itself begins endpoint teardown.
If re_force_disconnect is still clear, either a CM disconnect event or a
completion error can set XPRT_CLOSE_WAIT again while the current close
is in progress. When the transport send lock is subsequently released,
xprt_clear_locked() observes XPRT_CLOSE_WAIT and queues another
autoclose.
Requesting a disconnect this way is necessary when a connection is lost
unexpectedly, but not when the event was generated by
rpcrdma_xprt_disconnect() itself. In that case SUNRPC is already
committed to closing the transport.
Mark re_force_disconnect before initiating local endpoint teardown so
that CM events and completion errors caused by that teardown cannot
request another close. An unexpected error that wins the race before
local endpoint teardown begins can still request a disconnect normally.
Use a fully ordered exchange so that the gate is globally closed before
rdma_disconnect() can transition the QP to error and generate the
callbacks that the gate suppresses.
In 30-second traces of a sustained recovery loop, without this change
there were 7,693 xprt_force_disconnect() calls, 6,267 SUNRPC autocloses,
and 172,892 receive-side IB_WC_WR_FLUSH_ERR completions. With this
change, the same tracepoints recorded 3,512 xprt_force_disconnect()
calls, 3,212 autocloses, and 131,287 receive-side flush completions.
Thus QP teardown continues to produce flushed completions, but closing
the disconnect gate before teardown substantially reduces their
feedback into the SUNRPC close path.
Fixes: 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on connect")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 8449107b2a095..111c415f1aeda 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -114,9 +114,9 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
rpcrdma_ep_put(ep);
}
-/* Ensure xprt_force_disconnect() is invoked exactly once when a
- * connection is closed or lost. (The important thing is it needs
- * to be invoked "at least" once).
+/* Ensure xprt_force_disconnect() is invoked at most once for an
+ * unexpected endpoint failure. Local endpoint teardown closes this
+ * gate before it can generate CM events and flushed completions.
*/
void rpcrdma_force_disconnect(struct rpcrdma_ep *ep)
{
@@ -587,6 +587,9 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt)
if (!ep)
return;
+ /* Prevent teardown-generated events from requesting another close. */
+ atomic_xchg(&ep->re_force_disconnect, 1);
+
id = ep->re_id;
rc = rdma_disconnect(id);
trace_xprtrdma_disconnect(r_xprt, rc);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 476/869] xprtrdma: trim head iovec when the payload arrives via a Write chunk
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 475/869] xprtrdma: prevent disconnect feedback during endpoint teardown Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 477/869] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports Greg Kroah-Hartman
` (400 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongjian Mu, Chuck Lever,
Tim Menninger, Anna Schumaker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Mu <ymu@everpuredata.com>
[ Upstream commit 9ee534a75912361308b1f956bc3e7895a082a422 ]
The upper layer sets rq_rcv_buf.head[0].iov_len from its estimate of the
reply header size. For RPCSEC_GSS that estimate includes
auth->au_ralign, which gss_create_new() initializes to GSS_VERF_SLACK >>
2 (25 XDR words, or 100 bytes) and which is corrected to the real
verifier size only after the first reply on that rpc_auth has been
unwrapped. In this case, the krb5 MIC verifier is 36 bytes, so every
request encoded before the first reply completes has a head that is 64
bytes too long.
On TCP this is harmless: xdr_realign_pages() moves the excess head
bytes, which are genuine reply data, into the page list. With
RPC-over-RDMA and a Write chunk (sec=krb5, i.e. RPC_GSS_SVC_NONE, where
DDP is allowed), the payload has already been placed directly into the
page list, and the receive buffer holds only the inline part of the
reply. rpcrdma_inline_fixup() clamps its local copy of the head length
to the inline length but leaves head.iov_len untouched, so
xdr_realign_pages() still sees iov_len > cur and shifts whatever lies
past the inline reply in the receive buffer into the front of the
directly-placed payload:
rpc_xdr_recvfrom: head=[...,196] page=524288 tail=[...,64]
rpc_xdr_alignment: nfsv4 READ offset=132 copied=64
The first 64 bytes returned by each such READ are incorrect (zeroed, or
shifted right by 64 bytes depending on the kernel's xdr_shrink_bufhead()
implementation). This is readily hit with pNFS flexfiles over RDMA and
sec=krb5: the per-DS rpc_clnt gets a fresh rpc_auth whose first RPC is a
large READ. Reads following the first completed reply return the
expected data.
Commit cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in
rpcrdma_inline_fixup()") removed the head-length correction while fixing
the handling of pure-inline krb5p replies.
When a Write chunk conveyed the payload, trim head.iov_len (in both
rq_rcv_buf and rq_private_buf, which call_decode() expects to match) to
the inline length actually received so that the XDR layer does not
realign the page list. These READ replies have no trailing inline
fields, and the payload is already in the page list, so the upper
layer's head estimate can be safely reduced. Reduce buflen by the same
amount to avoid treating unused head capacity as additional tail
capacity. Pure inline replies and Reply chunk replies are unchanged.
Tested on Linux 6.8.0 and 7.3-rc4 with NFSv4.1 pNFS flexfiles over
RPC/RDMA and sec=krb5.
Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Mu <ymu@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 27 +++++++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e2694fb03ba1b..091b8cb415ec7 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1033,12 +1033,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
* @rqst: controlling RPC request
* @srcp: points to RPC message payload in receive buffer
* @copy_len: remaining length of receive buffer content
- * @pad: Write chunk pad bytes needed (zero for pure inline)
+ * @writelist: bytes conveyed by the Write chunk (zero for pure inline)
*
* The upper layer has set the maximum number of bytes it can
* receive in each component of rq_rcv_buf. These values are set in
* the head.iov_len, page_len, tail.iov_len, and buflen fields.
*
+ * For READ replies with a Write chunk, the payload is already in
+ * the page list. An overestimated head length and buflen can be
+ * reduced without moving reply data.
+ *
* Unlike the TCP equivalent (xdr_partial_copy_from_skb), in
* many cases this function simply updates iov_base pointers in
* rq_rcv_buf to point directly to the received reply data, to
@@ -1047,13 +1051,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
* Returns the count of bytes which had to be memcopied.
*/
static unsigned long
-rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
+rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len,
+ u32 writelist)
{
unsigned long fixup_copy_count;
int i, npages, curlen;
char *destp;
struct page **ppages;
int page_base;
+ int pad = writelist & 3;
+ unsigned int delta;
/* The head iovec is redirected to the RPC reply message
* in the receive buffer, to avoid a memcopy.
@@ -1065,8 +1072,20 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
* head.iov_len bytes are copied into the page list.
*/
curlen = rqst->rq_rcv_buf.head[0].iov_len;
- if (curlen > copy_len)
+ if (curlen > copy_len) {
+ /* These READ replies have no inline fields after the payload.
+ * Trim the head without moving the directly-placed data.
+ */
+ if (writelist) {
+ delta = curlen - copy_len;
+
+ rqst->rq_rcv_buf.head[0].iov_len = copy_len;
+ rqst->rq_private_buf.head[0].iov_len = copy_len;
+ rqst->rq_rcv_buf.buflen -= delta;
+ rqst->rq_private_buf.buflen -= delta;
+ }
curlen = copy_len;
+ }
srcp += curlen;
copy_len -= curlen;
@@ -1294,7 +1313,7 @@ rpcrdma_decode_msg(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
base = (char *)xdr_inline_decode(xdr, 0);
rpclen = xdr_stream_remaining(xdr);
r_xprt->rx_stats.fixup_copy_count +=
- rpcrdma_inline_fixup(rqst, base, rpclen, writelist & 3);
+ rpcrdma_inline_fixup(rqst, base, rpclen, writelist);
r_xprt->rx_stats.total_rdma_reply += writelist;
return rpclen + xdr_align_size(writelist);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 477/869] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 476/869] xprtrdma: trim head iovec when the payload arrives via a Write chunk Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 478/869] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once Greg Kroah-Hartman
` (399 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Kaloz, Bjorn Helgaas,
Magnus Lindholm, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Kaloz <kaloz@kernel.org>
[ Upstream commit 8e923e51892c7da91687dd5b8081ddb1f0fb395a ]
Runtime PM suspends an idle downstream port of a PLX/Broadcom PEX
8532/8533/8548 switch to D3hot, but that takes the whole switch down
with it: any device behind another port of the same switch then
faults with a fatal bus error on its next access, e.g. mptsas probe
on a Sun Ultra 45.
This surfaced on sparc64 once commit a5fb3ff63287 ("PCI: Allow PCI
bridges to go to D3Hot on all non-x86") let bridges enter D3hot. Keep
these downstream ports out of D3 by setting PCI_DEV_FLAGS_NO_D3.
Fixes: a5fb3ff63287 ("PCI: Allow PCI bridges to go to D3Hot on all non-x86")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260927105609.8813-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index d29ff1da29b17..812b01d24fc47 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2386,6 +2386,24 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2000, quirk_plx_pci9050);
DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2600, quirk_plx_pci9050);
+/*
+ * An idle downstream port of a PLX/Broadcom PEX 8532/8533/8548 switch
+ * autosuspends into D3hot, and that takes the whole switch down with
+ * it -- any device behind another port of the same switch then sees a
+ * fatal, non-recoverable bus fault on its next access. Keep these
+ * ports out of D3 entirely.
+ */
+static void quirk_plx_pex_no_d3(struct pci_dev *dev)
+{
+ if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM) {
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
+ pci_info(dev, "avoiding D3 on this downstream port\n");
+ }
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8532, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8533, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8548, quirk_plx_pex_no_d3);
+
static void quirk_netmos(struct pci_dev *dev)
{
unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 478/869] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 477/869] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 479/869] mm/madvise: reclaim isolated folios if PTE restart fails Greg Kroah-Hartman
` (398 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Usama Arif, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 60e58be27d5e16d35e0728298f994dcae9f208a5 ]
Patch series "mm/damon: move damos filter range arguments validation to
core".
DAMOS filter range arguments are being validated in the DAMON sysfs
interface. Some of those have minor time-of-check to time-of-use (TOCTOU)
bugs. In future, other callers might have duplicated validations with
similar bugs.
Fix the bugs and further refactor the code to move the validation to the
core layer. Also add kunit test cases for the validations.
Patches 1 and 2 fix the existing TOCTOU bugs. Patches 3 and 4 adds the
validation in the core layer. Patch 5 drops the replicated validation in
DAMON sysfs interface. Patch 6 further cleanup the code. Patches 7 and 8
extends kunit tests to test the validation.
This patch (of 8):
DAMON sysfs interface reads the user-provided address range arguments for
addr type DAMOS filter twice. Once for validation, and once again for
assignments to the variable that will be passed to the core layer. If the
user updates the argument in parallel, an invalid address range could be
passed to the core layer. Avoid it by doing the assignments first, and
then validating the assigned variables before passing those to the core
layer.
User impact of the bug should be trivial. From the core layer's
perspective, the invalid address range is not really invalid. It just
works as having a weird address range. No critical issues such as a crash
or a leak could happen. And sane users ain't do such parallel arguments
update anyway. If they do, such racy behavior is arguably somewhat
expected and deserved. That said, there is no reason to keep such races.
Link: https://lore.kernel.org/20260914142327.92510-1-sj@kernel.org
Link: https://lore.kernel.org/20260914142327.92510-2-sj@kernel.org
Fixes: 2f1abcfccd86 ("mm/damon/sysfs-schemes: support address range type DAMOS filter")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/sysfs-schemes.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
index 37e0a8bef4b1f..e95cddca0a10d 100644
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -2484,12 +2484,12 @@ static int damon_sysfs_add_scheme_filters(struct damos *scheme,
return err;
}
} else if (filter->type == DAMOS_FILTER_TYPE_ADDR) {
- if (sysfs_filter->addr_range.end <
- sysfs_filter->addr_range.start) {
+ filter->addr_range = sysfs_filter->addr_range;
+ if (filter->addr_range.end <
+ filter->addr_range.start) {
damos_destroy_filter(filter);
return -EINVAL;
}
- filter->addr_range = sysfs_filter->addr_range;
} else if (filter->type == DAMOS_FILTER_TYPE_TARGET) {
filter->target_idx = sysfs_filter->target_idx;
} else if (filter->type == DAMOS_FILTER_TYPE_HUGEPAGE_SIZE) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 479/869] mm/madvise: reclaim isolated folios if PTE restart fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 478/869] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 480/869] mm/madvise: use folio_trylock() in the cold/pageout PMD split Greg Kroah-Hartman
` (397 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, Lorenzo Stoakes (ARM), David Hildenbrand, Jann Horn,
Jiexun Wang, Liam R. Howlett, Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 5445a6359d717354dd76d509b8e693f13403ec61 ]
MADV_PAGEOUT collects isolated folios on a local list before reclaiming
them after the PTE walk. The reschedule path drops the PTE lock and then
restarts the mapping with pte_offset_map_lock().
A concurrent operation can remove or replace the PTE table while the lock
is dropped, causing pte_offset_map_lock() to return NULL. Returning
directly in that case bypasses reclaim_pages(), leaving the collected
folios off the LRU with elevated references.
This results in a permanent memory leak. nr_isolated_anon increases
reliably and does not decrease when the process dies.
Route the failure through the existing cleanup path so any isolated folios
are reclaimed or put back.
Simplest userland pseudo-code reproducer:
p = mmap(PMD_SIZE, ANONYMOUS);
touch_every_page(p, PMD_SIZE);
parallel {
while (1) madvise(p, PMD_SIZE, MADV_PAGEOUT);
while (1) {
madvise(p, PMD_SIZE, MADV_DONTNEED);
touch_every_page(p, PMD_SIZE);
}
}
Reproduced in qemu trivially with some explicit widening of the race window.
Link: https://lore.kernel.org/20260912110832.3203902-1-gourry@gourry.net
Fixes: b2f557a21bc8 ("mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range()")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260821150912.183976-1-gourry@gourry.net
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Assisted-by: LLM
Cc: David Hildenbrand <david@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jiexun Wang <wangjiexun@tinylab.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index b8c25fea4fab9..6b62e01f31911 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -460,7 +460,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
restart:
start_pte = pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
if (!start_pte)
- return 0;
+ goto out;
flush_tlb_batched_pending(mm);
arch_enter_lazy_mmu_mode();
for (; addr < end; pte += nr, addr += nr * PAGE_SIZE) {
@@ -564,6 +564,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
folio_deactivate(folio);
}
+out:
if (start_pte) {
arch_leave_lazy_mmu_mode();
pte_unmap_unlock(start_pte, ptl);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 480/869] mm/madvise: use folio_trylock() in the cold/pageout PMD split
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 479/869] mm/madvise: reclaim isolated folios if PTE restart fails Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 481/869] mm/page_alloc: do not boost watermarks in kdump capture kernels Greg Kroah-Hartman
` (396 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, Lorenzo Stoakes (ARM), David Hildenbrand (Arm),
Jann Horn, Liam R. Howlett, Vlastimil Babka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 5a6c9cf117fca3c38a98fb2a2d5549795c8b0b73 ]
MADV_COLD or MADV_PAGEOUT over part of a PMD splits the THP in
madvise_cold_or_pageout_pte_range(). Two threads doing that to the same
THP create spurious failures.
CPU0 CPU1
---- ----
folio_get()
spin_unlock(ptl)
folio_lock()
folio_get()
spin_unlock(ptl)
folio_lock() <- blocks, keeps its ref
split_folio()
folio_expected_ref_count(folio) != folio_ref_count(folio) - 1
-EAGAIN
CPU1 cannot drop its reference until it gets the lock CPU0 holds, so
CPU0's split always fails. folio_trylock() makes CPU1 leave without ever
taking a reference. The PTE branch of this same function already does
this, as do madvise_free_pte_range() and madvise_free_huge_pmd().
Reproducer: 400 rounds of eight threads calling MADV_COLD on half of each
of eight THPs, re-formed with MADV_COLLAPSE between rounds. From
/proc/vmstat:
thp_split_page thp_split_page_failed
before 3186 860
after 3200 0
The short before count is rounds where every thread failed and the advice
was dropped for that THP entirely.
On failure the walker returns 0 and nothing retries. The PMD path becomes
best effort when the folio lock is held elsewhere - same as the PTE path.
Link: https://lore.kernel.org/20260912110540.3203010-1-gourry@gourry.net
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index 6b62e01f31911..505a580cd9c4c 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -415,9 +415,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
if (next - addr != HPAGE_PMD_SIZE) {
int err;
+ if (!folio_trylock(folio))
+ goto huge_unlock;
folio_get(folio);
spin_unlock(ptl);
- folio_lock(folio);
err = split_folio(folio);
folio_unlock(folio);
folio_put(folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 481/869] mm/page_alloc: do not boost watermarks in kdump capture kernels
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 480/869] mm/madvise: use folio_trylock() in the cold/pageout PMD split Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 482/869] mm/hugetlb_cgroup: move per-node usage on cross node migration Greg Kroah-Hartman
` (395 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanhe Shu, Andrew Morton,
Vlastimil Babka (SUSE), Johannes Weiner, Henry Willard,
Brendan Jackman, David Hildenbrand, Mel Gorman, Michal Hocko,
Suren Baghdasaryan, Zi Yan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <xiangzao@linux.alibaba.com>
[ Upstream commit 331f94007d79b3c02d3098eea469a92aea3efc2c ]
A watermark boost is not confined to one watermark: wmark_pages() adds it
to min, low and high alike, so every watermark check sees it, including
should_reclaim_retry() and the last ditch ALLOC_WMARK_HIGH attempt in
__alloc_pages_may_oom(). Once the boost exceeds the memory still free the
allocator gives up and invokes the OOM killer, and a capture kernel that
is still booting has nothing to kill: the boot panics and the vmcore is
lost.
Seen on an arm64 machine with 64K pages, CONFIG_PAGE_BLOCK_MAX_ORDER=10
(pageblock = 64M) and crashkernel=512M, running a distribution kernel
based on 7.0.14. A high order UNMOVABLE allocation fell back to a MOVABLE
pageblock while the capture kernel was still in do_initcalls():
Node 0 DMA free:68096kB boost:65536kB min:68160kB
low:68800kB high:69440kB managed:479168kB
Out of memory and no killable processes...
Kernel panic - not syncing: System is deadlocked on memory
The zone was not short of memory. Subtracting the boost gives min:2624kB
low:3264kB high:3904kB, so the 68096kB still free sat 17 times above the
high watermark and the allocator would not even have entered its slow
path. The boost supplied 65536kB of the 68160kB min and by itself put the
zone 64kB under water. It is that large because boost_watermark() clamps
it with max(pageblock_nr_pages, max_boost); watermark_boost_factor alone
would have allowed 5824kB.
Commit 14f69140ff9c ("mm: limit boost_watermark on small zones") already
tried to protect capture kernels, but it infers them from the zone size
and skips the boost only below four pageblocks. arm64 64K pageblocks were
512M then, so the guard reached zones up to 2G;
CONFIG_PAGE_BLOCK_MAX_ORDER can cap them at 64M, which shrinks the guard
to zones under 256M and lets this 468M zone through.
kdump is a property of the kernel, not of the zone, so test for it
directly. A capture kernel exits within seconds and never uses the
fragmentation avoidance the boost buys. Normal kernels are unaffected:
the size based check still covers their genuinely tiny zones.
Passing sysctl.vm.watermark_boost_factor=0 to the capture kernel does not
cover this window: sysctl.* parameters are written through procfs by
do_sysctl_args(), which runs after do_initcalls() where the panic above
happened, and watermark_boost_factor has no early_param of its own.
Link: https://lore.kernel.org/20260916112545.3707893-1-xiangzao@linux.alibaba.com
Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org> # v5.0
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ff863a87f2b85..b866357339c56 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -38,6 +38,7 @@
#include <linux/vmstat.h>
#include <linux/fault-inject.h>
#include <linux/compaction.h>
+#include <linux/crash_dump.h>
#include <trace/events/kmem.h>
#include <trace/events/oom.h>
#include <linux/prefetch.h>
@@ -2206,10 +2207,17 @@ static inline bool boost_watermark(struct zone *zone)
if (!watermark_boost_factor)
return false;
+
+ /*
+ * A kdump capture kernel exits before a boost can pay off, while
+ * the raised watermark can exceed the memory left for the dump.
+ */
+ if (is_kdump_kernel())
+ return false;
+
/*
* Don't bother in zones that are unlikely to produce results.
- * On small machines, including kdump capture kernels running
- * in a small area, boosting the watermark can cause an out of
+ * On small machines, boosting the watermark can cause an out of
* memory situation immediately.
*/
if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 482/869] mm/hugetlb_cgroup: move per-node usage on cross node migration
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 481/869] mm/page_alloc: do not boost watermarks in kdump capture kernels Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 483/869] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting Greg Kroah-Hartman
` (394 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongfu Li, Andrew Morton,
Muchun Song, Colin Ian King, David Hildenbrand, Kees Cook,
Mina Almasry, Oscar Salvador, Shakeel Butt, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongfu Li <lihongfu@kylinos.cn>
[ Upstream commit fe0ba1909c59660f078560f5130e7af7c6004f12 ]
Patch series "mm/hugetlb_cgroup: move the per-node usage along with the
folio", v2.
The per-node usage reported by hugetlb.<size>.numa_stat is accounted
against folio_nid() in __hugetlb_cgroup_commit_charge() and
__hugetlb_cgroup_uncharge_folio(), so it is only correct while a folio
stays charged on the same node and in the same hugetlb_cgroup.
Two paths move a folio which stays charged, and neither moves the usage
with it. hugetlb_cgroup_migrate() only moves the hugetlb_cgroup pointers
of a folio migrated to another node, and hugetlb_cgroup_move_parent() only
moves the page_counter charges and the hugetlb_cgroup pointer of the
folios of a dying cgroup. In both cases the node (or cgroup) which was
charged keeps a usage which never goes away, while the node (or cgroup)
which ends up uncharging the folio underflows as soon as the folio is
freed.
Patch 1/2 moves the usage along with the folio on cross node migration,
patch 2/2 does the same for the folios a dying cgroup reparents.
This patch (of 2):
hugetlb.<size>.numa_stat uses folio_nid() to account usage in
__hugetlb_cgroup_commit_charge() and __hugetlb_cgroup_uncharge_folio().
hugetlb_cgroup_migrate() only moves hugetlb_cgroup pointers, leaving
per-node usage behind on the source node during cross-node migration.
When the migrated folio gets uncharged, we subtract usage from the
destination node counter. This creates stale usage on the source node and
unsigned long counter underflow on the destination node. The
hugetlb.<size>.numa_stat interface exposes these incorrect per-node usage
values to userspace.
Add a hugetlb_cgroup_move_usage() helper which moves the usage from the
old node to the new node, and call it from hugetlb_cgroup_migrate().
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-0-2b6d8c2bdc36@kylinos.cn
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-1-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb_cgroup.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index b6537a3e4f62c..00b20c4ff222f 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -187,6 +187,34 @@ static void hugetlb_cgroup_css_free(struct cgroup_subsys_state *css)
hugetlb_cgroup_free(hugetlb_cgroup_from_css(css));
}
+static void hugetlb_cgroup_move_usage(struct hugetlb_cgroup *from,
+ struct hugetlb_cgroup *to,
+ struct folio *from_folio,
+ struct folio *to_folio)
+{
+ int idx = hstate_index(folio_hstate(from_folio));
+ unsigned long nr_pages = folio_nr_pages(from_folio);
+ int from_nid = folio_nid(from_folio);
+ int to_nid = folio_nid(to_folio);
+ unsigned long usage;
+
+ lockdep_assert_held(&hugetlb_lock);
+
+ if (!from || !to)
+ return;
+
+ if (from == to && from_nid == to_nid)
+ return;
+
+ usage = from->nodeinfo[from_nid]->usage[idx];
+ if (WARN_ON_ONCE(usage < nr_pages))
+ return;
+ WRITE_ONCE(from->nodeinfo[from_nid]->usage[idx], usage - nr_pages);
+
+ usage = to->nodeinfo[to_nid]->usage[idx];
+ WRITE_ONCE(to->nodeinfo[to_nid]->usage[idx], usage + nr_pages);
+}
+
/*
* Should be called with hugetlb_lock held.
* Since we are holding hugetlb_lock, pages cannot get moved from
@@ -914,6 +942,9 @@ void hugetlb_cgroup_migrate(struct folio *old_folio, struct folio *new_folio)
/* move the h_cg details to new cgroup */
set_hugetlb_cgroup(new_folio, h_cg);
set_hugetlb_cgroup_rsvd(new_folio, h_cg_rsvd);
+
+ hugetlb_cgroup_move_usage(h_cg, h_cg, old_folio, new_folio);
+
list_move(&new_folio->lru, &h->hugepage_activelist);
spin_unlock_irq(&hugetlb_lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 483/869] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 482/869] mm/hugetlb_cgroup: move per-node usage on cross node migration Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 484/869] mm/shmem: report RCU-tasks quiescent states while undoing a range Greg Kroah-Hartman
` (393 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongfu Li, Andrew Morton,
Muchun Song, Colin Ian King, David Hildenbrand, Kees Cook,
Mina Almasry, Oscar Salvador, Shakeel Butt, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongfu Li <lihongfu@kylinos.cn>
[ Upstream commit 23fac055c21176f66ed453394b533bdfc00f7fba ]
hugetlb_cgroup_css_offline() hands the folios of a dying cgroup over to
its parent with hugetlb_cgroup_move_parent(), which moves the page_counter
charges and the hugetlb_cgroup pointer of the folio but not its per-node
usage. The parent's hugetlb.<size>.numa_stat is short by that usage while
they are charged, and underflows once they are freed, exposing incorrect
per-node usage values to userspace.
Move the per-node usage to the parent as well. The folios keep their node
here, so only the cgroup which holds the usage changes.
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-2-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb_cgroup.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 00b20c4ff222f..7c59c20d68574 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -249,6 +249,8 @@ static void hugetlb_cgroup_move_parent(int idx, struct hugetlb_cgroup *h_cg,
/* Take the pages off the local counter */
page_counter_cancel(counter, nr_pages);
+ hugetlb_cgroup_move_usage(h_cg, parent, folio, folio);
+
set_hugetlb_cgroup(folio, parent);
out:
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 484/869] mm/shmem: report RCU-tasks quiescent states while undoing a range
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 483/869] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 485/869] mm/alloc_tag: account for reserved tag ids in the kernel tag check Greg Kroah-Hartman
` (392 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Andrew Morton, SJ Park,
Baolin Wang, Hugh Dickins, Paul E . McKenney, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit ebd1a08c192109c83a87ddf42793ed6283180faf ]
This shows up in the Meta fleet on ftruncate() of large tmpfs files:
INFO: rcu_tasks detected stalls on tasks:
00000000752fd185: .. nvcsw: 59455/59455 holdout: 1 idle_cpu: -1/0
task:rocksdb:bottom state:R running task
__folio_split
find_get_entry
find_get_entries
truncate_inode_partial_folio
shmem_undo_range
shmem_setattr
notify_change
do_ftruncate
__x64_sys_ftruncate
do_syscall_64
shmem_undo_range() walks the whole of the requested range in folio_batch
sized steps, twice, and its two cond_resched() calls are the only
reschedule points in that walk.
cond_resched() is not an RCU-tasks quiescent state. Use
cond_resched_tasks_rcu_qs() at both points so the walk reports an
RCU-tasks quiescent state as it proceeds.
Link: https://lore.kernel.org/20260918-shmem-tasks-rcu-v1-1-79acf91a2569@debian.org
Fixes: 8315f42295d2 ("rcu: Add call_rcu_tasks()")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Paul E . McKenney" <paulmck@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/shmem.c b/mm/shmem.c
index 0100110f77b8e..f2b5a11e88a55 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1129,7 +1129,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
}
folio_batch_remove_exceptionals(&fbatch);
folio_batch_release(&fbatch);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
}
/*
@@ -1170,7 +1170,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
index = start;
while (index < end) {
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (!find_get_entries(mapping, &index, end - 1, &fbatch,
indices)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 485/869] mm/alloc_tag: account for reserved tag ids in the kernel tag check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 484/869] mm/shmem: report RCU-tasks quiescent states while undoing a range Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 486/869] mm/damon/core: charge only the part of a region the filter left Greg Kroah-Hartman
` (391 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Ge, Andrew Morton,
Suren Baghdasaryan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <hao.ge@linux.dev>
[ Upstream commit c6e5c0b9a493891634d0a413c3485930a28a8903 ]
The tag ids stored in the page flags include two reserved markers.
Id 0 means the page has no tag and id 1 means the tag was cleared,
so real tags start at CODETAG_ID_FIRST. The kernel-side check in
alloc_tag_sec_init() compared kernel_tags.count alone against the
addressable limit, so with the count at or just under the limit
the last tag ids wrapped into those markers. Pages allocated
through them then look the same as untagged pages on free, nothing
is ever subtracted from the real tag and /proc/allocinfo shows
that memory as still allocated.
Add the missing CODETAG_ID_FIRST, same as tags_addressable().
Link: https://lore.kernel.org/20260916075557.121316-1-hao.ge@linux.dev
Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Signed-off-by: Hao Ge <hao.ge@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/alloc_tag.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c
index 7c6d3a086fdc4..fbe9e6c995210 100644
--- a/lib/alloc_tag.c
+++ b/lib/alloc_tag.c
@@ -276,7 +276,7 @@ void __init alloc_tag_sec_init(void)
kernel_tags.count = last_codetag - kernel_tags.first_tag;
/* Check if kernel tags fit into page flags */
- if (kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
+ if (CODETAG_ID_FIRST + kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
shutdown_mem_profiling(false); /* allocinfo file does not exist yet */
pr_err("%lu allocation tags cannot be references using %d available page flag bits. Memory allocation profiling is disabled!\n",
kernel_tags.count, NR_UNUSED_PAGEFLAG_BITS);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 486/869] mm/damon/core: charge only the part of a region the filter left
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 485/869] mm/alloc_tag: account for reserved tag ids in the kernel tag check Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 487/869] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
` (390 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donggeun Yoo, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 4ff3b4a54a32142497fb44b79d0920aa6ba3393d ]
Patch series "mm/damon/core: fix the size charged for a filter-trimmed
region", v2.
An address range DAMOS filter that partially overlaps a monitoring region
splits it, so the scheme action reaches only one side of the boundary.
damos_apply_scheme() reads the region size before that split and never
re-reads it, so the quota charge and schemes/<S>/stats/sz_tried account
for the whole original region.
Patch 1 re-reads the size after the core filters have run. Patch 2 adds
KUnit coverage for what the function charges and reports, for the trimmed
cases and for the cases that must not change.
This patch (of 2):
An address range DAMOS filter that partially overlaps a monitoring region
splits the region at the filter boundary, so the scheme action is applied
to only one side of it. damos_apply_scheme() reads the region size once
on entry, before damos_core_filter_out() performs that split.
The quota charge and the statistics update therefore account for the
region as it was before the trim. schemes/<S>/stats/sz_tried counts
memory the filter excluded, which Documentation/mm/damon/design.rst says
is not counted as tried, and with quotas/bytes set the excluded part is
charged against the budget, throttling the scheme to a fraction of what
was configured.
User impact is that DAMOS could unexpectedly slowly run, due to
over-charged quota. DAMOS stat could also be confusing. No critical
events such as crashes or leask happen.
Re-read the region size after the core filters have run.
Link: https://lore.kernel.org/20260921152443.80132-1-sj@kernel.org
Link: https://lore.kernel.org/20260921152443.80132-2-sj@kernel.org
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 0bed1cd9e3a23..56f2343ffefac 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2004,6 +2004,7 @@ static void damos_apply_scheme(struct damon_ctx *c, struct damon_target *t,
}
if (damos_filter_out(c, t, r, s))
return;
+ sz = damon_sz_region(r);
ktime_get_coarse_ts64(&begin);
trace_damos_before_apply(cidx, sidx, tidx, r,
damon_nr_regions(t), do_trace);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 487/869] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 486/869] mm/damon/core: charge only the part of a region the filter left Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 20:27 ` SJ Park
2026-11-07 13:52 ` [PATCH 6.18 488/869] platform/x86/amd/pmf: Validate the APTS state index Greg Kroah-Hartman
` (389 subsequent siblings)
876 siblings, 1 reply; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donggeun Yoo, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 1c335228206392b96d327c6b49cea68cbb806d8a ]
damos_test_filter_out() checks that an address range filter splits a
region at the filter boundary, and stops there. Nothing checks what
damos_apply_scheme() then charges to the quota and reports as tried.
damos_test_apply_scheme_filtered_sz() covers the two ways such a filter
trims a region: one that starts before the filter's range, and one that
starts inside it.
damos_test_apply_scheme_filter_sz_unchanged() and
damos_test_apply_scheme_quota_sz() cover the cases whose accounting must
not change: a region wholly inside a reject range, one wholly inside an
allow range, two filters trimming in a single call, a filter type that
never splits, no filter at all, a region the quota trims, and a quota
remainder too small for one region.
Link: https://lore.kernel.org/20260921152443.80132-3-sj@kernel.org
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 316 ++++++++++++++++++++++++++++++++++++
1 file changed, 316 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 0ce6481319432..ddf4cc37188fd 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -624,6 +624,319 @@ static void damos_test_filter_out(struct kunit *test)
damos_free_filter(f);
}
+static unsigned long damos_test_apply_scheme_stub(struct damon_ctx *c,
+ struct damon_target *t, struct damon_region *r,
+ struct damos *s, unsigned long *sz_filter_passed)
+{
+ return 0;
+}
+
+static void damos_test_apply_scheme_filtered_sz(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damon_region *r;
+ struct damos_filter *f;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz,
+ .end = 8 * min_sz
+ };
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+
+ /* reject filter, region starting before the range */
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ if (damon_nr_regions(t) != 2)
+ goto out;
+ damon_destroy_region(damon_next_region(r), t);
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+
+ /* allow filter, region starting inside the range */
+ f->allow = true;
+ damos_set_filters_default_reject(s);
+ r = damon_new_region(2 * min_sz, 10 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 8 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 6 * min_sz);
+
+out:
+ damon_destroy_ctx(c);
+}
+
+static void damos_test_apply_scheme_filter_sz_unchanged(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damos_filter *f, *f2;
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damon_region *r;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz, .end = 8 * min_sz};
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+
+ /* wholly inside a reject range: not counted at all */
+ r = damon_new_region(4 * min_sz, 6 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.nr_tried, 0);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 0);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* wholly inside an allow range: counted whole, not split */
+ f->allow = true;
+ damos_set_filters_default_reject(s);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* two filters, each trimming: the size left after both is counted */
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ f->allow = false;
+ f->addr_range = (struct damon_addr_range){
+ .start = 4 * min_sz, .end = 12 * min_sz};
+ f2 = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f2) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f2->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz, .end = 3 * min_sz};
+ damos_add_filter(s, f2);
+ damos_set_filters_default_reject(s);
+
+ r = damon_new_region(0, 8 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ /* a core filter that never splits: counted whole */
+ damos_destroy_filter(f2);
+ damos_destroy_filter(f);
+ f = damos_new_filter(DAMOS_FILTER_TYPE_TARGET, true, true);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->target_idx = 0;
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+ s->stat = (struct damos_stat){};
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ damon_destroy_ctx(c);
+}
+
+static void damos_test_apply_scheme_quota_sz(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damon_region *r, *next;
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+ damos_set_filters_default_reject(s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ /* no apply_scheme operation: the whole region is counted */
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 4 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* no filter and no quota: the whole region is counted */
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+ s->stat = (struct damos_stat){};
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 4 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* the quota trims the region: the trimmed size is counted */
+ damon_for_each_region_safe(r, next, t)
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ s->quota.esz = 2 * min_sz;
+ s->quota.charged_sz = 0;
+
+ r = damon_new_region(0, 8 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ /* quota remainder below one region: tried, but nothing counted */
+ damon_for_each_region_safe(r, next, t)
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ s->quota.esz = 1;
+ s->quota.charged_sz = 0;
+
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.nr_tried, 1);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 0);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 4 * min_sz);
+
+ damon_destroy_ctx(c);
+}
+
static void damon_test_feed_loop_next_input(struct kunit *test)
{
unsigned long last_input = 900000, current_score = 200;
@@ -750,6 +1063,9 @@ static struct kunit_case damon_test_cases[] = {
KUNIT_CASE(damos_test_new_filter),
KUNIT_CASE(damos_test_commit_filter),
KUNIT_CASE(damos_test_filter_out),
+ KUNIT_CASE(damos_test_apply_scheme_filtered_sz),
+ KUNIT_CASE(damos_test_apply_scheme_filter_sz_unchanged),
+ KUNIT_CASE(damos_test_apply_scheme_quota_sz),
KUNIT_CASE(damon_test_feed_loop_next_input),
KUNIT_CASE(damon_test_set_filters_default_reject),
{},
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 487/869] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
2026-11-07 13:52 ` [PATCH 6.18 487/869] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
@ 2026-11-07 20:27 ` SJ Park
0 siblings, 0 replies; 880+ messages in thread
From: SJ Park @ 2026-11-07 20:27 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: SJ Park, stable, patches, Donggeun Yoo, Andrew Morton,
Brendan Higgins, David Gow, Sasha Levin, damon
On Sat, 7 Nov 2026 08:52:49 -0500 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 6.18-stable review patch. If anyone has any objections, please let me know.
Please drop this. This is not intended to be picked for stable tree, and
causing a DAMON kunit test failure.
The Cc:stable@ tag was wrongly added due to a mix of Cc:stable@ and
non-Cc:stable@ patches in a series.
Thanks,
SJ
[...]
^ permalink raw reply [flat|nested] 880+ messages in thread
* [PATCH 6.18 488/869] platform/x86/amd/pmf: Validate the APTS state index
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 487/869] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 489/869] platform/x86/amd: Stop counting intermediate cycles with metrics table Greg Kroah-Hartman
` (388 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 192dddd5aa45166450820cef16521bdf23976a73 ]
The static slider APTS state index is supplied by the BIOS as an 8-bit
value, but apts_config_store contains only APTS_MAX_STATES entries. An
invalid firmware value can therefore cause amd_pmf_update_slider_v2() to
read beyond the end of the array.
Validate the selected index before applying the slider values and return
an error when it is out of range.
Fixes: 8362e862fb87 ("platform/x86/amd/pmf: Update sps power thermals according to the platform-profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260903182927.3556274-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmf/sps.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
index c28f3c5744c25..bf101e527b115 100644
--- a/drivers/platform/x86/amd/pmf/sps.c
+++ b/drivers/platform/x86/amd/pmf/sps.c
@@ -248,20 +248,24 @@ static int amd_pmf_update_sps_power_limits_v2(struct amd_pmf_dev *pdev, int pwr_
switch (pwr_mode) {
case POWER_MODE_PERFORMANCE:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_PERFORMANCE];
- amd_pmf_update_slider_v2(pdev, index);
break;
case POWER_MODE_BALANCED_POWER:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BALANCED];
- amd_pmf_update_slider_v2(pdev, index);
break;
case POWER_MODE_POWER_SAVER:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_POWER_EFFICIENCY];
- amd_pmf_update_slider_v2(pdev, index);
break;
default:
return -EINVAL;
}
+ if (index >= APTS_MAX_STATES) {
+ dev_err(pdev->dev, "Invalid APTS index: %d\n", index);
+ return -EINVAL;
+ }
+
+ amd_pmf_update_slider_v2(pdev, index);
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 489/869] platform/x86/amd: Stop counting intermediate cycles with metrics table
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 488/869] platform/x86/amd/pmf: Validate the APTS state index Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 490/869] platform/x86: asus-wmi: fix unclear usage of bd->props.power Greg Kroah-Hartman
` (387 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Gibson, Mario Limonciello,
Chia-Lin Kao (AceLan), Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 0c2c928ea7d33c8131b0785bda4e26a32dce5caa ]
The metrics table doesn't increment for all cases that can cause an
intermediate wakeup if the cycle is very fast. This can make the intent
from commit 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5
seconds between HW sleep cycles") not work properly.
That commit originally was measured to work properly, but it was
accidental due to a logic error. The logic error was fixed in
commit 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at
start of cycle") but this now masked the table doesn't always update.
Since that code was introduced, Daniel Gibson added a number of changes
to the logic which includes a state variable introduced in
commit 037f0b03c663a ("platform/x86/amd/pmc: Don't log during
intermediate wakeups").
Utilize that state variable to instead decide if a single sequence has
started.
Cc: Daniel Gibson <daniel@gibson.sh>
Cc: stable@vger.kernel.org # 7.1.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Cc: stable@vger.kernel.org # 6.18.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Fixes: 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at start of cycle")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Link: https://patch.msgid.link/20260914141734.2703545-1-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 15 +--------------
1 file changed, 1 insertion(+), 14 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index 000f876e27ebb..fea41c8c1899a 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -604,19 +604,6 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
return rc;
}
-static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)
-{
- /*
- * Starting a new HW sleep cycle right after waking from one
- * can cause electrical problems triggering the over voltage protection.
- * That is avoided by delaying the next suspend a bit, see also
- * https://lore.kernel.org/all/20250414162446.3853194-1-superm1@kernel.org/
- */
- struct smu_metrics table;
-
- return get_metrics_table(pdev, &table) == 0 && table.s0i3_last_entry_status;
-}
-
static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
{
/*
@@ -709,7 +696,7 @@ static void amd_pmc_s2idle_check(void)
struct amd_pmc_dev *pdev = &pmc;
int rc;
- if (amd_pmc_intermediate_wakeup_need_delay(pdev) ||
+ if (!pdev->is_first_check_after_suspend ||
amd_pmc_want_suspend_delay(pdev))
msleep(2500);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 490/869] platform/x86: asus-wmi: fix unclear usage of bd->props.power
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 489/869] platform/x86/amd: Stop counting intermediate cycles with metrics table Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 491/869] platform/x86: asus-wmi: fix screenpad power state detection Greg Kroah-Hartman
` (386 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Baigue, Ponali, Denis Benato,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <denis.benato@linux.dev>
[ Upstream commit fd83d81ddf058d487e6d6489b18094f068e66a59 ]
The bd->props.power is checked in parts of the driver correctly
comparing with BACKLIGHT_POWER_ON, while in others with a raw usage
of bd->props.power and !bd->props.power, moreover in certain checks
the logic has been inverted due to BACKLIGHT_POWER_ON being defined
as 0: fix both the wrong usage and the inconsistencies by using
proper comparisons.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Closes: https://lore.kernel.org/all/178362762638.911488.8564892548331679884@eldamar.lan/
Closes: https://lore.kernel.org/all/ea9c63d1-4776-49d5-9dc4-6c09498f99c9@linux.dev/
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Ponali <ponali2k@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-2-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 9f0f79030b5b8..adff9f49b5677 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4156,7 +4156,8 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
u32 ctrl_param = bd->props.brightness;
int err = 0;
- if (bd->props.power) {
+ switch (bd->props.power) {
+ case BACKLIGHT_POWER_ON:
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 1, NULL);
if (err < 0)
return err;
@@ -4164,12 +4165,17 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_LIGHT, ctrl_param, NULL);
if (err < 0)
return err;
- }
+ break;
- if (!bd->props.power) {
+ case BACKLIGHT_POWER_OFF:
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 0, NULL);
if (err < 0)
return err;
+ break;
+
+ default:
+ pr_warn("Invalid screenpad backlight power state: %d\n", bd->props.power);
+ return -EINVAL;
}
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 491/869] platform/x86: asus-wmi: fix screenpad power state detection
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 490/869] platform/x86: asus-wmi: fix unclear usage of bd->props.power Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 492/869] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token Greg Kroah-Hartman
` (385 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Baigue, Denis Benato,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <denis.benato@linux.dev>
[ Upstream commit f9a1cd14b392a82fdc73474894bf8b198757dfb2 ]
On some models, e.g. the UX5400EA, the screenpad power state cannot be
read back: DSTS(ASUS_WMI_DEVID_SCREENPAD_POWER) never sets
ASUS_WMI_DSTS_STATUS_BIT, so asus_wmi_get_devstate_simple() reports the
panel as powered off regardless of its real state.
The DSDT shows DSTS 0x00050031 (POWER) and DSTS 0x00050032 (LIGHT)
both read the same two-byte EC register, each returning a different
byte: byte 0 is a raw EC status byte, which is 0xa0 when the panel is
powered and 0x00 when it is off, and byte 1 is the brightness. Read
the power state from the low byte instead of
ASUS_WMI_DSTS_STATUS_BIT: firmware reporting the power through the
status bit is covered too, since ASUS_WMI_DSTS_STATUS_BIT lies inside
ASUS_WMI_DSTS_BRIGHTNESS_MASK.
Reuse read_screenpad_backlight_power() in asus_screenpad_init() in
place of the raw devstate read. This makes the brightness read
reachable on models like the UX5400EA, so mask the SCREENPAD_LIGHT
value with ASUS_WMI_DSTS_BRIGHTNESS_MASK before storing it: the
unmasked devstate (0x0001ffa0 when the panel is on) would otherwise be
exposed to userspace as an out-of-range brightness (max_brightness is
255) which systemd-backlight then persists.
While at it, pass asus_wmi_get_devstate() the u32 it expects.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Reported-by: Hugo Baigue <hugobaigue2004@gmail.com>
Closes: https://lore.kernel.org/all/CAO84+x+P2_xyHP89+nGVSMV6bL+dy0P9=vyEEfZGnFhv0hBNWw@mail.gmail.com/
Suggested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-3-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index adff9f49b5677..486c12b232d14 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4122,13 +4122,20 @@ static int is_display_toggle(int code)
static int read_screenpad_backlight_power(struct asus_wmi *asus)
{
- int ret;
+ int ret, retval;
- ret = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+ ret = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_POWER, &retval);
if (ret < 0)
return ret;
- /* 1 == powered */
- return ret ? BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
+
+ /*
+ * The firmware reports the panel power in the low byte of the
+ * devstate as a raw EC status byte that is non-zero when the
+ * panel is powered; other models report it through
+ * ASUS_WMI_DSTS_STATUS_BIT, which lies inside the same mask.
+ */
+ return (retval & ASUS_WMI_DSTS_BRIGHTNESS_MASK) ?
+ BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
}
static int read_screenpad_brightness(struct backlight_device *bd)
@@ -4192,16 +4199,17 @@ static int asus_screenpad_init(struct asus_wmi *asus)
struct backlight_device *bd;
struct backlight_properties props;
int err, power;
- int brightness = 0;
+ u32 brightness = 0;
- power = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+ power = read_screenpad_backlight_power(asus);
if (power < 0)
return power;
- if (power) {
+ if (power == BACKLIGHT_POWER_ON) {
err = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_LIGHT, &brightness);
if (err < 0)
return err;
+ brightness &= ASUS_WMI_DSTS_BRIGHTNESS_MASK;
}
memset(&props, 0, sizeof(struct backlight_properties));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 492/869] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 491/869] platform/x86: asus-wmi: fix screenpad power state detection Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 493/869] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() Greg Kroah-Hartman
` (384 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Snyder, Muhammad Bilal,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 540b8ae192afb5566c1b13b6884aee87107a26b9 ]
hp_calculate_security_buffer() special-cases an empty authentication
string and returns a fixed 4 bytes (sizeof(u16) * 2). But
hp_populate_security_buffer() does not special-case that same input:
for any authentication string that does not start with BEAM_PREFIX,
including the empty string, it always builds "UTF_PREFIX +
authentication" and converts the result to UTF-16, writing a 2-byte
length header plus 2 bytes per character of "<utf-16/>" (9 characters),
20 bytes total, regardless of how long "authentication" itself is.
The caller, hp_set_attribute(), sizes its kmalloc() buffer using
hp_calculate_security_buffer()'s return value, so for an empty
authentication token it allocates 4 bytes for the security area but
hp_populate_security_buffer() then writes 20 bytes into it, causing a
16-byte heap buffer overflow.
The authentication token used here is the current admin/setup
password, which is an empty string by default until one is
configured. Any write to a writable BIOS attribute while no admin
password has been set reaches this path.
Fix by removing the special-case early return for an empty string in
hp_calculate_security_buffer(). The generic calculation that follows
already accounts for the UTF_PREFIX correctly, which naturally yields
the same 20 bytes that hp_populate_security_buffer() writes for an empty
string, avoiding duplicate logic for special cases.
Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Reported-by: Josh Snyder <josh@code406.com>
Closes: https://lore.kernel.org/platform-driver-x86/20260402-hp-bioscfg-overflow-v1-1-6985f8c9e67c@code406.com/
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260919060037.84602-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index 4d94e48c1a4c8..abf8ce20fe15c 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -47,9 +47,6 @@ size_t hp_calculate_security_buffer(const char *authentication)
return sizeof(u16) * 2;
authlen = strlen(authentication);
- if (!authlen)
- return sizeof(u16) * 2;
-
size = sizeof(u16) + authlen * sizeof(u16);
if (!strstarts(authentication, BEAM_PREFIX))
size += strlen(UTF_PREFIX) * sizeof(u16);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 493/869] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 492/869] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 494/869] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() Greg Kroah-Hartman
` (383 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6dea092b261f04d632411c2be52d13190f5f67b1 ]
hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
struct bios_return header in the returned buffer. However, it only
checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).
If the firmware or ACPI method returns a buffer shorter than 8 bytes:
1. bios_return->return_code at offset 4 reads out of bounds from the
allocated ACPI buffer slab.
2. If return_code evaluates to 0 and outsize is non-zero,
(int)(obj->buffer.length - sizeof(*bios_return)) evaluates to a
negative integer (e.g. -8 for a 0-length buffer). actual_outsize is
set to this negative value and passed to memcpy(buffer, ...,
actual_outsize), where the signed negative value is cast to
size_t (e.g. 0xfffffffffffffff8), attempting to copy ~18 Exabytes
and triggering an immediate kernel crash. Additionally,
memset(buffer + actual_outsize, ...) performs an out-of-bounds
write before buffer.
Fix this by ensuring obj->buffer.length is at least sizeof(*bios_return)
before accessing the return code, and compute actual_outsize safely
using min_t(u32, ...), which is sound specifically because the guard
above already rules out obj->buffer.length being smaller than
sizeof(*bios_return) by the time that subtraction runs.
Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260826103012.240453-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-wmi.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 5eb2aade44cca..f92bb3dca2e30 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -491,8 +491,9 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
goto out_free;
}
- if (obj->type != ACPI_TYPE_BUFFER) {
- pr_warn("query 0x%x returned an invalid object 0x%x\n", query, ret);
+ if (obj->type != ACPI_TYPE_BUFFER ||
+ obj->buffer.length < sizeof(*bios_return)) {
+ pr_warn("query 0x%x returned wrong type or too small buffer\n", query);
ret = -EINVAL;
goto out_free;
}
@@ -511,7 +512,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
if (!outsize)
goto out_free;
- actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
+ actual_outsize = min_t(u32, outsize, obj->buffer.length - sizeof(*bios_return));
memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
memset(buffer + actual_outsize, 0, outsize - actual_outsize);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 494/869] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 493/869] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 495/869] platform/x86: oxpec: Fix Apex charge limit control Greg Kroah-Hartman
` (382 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jack Boykin, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Boykin <jtboykin.jb@gmail.com>
[ Upstream commit 9f3eebbbd1033de0abcc2694ba4b455d30fe33f9 ]
power_supply_get_by_name() takes a reference that is only dropped on
the error path. On success it leaks, five times per policy evaluation.
Unregistering the battery later trips the use_cnt WARN_ON in
power_supply_unregister() and never frees it.
While here, return -ENODEV instead of an uninitialised 'value' when
no battery matches, and stop at the first supply found rather than
letting the last one in the table win.
Found by reading the code. Fix and changelog drafted with Claude Code
(Fable 5.1) and reviewed by hand. Compile-tested only (allmodconfig,
W=1, sparse); not run on Smart PC hardware.
Fixes: f4627dfd0e19 ("platform/x86/amd/pmf: Add support to get inputs from other subsystems")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Jack Boykin <jtboykin.jb@gmail.com>
Link: https://patch.msgid.link/20260902210217.69483-1-jtboykin.jb@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmf/spc.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/platform/x86/amd/pmf/spc.c b/drivers/platform/x86/amd/pmf/spc.c
index 85192c7536b80..cbe4eef5b8bb4 100644
--- a/drivers/platform/x86/amd/pmf/spc.c
+++ b/drivers/platform/x86/amd/pmf/spc.c
@@ -244,13 +244,11 @@ static int amd_pmf_get_battery_prop(enum power_supply_property prop)
continue;
ret = power_supply_get_property(psy, prop, &value);
- if (ret) {
- power_supply_put(psy);
- return ret;
- }
+ power_supply_put(psy);
+ return ret ? ret : value.intval;
}
- return value.intval;
+ return -ENODEV;
}
static int amd_pmf_get_battery_info(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 495/869] platform/x86: oxpec: Fix Apex charge limit control
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 494/869] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 496/869] platform/x86: simatic-ipc: fix platform device leak on registration failure Greg Kroah-Hartman
` (381 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antheas Kapenekakis, Derek J. Clark,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <lkml@antheas.dev>
[ Upstream commit 0ccdf9a1381c7fb6d9e84abeb8e5d6c85dd07059 ]
The OneXPlayer Apex uses E5/E6 for battery bypass / charge limit, making
it the first device to deviate. This was verified by a user on Windows
with BIOS version 2.17 and later by running this kernel patch.
Drop X1_ from the MASK variables as they are common in all devices,
introduce a board enum for Apex, and make it use the new E5/E6 registers
for charge limit / bypass. Apply the same quirks as oxp_fly, since APEX
uses the same registers otherwise.
Fixes: 3385ea97c14d ("platform/x86: oxpec: Add support for OneXPlayer APEX")
Cc: stable@vger.kernel.org
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Link: https://patch.msgid.link/20260920190438.3444923-1-lkml@antheas.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/oxpec.c | 68 ++++++++++++++++++++++++++++--------
1 file changed, 53 insertions(+), 15 deletions(-)
diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c
index a30845ba37969..4fc9310296342 100644
--- a/drivers/platform/x86/oxpec.c
+++ b/drivers/platform/x86/oxpec.c
@@ -60,6 +60,7 @@ enum oxp_board {
oxp_x1,
oxp_g1_i,
oxp_g1_a,
+ oxp_apex,
};
static enum oxp_board board;
@@ -103,11 +104,14 @@ static struct device *oxp_dev;
#define OXP_X1_CHARGE_LIMIT_REG 0xA3 /* X1 charge limit (%) */
#define OXP_X1_CHARGE_INHIBIT_REG 0xA4 /* X1 bypass charging */
-#define OXP_X1_CHARGE_INHIBIT_MASK_AWAKE 0x01
+#define OXP_APEX_CHARGE_LIMIT_REG 0xE5 /* Apex charge limit (%) */
+#define OXP_APEX_CHARGE_INHIBIT_REG 0xE6 /* Apex bypass charging */
+
+#define OXP_CHARGE_INHIBIT_MASK_AWAKE 0x01
/* X1 Mask is 0x0A, F1Pro is 0x02 but the extra bit on the X1 does nothing. */
-#define OXP_X1_CHARGE_INHIBIT_MASK_OFF 0x02
-#define OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS (OXP_X1_CHARGE_INHIBIT_MASK_AWAKE | \
- OXP_X1_CHARGE_INHIBIT_MASK_OFF)
+#define OXP_CHARGE_INHIBIT_MASK_OFF 0x02
+#define OXP_CHARGE_INHIBIT_MASK_ALWAYS (OXP_CHARGE_INHIBIT_MASK_AWAKE | \
+ OXP_CHARGE_INHIBIT_MASK_OFF)
static const struct dmi_system_id dmi_table[] = {
{
@@ -220,7 +224,7 @@ static const struct dmi_system_id dmi_table[] = {
DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER APEX"),
},
- .driver_data = (void *)oxp_fly,
+ .driver_data = (void *)oxp_apex,
},
{
.matches = {
@@ -404,6 +408,7 @@ static umode_t tt_toggle_is_visible(struct kobject *kobj,
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return attr->mode;
default:
break;
@@ -433,6 +438,7 @@ static ssize_t tt_toggle_store(struct device *dev,
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
reg = OXP_TURBO_SWITCH_REG;
mask = OXP_TURBO_TAKE_VAL;
break;
@@ -479,6 +485,7 @@ static ssize_t tt_toggle_show(struct device *dev,
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
reg = OXP_TURBO_SWITCH_REG;
mask = OXP_TURBO_TAKE_VAL;
break;
@@ -576,6 +583,7 @@ static bool oxp_psy_ext_supported(void)
case oxp_g1_i:
case oxp_g1_a:
case oxp_fly:
+ case oxp_apex:
return true;
default:
break;
@@ -589,12 +597,24 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
enum power_supply_property psp,
union power_supply_propval *val)
{
+ u8 limit_reg, inhibit_reg;
long raw_val;
int ret;
+ switch (board) {
+ case oxp_apex:
+ limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+ break;
+ default:
+ limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+ break;
+ }
+
switch (psp) {
case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
- ret = read_from_ec(OXP_X1_CHARGE_LIMIT_REG, 1, &raw_val);
+ ret = read_from_ec(limit_reg, 1, &raw_val);
if (ret)
return ret;
if (raw_val < 0 || raw_val > 100)
@@ -602,14 +622,14 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
val->intval = raw_val;
return 0;
case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
- ret = read_from_ec(OXP_X1_CHARGE_INHIBIT_REG, 1, &raw_val);
+ ret = read_from_ec(inhibit_reg, 1, &raw_val);
if (ret)
return ret;
- if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS) ==
- OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS)
+ if ((raw_val & OXP_CHARGE_INHIBIT_MASK_ALWAYS) ==
+ OXP_CHARGE_INHIBIT_MASK_ALWAYS)
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE;
- else if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_AWAKE) ==
- OXP_X1_CHARGE_INHIBIT_MASK_AWAKE)
+ else if ((raw_val & OXP_CHARGE_INHIBIT_MASK_AWAKE) ==
+ OXP_CHARGE_INHIBIT_MASK_AWAKE)
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE;
else
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO;
@@ -625,29 +645,41 @@ static int oxp_psy_ext_set_prop(struct power_supply *psy,
enum power_supply_property psp,
const union power_supply_propval *val)
{
+ u8 limit_reg, inhibit_reg;
long raw_val;
+ switch (board) {
+ case oxp_apex:
+ limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+ break;
+ default:
+ limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+ break;
+ }
+
switch (psp) {
case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
if (val->intval < 0 || val->intval > 100)
return -EINVAL;
- return write_to_ec(OXP_X1_CHARGE_LIMIT_REG, val->intval);
+ return write_to_ec(limit_reg, val->intval);
case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
switch (val->intval) {
case POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO:
raw_val = 0;
break;
case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE:
- raw_val = OXP_X1_CHARGE_INHIBIT_MASK_AWAKE;
+ raw_val = OXP_CHARGE_INHIBIT_MASK_AWAKE;
break;
case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE:
- raw_val = OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS;
+ raw_val = OXP_CHARGE_INHIBIT_MASK_ALWAYS;
break;
default:
return -EINVAL;
}
- return write_to_ec(OXP_X1_CHARGE_INHIBIT_REG, raw_val);
+ return write_to_ec(inhibit_reg, raw_val);
default:
return -EINVAL;
}
@@ -715,6 +747,7 @@ static int oxp_pwm_enable(void)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_MANUAL);
default:
return -EINVAL;
@@ -743,6 +776,7 @@ static int oxp_pwm_disable(void)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_AUTO);
default:
return -EINVAL;
@@ -771,6 +805,7 @@ static int oxp_pwm_read(long *val)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return read_from_ec(OXP_SENSOR_PWM_ENABLE_REG, 1, val);
default:
return -EOPNOTSUPP;
@@ -815,6 +850,7 @@ static int oxp_pwm_fan_speed(long *val)
case oxp_mini_amd_a07:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
return read_from_ec(OXP_SENSOR_FAN_REG, 2, val);
default:
return -EOPNOTSUPP;
@@ -855,6 +891,7 @@ static int oxp_pwm_input_write(long val)
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_REG, val);
default:
return -EOPNOTSUPP;
@@ -902,6 +939,7 @@ static int oxp_pwm_input_read(long *val)
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
default:
ret = read_from_ec(OXP_SENSOR_PWM_REG, 1, val);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 496/869] platform/x86: simatic-ipc: fix platform device leak on registration failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 495/869] platform/x86: oxpec: Fix Apex charge limit control Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 6.18 497/869] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data Greg Kroah-Hartman
` (380 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 9523698252fd583d6987582b9c34ec6500d10986 ]
register_platform_devices() registers the battery, LED, and watchdog
platform devices in sequence. If LED registration fails, the battery
device remains registered. If watchdog registration fails, the LED and
battery devices remain registered.
These failure paths leave successful platform_device_register_data()
calls without the matching platform_device_unregister() calls.
Add an unwind ladder to unregister previously registered platform
devices in reverse order before returning the registration error.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: dd123e62bded ("platform/x86: simatic-ipc: add main driver for Siemens devices")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924115617.1578309-1-lgs201920130244@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/siemens/simatic-ipc.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/siemens/simatic-ipc.c b/drivers/platform/x86/siemens/simatic-ipc.c
index 7039874d8f112..4a4509fc9263e 100644
--- a/drivers/platform/x86/siemens/simatic-ipc.c
+++ b/drivers/platform/x86/siemens/simatic-ipc.c
@@ -92,6 +92,7 @@ static int register_platform_devices(u32 station_id)
u8 wdtmode = SIMATIC_IPC_DEVICE_NONE;
u8 battmode = SIMATIC_IPC_DEVICE_NONE;
char *pdevname;
+ int ret;
int i;
for (i = 0; i < ARRAY_SIZE(device_modes); i++) {
@@ -139,8 +140,10 @@ static int register_platform_devices(u32 station_id)
pdevname, PLATFORM_DEVID_NONE,
&platform_data,
sizeof(struct simatic_ipc_platform));
- if (IS_ERR(ipc_led_platform_device))
- return PTR_ERR(ipc_led_platform_device);
+ if (IS_ERR(ipc_led_platform_device)) {
+ ret = PTR_ERR(ipc_led_platform_device);
+ goto err_unregister_batt;
+ }
pr_debug("device=%s created\n",
ipc_led_platform_device->name);
@@ -153,8 +156,10 @@ static int register_platform_devices(u32 station_id)
KBUILD_MODNAME "_wdt", PLATFORM_DEVID_NONE,
&platform_data,
sizeof(struct simatic_ipc_platform));
- if (IS_ERR(ipc_wdt_platform_device))
- return PTR_ERR(ipc_wdt_platform_device);
+ if (IS_ERR(ipc_wdt_platform_device)) {
+ ret = PTR_ERR(ipc_wdt_platform_device);
+ goto err_unregister_led;
+ }
pr_debug("device=%s created\n",
ipc_wdt_platform_device->name);
@@ -169,6 +174,14 @@ static int register_platform_devices(u32 station_id)
}
return 0;
+
+err_unregister_led:
+ if (ledmode != SIMATIC_IPC_DEVICE_NONE)
+ platform_device_unregister(ipc_led_platform_device);
+err_unregister_batt:
+ if (battmode != SIMATIC_IPC_DEVICE_NONE)
+ platform_device_unregister(ipc_batt_platform_device);
+ return ret;
}
static void request_additional_modules(u32 station_id)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 497/869] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 496/869] platform/x86: simatic-ipc: fix platform device leak on registration failure Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 498/869] platform/x86/intel-uncore-freq: Continue restoring limits on resume Greg Kroah-Hartman
` (379 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Mario Limonciello,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit b7b273844b94af9cc64907dccd9e7997c2b60f1a ]
amd_hfi_fill_metadata() parses CPU core ranking data out of the
firmware-provided PCC shared memory but trusts two values it should not:
- n_bitmaps is used to bound the outer loop that reads the APIC ID
bitmaps from table_data[], but it is never validated against the size
of the shared memory region (pcct_ext->length). A firmware-supplied
count larger than the region reads past the end of table_data.
- When resolving the base of the ranking data for a processor, the
pointer is shifted by an extra "i * nr_class" term, where i is the
current bitmap index. The per-processor offset is already applied
through apic_index, which uses the running count of active processors
(apic_start). The extra shift compounds for every logical processor
beyond the first bitmap (APIC ID >= 32), reading out of bounds.
Both result in out-of-bounds reads that can corrupt the ranking metrics,
oops, or otherwise destabilise the system.
Reject an n_bitmaps value that would not fit within the shared memory
region, and drop the bogus "i * nr_class" term so the ranking data is
addressed only through its correct per-processor offset.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: d4e95ea7a78e ("platform/x86: hfi: Parse CPU core ranking data from shared memory")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260921170411.1149960-3-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/hfi/hfi.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/amd/hfi/hfi.c b/drivers/platform/x86/amd/hfi/hfi.c
index ac6ef0b5b95b2..1d12a3b8f32f1 100644
--- a/drivers/platform/x86/amd/hfi/hfi.c
+++ b/drivers/platform/x86/amd/hfi/hfi.c
@@ -21,6 +21,7 @@
#include <linux/module.h>
#include <linux/mailbox_client.h>
#include <linux/mutex.h>
+#include <linux/overflow.h>
#include <linux/percpu-defs.h>
#include <linux/platform_device.h>
#include <linux/smp.h>
@@ -169,6 +170,21 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
return -EINVAL;
}
+ /*
+ * The bitmaps enumerating the APIC IDs occupy the first n_bitmaps
+ * words of table_data. Reject a firmware-provided count that would
+ * push those reads past the end of the shared memory region.
+ */
+ if (struct_size(amd_hfi_data->shmem, table_data, amd_hfi_data->shmem->n_bitmaps) >
+ pcct_ext->length) {
+ dev_err(amd_hfi_data->dev, "invalid number of bitmaps: %u\n",
+ amd_hfi_data->shmem->n_bitmaps);
+ return -EINVAL;
+ }
+
+ /* The ranking data for each processor follows the bitmaps */
+ u32 *table = amd_hfi_data->shmem->table_data + amd_hfi_data->shmem->n_bitmaps;
+
for (unsigned int i = 0; i < amd_hfi_data->shmem->n_bitmaps; i++) {
u32 bitmap = amd_hfi_data->shmem->table_data[i];
@@ -193,10 +209,6 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
info = per_cpu_ptr(&amd_hfi_cpuinfo, cpu_index);
apic_index = apic_start * info->nr_class * 2;
for (unsigned int k = 0; k < info->nr_class; k++) {
- u32 *table = amd_hfi_data->shmem->table_data +
- amd_hfi_data->shmem->n_bitmaps +
- i * info->nr_class;
-
info->amd_hfi_classes[k].eff = table[apic_index + 2 * k];
info->amd_hfi_classes[k].perf = table[apic_index + 2 * k + 1];
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 498/869] platform/x86/intel-uncore-freq: Continue restoring limits on resume
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 6.18 497/869] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 499/869] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features() Greg Kroah-Hartman
` (378 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yijia Wang, Guixiong Wei,
Srinivas Pandruvada, Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <weiguixiong@bytedance.com>
[ Upstream commit 38998529f45c02edcf96b0a3ddd3c83de6d11bbe ]
The PM notifier iterates over every uncore frequency instance to restore
user-configured MSR_UNCORE_RATIO_LIMIT values after resume. Entries that
have never been configured legitimately have stored_uncore_data set to
zero.
The refactoring that split common and enumeration code changed the
iteration from active control CPUs to all allocated instances. It also
changed the skip for an invalid or unconfigured entry from continue to
return, causing that entry to terminate the entire restore operation.
On a multi-package or multi-die system, configuring only a later instance
therefore leaves its limit unrestored after suspend, hibernation, or
restore if an earlier entry is invalid or unconfigured.
Use continue to skip only the current entry and restore all remaining
configured instances.
Fixes: dbce412a7733 ("platform/x86/intel-uncore-freq: Split common and enumeration part")
Cc: stable@vger.kernel.org
Tested-by: Yijia Wang <wangyijia.yeah@bytedance.com>
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260929163133.14326-2-weiguixiong@bytedance.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
index 0dfc552b28024..3836d76943f5a 100644
--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
@@ -211,7 +211,7 @@ static int uncore_pm_notify(struct notifier_block *nb, unsigned long mode,
struct uncore_data *data = &uncore_instances[i];
if (!data || !data->valid || !data->stored_uncore_data)
- return 0;
+ continue;
wrmsrq_on_cpu(data->control_cpu, MSR_UNCORE_RATIO_LIMIT,
data->stored_uncore_data);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 499/869] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 498/869] platform/x86/intel-uncore-freq: Continue restoring limits on resume Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 500/869] fbdev: ssd1307fb: check for fb_deferred_io_init() error Greg Kroah-Hartman
` (377 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David E. Box, Michael J. Ruhl,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David E. Box <david.e.box@linux.intel.com>
[ Upstream commit 3678e39c6aaeb9aa380c7357b24f7d55955543f8 ]
intel_vsec_walk_header() used to return a bool that was true when devices
were found. It was converted to return 0 on success and a negative errno
on failure, but the boolean test in intel_vsec_get_features() was left
unchanged, so its meaning is now inverted.
A successful walk returns 0 and leaves found set to false, while a failed
walk returns an error that evaluates to true. When no other capabilities
are present, intel_vsec_pci_init() then returns -ENODEV even though the
auxiliary devices were created, and the driver core tears them back down.
This affects platforms that have no DVSEC or VSEC capabilities and
describe their features through device_data instead, which today means
DG1. Test the return value for success explicitly.
Fixes: a6ce8bf3c993 ("platform/x86/intel/vsec: Return real error codes from registration path")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20261001220351.1592138-3-david.e.box@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/vsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
index 1e292eaeb209d..814e418bea82b 100644
--- a/drivers/platform/x86/intel/vsec.c
+++ b/drivers/platform/x86/intel/vsec.c
@@ -617,7 +617,7 @@ static bool intel_vsec_get_features(struct pci_dev *pdev,
found = true;
if (info && (info->quirks & VSEC_QUIRK_NO_DVSEC) &&
- intel_vsec_walk_header(&pdev->dev, info))
+ !intel_vsec_walk_header(&pdev->dev, info))
found = true;
return found;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 500/869] fbdev: ssd1307fb: check for fb_deferred_io_init() error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 499/869] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 501/869] fbdev: xen-fbfront: " Greg Kroah-Hartman
` (376 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 81ae1f9a6c850efab3e5dec6b7c9aa5c587f92b7 ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently ssd1307fb_probe() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/ssd1307fb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 0df3ac694f4e0..e4559312a9265 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -763,7 +763,11 @@ static int ssd1307fb_probe(struct i2c_client *client)
info->fix.smem_start = __pa(vmem);
info->fix.smem_len = vmem_size;
- fb_deferred_io_init(info);
+ ret = fb_deferred_io_init(info);
+ if (ret) {
+ dev_err(dev, "failed to init fb deferred io: %d\n", ret);
+ goto fb_defio_error;
+ }
i2c_set_clientdata(client, info);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 501/869] fbdev: xen-fbfront: check for fb_deferred_io_init() error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 500/869] fbdev: ssd1307fb: check for fb_deferred_io_init() error Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 502/869] fbdev: udlfb: " Greg Kroah-Hartman
` (375 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 5b234b0dd29d79207c059c7b40851dd1e934fa3a ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently xenfb_probe() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/xen-fbfront.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index d8f3bfb2dd6c9..22aaafd2c11f5 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -443,7 +443,11 @@ static int xenfb_probe(struct xenbus_device *dev,
}
fb_info->fbdefio = &xenfb_defio;
- fb_deferred_io_init(fb_info);
+ ret = fb_deferred_io_init(fb_info);
+ if (ret < 0) {
+ xenbus_dev_fatal(dev, ret, "fb_deferred_io_init");
+ goto error_cmap;
+ }
xenfb_init_shared_page(info, fb_info);
@@ -465,6 +469,7 @@ static int xenfb_probe(struct xenbus_device *dev,
error_fb:
fb_deferred_io_cleanup(fb_info);
+error_cmap:
fb_dealloc_cmap(&fb_info->cmap);
framebuffer_release(fb_info);
error_nomem:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 502/869] fbdev: udlfb: check for fb_deferred_io_init() error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 501/869] fbdev: xen-fbfront: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 503/869] fbdev: smscufx: " Greg Kroah-Hartman
` (374 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit eae055f33e41e1d3e1a7e905bdcb1e9f196ed31d ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently dlfb_ops_open() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.
fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as dlfb_ops_open() returns.
Additionally, if the allocation of info->fbdefio itself fails,
dlfb_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).
Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.
The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.
The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").
However, the BUG_ON() issue originates from the earlier
commit 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio
implementation for multiple framebuffers"), so target that for the fix.
Fixes: 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio implementation for multiple framebuffers")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/udlfb.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index f6da680c29eac..abaac2ed22a98 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -947,10 +947,13 @@ static int dlfb_ops_open(struct fb_info *info, int user)
fbdefio->delay = DL_DEFIO_WRITE_DELAY;
fbdefio->sort_pagereflist = true;
fbdefio->deferred_io = dlfb_dpy_deferred_io;
- }
- info->fbdefio = fbdefio;
- fb_deferred_io_init(info);
+ info->fbdefio = fbdefio;
+ if (fb_deferred_io_init(info)) {
+ kfree(fbdefio);
+ info->fbdefio = NULL;
+ }
+ }
}
dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 503/869] fbdev: smscufx: check for fb_deferred_io_init() error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 502/869] fbdev: udlfb: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 504/869] fbdev: sh_mobile_lcdc: " Greg Kroah-Hartman
` (373 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 8ea6c6e77ccf887f3e68c64f4c261071a345da1e ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently ufx_ops_open() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.
fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as ufx_ops_open() returns.
Additionally, if the allocation of info->fbdefio itself fails,
ufx_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).
Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.
The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.
The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").
However, the BUG_ON() issue originates from the earlier
commit 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display
adapters"), so target that for the fix.
Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/smscufx.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index 891ce7b76d637..30a94d85fc8c1 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1041,10 +1041,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
if (fbdefio) {
fbdefio->delay = UFX_DEFIO_WRITE_DELAY;
fbdefio->deferred_io = ufx_dpy_deferred_io;
- }
- info->fbdefio = fbdefio;
- fb_deferred_io_init(info);
+ info->fbdefio = fbdefio;
+ if (fb_deferred_io_init(info)) {
+ kfree(fbdefio);
+ info->fbdefio = NULL;
+ }
+ }
}
pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 504/869] fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 503/869] fbdev: smscufx: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 505/869] fbdev: kyro: Release WC setup on registration failure Greg Kroah-Hartman
` (372 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 5192201aaac2a923ff98306e3ccda58718ee395f ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently sh_mobile_lcdc_start() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Also clear info->fbdefio in that case, so that sh_mobile_lcdc_stop() does
not attempt to clean up deferred I/O state that was never initialised.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index 6038f217ab427..c6da5a62f8c5f 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -1042,7 +1042,11 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
ch->defio.deferred_io = sh_mobile_lcdc_deferred_io;
ch->defio.delay = msecs_to_jiffies(tmp);
ch->info->fbdefio = &ch->defio;
- fb_deferred_io_init(ch->info);
+ ret = fb_deferred_io_init(ch->info);
+ if (ret) {
+ ch->info->fbdefio = NULL;
+ return ret;
+ }
}
sh_mobile_lcdc_display_on(ch);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 505/869] fbdev: kyro: Release WC setup on registration failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 504/869] fbdev: sh_mobile_lcdc: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 506/869] serial: 8250_exar: store the GPIO platform device in struct exar8250 Greg Kroah-Hartman
` (371 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Helge Deller, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit d3bc005a62945aec57059201092b12b7c955e5a7 ]
If register_framebuffer() fails, kyrofb_probe() frees the framebuffer
without releasing its write-combining range. Release the range before
freeing the framebuffer. Earlier failures still skip this cleanup.
The missing cleanup already exists in the initial Git import, before
the conversion from mtrr_add() to arch_phys_wc_add().
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/kyro/fbdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index c44d6809859e5..fc350edb41a82 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -766,7 +766,7 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
fb_memset_io(info->screen_base, 0, size);
if (register_framebuffer(info) < 0)
- goto out_free_fb;
+ goto out_free_wc;
fb_info(info, "%s frame buffer device, at %dx%d@%d using %ldk/%ldk of VRAM\n",
info->fix.id,
@@ -777,6 +777,8 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
+out_free_wc:
+ arch_phys_wc_del(currentpar->wc_cookie);
out_free_fb:
framebuffer_release(info);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 506/869] serial: 8250_exar: store the GPIO platform device in struct exar8250
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 505/869] fbdev: kyro: Release WC setup on registration failure Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 507/869] dm-bufio: fix non-working memory limit Greg Kroah-Hartman
` (370 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 33d337816e00994daaf670243186d9e537ee090d ]
The GPIO platform device is registered via platform->register_gpio()
when port 0 is being set up. It is stored to port->port.private_data of
the on-stack uart template (and from there it is copied into every
registered port). pci_xr17v35x_exit() then fetches it back by
serial8250_get_port(priv->line[0]).
But port 0 does not have to exist at that point. If
serial8250_register_8250_port() fails for port 0, priv->line[0] holds a
negative error code. The probe still succeeds (it only breaks the loop),
so on unbind, priv->line[0] (a negative value) is passed to
serial8250_get_port(). The GPIO device is never unregistered and a
bogus port is accessed.
The same problem would also occur after the planned conversion of
serial8250_register_8250_port() to return a uart port instead of a
line. As Sashiko pointed out in that case:
If board->setup() fails for the first port (i=0) in exar_pci_probe(),
priv->uport[0] remains NULL. If serial8250_register_8250_port() fails,
it returns an ERR_PTR. In either case, the loop breaks and probe
returns success. When the device is later unbound,
pci_xr17v35x_exit() unconditionally passes priv->uport[0] to
platform->unregister_gpio(), which will dereference it without
checking for validity.
The GPIO device belongs to the PCI device, not to any particular port.
So store it in a new struct exar8250::gpio member. Pass priv to both
->register_gpio() and ->unregister_gpio(), so that pci_xr17v35x_exit()
does not need to look up any port at all.
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci")
Link: https://lore.kernel.org/all/sashiko-outbox-166269@kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/03a8b5c71614fc672fef1e55c083bda6c73b5bf3.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_exar.c | 36 ++++++++++++++---------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index b9cc0b786ca62..f9f9c10246e12 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -231,8 +231,9 @@ struct exar8250_platform {
int (*rs485_config)(struct uart_port *port, struct ktermios *termios,
struct serial_rs485 *rs485);
const struct serial_rs485 *rs485_supported;
- int (*register_gpio)(struct pci_dev *pcidev, struct uart_8250_port *port);
- void (*unregister_gpio)(struct uart_8250_port *port);
+ int (*register_gpio)(struct exar8250 *priv, struct pci_dev *pcidev,
+ struct uart_8250_port *port);
+ void (*unregister_gpio)(struct exar8250 *priv);
};
/**
@@ -256,6 +257,7 @@ struct exar8250 {
struct exar8250_board *board;
struct eeprom_93cx6 eeprom;
void __iomem *virt;
+ struct platform_device *gpio;
int line[];
};
@@ -1174,22 +1176,21 @@ static const struct software_node exar_gpio_node = {
.properties = exar_gpio_properties,
};
-static int xr17v35x_register_gpio(struct pci_dev *pcidev, struct uart_8250_port *port)
+static int xr17v35x_register_gpio(struct exar8250 *priv, struct pci_dev *pcidev,
+ struct uart_8250_port *port)
{
if (pcidev->vendor == PCI_VENDOR_ID_EXAR)
- port->port.private_data =
- __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
+ priv->gpio = __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
return 0;
}
-static void xr17v35x_unregister_gpio(struct uart_8250_port *port)
+static void xr17v35x_unregister_gpio(struct exar8250 *priv)
{
- if (!port->port.private_data)
- return;
-
- __xr17v35x_unregister_gpio(port->port.private_data);
- port->port.private_data = NULL;
+ if (priv->gpio) {
+ __xr17v35x_unregister_gpio(priv->gpio);
+ priv->gpio = NULL;
+ }
}
static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termios,
@@ -1286,8 +1287,9 @@ static const struct software_node iot2040_gpio_node = {
.properties = iot2040_gpio_properties,
};
-static int iot2040_register_gpio(struct pci_dev *pcidev,
- struct uart_8250_port *port)
+static int iot2040_register_gpio(struct exar8250 *priv,
+ struct pci_dev *pcidev,
+ struct uart_8250_port *port)
{
u8 __iomem *p = port->port.membase;
@@ -1296,8 +1298,7 @@ static int iot2040_register_gpio(struct pci_dev *pcidev,
writeb(IOT2040_UARTS_ENABLE, p + UART_EXAR_MPIOLVL_15_8);
writeb(IOT2040_UARTS_GPIO_HI_MODE, p + UART_EXAR_MPIOSEL_15_8);
- port->port.private_data =
- __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
+ priv->gpio = __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
return 0;
}
@@ -1374,7 +1375,7 @@ pci_xr17v35x_setup(struct exar8250 *priv, struct pci_dev *pcidev,
/* Setup Multipurpose Input/Output pins. */
setup_gpio(pcidev, p);
- ret = platform->register_gpio(pcidev, port);
+ ret = platform->register_gpio(priv, pcidev, port);
}
return ret;
@@ -1384,9 +1385,8 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev)
{
const struct exar8250_platform *platform = exar_get_platform();
struct exar8250 *priv = pci_get_drvdata(pcidev);
- struct uart_8250_port *port = serial8250_get_port(priv->line[0]);
- platform->unregister_gpio(port);
+ platform->unregister_gpio(priv);
}
static inline void exar_misc_clear(struct exar8250 *priv)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 507/869] dm-bufio: fix non-working memory limit
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 506/869] serial: 8250_exar: store the GPIO platform device in struct exar8250 Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 508/869] dm-bufio: fix a race leading to an unsigned integer underflow Greg Kroah-Hartman
` (369 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 1190dbeaeaa026a4879e675b8556a150c36a7ced ]
The function evict_old is supposed to loop and evict buffers while the
allocated size is above the threshold. However if it hits one bufio
client that is empty, it stops and doesn't attempt to scan other
clients.
This commit fixes it, so that it skips empty clients and retries up to
dm_bufio_client_count times.
Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-bufio.c | 41 +++++++++++++++++++++++++++++++++++++----
1 file changed, 37 insertions(+), 4 deletions(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 59e5d8aa42b71..6d76511953a25 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2521,6 +2521,13 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
init_waitqueue_head(&c->free_buffer_wait);
c->async_write_error = 0;
+ /*
+ * A client with no buffers yet is not holding the oldest buffer in
+ * the system; leaving this zeroed would claim exactly that and keep
+ * the client pinned at the front of dm_bufio_all_clients.
+ */
+ c->oldest_buffer = jiffies;
+
c->dm_io = dm_io_client_create();
if (IS_ERR(c->dm_io)) {
r = PTR_ERR(c->dm_io);
@@ -2755,9 +2762,23 @@ static unsigned long __evict_a_few(unsigned long nr_buffers)
dm_bufio_unlock(c);
- if (count)
+ if (count) {
c->oldest_buffer = oldest_buffer;
- __insert_client(c);
+ __insert_client(c);
+ } else {
+ /*
+ * We evicted nothing, so 'oldest_buffer' tells us nothing new
+ * and the client keeps its old, possibly very stale, value.
+ * Requeue it at the back rather than by that value, otherwise
+ * __insert_client() would put it straight back at the front
+ * and every subsequent call would pop this same client again,
+ * never reaching any of the others.
+ *
+ * This leaves the list slightly out of order, which is fine -
+ * it is only ever an approximation.
+ */
+ list_add_tail(&c->client_list, &dm_bufio_all_clients);
+ }
return count;
}
@@ -2782,11 +2803,23 @@ static void evict_old(void)
{
unsigned long threshold = dm_bufio_cache_size -
dm_bufio_cache_size / DM_BUFIO_LOW_WATERMARK_RATIO;
+ int unproductive = 0;
mutex_lock(&dm_bufio_clients_lock);
while (dm_bufio_current_allocated > threshold) {
- if (!__evict_a_few(64))
- break;
+ if (__evict_a_few(64)) {
+ unproductive = 0;
+ } else {
+ /*
+ * This client had nothing to give. Try the others
+ * before giving up: one idle client, or one whose
+ * buffers are all held, must not stop us evicting
+ * from everybody else. Stop once a whole sweep of
+ * the client list has freed nothing.
+ */
+ if (++unproductive >= dm_bufio_client_count)
+ break;
+ }
cond_resched();
}
mutex_unlock(&dm_bufio_clients_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 508/869] dm-bufio: fix a race leading to an unsigned integer underflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 507/869] dm-bufio: fix non-working memory limit Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 509/869] mei: vsc: Fix packet CRC computed over pointer size Greg Kroah-Hartman
` (368 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 005d2ec5723cd4ac740de678274623f1fadd6a6e ]
The function __scan tests "count - freed <= retain_target" and then sets
"atomic_long_set(&c->need_shrink, 0);" It exits with the condition "if
(!atomic_long_read(&c->need_shrink)) break;" It may be possible that
between these two statements, another thread sets &c->need_shrink to a
non-zero value. In this case, the function __scan continues and it may
possibly the "freed" variable is larger than the "count" variable. The
expression "count - freed" underflows and the function __scan will
continue to free all the buffers, even those that are below
retain_target.
Fix this bug by immediatelly exiting if we set
"atomic_long_set(&c->need_shrink, 0)"; and don't attempt to re-read
c->need_shrink afterwards.
Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-bufio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6d76511953a25..07e2f0fccefe5 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2402,8 +2402,10 @@ static void __scan(struct dm_bufio_client *c)
for (l = 0; l < LIST_SIZE; l++) {
while (true) {
- if (count - freed <= retain_target)
+ if (count - freed <= retain_target) {
atomic_long_set(&c->need_shrink, 0);
+ break;
+ }
if (!atomic_long_read(&c->need_shrink))
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 509/869] mei: vsc: Fix packet CRC computed over pointer size
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 508/869] dm-bufio: fix a race leading to an unsigned integer underflow Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 510/869] speakup: Fix NULL pointer dereference on VT switch + selection Greg Kroah-Hartman
` (367 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sakari Ailus, Wentao Guan,
Alexander Usyskin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 1d2a50533aac7046488da78b0d25f69673cbb028 ]
vsc_tp_xfer() computes the packet CRC over sizeof(pkt) + olen bytes,
but pkt is a pointer, so sizeof(pkt) evaluates to the pointer size
instead of the size of struct vsc_tp_packet_hdr. The value correctly
match the 8-byte header on 64-bit builds.
Use sizeof(pkt->hdr), consistent with the header size used everywhere
else in the driver, e.g. in VSC_TP_PACKET_SIZE().
Cc: stable@kernel.org
Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20261006-vcs_fix_crc-v1-1-b7b149f13c1d@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/mei/vsc-tp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c
index 5ecf99883996b..e70c07aa0d604 100644
--- a/drivers/misc/mei/vsc-tp.c
+++ b/drivers/misc/mei/vsc-tp.c
@@ -293,7 +293,7 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmd, const void *obuf, size_t olen,
pkt->hdr.seq = cpu_to_le32(++tp->seq);
memcpy(pkt->buf, obuf, olen);
- crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt) + olen);
+ crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt->hdr) + olen);
memcpy(pkt->buf + olen, &crc, sizeof(crc));
ret = vsc_tp_wakeup_request(tp);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 510/869] speakup: Fix NULL pointer dereference on VT switch + selection
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 509/869] mei: vsc: Fix packet CRC computed over pointer size Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 511/869] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws Greg Kroah-Hartman
` (366 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+e5693071d903b832, Samuel Thibault,
stable, Weiming Shi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
[ Upstream commit e1301ab8a8411fccc7effe0711fc09939a94953c ]
When selecting/pasting very quickly after VT switch, the tty is not set
yet, leading to a NULL dereference. We can just abort the operation.
Reported-by: co+e5693071d903b832@bugs.sh
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: stable@kernel.org
Tested-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260829164945.2691317-3-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accessibility/speakup/selection.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
index 7df7afad5ab42..463a7ef19315e 100644
--- a/drivers/accessibility/speakup/selection.c
+++ b/drivers/accessibility/speakup/selection.c
@@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = {
int speakup_set_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
/* we get kref here first in order to avoid a subtle race when
* cancelling selection work. getting kref first establishes the
* invariant that if speakup_sel_work.tty is not NULL when
@@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = {
int speakup_paste_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
tty_kref_get(tty);
if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
tty_kref_put(tty);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 511/869] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 510/869] speakup: Fix NULL pointer dereference on VT switch + selection Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 512/869] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock Greg Kroah-Hartman
` (365 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Luo Jie, Konrad Dybcio,
Gustavo A. R. Silva, Abel Vesa, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit 231bbd135772390522be3656b34b49ea3039eccf ]
hw_data->hws[] is annotated with __counted_by(num), so hw_data->num
must hold the element count before the array is accessed.
ipq_cmn_pll_register_clks() assigns it only after storing the fixed
rate output clocks and the CMN PLL, and the unwind loop under
unregister_fixed_clk reads .hws[] with .num still zero. Both are
out-of-bounds accesses under CONFIG_UBSAN_BOUNDS.
Move the assignment to right after the allocation.
Fixes: f81715a4c87c ("clk: qcom: Add CMN PLL clock controller driver for IPQ SoC")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Luo Jie <jie.luo@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/AS8P251MB000187BDFAD98A21F4C356E9C8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/ipq-cmn-pll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/ipq-cmn-pll.c b/drivers/clk/qcom/ipq-cmn-pll.c
index 369798d1ce427..e01c8ccf17311 100644
--- a/drivers/clk/qcom/ipq-cmn-pll.c
+++ b/drivers/clk/qcom/ipq-cmn-pll.c
@@ -351,6 +351,8 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
if (!hw_data)
return -ENOMEM;
+ hw_data->num = num_clks + 1;
+
/*
* Register the CMN PLL clock, which is the parent clock of
* the fixed rate output clocks.
@@ -377,7 +379,6 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
* is configured to 12 GHZ by DT property assigned-clock-rates-u64.
*/
hw_data->hws[CMN_PLL_CLK] = cmn_pll_hw;
- hw_data->num = num_clks + 1;
ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, hw_data);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 512/869] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 511/869] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 513/869] clk: qcom: ipq5332: " Greg Kroah-Hartman
` (364 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 75e893169fc5c9ec28d5f9dffde40ce29b59a5de ]
The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.
Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.
Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-1-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5018.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index e2d01cdc39c96..78ccd70199fc9 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -1270,6 +1270,7 @@ static struct clk_rcg2 usb0_master_clk_src = {
};
static const struct freq_tbl ftbl_usb0_mock_utmi_clk_src[] = {
+ F(24000000, P_XO, 1, 0, 0),
F(60000000, P_GPLL4, 10, 1, 2),
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 513/869] clk: qcom: ipq5332: add 24MHz rate for USB UTMI clock
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 512/869] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 514/869] iomap: dont lose a fiemap iteration error when emitting the last extent Greg Kroah-Hartman
` (363 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 19b62f31e15ef70dc927aab91b1576ea6c37f992 ]
The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.
Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.
Cc: stable@vger.kernel.org
Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-2-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5332.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
index 9246e97d785a1..1d02c35c67225 100644
--- a/drivers/clk/qcom/gcc-ipq5332.c
+++ b/drivers/clk/qcom/gcc-ipq5332.c
@@ -1039,6 +1039,7 @@ static struct clk_rcg2 gcc_usb0_master_clk_src = {
};
static const struct freq_tbl ftbl_gcc_usb0_mock_utmi_clk_src[] = {
+ F(24000000, P_XO, 1, 0, 0),
F(60000000, P_GPLL4_OUT_AUX, 10, 1, 2),
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 514/869] iomap: dont lose a fiemap iteration error when emitting the last extent
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 513/869] clk: qcom: ipq5332: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 515/869] nvme-rdma: dont complete a request after a bogus remote invalidation Greg Kroah-Hartman
` (362 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Foster, Darrick J. Wong,
Christoph Hellwig, Andrea Parri, Christian Brauner (Amutable),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 0d0104adc2c8316433b660cdf6d182a09881864f ]
iomap_fiemap() emits extents one behind: iomap_fiemap_iter() flushes the
previous extent and remembers the current one, and the remembered extent
is written with FIEMAP_EXTENT_LAST after the iteration loop.
That final flush overwrites ret, so when ->iomap_begin() fails partway
through the iteration the error is replaced by the result of
iomap_to_fiemap() (zero on success) and iomap_fiemap() returns success
with a truncated extent list whose last entry is wrongly marked as the
last extent in the file. The pre-iomap_iter code returned the error
from inside the loop, before flushing the pending extent.
Check for the iteration error before flushing the pending extent, so
that real errors are propagated and only a successful iteration emits
the final FIEMAP_EXTENT_LAST extent. -ENOENT (no mapping) is still not
an error, and the pending extent is still emitted in that case.
Fixes: 7892386d3571 ("iomap: switch iomap_fiemap to use iomap_iter")
Cc: stable@vger.kernel.org # v5.15
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/250226e33b3b23c6b1714a45dc3c465c2a45cdc0.1790342457.git.parri.andrea@gmail.com
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/iomap/fiemap.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/iomap/fiemap.c b/fs/iomap/fiemap.c
index d11dadff82865..54b824b7edb5c 100644
--- a/fs/iomap/fiemap.c
+++ b/fs/iomap/fiemap.c
@@ -76,15 +76,15 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
while ((ret = iomap_iter(&iter, ops)) > 0)
iter.status = iomap_fiemap_iter(&iter, fi, &prev);
+ /* inode with no (attribute) mapping will give ENOENT */
+ if (ret < 0 && ret != -ENOENT)
+ return ret;
+
if (prev.type != IOMAP_HOLE) {
ret = iomap_to_fiemap(fi, &prev, FIEMAP_EXTENT_LAST);
if (ret < 0)
return ret;
}
-
- /* inode with no (attribute) mapping will give ENOENT */
- if (ret < 0 && ret != -ENOENT)
- return ret;
return 0;
}
EXPORT_SYMBOL_GPL(iomap_fiemap);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 515/869] nvme-rdma: dont complete a request after a bogus remote invalidation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 514/869] iomap: dont lose a fiemap iteration error when emitting the last extent Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 516/869] nvmet: fix preempt of another registrant by the reservation holder Greg Kroah-Hartman
` (361 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Yehyeong Lee,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 909307cea08aff4e486cdb7491de5c76a2c31341 ]
When a remote invalidation names an rkey that is not the one we handed out
for this request, nvme_rdma_process_nvme_rsp() logs and schedules error
recovery, then falls through to nvme_rdma_end_request(). The request is
completed with req->mr never invalidated, and nvme_rdma_unmap_data() hands
it back with ib_mr_pool_put(), which only puts it on a list. The rkey
stays valid and still maps the pages the completed read filled, so a
controller that sent the bogus invalidation can write into those pages
after pread() has returned.
Return instead, the way the local invalidation path below already does,
and leave the request for error recovery to cancel.
Fixes: 3ef0279bb0031 ("nvme-rdma: Check remotely invalidated rkey matches our expected rkey")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/rdma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 19a9dd7caed8d..dbaf503b7de9c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1713,6 +1713,7 @@ static void nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
"Bogus remote invalidation for rkey %#x\n",
req->mr ? req->mr->rkey : 0);
nvme_rdma_error_recovery(queue->ctrl);
+ return;
}
} else if (req->mr) {
int ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 516/869] nvmet: fix preempt of another registrant by the reservation holder
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 515/869] nvme-rdma: dont complete a request after a bogus remote invalidation Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 517/869] nvme-auth: fail when the controller does not authenticate itself Greg Kroah-Hartman
` (360 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Daejun Park,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit d9e84d4e19994818b80846bd2abb7b396e4116a9 ]
Unless the reservation is of an All Registrants type, nvmet_pr_preempt()
treats every Reservation Acquire command with the Preempt or Preempt and
Abort action that is sent by the reservation holder as the holder
preempting itself. It updates the reservation type to RTYPE and
completes the command successfully without looking at PRKEY.
NVMe Base Specification 2.1, section 8.1.22.7 makes the action depend
on PRKEY for these reservation types, no matter which registrant sends
the command:
- PRKEY matches the key of the reservation holder: the reservation is
preempted. This is how a holder preempts itself.
- PRKEY does not match the key of the holder and is not 0h: the
registrants whose key matches PRKEY are unregistered.
- PRKEY does not match the key of the holder and is 0h: the command is
aborted with Invalid Field in Command.
With the current code, a holder that preempts with the key of another
registrant leaves that registrant registered, changes the reservation
type to RTYPE and still gets a successful completion. With hosts A, B
and C registered with the keys 0xa, 0xb and 0xc, and A holding an
Exclusive Access - Registrants Only reservation, A sends:
# nvme resv-acquire /dev/nvme1 -n 1 --crkey=0xa --prkey=0xb \
--rtype=4 --racqa=1
NVME Reservation Acquire success
# nvme resv-report /dev/nvme1 -n 1 --eds | grep '^regctl '
regctl : 3
and B can still write to the namespace. Preempt and Abort (--racqa=2)
gives the same result. When C sends the preempt instead (--crkey=0xc),
B is unregistered and its writes fail with Reservation Conflict.
This defeats fencing in the pNFS SCSI layout server. nfsd holds the
reservation and fences a client that does not return its layout by
calling pr_preempt() with the key of that client and the abort flag,
which is the command RFC 9561 section 2.2.3 asks for. On an nvmet
namespace the preempt succeeds, nfsd logs the client as fenced, and the
client keeps writing to the device. In a test with an nfsd server and
two clients on an nvmet-tcp namespace, the namespace still had three
registrants after the fence and the fenced client went on writing to
it. With this patch two registrants are left and the writes of the
fenced client fail with a reservation conflict.
Take the self preempt path only when PRKEY is the key of the holder.
Any other PRKEY sent by the holder is then handled by the code that
already serves a non-holder registrant, for Preempt and for Preempt and
Abort. For a host that holds the reservation this changes the
following:
- A preempt with the key of another registrant unregisters the
registrants with that key, sends them the registration preempted
notification and leaves the reservation type alone.
- A preempt with PRKEY 0h fails with Invalid Field in Command. A
holder that changed its reservation type this way has to pass its
own key in PRKEY, which works with and without this patch.
- A preempt with a PRKEY that matches no registrant fails with
Reservation Conflict. The specification defines that status only
for the All Registrants types. It is what nvmet already returns to
a non-holder registrant in this case and what the SCSI target
returns for an unregistered key. nfsd treats it as a successful
fence.
Not changed: when the holder preempts itself, registrants that share
its key stay registered.
Fixes: 5a47c2080a73 ("nvmet: support reservation feature")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/pr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/target/pr.c b/drivers/nvme/target/pr.c
index 9ab50f821ad69..0f696840b168b 100644
--- a/drivers/nvme/target/pr.c
+++ b/drivers/nvme/target/pr.c
@@ -589,7 +589,7 @@ static u16 nvmet_pr_preempt(struct nvmet_req *req,
&ctrl->hostid, abort);
}
- if (holder == reg) {
+ if (holder == reg && prkey == holder->rkey) {
status = nvmet_pr_update_reg_attr(pr, holder,
nvmet_pr_update_holder_rtype, &rtype);
if (!status && original_rtype != rtype)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 517/869] nvme-auth: fail when the controller does not authenticate itself
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 516/869] nvmet: fix preempt of another registrant by the reservation holder Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 518/869] nvmet: free the bvec on file namespace range errors Greg Kroah-Hartman
` (359 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Yehyeong Lee, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit f9e43d924bc74feeb56197de82b2845de2a4b85a ]
nvme_auth_process_dhchap_success1() returns success as soon as the
controller clears the rvalid flag in its DH-HMAC-CHAP success1 message,
without looking at whether the host had asked the controller to
authenticate. A host configured with a controller secret sends a
challenge in its reply, computes the expected controller response, and
sets chap->bi_directional; if the controller then answers with
rvalid = 0 the response is never compared, the host still sends
success2, and the queue is marked as authenticated.
A malicious or man-in-the-middle controller therefore only has to clear
one flag to turn the configured bidirectional authentication into a
one-way one, without holding any secret of its own. The target side
already treats the mirror image of this as fatal: when the host supplied
a challenge but no controller key is configured, nvmet_auth_success1()
fails the authentication rather than answering with rvalid = 0.
Refuse the connection if the controller returns no response although
bidirectional authentication was requested. chap->bi_directional is the
right condition rather than ctrl->ctrl_key, because secure concatenation
sends a challenge only to derive the PSK and deliberately clears
bi_directional; a one-way setup without a controller secret keeps
returning success as before.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 9d73713d6f828..38506314248f6 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -378,8 +378,21 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl,
nvme_auth_hmac_name(chap->hash_id),
nvme_auth_dhgroup_name(chap->dhgroup_id));
- if (!data->rvalid)
+ if (!data->rvalid) {
+ /*
+ * The controller did not return a response. If we asked it to
+ * authenticate itself the session must not be used, otherwise
+ * mutual authentication would silently degrade to one-way.
+ */
+ if (chap->bi_directional) {
+ dev_warn(ctrl->device,
+ "qid %d: controller did not authenticate\n",
+ chap->qid);
+ chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED;
+ return -ECONNREFUSED;
+ }
return 0;
+ }
/* Validate controller response */
if (crypto_memneq(chap->response, data->rval, data->hl)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 518/869] nvmet: free the bvec on file namespace range errors
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 517/869] nvme-auth: fail when the controller does not authenticate itself Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 519/869] nvmet: require authentication before property set Greg Kroah-Hartman
` (358 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Jérémy Jean, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 9d820d55b3cb4859c7cf42a74dc78f6154f97398 ]
nvmet_file_execute_rw() allocates the bvec before
nvmet_file_execute_io() checks whether the request fits in the backing
file. If the request extends beyond the file, nvmet_file_execute_io()
calls nvmet_req_complete() to return an error. This skips
nvmet_file_io_done(), so the allocated memory is never freed. Repeated
requests can exhaust memory.
Use nvmet_file_io_done() to free the bvec before returning the range
error to the client.
Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/io-cmd-file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 2d068439b129c..6e14700164724 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -133,8 +133,8 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
pos = le64_to_cpu(req->cmd->rw.slba) << req->ns->blksize_shift;
if (unlikely(pos + req->transfer_len > req->ns->size)) {
- nvmet_req_complete(req, errno_to_nvme_status(req, -ENOSPC));
- return true;
+ ret = -ENOSPC;
+ goto complete;
}
memset(&req->f.iocb, 0, sizeof(struct kiocb));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 519/869] nvmet: require authentication before property set
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 518/869] nvmet: free the bvec on file namespace range errors Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 520/869] nvme: bound FDP config log reads to the received buffer Greg Kroah-Hartman
` (357 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Sung Byeongchan,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 44512543ff0413031516a02cde67323a55e0f769 ]
I/O queues do not perform independent DH-HMAC-CHAP authentication. They
instead rely on authentication of the controller's admin queue. Fabrics
property commands, however, are dispatched before the general admin command
authentication check.
An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
and access a namespace after admin CONNECT reported that authentication was
required. Reject PROPERTY_SET until the admin queue has authenticated.
Targets without a configured authentication key are unchanged.
This was found by source review with AI assistance. A localhost NVMe/TCP
wire reproducer retrieved a known 4 KiB namespace block in two independent
boots without completing AUTH_SEND or AUTH_RECEIVE. With this change,
PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
returned; the no-authentication control continued to work.
Fixes: c91a20129185 ("nvmet-auth: authenticate on admin queue only")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fabrics-cmd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index bc837fbfada15..9aedab2603bdd 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -14,6 +14,10 @@ static void nvmet_execute_prop_set(struct nvmet_req *req)
if (!nvmet_check_transfer_len(req, 0))
return;
+ if (!nvmet_check_auth_status(req)) {
+ status = NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
+ goto out;
+ }
if (req->cmd->prop_set.attrib & 1) {
req->error_loc =
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 520/869] nvme: bound FDP config log reads to the received buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 519/869] nvmet: require authentication before property set Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 521/869] nvmet: zns: dont leak stale memory in zone management receive Greg Kroah-Hartman
` (356 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kanchan Joshi, Christoph Hellwig,
Yehyeong Lee, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 3cf6de080d97d0d9641fbdb613d546c0734905dd ]
nvme_query_fdp_granularity() parses the FDP Configurations log using
sizes the controller returns, without checking that they fit the buffer
it was given. The log size is only bounded from above before
kvmalloc(), so a size below the log header makes
le16_to_cpu(h->numfdpc) read past the allocation, and a size of zero
yields ZERO_SIZE_PTR and faults. Each configuration descriptor is then
dereferenced (dsze while walking, and nrg and runs on the selected one)
without checking that the whole descriptor lies within the buffer, so a
descriptor at or past the end is read out of bounds. The out-of-bounds
runs value is then exposed to userspace through
/sys/block/nvmeXnY/queue/write_stream_granularity.
A device-supplied dsze that is not a multiple of eight also leaves the
following descriptors unaligned, and the structure is not packed, so
reading nrg and runs from one can fault on architectures without
efficient unaligned access.
A malicious or buggy controller triggers this during namespace scan with a
short FDP Configurations log:
[ 1.104828] BUG: KASAN: slab-out-of-bounds in nvme_alloc_ns+0x39a6/0x4480
[ 1.104848] Read of size 8 at addr ffff888009fd8fe0 by task kworker/u8:3/52
[ 1.104852]
[ 1.104857] CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 7.3.0-rc6-00063-g0c2669a9f4a1 #1 PREEMPT(lazy)
[ 1.104862] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 1.104866] Workqueue: async async_run_entry_fn
[ 1.104873] Call Trace:
[ 1.104876] <TASK>
[ 1.104878] dump_stack_lvl+0x66/0xa0
[ 1.104886] print_report+0xd0/0x630
[ 1.104893] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104897] ? __virt_addr_valid+0x209/0x3f0
[ 1.104903] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104907] kasan_report+0xe4/0x120
[ 1.104913] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104919] nvme_alloc_ns+0x39a6/0x4480
[ 1.104926] ? __pfx_nvme_alloc_ns+0x10/0x10
[ 1.104931] ? check_prev_add+0xfd/0xe80
[ 1.104942] ? lock_acquire+0x18d/0x300
[ 1.104948] ? nvme_find_get_ns+0xbb/0x2e0
[ 1.104952] ? find_held_lock+0x2b/0x80
[ 1.104956] ? nvme_find_get_ns+0x221/0x2e0
[ 1.104962] ? nvme_find_get_ns+0x231/0x2e0
[ 1.104967] ? nvme_scan_ns+0x2e1/0x8d0
[ 1.104971] ? kfree+0x2e5/0x510
[ 1.104976] ? __lock_acquire+0x570/0x1b00
[ 1.104982] nvme_scan_ns+0x56a/0x8d0
[ 1.104987] ? __pfx_nvme_scan_ns+0x10/0x10
[ 1.104994] ? lockdep_hardirqs_on_prepare+0xdc/0x190
[ 1.104999] ? trace_hardirqs_on+0x18/0x160
[ 1.105005] ? kvm_clock_get_cycles+0x19/0x40
[ 1.105011] ? __pfx_nvme_scan_ns_async+0x10/0x10
[ 1.105015] async_run_entry_fn+0x8d/0x290
[ 1.105020] process_one_work+0x8ac/0x1b00
[ 1.105029] ? __pfx_process_one_work+0x10/0x10
[ 1.105034] ? lock_acquire+0x18d/0x300
[ 1.105040] ? lock_is_held_type+0x8f/0x100
[ 1.105046] ? __pfx_async_run_entry_fn+0x10/0x10
[ 1.105050] worker_thread+0x4ee/0xe70
[ 1.105056] ? lockdep_hardirqs_on_prepare+0xdc/0x190
[ 1.105061] ? trace_hardirqs_on+0x18/0x160
[ 1.105066] ? __pfx_worker_thread+0x10/0x10
[ 1.105071] ? __pfx_worker_thread+0x10/0x10
[ 1.105076] kthread+0x2ce/0x3b0
[ 1.105080] ? __pfx_kthread+0x10/0x10
[ 1.105085] ret_from_fork+0x52e/0x780
[ 1.105090] ? __pfx_ret_from_fork+0x10/0x10
[ 1.105094] ? __switch_to+0x572/0xde0
[ 1.105101] ? __pfx_kthread+0x10/0x10
[ 1.105105] ret_from_fork_asm+0x1a/0x30
[ 1.105114] </TASK>
[ 1.105116]
[ 1.105117] Allocated by task 52:
[ 1.105119] kasan_save_stack+0x33/0x60
[ 1.105123] kasan_save_track+0x14/0x30
[ 1.105126] __kasan_kmalloc+0x8f/0xa0
[ 1.105129] __kvmalloc_node_noprof+0x2e1/0x820
[ 1.105134] nvme_alloc_ns+0x1097/0x4480
[ 1.105138] nvme_scan_ns+0x56a/0x8d0
[ 1.105142] async_run_entry_fn+0x8d/0x290
[ 1.105145] process_one_work+0x8ac/0x1b00
[ 1.105148] worker_thread+0x4ee/0xe70
[ 1.105152] kthread+0x2ce/0x3b0
[ 1.105155] ret_from_fork+0x52e/0x780
[ 1.105159] ret_from_fork_asm+0x1a/0x30
[ 1.105163]
[ 1.105164] The buggy address belongs to the object at ffff888009fd8fc0
[ 1.105164] which belongs to the cache kmalloc-32 of size 32
[ 1.105167] The buggy address is located 8 bytes to the right of
[ 1.105167] allocated 24-byte region [ffff888009fd8fc0, ffff888009fd8fd8)
[ 1.105171]
[ 1.105172] The buggy address belongs to the physical page:
[ 1.105175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9fd8
[ 1.105179] flags: 0x100000000000000(node=0|zone=1)
[ 1.105183] page_type: f5(slab)
[ 1.105188] raw: 0100000000000000 ffff888008c41780 dead000000000100 dead000000000122
[ 1.105192] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 1.105194] page dumped because: kasan: bad access detected
[ 1.105195]
[ 1.105196] Memory state around the buggy address:
[ 1.105198] ffff888009fd8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1.105201] ffff888009fd8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1.105203] >ffff888009fd8f80: fc fc fc fc fc fc fc fc 00 00 00 fc fc fc fc fc
[ 1.105205] ^
[ 1.105207] ffff888009fd9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[ 1.105210] ffff888009fd9080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 1.105212] ==================================================================
Reject a log smaller than its header plus one configuration descriptor,
zero the buffer so a short transfer leaves no uninitialized tail to parse,
require each descriptor's declared size to be at least a descriptor and to
leave room for the next one before walking it, and read the descriptor
fields with the unaligned accessors.
Fixes: 30b5f20bb2dda ("nvme: register fdp parameters with the block layer")
Cc: stable@vger.kernel.org
Suggested-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index ad725e346c94e..99a8e2953b02a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2210,13 +2210,18 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
}
size = le32_to_cpu(hdr.sze);
+ if (size < sizeof(*h) + sizeof(*desc)) {
+ dev_warn(ctrl->device, "FDP config size too small:%zu\n",
+ size);
+ return 0;
+ }
if (size > PAGE_SIZE * MAX_ORDER_NR_PAGES) {
dev_warn(ctrl->device, "FDP config size too large:%zu\n",
size);
return 0;
}
- h = kvmalloc(size, GFP_KERNEL);
+ h = kvzalloc(size, GFP_KERNEL);
if (!h)
return -ENOMEM;
@@ -2242,9 +2247,9 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
desc = log;
end = log + size - sizeof(*h);
for (i = 0; i < fdp_idx; i++) {
- u16 dsze = le16_to_cpu(desc->dsze);
+ u16 dsze = get_unaligned_le16(&desc->dsze);
- if (!dsze || log + dsze > end) {
+ if (dsze < sizeof(*desc) || log + dsze + sizeof(*desc) > end) {
dev_warn(ctrl->device,
"FDP invalid config descriptor at index %d\n", i);
ret = 0;
@@ -2254,13 +2259,13 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
desc = log;
}
- if (le32_to_cpu(desc->nrg) > 1) {
+ if (get_unaligned_le32(&desc->nrg) > 1) {
dev_warn(ctrl->device, "FDP NRG > 1 not supported\n");
ret = 0;
goto out;
}
- info->runs = le64_to_cpu(desc->runs);
+ info->runs = get_unaligned_le64(&desc->runs);
out:
kvfree(h);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 521/869] nvmet: zns: dont leak stale memory in zone management receive
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 520/869] nvme: bound FDP config log reads to the received buffer Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 522/869] f2fs: convert inline quota files when turning quota on Greg Kroah-Hartman
` (355 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Andrea Parri,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 31b8a6af19b73e6167c4b655cd5e86681bac1c41 ]
A Zone Management Receive report returns the full buffer the host asked
for, but nvmet_bdev_zone_zmgmt_recv_work() writes only the 8-byte
Number of Zones field and one 64-byte descriptor for each matching zone
that fits. The 56 reserved header bytes and every descriptor slot past
the last match keep whatever the buffer held before. A 4096-byte report
covering a single zone leaves 4024 bytes unwritten.
The tcp, rdma and fc transports allocate that buffer with sgl_alloc()
and pci-epf with kmalloc(), none with __GFP_ZERO, and on success each
sends the whole buffer to the host (nvmet_setup_c2h_data_pdu() for
tcp), so the host receives old kernel memory from the target.
nvmet_bdev_execute_zone_mgmt_recv() also never checks the transport
data length against NUMD, so on transports where the host sets that
length, the buffer sent back can be much larger than the report NUMD
describes. pci-epf derives its data length from NUMD, so the length
check below does not apply there, but the zeroing still covers the
report.
Reject a data length that does not match NUMD with
nvmet_check_transfer_len(), as nvmet_bdev_execute_zone_append() does,
and zero the report with nvmet_zero_sgl() before filling it. Zeroing
NUMD bytes is only enough because of the length check, so the two go
together.
Allocating with __GFP_ZERO in the transports would also close the leak,
but it adds a memset to every read command to fix one handler, so the
transports are left alone.
Tested over the loop, tcp, rdma and fc transports with a zoned
null_blk namespace: before this patch, zone reports carried stale bytes
and a data length larger than NUMD was accepted; with it, reports are
fully initialized and such a length fails with Data SGL Length Invalid.
Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/zns.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index 95af4b67108c7..00f694ac3986c 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -286,6 +286,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
if (status)
goto out;
+ /* Only the zone count and matching descriptors are written below. */
+ status = nvmet_zero_sgl(req, 0, out_bufsize);
+ if (status)
+ goto out;
+
if (!req_slba_nr_zones) {
status = NVME_SC_SUCCESS;
goto out;
@@ -314,6 +319,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req)
{
+ u32 out_bufsize = (le32_to_cpu(req->cmd->zmr.numd) + 1) << 2;
+
+ if (!nvmet_check_transfer_len(req, out_bufsize))
+ return;
+
INIT_WORK(&req->z.zmgmt_work, nvmet_bdev_zone_zmgmt_recv_work);
queue_work(zbd_wq, &req->z.zmgmt_work);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 522/869] f2fs: convert inline quota files when turning quota on
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 521/869] nvmet: zns: dont leak stale memory in zone management receive Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 523/869] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining Greg Kroah-Hartman
` (354 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit a85e09bd6cc80059b9e0ef5cd1467719aa3129a8 ]
With a block size larger than 4KB, the inline data area is large enough
to hold a freshly created quota file (quotacheck writes 6KB), so
aquota.user/aquota.group stay inline after quotaon. f2fs does not
expect quota files to be inline, and this causes two problems:
1. Quota file corruption. f2fs_write_single_data_page() sends quota
inodes straight to f2fs_do_write_data_page(), which sees NULL_ADDR
for index 0, treats the folio as truncated and drops it. Updates to
the quota file are lost once the folio is reclaimed, so the quota
tree reads stale data: chown/chgrp fail with EIO and quota entries
of users disappear. For example, the kernel log shows:
find_free_dqentry: Data block full but it shouldn't
qtree_write_dquot: Error -5 occurred while creating quota
2. Deadlock. Writing a quota file past MAX_INLINE_DATA converts it from
f2fs_write_begin() under f2fs_lock_op(). dquot_transfer() is called
from f2fs_setattr() with f2fs_lock_op() already held, so chown/chgrp
take cp_rwsem for read twice and hang, together with the checkpoint
and every other writer, once a checkpoint waits for cp_rwsem in
between (seen with generic/232).
Quota files only grow and there are at most MAXQUOTAS of them, so there
is no point in keeping them inline. Convert them in f2fs_quota_on() and
after dquot_quota_on_mount(), which keeps every block size on the same
path as 4KB blocks, where quota files never fit inline. Quota sysfiles
are created by mkfs with real blocks and are not affected.
Cc: stable@kernel.org
Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 74b12c1ef8211..146bd977bb591 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3171,15 +3171,42 @@ static qsize_t *f2fs_get_reserved_space(struct inode *inode)
return &F2FS_I(inode)->i_reserved_quota;
}
+/*
+ * Quota files only grow and there are at most MAXQUOTAS of them, so there is
+ * no point in keeping them inline. Writeback of quota files does not handle
+ * inline data and would drop what was written to them.
+ */
+static int f2fs_quota_convert_inline(struct inode *inode)
+{
+ int err;
+
+ if (!f2fs_has_inline_data(inode))
+ return 0;
+
+ inode_lock(inode);
+ err = f2fs_convert_inline_inode(inode);
+ inode_unlock(inode);
+ return err;
+}
+
static int f2fs_quota_on_mount(struct f2fs_sb_info *sbi, int type)
{
+ int err;
+
if (is_set_ckpt_flags(sbi, CP_QUOTA_NEED_FSCK_FLAG)) {
f2fs_err(sbi, "quota sysfile may be corrupted, skip loading it");
return 0;
}
- return dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
+ err = dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
F2FS_OPTION(sbi).s_jquota_fmt, type);
+ if (err)
+ return err;
+
+ err = f2fs_quota_convert_inline(sb_dqopt(sbi->sb)->files[type]);
+ if (err)
+ dquot_quota_off(sbi->sb, type);
+ return err;
}
int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly)
@@ -3391,6 +3418,10 @@ static int f2fs_quota_on(struct super_block *sb, int type, int format_id,
inode = d_inode(path->dentry);
+ err = f2fs_quota_convert_inline(inode);
+ if (err)
+ goto out;
+
err = filemap_fdatawrite(inode->i_mapping);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 523/869] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 522/869] f2fs: convert inline quota files when turning quota on Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 524/869] PCI: rockchip-host: " Greg Kroah-Hartman
` (353 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 7f173bfa6d42742de4ab647e001232c1165ab28e ]
Drop the 5.0 GT/s Link Speed retraining code block from Rockchip PCIe EP
driver. The reason is that Shawn Lin from Rockchip has reiterated that
there may be danger of "catastrophic failure" in using their PCIe with 5.0
GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: bd6e61df4b2e ("PCI: rockchip-ep: Improve link training")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/d994f8fb3481bbb8f3972f117334a6e8aea383fb.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip-ep.c | 13 -------------
1 file changed, 13 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index 799461335762e..9ebc227a1ef84 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -553,19 +553,6 @@ static void rockchip_pcie_ep_link_training(struct work_struct *work)
if (ret)
goto again;
- /*
- * Check the current speed: if gen2 speed was requested and we are not
- * at gen2 speed yet, retrain again for gen2.
- */
- val = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
- if (!PCIE_LINK_IS_GEN2(val) && rockchip->link_gen == 2) {
- /* Enable retrain for gen2 */
- rockchip_pcie_ep_retrain_link(rockchip);
- readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
- val, PCIE_LINK_IS_GEN2(val), 50,
- LINK_TRAIN_TIMEOUT);
- }
-
/* Check again that the link is up */
if (!rockchip_pcie_ep_link_up(rockchip))
goto again;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 524/869] PCI: rockchip-host: Do not attempt 5.0 GT/s retraining
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 523/869] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 525/869] PCI: rockchip: Drive at 2.5 GT/s, error other speeds Greg Kroah-Hartman
` (352 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 2a1e6c382fb7567679c07bd6a7060fefc7a5edc9 ]
Drop the 5.0 GT/s Link Speed retraining from Rockchip PCIe Root Complex
Mode Operation, so-called host driver.
The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/68f6353e3a2ea4914de36c42b6906e41282adad3.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip-host.c | 20 --------------------
1 file changed, 20 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
index d203c4876d304..0b52f2e370f41 100644
--- a/drivers/pci/controller/pcie-rockchip-host.c
+++ b/drivers/pci/controller/pcie-rockchip-host.c
@@ -328,26 +328,6 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip)
goto err_power_off_phy;
}
- if (rockchip->link_gen == 2) {
- /*
- * Enable retrain for gen2. This should be configured only after
- * gen1 finished.
- */
- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
- status &= ~PCI_EXP_LNKCTL2_TLS;
- status |= PCI_EXP_LNKCTL2_TLS_5_0GT;
- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
- status |= PCI_EXP_LNKCTL_RL;
- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
-
- err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
- status, PCIE_LINK_IS_GEN2(status), 20,
- 500 * USEC_PER_MSEC);
- if (err)
- dev_dbg(dev, "PCIe link training gen2 timeout, fall back to gen1!\n");
- }
-
/* Check the final link width from negotiated lane counter from MGMT */
status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 525/869] PCI: rockchip: Drive at 2.5 GT/s, error other speeds
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 524/869] PCI: rockchip-host: " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 526/869] sh: intc: Sort the prio and sense lists after filling them Greg Kroah-Hartman
` (351 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 84d08ff902f1ec01177fef1a21a38934927f5aee ]
Configure the core to be driven at 2.5 GT/s Link Speed and ignore any other
speed with a warning. Also drop the 5.0 GT/s Link Speed defines from
Rockchip PCIe header.
The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0 GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: 956cd99b35a8 ("PCI: rockchip: Separate common code from RC driver")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/7421df7a7b7778ee99363cccfdfabbfa8aa6ab5e.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip.c | 14 ++++++--------
drivers/pci/controller/pcie-rockchip.h | 3 ---
2 files changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
index 0f88da3788054..456dcfd676ed7 100644
--- a/drivers/pci/controller/pcie-rockchip.c
+++ b/drivers/pci/controller/pcie-rockchip.c
@@ -66,8 +66,10 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
}
rockchip->link_gen = of_pci_get_max_link_speed(node);
- if (rockchip->link_gen < 0 || rockchip->link_gen > 2)
- rockchip->link_gen = 2;
+ if (rockchip->link_gen < 0 || rockchip->link_gen >= 2) {
+ rockchip->link_gen = 1;
+ dev_warn(dev, "invalid max-link-speed, limited to 2.5 GT/s\n");
+ }
for (i = 0; i < ROCKCHIP_NUM_PM_RSTS; i++)
rockchip->pm_rsts[i].id = rockchip_pci_pm_rsts[i];
@@ -147,12 +149,8 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
goto err_exit_phy;
}
- if (rockchip->link_gen == 2)
- rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_2,
- PCIE_CLIENT_CONFIG);
- else
- rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
- PCIE_CLIENT_CONFIG);
+ rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
+ PCIE_CLIENT_CONFIG);
regs = PCIE_CLIENT_ARI_ENABLE |
PCIE_CLIENT_CONF_LANE_NUM(rockchip->lanes);
diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h
index 3e82a69b9c006..b5da15601b585 100644
--- a/drivers/pci/controller/pcie-rockchip.h
+++ b/drivers/pci/controller/pcie-rockchip.h
@@ -42,7 +42,6 @@
#define PCIE_CLIENT_MODE_RC HWORD_SET_BIT(0x0040)
#define PCIE_CLIENT_MODE_EP HWORD_CLR_BIT(0x0040)
#define PCIE_CLIENT_GEN_SEL_1 HWORD_CLR_BIT(0x0080)
-#define PCIE_CLIENT_GEN_SEL_2 HWORD_SET_BIT(0x0080)
#define PCIE_CLIENT_LEGACY_INT_CTRL (PCIE_CLIENT_BASE + 0x0c)
#define PCIE_CLIENT_INT_IN_ASSERT HWORD_SET_BIT(0x0002)
#define PCIE_CLIENT_INT_IN_DEASSERT HWORD_CLR_BIT(0x0002)
@@ -197,8 +196,6 @@
(((x) & PCIE_CORE_PL_CONF_LS_MASK) == PCIE_CORE_PL_CONF_LS_READY)
#define PCIE_LINK_UP(x) \
(((x) & PCIE_CLIENT_LINK_STATUS_MASK) == PCIE_CLIENT_LINK_STATUS_UP)
-#define PCIE_LINK_IS_GEN2(x) \
- (((x) & PCIE_CORE_PL_CONF_SPEED_MASK) == PCIE_CORE_PL_CONF_SPEED_5G)
#define RC_REGION_0_ADDR_TRANS_H 0x00000000
#define RC_REGION_0_ADDR_TRANS_L 0x00000000
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 526/869] sh: intc: Sort the prio and sense lists after filling them
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 525/869] PCI: rockchip: Drive at 2.5 GT/s, error other speeds Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 527/869] f2fs: remove mappedtodisk flag usage in mmap write path Greg Kroah-Hartman
` (350 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter,
John Paul Adrian Glaubitz, Geert Uytterhoeven, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 94a219eda3b5fb1d1753a5ecf28b171c8f308a27 ]
register_intc_controller() sorts d->prio and d->sense right after
allocating them, with hw->nr_prio_regs and hw->nr_sense_regs as the
element count. The lists hold hw->nr_vectors entries and are only
filled later, by intc_register_irq().
On SH7785, sh7785-irq0123 and sh7785-irq4567 have four vectors but the
SoC's eleven priority registers, so sort() swaps 88 bytes in a 32 byte
kmalloc object at boot. slub_debug=FZPU reports "Right Redzone
overwritten" in kmalloc-32, and v6.5 and v6.6 panic in
__kmem_cache_alloc_node() while registering sh7785-irq0123.
Found with a custom QEMU model of the SH7785LCR. On it, v6.4
sh7785lcr_defconfig boots with SLAB, the defconfig default before v6.5,
and hangs before the console is up when built with SLUB.
Sort the lists once all vectors are registered, with the number of
entries that were added.
Fixes: b59f9f9775e6 ("sh: intc: optimize intc IRQ lookup")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/sh/intc/core.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 3dde703b77668..137a7a94d9cb8 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -277,9 +277,6 @@ int __init register_intc_controller(struct intc_desc *desc)
k += save_reg(d, k, hw->prio_regs[i].set_reg, smp);
k += save_reg(d, k, hw->prio_regs[i].clr_reg, smp);
}
-
- sort(d->prio, hw->nr_prio_regs, sizeof(*d->prio),
- intc_handle_int_cmp, NULL);
}
if (hw->sense_regs) {
@@ -290,9 +287,6 @@ int __init register_intc_controller(struct intc_desc *desc)
for (i = 0; i < hw->nr_sense_regs; i++)
k += save_reg(d, k, hw->sense_regs[i].reg, 0);
-
- sort(d->sense, hw->nr_sense_regs, sizeof(*d->sense),
- intc_handle_int_cmp, NULL);
}
if (hw->subgroups)
@@ -360,6 +354,11 @@ int __init register_intc_controller(struct intc_desc *desc)
}
}
+ sort(d->prio, d->nr_prio, sizeof(*d->prio),
+ intc_handle_int_cmp, NULL);
+ sort(d->sense, d->nr_sense, sizeof(*d->sense),
+ intc_handle_int_cmp, NULL);
+
intc_subgroup_init(desc, d);
/* enable bits matching force_enable after registering irqs */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 527/869] f2fs: remove mappedtodisk flag usage in mmap write path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 526/869] sh: intc: Sort the prio and sense lists after filling them Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 528/869] f2fs: allow pinning empty compressed files Greg Kroah-Hartman
` (349 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Yu, Barry Song, Nanzhe Zhao,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
[ Upstream commit b3c9843589257631bac18f30655e82d88970688a ]
PG_mappedtodisk was inherited from the nobh/buffer-head era. However,
f2fs has no buffer heads and the flag is no longer meaningful. The only
user of the flag is the "no holes" shortcut in f2fs_vm_page_mkwrite(),
which makes mmap write faults skip marking the folio dirty. Moreover,
it causes the following race condition with filesystem freezing:
CPU0 (write fault) CPU1 (freeze_super)
---- ----
f2fs_vm_page_mkwrite()
sb_start_pagefault()
/* shortcut: no dirty */
sb_end_pagefault()
sb_wait_write(SB_FREEZE_PAGEFAULT)
/* no waiter, passes */
sync_filesystem()
/* folio not dirty, skipped */
finish_fault()
/* PTE writable */
fault_dirty_shared_page()
folio_mark_dirty()
/* dirty folio on a frozen fs */
It will also skip APP_MAPPED_IO iostat/REQ_TIME updates and post-EOF
folio zeroing.
Remove this shortcut in f2fs_vm_page_mkwrite() and stop setting it in
f2fs_read_single_page().
Reported-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/linux-f2fs-devel/496b913c-eb81-4fa8-be72-c6a06a10aba2@kernel.org/
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 1 -
fs/f2fs/file.c | 6 ------
2 files changed, 7 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index aa6a844ed34dd..52bdfb2785f06 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2186,7 +2186,6 @@ static int f2fs_read_single_page(struct inode *inode, struct folio *folio,
got_it:
if ((map->m_flags & F2FS_MAP_MAPPED)) {
block_nr = map->m_pblk + block_in_file - map->m_lblk;
- folio_set_mappedtodisk(folio);
if (!f2fs_is_valid_blkaddr(F2FS_I_SB(inode), block_nr,
DATA_GENERIC_ENHANCE_READ)) {
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 49febaa660815..e5de7c3557260 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -207,12 +207,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
/* wait for GCed page writeback via META_MAPPING */
f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
- /*
- * check to see if the page is mapped already (no holes)
- */
- if (folio_test_mappedtodisk(folio))
- goto out_sem;
-
/* page is wholly or partially inside EOF */
if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
i_size_read(inode)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 528/869] f2fs: allow pinning empty compressed files
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 527/869] f2fs: remove mappedtodisk flag usage in mmap write path Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 529/869] f2fs: read i_size once in f2fs_vm_page_mkwrite Greg Kroah-Hartman
` (348 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Joanne Chang, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Chang <joannechien@google.com>
[ Upstream commit 2eebc31ae5f53e1066bb6238c8087c23b688ad17 ]
Commit a64a3fec11e7 ("f2fs: force out-place update for all writes on
compressed file") updated f2fs_should_update_outplace() to always
return true for compressed files. However, this function is also
called during f2fs_ioc_set_pin_file() validation, so pinning an
empty file with compression enabled now fails with -EINVAL before the
compression flag can be stripped.
Fix this by guarding the f2fs_compressed_file(inode) check with fio in
f2fs_should_update_outplace(). This preserves forced OPU for actual
compressed writes (fio != NULL), while allowing f2fs_ioc_set_pin_file()
(fio == NULL) to proceed to f2fs_disable_compressed_file(inode).
Cc: stable@kernel.org
Fixes: a64a3fec11e7 ("f2fs: force out-place update for all writes on compressed file")
Assisted-by: LLM
Signed-off-by: Joanne Chang <joannechien@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 52bdfb2785f06..eba1e025b9d6e 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2679,7 +2679,7 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
* If IO comes from compressed write path and fallback to raw write,
* force out‑place to prevent metadata‑data inconsistency.
*/
- if (f2fs_compressed_file(inode))
+ if (fio && f2fs_compressed_file(inode))
return true;
/* swap file is migrating in aligned write mode */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 529/869] f2fs: read i_size once in f2fs_vm_page_mkwrite
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 528/869] f2fs: allow pinning empty compressed files Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 530/869] f2fs: check every cur_*_segno[] entry on readonly images Greg Kroah-Hartman
` (347 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nanzhe Zhao, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
[ Upstream commit c04f209773ecb31e592cababce0d6658ee0b8d58 ]
f2fs_vm_page_mkwrite() reads i_size twice: once to check whether the
folio is partially beyond EOF, and once to calculate the offset for
folio_zero_segment(). But a concurrent buffered write can extend isize
and cause the following race condition to corrupt data:
buffered write writes [0,3500)
CPU0 (write fault) CPU1 (buffered write)
---- ----
f2fs_vm_page_mkwrite()
folio_lock(folio)
if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
i_size_read(inode))
/* i_size_read() = 3500 */
write(fd, buf, 200, 4096)
/* writes into page1, does not
wait for folio lock */
i_size_write(inode, 4296)
offset = i_size_read(inode) & ~PAGE_MASK
/* i_size_read() = 4296, offset = 200 */
folio_zero_segment(folio, offset, folio_size(folio))
/* valid data [200, 3500) is zeroed */
Fix this by reading i_size once and using the same value for both the
EOF check and the zeroing offset.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261012030315.978375-1-zhaonanzhe%40xiaomi.com
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index e5de7c3557260..df625a48d725e 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -123,6 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
struct dnode_of_data dn;
bool need_alloc = !f2fs_is_pinned_file(inode);
+ loff_t isize;
int err = 0;
vm_fault_t ret;
@@ -177,8 +178,14 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
filemap_invalidate_lock_shared(inode->i_mapping);
folio_lock(folio);
+ /*
+ * A concurrent buffered write can extend isize, so we store isize in a
+ * local variable to let the zeroing offset match the EOF check below.
+ */
+ isize = i_size_read(inode);
+
if (unlikely(folio->mapping != inode->i_mapping ||
- folio_pos(folio) > i_size_read(inode) ||
+ folio_pos(folio) > isize ||
!folio_test_uptodate(folio))) {
folio_unlock(folio);
err = -EFAULT;
@@ -208,11 +215,10 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
/* page is wholly or partially inside EOF */
- if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
- i_size_read(inode)) {
+ if (((loff_t)(folio->index + 1) << PAGE_SHIFT) > isize) {
loff_t offset;
- offset = i_size_read(inode) & ~PAGE_MASK;
+ offset = isize & ~PAGE_MASK;
folio_zero_segment(folio, offset, folio_size(folio));
}
folio_mark_dirty(folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 530/869] f2fs: check every cur_*_segno[] entry on readonly images
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 529/869] f2fs: read i_size once in f2fs_vm_page_mkwrite Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 531/869] f2fs: fix defragment writeback range truncation on 32-bit Greg Kroah-Hartman
` (346 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Kaixuan Li, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixuan Li <kaixuanli0131@gmail.com>
[ Upstream commit 9c4ee79190c8c23a9fb5c07d3bc87eaac514b2bb ]
sanity_check_ckpt() bounds-checks cur_node_segno[] and cur_data_segno[]
against main_segs, but on an image with the RO feature the goto that skips
the duplicate-segno cross-checks also leaves the enclosing loop, so only
index 0 of each array is ever checked.
An unchecked index reaches __set_sit_entry_type() through build_curseg() ->
reset_curseg(), which writes se->type through &sit_i->sentries[segno]. With
segment_count_main 120 and cur_data_segno[1] set to 200, KASAN reports
three out-of-bounds writes during mount and the mount then succeeds.
Use continue so every index is bounds-checked, and skip the node-vs-data
cross-check explicitly, which is the other thing the old goto skipped.
Cc: stable@kernel.org
Fixes: a7d9fe3c3388 ("f2fs: support RO feature")
Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 146bd977bb591..11d218b415b0d 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4180,7 +4180,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
return 1;
if (f2fs_sb_has_readonly(sbi))
- goto check_data;
+ continue;
for (j = i + 1; j < NR_CURSEG_NODE_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
@@ -4192,14 +4192,14 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
}
}
}
-check_data:
+
for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
return 1;
if (f2fs_sb_has_readonly(sbi))
- goto skip_cross;
+ continue;
for (j = i + 1; j < NR_CURSEG_DATA_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_data_segno[i]) ==
@@ -4211,6 +4211,9 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
}
}
}
+ if (f2fs_sb_has_readonly(sbi))
+ goto skip_cross;
+
for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
for (j = 0; j < NR_CURSEG_DATA_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 531/869] f2fs: fix defragment writeback range truncation on 32-bit
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 530/869] f2fs: check every cur_*_segno[] entry on readonly images Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 532/869] f2fs: disallow mmap write and data-modifying fallocate on atomic files Greg Kroah-Hartman
` (345 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhan Xusheng, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
[ Upstream commit 92154fe28c3701bebf75176dc5522bec62519a8f ]
f2fs_defragment_range() flushes the range it is about to defragment:
filemap_write_and_wait_range(inode->i_mapping,
pg_start << PAGE_SHIFT,
(pg_end << PAGE_SHIFT) - 1);
pg_start and pg_end are pgoff_t, 32 bits on 32-bit kernels, so both
shifts are evaluated in 32 bits and truncated before they are widened to
the loff_t parameters. pg_end is only capped by the file's page count,
so for a file larger than 4 GiB the shift wraps.
For a 5 GiB file pg_end is 1310720 and the range collapses from
[0, 5 GiB) to [0, 1 GiB), leaving the rest of the dirty pages unwritten
before the blocks are moved. For 8 GiB the shift yields 0, the minus one
makes it (loff_t)-1, and the range becomes [0, LLONG_MAX].
The matching call in f2fs_collapse_range() already casts:
filemap_write_and_wait_range(inode->i_mapping,
(loff_t)index << PAGE_SHIFT,
((loff_t)pg_end << PAGE_SHIFT) - 1);
Do the same here. On i386 the shift changes from "shl $0xc,%ecx" to
"shld", i.e. from a 32-bit shift to a double-precision one.
Cc: stable@kernel.org
Fixes: d323d005ac4a ("f2fs: support file defragment")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index df625a48d725e..86f1f734caaac 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2988,8 +2988,8 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
/* writeback all dirty pages in the range */
err = filemap_write_and_wait_range(inode->i_mapping,
- pg_start << PAGE_SHIFT,
- (pg_end << PAGE_SHIFT) - 1);
+ (loff_t)pg_start << PAGE_SHIFT,
+ ((loff_t)pg_end << PAGE_SHIFT) - 1);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 532/869] f2fs: disallow mmap write and data-modifying fallocate on atomic files
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 531/869] f2fs: fix defragment writeback range truncation on 32-bit Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 533/869] spi: ljca: validate the response length before copying the data Greg Kroah-Hartman
` (344 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit 06dfe4a7eb696d868b196c2a49873142f19bd862 ]
Stores through a shared writable mapping and fallocate with
FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
the COW inode and modify the original inode directly. Reject them while
the file is in atomic write mode, as fallocate already does for pinned
and compressed files. A write fault gets SIGBUS and fallocate gets
-EOPNOTSUPP.
fallocate without these flags only preallocates blocks and stays
allowed.
f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
invalidate_lock, and hold invalidate_lock in
f2fs_ioc_start_atomic_write() from the flush until the flag is set.
Otherwise a fault could check the flag, then start_atomic_write could
flush and set the flag, and the fault would dirty the folio afterwards.
Cc: stable@kernel.org
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 86f1f734caaac..8211ee75fb8f7 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -177,6 +177,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
file_update_time(vmf->vma->vm_file);
filemap_invalidate_lock_shared(inode->i_mapping);
+ /*
+ * mmap stores bypass the COW inode and would break atomicity. Check
+ * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
+ * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
+ * our dirty folio and writes it back, or we see the flag.
+ */
+ if (unlikely(f2fs_is_atomic_file(inode))) {
+ err = -EOPNOTSUPP;
+ goto out_sem;
+ }
+
folio_lock(folio);
/*
* A concurrent buffered write can extend isize, so we store isize in a
@@ -2081,9 +2092,11 @@ static long f2fs_fallocate(struct file *file, int mode,
/*
* Pinned file should not support partial truncation since the block
- * can be used by applications.
+ * can be used by applications. Atomic files should not either, since
+ * these modify the original inode directly and break atomicity.
*/
- if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
+ if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
+ f2fs_is_atomic_file(inode)) &&
(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
ret = -EOPNOTSUPP;
@@ -2368,6 +2381,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
f2fs_down_write(&fi->i_gc_rwsem[READ]);
+ /* serialize with f2fs_vm_page_mkwrite(), see the comment there */
+ filemap_invalidate_lock(inode->i_mapping);
/*
* Should wait end_io to count F2FS_WB_CP_DATA correctly by
@@ -2423,6 +2438,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
f2fs_i_size_write(fi->cow_inode, isize);
out_unlock:
+ filemap_invalidate_unlock(inode->i_mapping);
f2fs_up_write(&fi->i_gc_rwsem[READ]);
f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 533/869] spi: ljca: validate the response length before copying the data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 532/869] f2fs: disallow mmap write and data-modifying fallocate on atomic files Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 534/869] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() Greg Kroah-Hartman
` (343 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 0fe4573c822c4c9152e2fd5269ab85410c9e458f ]
ljca_spi_read_write() only checks that the response from the adapter
carries the packet header and a non-zero payload length before copying
r_packet->len bytes from the response into the transfer buffer.
The payload length is taken from the packet the device sent back and is
neither bounded by the number of bytes actually received nor by the
size of the requested transfer: a misbehaving adapter can announce a
payload larger than what it actually sent, and the memcpy then reads
past the end of the 60-byte input buffer and writes past the end of the
caller's transfer buffer.
Check that the response carries the full header before reading
r_packet->len, then reject responses whose payload is not contained in
the data received or is longer than the requested transfer.
Fixes: caee8e38da67 ("spi: Add support for Intel LJCA USB SPI driver")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013031717.3933277-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ljca.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-ljca.c b/drivers/spi/spi-ljca.c
index 3f412cf8f1cd9..1b745a55d8c8a 100644
--- a/drivers/spi/spi-ljca.c
+++ b/drivers/spi/spi-ljca.c
@@ -105,7 +105,12 @@ static int ljca_spi_read_write(struct ljca_spi_dev *ljca_spi, const u8 *w_data,
(u8 *)r_packet, LJCA_SPI_BUF_SIZE);
if (ret < 0)
return ret;
- else if (ret < sizeof(*r_packet) || r_packet->len <= 0)
+
+ if (ret < sizeof(*r_packet))
+ return -EIO;
+
+ if (!r_packet->len || ret < sizeof(*r_packet) + r_packet->len ||
+ r_packet->len > len)
return -EIO;
if (r_data)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 534/869] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 533/869] spi: ljca: validate the response length before copying the data Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 535/869] lib/decompress_bunzip2: fix off-by-one in run-length bounds check Greg Kroah-Hartman
` (342 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Antonio Borneo, Linus Walleij,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit 54c66b5e47a9b10cbf4a1efe9b01301b7ffee205 ]
stm32_gpiolib_register_bank() walks the "gpio-ranges" property with
fwnode_property_get_reference_args(). As documented in
drivers/base/property.c:
* The caller is responsible for calling fwnode_handle_put() on the
* returned @args->fwnode pointer.
The returned reference is never put. The function calls the helper
twice, once directly and then repeatedly in a while loop, and each
call overwrites args, so only the last reference is even reachable
and all the earlier ones are leaked for good.
Put the reference as soon as args.args[] has been consumed, both for
the initial call and for every iteration of the loop.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: bb949ed9b16b ("pinctrl: stm32: Switch to use for_each_gpiochip_node() helper")
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index e73feb8ac90d1..f64dbb29a99dc 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1452,8 +1452,12 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
/* get the last defined gpio line (offset + nb of pins) */
npins = args.args[0] + args.args[2];
- while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args))
+ fwnode_handle_put(args.fwnode);
+
+ while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) {
npins = max(npins, (int)(args.args[0] + args.args[2]));
+ fwnode_handle_put(args.fwnode);
+ }
} else {
bank_nr = pctl->nbanks;
bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 535/869] lib/decompress_bunzip2: fix off-by-one in run-length bounds check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 534/869] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 536/869] panic: flatten nmi_panic control flow Greg Kroah-Hartman
` (341 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Andrew Morton,
Alain Knaff, H. Peter Anvin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit 69919be2b93ef3922f646729ff42b4bd9a30846b ]
The run-length path rejects a block when dbufCount+t equals dbufSize, but
the loop that follows writes exactly t bytes starting at dbufCount, so a
block that fills the buffer exactly is legal. bzip2 allows it too: its
decompressor bounds a block at 100000 * blockSize100k and checks that
limit per byte appended. Use > instead of >=.
bzip2's encoder stops filling a block 19 bytes early, so nothing it
produces ever reaches the limit and the bug stays hidden. Compressors
that use the full block size do reach it: an lbzip2 -9 image whose block
ends on a run fails to decode, and a self-extracting kernel built that way
does not boot.
This code came from busybox, which fixed the same line in 2013 in commit
932e233a491b ("bunzip2: fix off-by-one check").
I ran into this because my system uses lbzip2 as /bin/bzip2 -- a common
thing on Gentoo I believe. As far as I can tell, anyone using lbzip2
as their system bzip2 would run into this and it's only because it's
very uncommon these days to compress a kernel with bzip2 that no one
has noticed. I only noticed because I was adding support for various
compression formats on alpha.
Link: https://lore.kernel.org/20260912-b4-bunzip2-blocksize-fix-v1-1-c7384bbfc954@gmail.com
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/decompress_bunzip2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index ca736166f1000..4f98cdea7e0b3 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -439,7 +439,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
array.) */
if (runPos) {
runPos = 0;
- if (dbufCount+t >= dbufSize)
+ if (dbufCount+t > dbufSize)
return RETVAL_DATA_ERROR;
uc = symToByte[mtfSymbol[0]];
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 536/869] panic: flatten nmi_panic control flow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 535/869] lib/decompress_bunzip2: fix off-by-one in run-length bounds check Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 537/869] lib: decompress_bunzip2: fix integer overflow in run-length decoding Greg Kroah-Hartman
` (340 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Petr Mladek, Guenetr Roeck, Sashiko, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 75eb687ff2bcec9fba31bbe266e5f91e5c283efe ]
panic() is __noreturn, so the else after panic_try_start() is dead. Drop
it so the force_cpu path can be added cleanly on top.
Link: https://lore.kernel.org/20260916182957.7788-3-brads@mainlining.org
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index b13f040680ac1..7f8725f2154b8 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -364,7 +364,8 @@ void nmi_panic(struct pt_regs *regs, const char *msg)
{
if (panic_try_start())
panic("%s", msg);
- else if (panic_on_other_cpu())
+
+ if (panic_on_other_cpu())
nmi_panic_self_stop(regs);
}
EXPORT_SYMBOL(nmi_panic);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 537/869] lib: decompress_bunzip2: fix integer overflow in run-length decoding
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 536/869] panic: flatten nmi_panic control flow Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 538/869] tmpfs: fix unicode_map leaks in casefold option handling Greg Kroah-Hartman
` (339 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Andrew Morton,
Alain Knaff, H. Peter Anvin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit b822ad8d702df0be9fe3f24f71caeb0522d72319 ]
The RUNA/RUNB decoder in get_next_block() accumulates a run length into
the signed int t with no bound. runPos doubles per symbol, so t grows as
at least 2^n-1 and reaches INT_MAX after 31 RUNA symbols. The guard that
follows, dbufCount+t >= dbufSize, is itself a signed addition, and as the
kernel builds with -fno-strict-overflow it wraps negative once dbufCount
is nonzero, so the guard is skipped. while (t--) dbuf[dbufCount++] = uc
then writes INT_MAX entries into a buffer holding at most 900000. One
literal symbol ahead of the run is enough to make dbufCount nonzero.
Bound t to the block size as it is accumulated. t only grows within a
run, so the value tested never exceeds the final run length; any stream
that decodes today satisfies dbufCount+t < dbufSize at the flush, hence t
< dbufSize throughout, and no such stream is rejected. Because t grows as
at least 2^n-1 the bound trips by the 20th symbol, leaving runPos at most
2^19, so the following runPos <<= 1 cannot overflow either.
Link: https://lore.kernel.org/AS8P251MB00010FE5E38D253CF98A652AC8B92@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/decompress_bunzip2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 4f98cdea7e0b3..b8fb40ed06d22 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -428,6 +428,10 @@ static int INIT get_next_block(struct bunzip_data *bd)
t += (runPos << nextSym);
/* +runPos if RUNA; +2*runPos if RUNB */
+ /* Bound the run so t and runPos cannot overflow. */
+ if (t >= dbufSize)
+ return RETVAL_DATA_ERROR;
+
runPos <<= 1;
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 538/869] tmpfs: fix unicode_map leaks in casefold option handling
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 537/869] lib: decompress_bunzip2: fix integer overflow in run-length decoding Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 539/869] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data Greg Kroah-Hartman
` (338 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kazuki Hanai, Andrew Morton,
Gabriel Krisman Bertazi, Hugh Dickins, Baolin Wang,
André Almeida, Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Hanai <hnkz.64@gmail.com>
[ Upstream commit f439d79e8cd19f89e04cbb3b532347edacd72c79 ]
shmem_parse_opt_casefold() stores the unicode_map returned by utf8_load()
in ctx->encoding. A filesystem context can receive the casefold parameter
more than once, and a second successful parse overwrites the stored map
without releasing it.
The map is also leaked when an unmounted filesystem context is freed.
This includes the temporary context used for remount, because
shmem_reconfigure() does not take ownership of ctx->encoding.
Reject a second casefold setting, clear ctx->encoding after transferring
ownership to the superblock, and release any remaining map from
shmem_free_fc().
An unprivileged user can repeatedly create tmpfs filesystem contexts, set
the casefold parameter, and close them from a user namespace. This causes
unbounded kernel memory consumption and can result in a local denial of
service.
Link: https://lore.kernel.org/20261002081306.637148-1-hnkz.64@gmail.com
Fixes: 58e55efd6c72 ("tmpfs: Add casefold lookup support")
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Gabriel Krisman Bertazi <gabriel@krisman.be>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: André Almeida <andrealmeid@igalia.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/shmem.c b/mm/shmem.c
index f2b5a11e88a55..68a3a0734e3df 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4595,6 +4595,9 @@ static int shmem_parse_opt_casefold(struct fs_context *fc, struct fs_parameter *
struct unicode_map *encoding;
char *version_str = param->string + 5;
+ if (ctx->encoding)
+ return invalfc(fc, "casefold parameter cannot be specified twice\n");
+
if (!latest_version) {
if (strncmp(param->string, "utf8-", 5))
return invalfc(fc, "Only UTF-8 encodings are supported "
@@ -5081,6 +5084,7 @@ static int shmem_fill_super(struct super_block *sb, struct fs_context *fc)
if (ctx->encoding) {
sb->s_encoding = ctx->encoding;
+ ctx->encoding = NULL;
set_default_d_op(sb, &shmem_ci_dentry_ops);
if (ctx->strict_encoding)
sb->s_encoding_flags = SB_ENC_STRICT_MODE_FL;
@@ -5177,6 +5181,9 @@ static void shmem_free_fc(struct fs_context *fc)
struct shmem_options *ctx = fc->fs_private;
if (ctx) {
+#if IS_ENABLED(CONFIG_UNICODE)
+ utf8_unload(ctx->encoding);
+#endif
mpol_put(ctx->mpol);
kfree(ctx);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 539/869] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 538/869] tmpfs: fix unicode_map leaks in casefold option handling Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 540/869] platform/x86/tuxedo: Fix keyboard LED map ordering Greg Kroah-Hartman
` (337 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georg Wenzel, Gergo Koteles,
Philipp Oster, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
[ Upstream commit a0f0325e92e505db6a6879d79da5aa88e94a36ab ]
Some Lenovo 14ARB7 laptops do not have proper calibration data.
Skip these zero calibration values and fall back to the calibration data
provided by the DSP firmware.
Tested-by: Georg Wenzel <g.wenzel@gmail.com>
Fixes: c3ca4458cc2f ("ALSA: hda/tas2781: add TAS2563 support for 14ARB7")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Tested-by: Philipp Oster <philippdev5396@outlook.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/12a1ab265a1dc0e3a062a54287c8ef48682c4efc.1791895478.git.soyer@irl.hu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
index ebfc08b5fb283..6eb9e4b8ba2e8 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
@@ -375,6 +375,11 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
i, j, status);
return -EINVAL;
}
+ if (*(uint32_t *)&data[offset] == 0) {
+ dev_warn(p->dev,
+ "Dev %d: Caldat[%d] is zero\n", i, j);
+ return -EINVAL;
+ }
bedata = cpu_to_be32(*(uint32_t *)&data[offset]);
memcpy(&data[offset], &bedata, sizeof(bedata));
offset += TAS2563_CAL_DATA_SIZE;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 540/869] platform/x86/tuxedo: Fix keyboard LED map ordering
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 539/869] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 541/869] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check Greg Kroah-Hartman
` (336 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Sembach, Aaron Erhardt,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Erhardt <aer@tuxedocomputers.com>
[ Upstream commit 5c9c54dfa28c9a47c9d81322d16585f9a64d4c69 ]
The LED mappings in sirius_16_[iso|ansii]_kbl_map did contain a
flipped line that caused LEDs to turn on in the wrong order when
counting up the Lamp ID.
Fixes: cfd84b3f419b ("platform/x86/tuxedo: Add virtual LampArray for TUXEDO NB04 devices")
Cc: stable@vger.kernel.org
Reviewed-by: Werner Sembach <wse@tuxedocomputers.com>
Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
Link: https://patch.msgid.link/20261007080202.81694-5-aer@tuxedocomputers.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/tuxedo/nb04/wmi_ab.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
index 32d7756022c26..38a719381fdc5 100644
--- a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
+++ b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
@@ -232,8 +232,8 @@ static const struct tux_kbl_map_entry_t sirius_16_ansii_kbl_map[] = {
{ 0x2e, { 246000, 67500, 5250 } },
{ 0x2a, { 269500, 67500, 5250 } },
{ 0x53, { 294500, 67500, 5250 } },
- { 0x55, { 311200, 67500, 5250 } },
- { 0x54, { 327900, 67500, 5250 } },
+ { 0x54, { 311200, 67500, 5250 } },
+ { 0x55, { 327900, 67500, 5250 } },
{ 0x56, { 344600, 67500, 5250 } },
{ 0x2b, { 31000, 85500, 5500 } },
{ 0x14, { 51500, 85500, 5500 } },
@@ -337,8 +337,8 @@ static const struct tux_kbl_map_entry_t sirius_16_iso_kbl_map[] = {
{ 0x2e, { 246000, 67500, 5250 } },
{ 0x2a, { 269500, 67500, 5250 } },
{ 0x53, { 294500, 67500, 5250 } },
- { 0x55, { 311200, 67500, 5250 } },
- { 0x54, { 327900, 67500, 5250 } },
+ { 0x54, { 311200, 67500, 5250 } },
+ { 0x55, { 327900, 67500, 5250 } },
{ 0x56, { 344600, 67500, 5250 } },
{ 0x2b, { 31000, 85500, 5500 } },
{ 0x14, { 51500, 85500, 5500 } },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 541/869] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 540/869] platform/x86/tuxedo: Fix keyboard LED map ordering Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 542/869] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() Greg Kroah-Hartman
` (335 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Denis Arefev, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <arefev@swemel.ru>
[ Upstream commit fd65108f5001ffb416dc9bd37ec1893f55cff24a ]
ins->code.offset and code->size are measured in 32-bit words, while
DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
cs46xx_dsp_load_module() therefore allowed up to four times more code
than the code area can hold.
The shadow buffer ins->code.data is allocated with
kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
words. A firmware file with a code segment larger than
DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
out-of-bounds write in shadow_and_reallocate_code() and an
out-of-bounds read in snd_cs46xx_download().
Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
u64 so that the sum cannot wrap for large code->size values.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Link: https://patch.msgid.link/20261014102619.16415-1-arefev@swemel.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/cs46xx/dsp_spos.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index 3d34575a0e8f6..ba290f3a50e43 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -395,7 +395,7 @@ int cs46xx_dsp_load_module (struct snd_cs46xx * chip, struct dsp_module_desc * m
dev_dbg(chip->card->dev,
"dsp_spos: module got no code segment\n");
} else {
- if (ins->code.offset + code->size > DSP_CODE_BYTE_SIZE) {
+ if ((u64)ins->code.offset + code->size > DSP_CODE_BYTE_SIZE / 4) {
dev_err(chip->card->dev,
"dsp_spos: no space available in DSP\n");
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 542/869] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 541/869] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 543/869] platform/x86: hp-bioscfg: fix non-ASCII truncation " Greg Kroah-Hartman
` (334 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 176b38b84ae5e075850b3ebb25f906d66f95a46d ]
The escape prescan loop uses 'size' as both its bound and its
accumulator, so each escape character found extends the loop and
reads past the end of src[].
Use the original u16 count as the loop bound. Also include the 2-byte
length prefix in the bounds check, pass the u16 count instead of the
byte count to utf16s_to_utf8s(), and advance the buffer by the bytes
actually consumed instead of the escape-inflated count.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-2-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 26 +++++++++++---------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index f665af1c11850..288f7ac01dacc 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -54,8 +54,8 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
{
u16 *src = (u16 *)*buffer;
+ u16 orig_size;
u16 src_size;
-
u16 size;
int i;
int conv_dst_size;
@@ -63,17 +63,21 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
if (*buffer_size < sizeof(u16))
return -EINVAL;
- src_size = *(src++);
- /* size value in u16 chars */
- size = src_size / sizeof(u16);
+ src_size = *src;
- /* Ensure there is enough space remaining to read and convert
- * the string
+ /*
+ * Ensure there is enough space remaining for the length prefix
+ * just read plus the string data it describes.
*/
- if (*buffer_size < src_size)
+ if (*buffer_size < sizeof(u16) + src_size)
return -EINVAL;
- for (i = 0; i < size; i++)
+ src++;
+ /* size value in u16 chars */
+ orig_size = src_size / sizeof(u16);
+ size = orig_size;
+
+ for (i = 0; i < orig_size; i++)
if (src[i] == '\\' ||
src[i] == '\r' ||
src[i] == '\n' ||
@@ -91,7 +95,7 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
/*
* convert from UTF-16 unicode to ASCII
*/
- utf16s_to_utf8s(src, src_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
+ utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
dst[conv_dst_size] = 0;
for (i = 0; i < conv_dst_size; i++) {
@@ -117,8 +121,8 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
src++;
}
- *buffer = (u8 *)src;
- *buffer_size -= size * sizeof(u16);
+ *buffer += sizeof(u16) + src_size;
+ *buffer_size -= sizeof(u16) + src_size;
return size;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 543/869] platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 542/869] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 544/869] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() Greg Kroah-Hartman
` (333 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Muhammad Bilal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6b8d2374b32c35efa2a431b3cd2fe346f8917dcc ]
utf16s_to_utf8s() writes into dst, but the loop that follows
overwrites dst from the raw UTF-16 code units with truncating casts,
so any character above U+007F is mangled. For example, U+00E9 is
stored as 0xe9 instead of 0xc3 0xa9.
Convert into a scratch buffer first, then escape '\\', '\r', '\n' and
'\t' into dst with string_escape_mem(). Quotes are not escaped, so the
existing strreplace() still handles them.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-3-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 62 +++++---------------
1 file changed, 14 insertions(+), 48 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 288f7ac01dacc..0dac3a853dfe2 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -11,7 +11,7 @@
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/printk.h>
-#include <linux/string.h>
+#include <linux/string_helpers.h>
#include <linux/wmi.h>
#include "bioscfg.h"
#include "../../firmware_attributes_class.h"
@@ -53,12 +53,12 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
{
+ char utf8_buf[MAX_BUFF_SIZE];
u16 *src = (u16 *)*buffer;
+ int escaped_len;
u16 orig_size;
u16 src_size;
- u16 size;
- int i;
- int conv_dst_size;
+ int utf8_len;
if (*buffer_size < sizeof(u16))
return -EINVAL;
@@ -75,56 +75,22 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
src++;
/* size value in u16 chars */
orig_size = src_size / sizeof(u16);
- size = orig_size;
-
- for (i = 0; i < orig_size; i++)
- if (src[i] == '\\' ||
- src[i] == '\r' ||
- src[i] == '\n' ||
- src[i] == '\t')
- size++;
- /*
- * Conversion is limited to destination string max number of
- * bytes.
- */
- conv_dst_size = size;
- if (size >= dst_size)
- conv_dst_size = dst_size - 1;
+ utf8_len = utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN,
+ utf8_buf, sizeof(utf8_buf));
- /*
- * convert from UTF-16 unicode to ASCII
- */
- utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
- dst[conv_dst_size] = 0;
-
- for (i = 0; i < conv_dst_size; i++) {
- if (*src == '\\' ||
- *src == '\r' ||
- *src == '\n' ||
- *src == '\t') {
- dst[i++] = '\\';
- if (i == conv_dst_size)
- break;
- }
-
- if (*src == '\r')
- dst[i] = 'r';
- else if (*src == '\n')
- dst[i] = 'n';
- else if (*src == '\t')
- dst[i] = 't';
- else if (*src == '"')
- dst[i] = '\'';
- else
- dst[i] = *src;
- src++;
- }
+ escaped_len = string_escape_mem(utf8_buf, utf8_len, dst, dst_size - 1,
+ ESCAPE_SPACE | ESCAPE_SPECIAL,
+ "\\\r\n\t");
+ if (escaped_len > dst_size - 1)
+ escaped_len = dst_size - 1;
+ dst[escaped_len] = '\0';
+ strreplace(dst, '"', '\'');
*buffer += sizeof(u16) + src_size;
*buffer_size -= sizeof(u16) + src_size;
- return size;
+ return escaped_len;
}
int hp_get_common_data_from_buffer(u8 **buffer_ptr, u32 *buffer_size,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 544/869] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 543/869] platform/x86: hp-bioscfg: fix non-ASCII truncation " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 545/869] platform/x86: hp-bioscfg: allow clearing current_password Greg Kroah-Hartman
` (332 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit a4f19c589b21e18567d3c0ac7b9294f81e29b1de ]
validate_password_input() returns the positive INVALID_BIOS_AUTH on
rejection. store_password_instance() skips the store on nonzero ret,
but its final "return ret < 0 ? ret : count" treats the positive value
as success, so userspace sees count instead of an error.
Return -E2BIG for an invalid password length.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7): writing 999
bytes to current_password returned 999 before this change.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-4-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 6b94f90bea07a..43a2fd0c07db1 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -70,12 +70,13 @@ static int validate_password_input(int instance_id, const char *buf)
length--;
if (length > MAX_PASSWD_SIZE)
- return INVALID_BIOS_AUTH;
+ return -E2BIG;
if (password_data->min_password_length > length ||
password_data->max_password_length < length)
- return INVALID_BIOS_AUTH;
- return SUCCESS;
+ return -E2BIG;
+
+ return 0;
}
ATTRIBUTE_N_PROPERTY_SHOW(is_enabled, password);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 545/869] platform/x86: hp-bioscfg: allow clearing current_password
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 544/869] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 546/869] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token Greg Kroah-Hartman
` (331 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit acada379d5c4dd3a86d48fc69802e769eff29f7e ]
The ABI documents echo "" > current_password as the way to end a
session, but validate_password_input() rejects an empty string when
min_password_length is nonzero, so the password stays cached.
Skip the length check for an empty current_password so the write
clears it.
Compile tested only.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-5-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 43a2fd0c07db1..97990191b71f3 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -60,7 +60,8 @@ int hp_get_password_instance_for_type(const char *name)
return -EINVAL;
}
-static int validate_password_input(int instance_id, const char *buf)
+static int validate_password_input(int instance_id, const char *buf,
+ bool is_current)
{
int length;
struct password_data *password_data = &bioscfg_drv.password_data[instance_id];
@@ -69,6 +70,10 @@ static int validate_password_input(int instance_id, const char *buf)
if (length > 0 && buf[length - 1] == '\n')
length--;
+ /* An empty current_password clears the session password */
+ if (is_current && !length)
+ return 0;
+
if (length > MAX_PASSWD_SIZE)
return -E2BIG;
@@ -97,7 +102,7 @@ static int store_password_instance(struct kobject *kobj, const char *buf,
id = get_password_instance_id(kobj);
if (id >= 0)
- ret = validate_password_input(id, buf_cp);
+ ret = validate_password_input(id, buf_cp, is_current);
}
if (!ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 546/869] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 545/869] platform/x86: hp-bioscfg: allow clearing current_password Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 547/869] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() Greg Kroah-Hartman
` (330 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit f2769668959f6411ac69e83080a240f8a8785e05 ]
auth_token_store() copies the token with kmemdup(), which does not NUL
terminate it, but hp_calculate_security_buffer() and
hp_populate_security_buffer() use it as a C string and read past the
allocation.
A lone newline (echo > auth_token) is worse: kmemdup() of 0 bytes
returns ZERO_SIZE_PTR, which passes the NULL checks, so a later
attribute write passes it to strlen().
A userspace replica of the two helpers under ASan reports a heap
buffer overflow in hp_calculate_security_buffer() for the unterminated
token and a fault at address 0x10 for the lone newline, and is clean
with this change.
The token is a string, so copy it with kstrndup(), which always NUL
terminates and allocates at least one byte.
Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-9-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index abf8ce20fe15c..040964ed50ced 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -307,7 +307,7 @@ static ssize_t auth_token_store(struct kobject *kobj,
length--;
/* allocate space and copy current auth token */
- bioscfg_drv.spm_data.auth_token = kmemdup(buf, length, GFP_KERNEL);
+ bioscfg_drv.spm_data.auth_token = kstrndup(buf, length, GFP_KERNEL);
if (!bioscfg_drv.spm_data.auth_token) {
ret = -ENOMEM;
goto exit_token;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 547/869] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 546/869] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 548/869] serial: 8250_omap: set priv->line before enabling the IRQ Greg Kroah-Hartman
` (329 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE),
Ilpo Järvinen, stable, Andy Shevchenko, linux-serial,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 3e3ae95a3d84a6028f37a07ab7ad78bb14689f2e ]
lpss8250_probe() calls lpss->board->exit() on its error path. For the
EHL board, that is ehl_serial_exit() and it does:
serial8250_get_port(lpss->data.line)->dma = NULL;
But when lpss8250_dma_setup() or serial8250_register_8250_port() fails,
lpss->data.line was never assigned. As lpss is kzalloc()ed, line is 0
and ehl_serial_exit() clears the dma pointer of an unrelated port --
serial8250_ports[0], i.e. ttyS0, which is often the console.
Initialize lpss->data.line to -1 in probe and skip the clearing in
ehl_serial_exit() if no port was registered.
Fixes: 5318f70da7e8 ("serial: 8250_lpss: Balance reference count for PCI DMA device")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
Cc: stable@kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: linux-serial@vger.kernel.org
Link: https://patch.msgid.link/f389df34aaa538270313ebd4cea75c2baaf46b95.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_lpss.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
index 776ec1ef29d62..325e587ae2c42 100644
--- a/drivers/tty/serial/8250/8250_lpss.c
+++ b/drivers/tty/serial/8250/8250_lpss.c
@@ -183,9 +183,8 @@ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
static void ehl_serial_exit(struct lpss8250 *lpss)
{
- struct uart_8250_port *up = serial8250_get_port(lpss->data.line);
-
- up->dma = NULL;
+ if (lpss->data.line >= 0)
+ serial8250_get_port(lpss->data.line)->dma = NULL;
}
#ifdef CONFIG_SERIAL_8250_DMA
@@ -329,6 +328,8 @@ static int lpss8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return ret;
lpss->board = (struct lpss8250_board *)id->driver_data;
+ /* for tests in lpss->board->exit() */
+ lpss->data.line = -1;
memset(&uart, 0, sizeof(struct uart_8250_port));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 548/869] serial: 8250_omap: set priv->line before enabling the IRQ
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 547/869] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 549/869] serial: amba-pl011: honour delay_rts_before_send for every write Greg Kroah-Hartman
` (328 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 8276a44f0a0b68c07b2331cc0058036ac4c4190d ]
omap8250_irq() is requested in omap8250_probe() with IRQ_NOAUTOEN and
enabled only in omap_8250_startup(). The handler obtains the port by
serial8250_get_port(priv->line), but probe stores priv->line only after
serial8250_register_8250_port() returns.
The port becomes visible to userspace already inside
serial8250_register_8250_port() (uart_add_one_port()). So it can be
opened -- and the IRQ enabled -- before probe stores the line. An
interrupt in that window makes the handler call
serial8250_get_port(-ENODEV) and dereference a pointer outside of
serial8250_ports[].
Store the line in omap_8250_startup() before enable_irq(), so the
handler never runs with an unset line. Keep the assignment in probe
too, as remove and the system PM callbacks rely on it even when the
port was never opened.
Fixes: fef4f600319e ("serial: 8250: omap: Fix life cycle issues for interrupt handlers")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/3b3a642f7df2285f49a7bbbe5d1c23fa442c7d94.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index c0ffee2516142..8c48e0a26b3cb 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -727,6 +727,9 @@ static int omap_8250_startup(struct uart_port *port)
struct uart_8250_dma *dma = &priv->omap8250_dma;
int ret;
+ /* ISR and runtime PM need the line; probe sets it only after registration */
+ priv->line = port->line;
+
#ifdef CONFIG_PM
up->capabilities |= UART_CAP_RPM;
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 549/869] serial: amba-pl011: honour delay_rts_before_send for every write
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 548/869] serial: 8250_omap: set priv->line before enabling the IRQ Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 550/869] serial: amba-pl011: keep transmitter enabled when disabling RS485 Greg Kroah-Hartman
` (327 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nicolai Buchwitz, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <nb@tipi-net.de>
[ Upstream commit 8a9750209596be35d109de5aa89623b049855c67 ]
While the driver waits out delay_rts_before_send, another write calls
pl011_start_tx() again. pl011_rs485_tx_start() then switches straight
to SEND, and the data goes out before the delay has passed.
Leave the start to the trigger_start_tx timer while it is pending.
Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261011-fix-pl011-rs485-rts-delay-v1-1-5078e61bc408@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/amba-pl011.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 4b213d0c61336..3e777e4d13f20 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1355,10 +1355,6 @@ static void pl011_rs485_tx_start(struct uart_amba_port *uap)
struct uart_port *port = &uap->port;
u32 cr;
- if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
- uap->rs485_tx_state = SEND;
- return;
- }
if (uap->rs485_tx_state == WAIT_AFTER_SEND ||
uap->rs485_tx_state == WAIT_AFTER_SEND_DELAY) {
hrtimer_try_to_cancel(&uap->trigger_stop_tx);
@@ -1397,6 +1393,10 @@ static void pl011_start_tx(struct uart_port *port)
if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
uap->rs485_tx_state != SEND) {
+ /* trigger_start_tx starts TX once delay_rts_before_send passed */
+ if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+ return;
+
pl011_rs485_tx_start(uap);
if (uap->rs485_tx_state == WAIT_AFTER_RTS)
return;
@@ -1413,8 +1413,10 @@ static enum hrtimer_restart pl011_trigger_start_tx(struct hrtimer *t)
unsigned long flags;
uart_port_lock_irqsave(&uap->port, &flags);
- if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+ if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
+ uap->rs485_tx_state = SEND;
pl011_start_tx(&uap->port);
+ }
uart_port_unlock_irqrestore(&uap->port, flags);
return HRTIMER_NORESTART;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 550/869] serial: amba-pl011: keep transmitter enabled when disabling RS485
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 549/869] serial: amba-pl011: honour delay_rts_before_send for every write Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 551/869] serial: pmac_zilog: push received data to the port that received it Greg Kroah-Hartman
` (326 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Nicolai Buchwitz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <nb@tipi-net.de>
[ Upstream commit 97f85204275ae4d7fb530e451f3acc65c1ec1155 ]
Disabling RS485 on an open port calls pl011_rs485_tx_stop(), which
turns off the transmitter. Only the RS485 TX path turns it back on, so
any later output stays queued and tcdrain() hangs until the port is
closed.
pl011_rs485_tx_stop() also checks only the hardware FIFO. If a DMA
transfer has started but has not filled the FIFO yet, the transmitter
is turned off under the transfer and the DMA channel never recovers.
When leaving RS485 mode, cancel pending deferred starts and stops, leave
the transmitter enabled and start any TX that was still waiting for
delay_rts_before_send.
Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
Cc: stable@kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261012-fix-pl011-rs485-txe-v2-1-e9bf7d218389@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/amba-pl011.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 3e777e4d13f20..20d2a8612cbcb 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2308,8 +2308,31 @@ static int pl011_rs485_config(struct uart_port *port, struct ktermios *termios,
struct uart_amba_port *uap =
container_of(port, struct uart_amba_port, port);
- if (port->rs485.flags & SER_RS485_ENABLED)
+ if ((port->rs485.flags & SER_RS485_ENABLED) &&
+ !(rs485->flags & SER_RS485_ENABLED)) {
+ bool tx_pending = uap->rs485_tx_state == WAIT_AFTER_RTS;
+ u32 cr = pl011_read(uap, REG_CR);
+
+ /*
+ * Leaving RS485 mode, which only enables the transmitter while
+ * sending. Don't stop it, as that stalls a DMA transfer still
+ * in flight. Drop pending deferred starts and stops and keep
+ * it enabled.
+ */
+ hrtimer_try_to_cancel(&uap->trigger_start_tx);
+ hrtimer_try_to_cancel(&uap->trigger_stop_tx);
+ uap->rs485_tx_state = OFF;
+
+ cr |= UART011_CR_TXE | UART011_CR_RXE;
+ pl011_write(cr, uap, REG_CR);
+
+ /* Start TX that was still waiting for delay_rts_before_send */
+ if (tx_pending && !uart_tx_stopped(port) &&
+ !pl011_dma_tx_start(uap))
+ pl011_start_tx_pio(uap);
+ } else if (port->rs485.flags & SER_RS485_ENABLED) {
pl011_rs485_tx_stop(uap);
+ }
/* Make sure auto RTS is disabled */
if (rs485->flags & SER_RS485_ENABLED) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 551/869] serial: pmac_zilog: push received data to the port that received it
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 550/869] serial: amba-pl011: keep transmitter enabled when disabling RS485 Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 552/869] iommu/amd: Program device table when kdump reuse fails Greg Kroah-Hartman
` (325 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Douglas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Douglas <me@timdoug.com>
[ Upstream commit f3dc727da3af64abc12b625bbf1eb68d55d882cc ]
pmz_interrupt() drains both channels but, since commit 2e124b4a390c
("TTY: switch tty_flip_buffer_push"), pushes the flip buffer of the
port whose handler is running rather than the port that was drained.
With both ports open, data received on the other port can be left in
its flip buffer until something else pushes it, so its reader may not
see it.
Fixes: 2e124b4a390c ("TTY: switch tty_flip_buffer_push")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013013541.4535-2-me@timdoug.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/pmac_zilog.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index e3a9193286954..f49d6052d11be 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -444,7 +444,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
skip_a:
uart_port_unlock(&uap_a->port);
if (push)
- tty_flip_buffer_push(&uap->port.state->port);
+ tty_flip_buffer_push(&uap_a->port.state->port);
if (!uap_b)
goto out;
@@ -469,7 +469,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
skip_b:
uart_port_unlock(&uap_b->port);
if (push)
- tty_flip_buffer_push(&uap->port.state->port);
+ tty_flip_buffer_push(&uap_b->port.state->port);
out:
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 552/869] iommu/amd: Program device table when kdump reuse fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 551/869] serial: pmac_zilog: push received data to the port that received it Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 553/869] iommu/amd: Dont allocate kdump device table from DMA32 Greg Kroah-Hartman
` (324 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashish Kalra, Ankit Soni,
Vasant Hegde, Matt Fleming, Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <mfleming@cloudflare.com>
[ Upstream commit 05d62be400f3ae0f6856f6910a1281e67cbaabcf ]
Commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump") made
iommu_set_device_table() return early in every kdump kernel. That is
needed when the previous kernel's device table is reused: the base
register already points at it, and on SNP-enabled systems the register
is locked.
But if reuse isn't possible, early_enable_iommus() falls back to the
freshly allocated table and calls early_enable_iommu(). Because of the
early return, that table is never written to the base register. The
IOMMU keeps using whatever table the register pointed at before, while
the driver writes entries into the new one.
Only skip the write when the previous kernel's table was reused.
Fixes: 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
Cc: stable@vger.kernel.org
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index c07c3a01b978b..0572e1a674f0b 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -409,7 +409,13 @@ static void iommu_set_device_table(struct amd_iommu *iommu)
BUG_ON(iommu->mmio_base == NULL);
- if (is_kdump_kernel())
+ /*
+ * A kdump kernel that reuses the previous kernel's device table must
+ * leave the base register alone. It already points at that table, and
+ * with SNP enabled the register is locked. If reuse failed, program
+ * the freshly allocated table like a normal boot.
+ */
+ if (iommu->pci_seg->old_dev_tbl_cpy)
return;
entry = iommu_virt_to_phys(dev_table);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 553/869] iommu/amd: Dont allocate kdump device table from DMA32
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 552/869] iommu/amd: Program device table when kdump reuse fails Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 554/869] nvme: make the DH-HMAC-CHAP secret attributes readable by root only Greg Kroah-Hartman
` (323 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashish Kalra, Ankit Soni,
Matt Fleming, Vasant Hegde, Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <mfleming@cloudflare.com>
[ Upstream commit bae0d3760661ac77148944e88aafef698cf7b2bf ]
Booting a kdump kernel with crashkernel=X,high crashkernel=0,low on an
AMD system fails the per-segment device table allocation because there
is no memory below 4G:
swapper/0: page allocation failure: order:9, mode:0x40104(GFP_DMA32|__GFP_ZERO|__GFP_COMP)
iommu_alloc_pages_node_sz+0x7f/0x150
alloc_pci_segment+0x4bd/0x650
iommu_go_to_state+0x213d/0x34e0
amd_iommu_prepare+0x39/0xa0
irq_remapping_prepare+0x83/0xd0
enable_IR_x2apic+0x61/0x370
On our E810 systems, the kdump kernel booted but ice MSI-X interrupts
never fired and the TX queues timed out.
Commit b336781b82cc ("iommu/amd: Allocate memory below 4G for dev table
if translation pre-enabled") allocated device tables below 4G. At the
time, the kdump kernel programmed a copy of the old table into the base
register with the IOMMU still enabled. The 64-bit register is updated
as two 32-bit halves, so the running IOMMU could see a half-written,
invalid table pointer. Keeping both tables below 4G leaves the upper
half zero throughout the update, so the pointer stays valid.
Since commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
the kdump kernel reuses the previous kernel's table without writing the
base register, so its newly allocated table is discarded when reuse
succeeds. If reuse fails, the previous patch programs the new table only
after disabling the IOMMU. Either way, the kdump kernel's table doesn't
need to be below 4G.
The previous kernel still allocates its table from DMA32, so the kdump
kernel's check that the old table is below 4G still works. Drop
GFP_DMA32 for kdump kernels only.
Cc: stable@vger.kernel.org # 6.18.x
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 0572e1a674f0b..16c26d75f46f4 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -648,8 +648,19 @@ static int __init find_last_devid_acpi(struct acpi_table_header *table, u16 pci_
/* Allocate per PCI segment device table */
static inline int __init alloc_dev_table(struct amd_iommu_pci_seg *pci_seg)
{
- pci_seg->dev_table = iommu_alloc_pages_sz(GFP_KERNEL | GFP_DMA32,
- pci_seg->dev_table_size);
+ gfp_t gfp = GFP_KERNEL;
+
+ /*
+ * Keep normal kernel device tables below 4G because a later kdump
+ * kernel only trusts and reuses old tables below that limit. A kdump
+ * kernel's new table is either discarded when reuse succeeds or
+ * programmed after the IOMMU is disabled, so the table does not
+ * need DMA32 memory (which the crashkernel may not have).
+ */
+ if (!is_kdump_kernel())
+ gfp |= GFP_DMA32;
+
+ pci_seg->dev_table = iommu_alloc_pages_sz(gfp, pci_seg->dev_table_size);
if (!pci_seg->dev_table)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 554/869] nvme: make the DH-HMAC-CHAP secret attributes readable by root only
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 553/869] iommu/amd: Dont allocate kdump device table from DMA32 Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 555/869] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path Greg Kroah-Hartman
` (322 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wagner, Martin Belanger,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Belanger <martin.nvme.dev@gmail.com>
[ Upstream commit bbca7c312ab25efd0024eb87545c51a76ab2ea39 ]
The dhchap_secret and dhchap_ctrl_secret sysfs attributes have mode
0644. Their show functions return the secret, so any local user can
read the DH-HMAC-CHAP secrets of a connected controller.
Define them with DEVICE_ATTR_ADMIN_RW(), which sets mode 0600. The
macro takes the show and store functions from the attribute name, so
rename them. Writing the attributes was already limited to root and is
not changed.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Assisted-by: LLM
Signed-off-by: Martin Belanger <martin.nvme.dev@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/sysfs.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 12478e0297356..2b6085359a950 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -626,7 +626,7 @@ static ssize_t quirks_show(struct device *dev, struct device_attribute *attr,
static DEVICE_ATTR_RO(quirks);
#ifdef CONFIG_NVME_HOST_AUTH
-static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
+static ssize_t dhchap_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -637,7 +637,7 @@ static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
return sysfs_emit(buf, "%s\n", opts->dhchap_secret);
}
-static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
+static ssize_t dhchap_secret_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -681,10 +681,9 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
return count;
}
-static DEVICE_ATTR(dhchap_secret, S_IRUGO | S_IWUSR,
- nvme_ctrl_dhchap_secret_show, nvme_ctrl_dhchap_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_secret);
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
+static ssize_t dhchap_ctrl_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -695,7 +694,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
return sysfs_emit(buf, "%s\n", opts->dhchap_ctrl_secret);
}
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
+static ssize_t dhchap_ctrl_secret_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -739,8 +738,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
return count;
}
-static DEVICE_ATTR(dhchap_ctrl_secret, S_IRUGO | S_IWUSR,
- nvme_ctrl_dhchap_ctrl_secret_show, nvme_ctrl_dhchap_ctrl_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_ctrl_secret);
#endif
static struct attribute *nvme_dev_attrs[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 555/869] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 554/869] nvme: make the DH-HMAC-CHAP secret attributes readable by root only Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 556/869] ARM: 9488/1: smp: set current pointer in assembly before jumping into C Greg Kroah-Hartman
` (321 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit ef9690269999ddf9b204731baca1bd6b7aea1aa7 ]
transfer_one_message_b0() falls back to a 10-byte stack buffer for
transfers which carry no TX data and points both in_buffer and
out_buffer into it.
With a transfer longer than 10 bytes the SDMA branch of the loop moves
up to MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT (256) bytes
through those pointers and then advances them by the same amount, so
both directions overflow the scratch buffer: a read transaction copies
SDMA data past the end of the buffer, a write transaction sends stack
contents from beyond it to the SPI bus.
Size the scratch buffer for the largest chunk the loop can request,
keep the buffer pointers pinned to it when the message does not carry
the corresponding TX or RX data, and only advance the pointers which
reference real transfer buffers. Also zero-initialize the scratch
buffer so that padding bytes sent for TX-less transfers no longer leak
uninitialized stack contents.
Fixes: 5cb7651f78e1 ("Marvell HW overlay support for Cadence xSPI")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20260929081146.41041-3-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-xspi.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c
index 6dcba0e0ddaa3..c3676b21e8167 100644
--- a/drivers/spi/spi-cadence-xspi.c
+++ b/drivers/spi/spi-cadence-xspi.c
@@ -268,6 +268,7 @@
#define MRVL_XFER_FUNC_START BIT(0)
#define MRVL_XFER_QWORD_COUNT 32
#define MRVL_XFER_QWORD_BYTECOUNT 8
+#define MRVL_XFER_MAX_LEN (MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT)
#define MRVL_XSPI_POLL_TIMEOUT_US 1000
#define MRVL_XSPI_POLL_DELAY_US 10
@@ -1047,7 +1048,7 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
struct spi_device *spi = m->spi;
struct spi_transfer *t = NULL;
- const unsigned int max_len = MRVL_XFER_QWORD_BYTECOUNT * MRVL_XFER_QWORD_COUNT;
+ const unsigned int max_len = MRVL_XFER_MAX_LEN;
int current_transfer_len;
int cs = spi_get_chipselect(spi, 0);
int cs_change = 0;
@@ -1070,13 +1071,16 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
list_for_each_entry(t, &m->transfers, transfer_list) {
u8 *txd = (u8 *) t->tx_buf;
u8 *rxd = (u8 *) t->rx_buf;
- u8 data[10];
+ u8 data[MRVL_XFER_MAX_LEN] = {0};
u32 cmd_regs[6];
if (!txd)
txd = data;
- cdns_xspi->in_buffer = txd + 1;
+ if (rxd)
+ cdns_xspi->in_buffer = rxd;
+ else
+ cdns_xspi->in_buffer = data;
cdns_xspi->out_buffer = txd + 1;
while (t->len) {
@@ -1101,8 +1105,10 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
if (!cdns_xspi_is_stig_ready(cdns_xspi, true))
return -EIO;
- cdns_xspi->in_buffer += current_transfer_len;
- cdns_xspi->out_buffer += current_transfer_len;
+ if (rxd)
+ cdns_xspi->in_buffer += current_transfer_len;
+ if (t->tx_buf)
+ cdns_xspi->out_buffer += current_transfer_len;
}
if (rxd) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 556/869] ARM: 9488/1: smp: set current pointer in assembly before jumping into C
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 555/869] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 6.18 557/869] ARM: 9491/1: alignment: restore uaccess state on emulation fault Greg Kroah-Hartman
` (320 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Ard Biesheuvel,
Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit f6e551e7d515579b952422c93415470fb672d848 ]
With CONFIG_KCOV_INSTRUMENT_ALL=y, secondary CPUs fail to come online
on ARMv6K/ARMv7 SMP:
CPU1: failed to boot: -38
The compiler inserts a call to __sanitizer_cov_trace_pc() at the entry
of secondary_start_kernel(), before set_current(task). The KCOV hook
dereferences current while TPIDRURO is still uninitialized, causing a
data abort before cpu_init() has installed the exception stacks. The
secondary CPU consequently never completes startup.
Initialize current in the secondary assembly handoff, as
__mmap_switched already does for the boot CPU.
With current set in assembly, the set_current() call in
secondary_start_kernel() is redundant. Drop it together with the
function and the task argument. The hotplug resuscitate path in
arch_cpu_idle_dead() needs no hand-off either, as smp_ops.cpu_die()
can only return if the CPU kept its register state, TPIDRURO included.
Assisted-by: Claude:claude-fable-5
Fixes: 50596b7559bf ("ARM: smp: Store current pointer in TPIDRURO register if available")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/smp.h | 2 +-
arch/arm/kernel/head-nommu.S | 1 +
arch/arm/kernel/head.S | 1 +
arch/arm/kernel/smp.c | 15 ++-------------
4 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
index 8c05a7f374d8b..84aa6a663e816 100644
--- a/arch/arm/include/asm/smp.h
+++ b/arch/arm/include/asm/smp.h
@@ -43,7 +43,7 @@ extern void set_smp_ipi_range(int ipi_base, int nr_ipi);
* Called from platform specific assembly code, this is the
* secondary CPU entry point.
*/
-asmlinkage void secondary_start_kernel(struct task_struct *task);
+asmlinkage void secondary_start_kernel(void);
/*
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b9d6818f1ee16..f80bbfbd3a6f8 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -116,6 +116,7 @@ ENTRY(secondary_startup)
ldr r7, __secondary_data @ reload r7
ldr sp, [r7, #12] @ set up the stack pointer
ldr r0, [r7, #16] @ set up task pointer
+ set_current r0, r1
mov fp, #0
b secondary_start_kernel
ENDPROC(secondary_startup)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f22c50d4bd417..a22403a629efa 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -442,6 +442,7 @@ ENTRY(__secondary_switched)
adr_l r7, secondary_data + 12 @ get secondary_data.stack
ldr sp, [r7]
ldr r0, [r7, #4] @ get secondary_data.task
+ set_current r0, r1
mov fp, #0
b secondary_start_kernel
ENDPROC(__secondary_switched)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 50999886a8b5c..e302063658779 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -371,12 +371,9 @@ void __noreturn arch_cpu_idle_dead(void)
*/
__asm__("mov sp, %0\n"
" mov fp, #0\n"
- " mov r0, %1\n"
" b secondary_start_kernel"
:
- : "r" (task_stack_page(current) + THREAD_SIZE - 8),
- "r" (current)
- : "r0");
+ : "r" (task_stack_page(current) + THREAD_SIZE - 8));
unreachable();
}
@@ -397,23 +394,15 @@ static void smp_store_cpu_info(unsigned int cpuid)
check_cpu_icache_size(cpuid);
}
-static void set_current(struct task_struct *cur)
-{
- /* Set TPIDRURO */
- asm("mcr p15, 0, %0, c13, c0, 3" :: "r"(cur) : "memory");
-}
-
/*
* This is the secondary CPU boot entry. We're using this CPUs
* idle thread stack, but a set of temporary page tables.
*/
-asmlinkage void secondary_start_kernel(struct task_struct *task)
+asmlinkage void secondary_start_kernel(void)
{
struct mm_struct *mm = &init_mm;
unsigned int cpu;
- set_current(task);
-
secondary_biglittle_init();
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 557/869] ARM: 9491/1: alignment: restore uaccess state on emulation fault
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 556/869] ARM: 9488/1: smp: set current pointer in assembly before jumping into C Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 558/869] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves() Greg Kroah-Hartman
` (319 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Karl Mehltretter,
Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 80dafbcb705cead6d25cb821cf29c47da8860c8c ]
The alignment handlers enable access to user memory while emulating
unaligned instructions. If a checked access faults, its exception table
fixup jumps to the handler's fault label and bypasses uaccess_restore().
This leaves DOMAIN_USER as DOMAIN_CLIENT with SW domain PAN, or leaves
TTBR0 page table walks enabled with TTBR0 PAN, while the fault is handled.
An ARM926 QEMU test using LDMIA across an unmapped page boundary reports
DOMAIN_USER=1 at TYPE_FAULT before this change and DOMAIN_USER=0 after it.
SW domain PAN is the default on ARMv5, ARMv6, and non-LPAE ARMv7 builds.
Keep the saved uaccess state at function scope and track whether it was
saved. Restore it at the fault label only when needed. Paths that did not
enable user access continue to skip the restore.
Assisted-by: Codex:gpt-5.6-sol
Fixes: 274e91b81ed2 ("ARM: alignment: fix alignment handling for uaccess changes")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mm/alignment.c | 51 ++++++++++++++++++++++++++++++-----------
1 file changed, 37 insertions(+), 14 deletions(-)
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 812380f30ae36..2b470a419dda3 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -341,6 +341,8 @@ static int
do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
+ unsigned int ua_flags;
+ bool ua_saved = false;
ai_half += 1;
@@ -364,10 +366,11 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
user:
if (LDST_L_BIT(instr)) {
unsigned long val;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get16t_unaligned_check(val, addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
/* signed half-word? */
if (instr & 0x40)
@@ -375,14 +378,17 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
regs->uregs[rd] = val;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put16t_unaligned_check(regs->uregs[rd], addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -391,6 +397,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
unsigned int rd2;
+ unsigned int ua_flags;
+ bool ua_saved = false;
int load;
if ((instr & 0xfe000000) == 0xe8000000) {
@@ -425,26 +433,30 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
user:
if (load) {
unsigned long val, val2;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get32t_unaligned_check(val, addr);
get32t_unaligned_check(val2, addr + 4);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
regs->uregs[rd] = val;
regs->uregs[rd2] = val2;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put32t_unaligned_check(regs->uregs[rd], addr);
put32t_unaligned_check(regs->uregs[rd2], addr + 4);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
bad:
return TYPE_ERROR;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -452,6 +464,8 @@ static int
do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
+ unsigned int ua_flags;
+ bool ua_saved = false;
ai_word += 1;
@@ -469,18 +483,22 @@ do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
trans:
if (LDST_L_BIT(instr)) {
unsigned int val;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get32t_unaligned_check(val, addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
regs->uregs[rd] = val;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put32t_unaligned_check(regs->uregs[rd], addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -502,6 +520,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd, rn, correction, nr_regs, regbits;
unsigned long eaddr, newaddr;
+ unsigned int ua_flags;
+ bool ua_saved = false;
if (LDM_S_BIT(instr))
goto bad;
@@ -547,7 +567,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
#endif
if (user_mode(regs)) {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
regbits >>= 1, rd += 1)
if (regbits & 1) {
@@ -559,7 +580,7 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
put32t_unaligned_check(regs->uregs[rd], eaddr);
eaddr += 4;
}
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
} else {
for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
regbits >>= 1, rd += 1)
@@ -581,6 +602,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
return TYPE_DONE;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
regs->ARM_pc -= correction;
return TYPE_FAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 558/869] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 6.18 557/869] ARM: 9491/1: alignment: restore uaccess state on emulation fault Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 559/869] ARM: 9521/1: cacheinfo: count external caches in early_cache_level() Greg Kroah-Hartman
` (318 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 41a3f4bc3e4ae4722fd24743bf3f286cea14e3dc ]
populate_cache_leaves() advances its bounds-checking index once per
cache level, but split instruction/data caches consume two entries.
CLIDR-based allocation supplies enough entries. Early allocation from
the device tree can supply fewer and expose an out-of-bounds write.
Count each written leaf and stop before a split level that does not
fit. This prepares ARM for DT-based early allocation and matches
commit 875d742cf532 ("arm64: cacheinfo: Avoid out-of-bounds write to
cacheinfo array").
Assisted-by: LLM
Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-2-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index e1469b6417804..860eeb03cfe5d 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -151,7 +151,7 @@ int populate_cache_leaves(unsigned int cpu)
unsigned int level, idx;
enum cache_type type;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+ struct cacheinfo *infos = this_cpu_ci->info_list;
unsigned int arch = cpu_architecture();
/* CLIDR is not present before ARMv7/v7m */
@@ -159,13 +159,15 @@ int populate_cache_leaves(unsigned int cpu)
return -EOPNOTSUPP;
for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
- idx < this_cpu_ci->num_leaves; idx++, level++) {
+ idx < this_cpu_ci->num_leaves; level++) {
type = get_cache_type(level);
if (type == CACHE_TYPE_SEPARATE) {
- ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
- ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+ if (idx + 1 >= this_cpu_ci->num_leaves)
+ break;
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
} else {
- ci_leaf_init(this_leaf++, type, level);
+ ci_leaf_init(&infos[idx++], type, level);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 559/869] ARM: 9521/1: cacheinfo: count external caches in early_cache_level()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 558/869] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 560/869] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves() Greg Kroah-Hartman
` (317 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 4fd69e8a9ebc42e292637ec2ebfb6bcf2d2f6c0e ]
early_cache_level() counts only caches described by CLIDR. An external
PL310 is absent from CLIDR, and its arm,pl310-cache compatible is not
accepted by init_of_cache_level(), so early allocation falls back to
an incomplete count. init_cache_level() later adds the DT-described
L2, forcing reallocation on the secondary CPU with interrupts disabled.
This defeats early allocation on PREEMPT_RT.
Use init_cache_level() for early sizing too, so the initial allocation
includes external caches described by the device tree.
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-3-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 860eeb03cfe5d..31591c9472548 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -111,13 +111,6 @@ static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
return 0;
}
-int early_cache_level(unsigned int cpu)
-{
- struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-
- return detect_cache_level(&this_cpu_ci->num_levels, &this_cpu_ci->num_leaves);
-}
-
int init_cache_level(unsigned int cpu)
{
unsigned int level, leaves;
@@ -146,6 +139,11 @@ int init_cache_level(unsigned int cpu)
return 0;
}
+int early_cache_level(unsigned int cpu)
+{
+ return init_cache_level(cpu);
+}
+
int populate_cache_leaves(unsigned int cpu)
{
unsigned int level, idx;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 560/869] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 559/869] ARM: 9521/1: cacheinfo: count external caches in early_cache_level() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 561/869] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU Greg Kroah-Hartman
` (316 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 2315f2c46e0813d010e7b3ea40f2769621453e27 ]
ARM1176 and ARM11 MPCore can be reported as ARMv7 by
cpu_architecture() even though they lack CLIDR. populate_cache_leaves()
therefore needs the CTR-format check used by detect_cache_level().
DT-based early allocation bypasses init_cache_level(), so its check
no longer protects populate_cache_leaves(). A combined ARMv6/ARMv7
SMP kernel can reach this path on BCM2835, whose DT describes its
caches.
Share the CLIDR capability check between detection and population.
Return -ENOENT from population when CLIDR is unavailable, preserving
the existing absence of cacheinfo and avoiding a new topology warning.
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-4-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 31591c9472548..993c8a1347860 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -80,19 +80,21 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
this_leaf->type = type;
}
-static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+static bool clidr_present(void)
{
- unsigned int ctype, level, leaves;
- u32 ctr, format;
-
/* CLIDR is not present before ARMv7/v7m */
if (cpu_architecture() < CPU_ARCH_ARMv7)
- return -EOPNOTSUPP;
+ return false;
/* Don't try reading CLIDR if CTR declares old format */
- ctr = read_cpuid_cachetype();
- format = FIELD_GET(CTR_FORMAT_MASK, ctr);
- if (format != CTR_FORMAT_ARMV7)
+ return FIELD_GET(CTR_FORMAT_MASK, read_cpuid_cachetype()) == CTR_FORMAT_ARMV7;
+}
+
+static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+{
+ unsigned int ctype, level, leaves;
+
+ if (!clidr_present())
return -EOPNOTSUPP;
for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
@@ -150,11 +152,10 @@ int populate_cache_leaves(unsigned int cpu)
enum cache_type type;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
struct cacheinfo *infos = this_cpu_ci->info_list;
- unsigned int arch = cpu_architecture();
- /* CLIDR is not present before ARMv7/v7m */
- if (arch < CPU_ARCH_ARMv7)
- return -EOPNOTSUPP;
+ /* The device tree can describe caches CLIDR cannot fill in. */
+ if (!clidr_present())
+ return -ENOENT;
for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
idx < this_cpu_ci->num_leaves; level++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 561/869] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 560/869] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 562/869] PCI: Set supported_speeds in set_pcie_port_type() Greg Kroah-Hartman
` (315 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 2d4234f99900403842b2c031fefb4c5816ac4df8 ]
ARM secondary CPUs allocate cacheinfo in detect_cache_attributes(),
called from secondary_start_kernel() with interrupts disabled. With
PREEMPT_RT, the allocation takes a sleeping lock and triggers
"BUG: sleeping function called from invalid context".
Call fetch_cache_info() for each possible CPU from init_cpu_topology()
on the boot CPU, following commit 5944ce092b97 ("arch_topology: Build
cacheinfo from primary CPU"). This supplies the arrays before secondary
CPUs populate them. Suppress -ENOENT and -EOPNOTSUPP, which leave cache
detection to the existing late path.
The CLIDR fallback uses the boot CPU's cache geometry. A secondary CPU
with more cache leaves can still require late reallocation and trigger
the warning.
Assisted-by: LLM
Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-5-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/topology.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 2336ee2aa44a2..e6b50cd43ce53 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -12,6 +12,7 @@
*/
#include <linux/arch_topology.h>
+#include <linux/cacheinfo.h>
#include <linux/cpu.h>
#include <linux/cpufreq.h>
#include <linux/cpumask.h>
@@ -238,8 +239,20 @@ void store_cpu_topology(unsigned int cpuid)
*/
void __init init_cpu_topology(void)
{
+ int cpu, ret;
+
reset_cpu_topology();
smp_wmb();
parse_dt_topology();
+
+ for_each_possible_cpu(cpu) {
+ ret = fetch_cache_info(cpu);
+ if (!ret)
+ continue;
+ /* CPUs without a usable CLIDR return -EOPNOTSUPP. */
+ if (ret != -ENOENT && ret != -EOPNOTSUPP)
+ pr_err("Early cacheinfo failed, ret = %d\n", ret);
+ return;
+ }
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 562/869] PCI: Set supported_speeds in set_pcie_port_type()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 561/869] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 563/869] Input: xpad - add GameSir Nova Lite support Greg Kroah-Hartman
` (314 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stian Halseth, Bjorn Helgaas,
Tony Rodriguez, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stian Halseth <stian@itx.no>
[ Upstream commit 926767a9be8866d26cc27ca46c46c03d921e2193 ]
sparc64 and powerpc create PCI devices from the device tree in
of_create_pci_dev(), which calls set_pcie_port_type() but not
pci_setup_device(). Since d2bd39c0456b, supported_speeds is only set in
pci_setup_device(), so it stays 0 for these devices.
pcie_get_speed_cap() then returns PCI_SPEED_UNKNOWN, the sysfs
'max_link_speed' attribute reads "Unknown", and the failed link retraining
quirk passes PCI_SPEED_UNKNOWN to pcie_set_target_speed(), which warns on a
SPARC T7-1:
WARNING: drivers/pci/pcie/bwctrl.c:125 at pcie_set_target_speed+0x284/0x2e0
Set supported_speeds in set_pcie_port_type(), which all three paths call.
Fixes: d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds")
Closes: https://github.com/sparclinux/issues/issues/109
Signed-off-by: Stian Halseth <stian@itx.no>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Tony Rodriguez <unixpro1970@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261007131304.309511-1-stian@itx.no
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/probe.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 4e4e38e626912..082c51ce88936 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1661,6 +1661,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
pdev->aspm_l1_support = 1;
#endif
+ pdev->supported_speeds = pcie_get_supported_speeds(pdev);
+
parent = pci_upstream_bridge(pdev);
if (!parent)
return;
@@ -2046,9 +2048,6 @@ int pci_setup_device(struct pci_dev *dev)
set_pcie_untrusted(dev);
- if (pci_is_pcie(dev))
- dev->supported_speeds = pcie_get_supported_speeds(dev);
-
/* "Unknown power state" */
dev->current_state = PCI_UNKNOWN;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 563/869] Input: xpad - add GameSir Nova Lite support
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 562/869] PCI: Set supported_speeds in set_pcie_port_type() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 564/869] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) Greg Kroah-Hartman
` (313 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Orlando, Dmitry Torokhov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Orlando <francesco.orlando99@libero.it>
[ Upstream commit 2e6f2e5799f328ca0879dad14d7f3709c7f7496b ]
Add vendor and product ID for GameSir Nova Lite (0x3537:0x1040) in
XInput mode to enable force feedback rumble support.
Signed-off-by: Francesco Orlando <francesco.orlando99@libero.it>
Link: https://patch.msgid.link/20261011165821.72698-1-francesco.orlando99@libero.it
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/joystick/xpad.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 126f99cd0b29e..716ab1c608f0b 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -442,6 +442,7 @@ static const struct xpad_device {
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
+ { 0x3537, 0x1040, "GameSir Nova Lite", 0, XTYPE_XBOX360 },
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 564/869] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1)
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 563/869] Input: xpad - add GameSir Nova Lite support Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 565/869] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file Greg Kroah-Hartman
` (312 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikolaj Klitlund Børty,
Luiz Augusto von Dentz, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolaj Klitlund Børty <nbn@sj.dk>
[ Upstream commit 1430308fc9d47a801a305700cd444b1a0051d14a ]
Add the USB ID 0x14b0:0x047a for the StarTech AV53C1-USB-BLUETOOTH
adapter, a Realtek RTL8761BUE based Bluetooth 5.3 dongle.
Without this entry btusb treats the device as a generic Bluetooth
adapter and never loads the Realtek firmware, leaving the controller on
its ROM firmware. In that state it advertises and scans actively, but
never reports advertisements during passive scanning. LE connections
initiated by the kernel wait for a passive-scan report before issuing
LE Create Connection, so connecting and pairing from BlueZ time out
without any error from the controller.
The same product is also sold with the ID 0x2c0a:0x8761, which is
already supported.
lsusb -v output for the device:
Bus 001 Device 010: ID 14b0:047a StarTech.com Ltd. Bluetooth Radio
Device Descriptor:
bcdUSB 1.10
bDeviceClass 224 Wireless
bDeviceSubClass 1 Radio Frequency
bDeviceProtocol 1 Bluetooth
idVendor 0x14b0 StarTech.com Ltd.
idProduct 0x047a
bcdDevice 2.00
iManufacturer 1 Realtek
iProduct 2 Bluetooth Radio
iSerial 3 00E04C239987
bNumInterfaces 2
Interface Descriptor:
bInterfaceClass 224 Wireless
bInterfaceSubClass 1 Radio Frequency
bInterfaceProtocol 1 Bluetooth
Cc: stable@vger.kernel.org
Signed-off-by: Nikolaj Klitlund Børty <nbn@sj.dk>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 0b8c2ecf0a64c..5b8b71efffac9 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -843,6 +843,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x14b0, 0x047a), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional Realtek 8821AE Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 565/869] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 564/869] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 566/869] Bluetooth: hci_debugfs: Pin module for debugfs file operations Greg Kroah-Hartman
` (311 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
[ Upstream commit 8368f0c2cde48c09ed70644059f24172b0c59f52 ]
An open debugfs file retains lowpan_control_fops in the debugfs proxy
state. However, lowpan_control_fops has no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth_6lowpan module.
With CONFIG_BT_6LOWPAN=m, a userspace process can keep the debugfs file
descriptor for 6lowpan_control open across module unload
(delete_module / rmmod bluetooth_6lowpan). When the process subsequently
closes the file descriptor, full_proxy_release() accesses the already
freed and unmapped lowpan_control_fops table, causing a kernel page fault
or oops.
The issue was discovered via manual code audit of
net/bluetooth/6lowpan.c.
Set .owner = THIS_MODULE on lowpan_control_fops so that debugfs pins
the module until all open file descriptors have finished.
Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 3733f408d2e40..0660d306cf4f7 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1207,6 +1207,7 @@ static int lowpan_control_open(struct inode *inode, struct file *file)
}
static const struct file_operations lowpan_control_fops = {
+ .owner = THIS_MODULE,
.open = lowpan_control_open,
.read = seq_read,
.write = lowpan_control_write,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 566/869] Bluetooth: hci_debugfs: Pin module for debugfs file operations
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 565/869] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 567/869] Bluetooth: L2CAP: Reject mode changes on connected channels Greg Kroah-Hartman
` (310 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
[ Upstream commit 2a3e2287877b1ee40ffb80b7d769b633866533f3 ]
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, the file_operations defined in
hci_debugfs.c (use_debug_keys_fops, sc_only_mode_fops,
ssp_debug_mode_fops, force_bredr_smp_fops, force_static_address_fops,
force_no_mitm_fops, dut_mode_fops, vendor_diag_fops, and the
DEFINE_QUIRK_ATTRIBUTE macro) have no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth module. When a userspace
process opens any of these debugfs files, a subsequent controller removal
and module unload (rmmod bluetooth) can succeed while the file descriptor
remains open.
When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():
BUG: unable to handle page fault for address: fffffbfff8056f03
#PF: supervisor read access in kernel mode
Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0x8e/0x140
Call Trace:
<TASK>
__fput+0x39f/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
The issue was discovered via manual code audit of
net/bluetooth/hci_debugfs.c and verified on a Linux 7.3-rc6 test VM
with CONFIG_BT=m.
Set .owner = THIS_MODULE on all debugfs file_operations tables in
hci_debugfs.c so that debugfs keeps the module loaded until close has
finished.
Fixes: 0886aea6acd2 ("Bluetooth: Expose debug keys usage setting via debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_debugfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 9ae6d9224c3b7..807c9e0e212c9 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -68,6 +68,7 @@ static ssize_t __name ## _write(struct file *file, \
} \
\
static const struct file_operations __name ## _fops = { \
+ .owner = THIS_MODULE, \
.open = simple_open, \
.read = __name ## _read, \
.write = __name ## _write, \
@@ -286,6 +287,7 @@ static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf,
}
static const struct file_operations use_debug_keys_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = use_debug_keys_read,
.llseek = default_llseek,
@@ -304,6 +306,7 @@ static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
}
static const struct file_operations sc_only_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = sc_only_mode_read,
.llseek = default_llseek,
@@ -440,6 +443,7 @@ static ssize_t ssp_debug_mode_read(struct file *file, char __user *user_buf,
}
static const struct file_operations ssp_debug_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = ssp_debug_mode_read,
.llseek = default_llseek,
@@ -532,6 +536,7 @@ static ssize_t force_bredr_smp_write(struct file *file,
}
static const struct file_operations force_bredr_smp_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_bredr_smp_read,
.write = force_bredr_smp_write,
@@ -781,6 +786,7 @@ static ssize_t force_static_address_write(struct file *file,
}
static const struct file_operations force_static_address_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_static_address_read,
.write = force_static_address_write,
@@ -1184,6 +1190,7 @@ static ssize_t force_no_mitm_write(struct file *file,
}
static const struct file_operations force_no_mitm_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_no_mitm_read,
.write = force_no_mitm_write,
@@ -1322,6 +1329,7 @@ static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
}
static const struct file_operations dut_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = dut_mode_read,
.write = dut_mode_write,
@@ -1378,6 +1386,7 @@ static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
}
static const struct file_operations vendor_diag_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = vendor_diag_read,
.write = vendor_diag_write,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 567/869] Bluetooth: L2CAP: Reject mode changes on connected channels
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 566/869] Bluetooth: hci_debugfs: Pin module for debugfs file operations Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 568/869] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Greg Kroah-Hartman
` (309 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit c1398cf11b31a94c27ed810ba69515e0df5ce379 ]
A peer can send a configuration response with an RFC
option for another mode to a connected channel, for
example to switch it from Streaming to ERTM mode.
l2cap_parse_conf_rsp() then changes chan->mode, but
l2cap_ertm_init() is not called again, so the ERTM
sequence lists are never allocated. The next
out-of-sequence I-frame makes l2cap_seq_list_clear()
write through the NULL srej_list.list.
Refuse the channel when a response tries to change
the mode of a connected channel.
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 462667a6e6ac2..4e1c21f05e54e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3801,7 +3801,11 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
}
}
- if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+ /* A connected channel cannot change its mode, as the new mode would
+ * not be initialized.
+ */
+ if (chan->mode != rfc.mode &&
+ (chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED))
return -ECONNREFUSED;
chan->mode = rfc.mode;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 568/869] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 567/869] Bluetooth: L2CAP: Reject mode changes on connected channels Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 569/869] Bluetooth: L2CAP: Use default TxWindow for zero socket option Greg Kroah-Hartman
` (308 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit c5ebb0245fe927cf5fa33510a9cb2799c4a2dd01 ]
A peer can send an ERTM RFC option with a TxWindow
of zero, which is out of spec. It is stored in
remote_tx_win unchanged and later passed to
l2cap_seq_list_init(), where roundup_pow_of_two(0)
is undefined. On some architectures this results in
a ZERO_SIZE_PTR list and a remote kernel oops.
A TxWindow above 63 is out of spec as well. With
6-bit sequence numbers we would then send more
unacknowledged frames than the sequence space can
tell apart.
Reply with L2CAP_CONF_UNACCEPT and propose the
default TxWindow instead of accepting the value, so
remote_tx_win always stays within 1 to 63. Keep the
parameters of an earlier request then, and do not
treat the request as done because an earlier one was.
Also refuse a zero size in l2cap_seq_list_init(), so
any other path that reaches it with a zero TxWindow
fails the channel instead of the kernel.
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4e1c21f05e54e..0ba7b1ea435cc 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -323,6 +323,10 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
{
size_t alloc_size, i;
+ /* roundup_pow_of_two(0) is undefined */
+ if (!size)
+ return -EINVAL;
+
/* Allocated size is a power of 2 to map sequence numbers
* (which may be up to 14 bits) in to a smaller array that is
* sized for the negotiated ERTM transmit windows.
@@ -3648,18 +3652,33 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
break;
case L2CAP_MODE_ERTM:
- if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
- chan->remote_tx_win = rfc.txwin_size;
- else
- rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
-
- chan->remote_max_tx = rfc.max_transmit;
-
size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
rfc.max_pdu_size = cpu_to_le16(size);
- chan->remote_mps = size;
+
+ /* The TxWindow must be within 1 to 63, otherwise
+ * propose the default one and keep the parameters of
+ * an earlier request. This overrides a PENDING result
+ * from the EFS check above, so the request is no
+ * longer pending, nor done if an earlier one was.
+ */
+ if (!rfc.txwin_size ||
+ rfc.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
+ result = L2CAP_CONF_UNACCEPT;
+ clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
+ clear_bit(CONF_OUTPUT_DONE, &chan->conf_state);
+ rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+ remote_efs = 0;
+ } else {
+ if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
+ chan->remote_tx_win = rfc.txwin_size;
+ else
+ rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
+ chan->remote_max_tx = rfc.max_transmit;
+ chan->remote_mps = size;
+ }
__l2cap_set_ertm_timeouts(chan, &rfc);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 569/869] Bluetooth: L2CAP: Use default TxWindow for zero socket option
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 568/869] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 570/869] cpufreq: schedutil: Serialize sugov_start() against rate limit updates Greg Kroah-Hartman
` (307 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit 226fa3b676cbf2236f803bccd347462433ffc2c8 ]
L2CAP_OPTIONS accepts a txwin_size of zero and
stores it in tx_win. The zero is then sent to the
peer in our configuration request, and if the
channel ends up in ERTM mode it is passed to
l2cap_seq_list_init().
Use the default TxWindow instead, as the mode can
still be changed to ERTM during configuration.
Fixes: 14b5aa71ec50 ("Bluetooth: Add sockopt configuration for txWindow on L2CAP")
Cc: stable@vger.kernel.org
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index bb383ee188bbc..b85c6a11334ee 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -805,6 +805,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
break;
}
+ /* A zero TxWindow is invalid, use the default instead */
+ if (!opts.txwin_size)
+ opts.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
if (!l2cap_valid_mtu(chan, opts.imtu)) {
err = -EINVAL;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 570/869] cpufreq: schedutil: Serialize sugov_start() against rate limit updates
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 569/869] Bluetooth: L2CAP: Use default TxWindow for zero socket option Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 571/869] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() Greg Kroah-Hartman
` (306 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Hui Su,
Rafael J. Wysocki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
[ Upstream commit ce390caf5541c493c9061e7a2d98a463e66b736a ]
The current value of sg_policy->tunables->rate_limit_us is used in
sugov_start() without locking to update sg_policy->freq_update_delay_ns,
so if rate_limit_us_store() runs in parallel with it, the rate limit
update may go unnoticed and the new freq_update_delay_ns value may be
stale until the rate limit is updated again.
To avoid that, acquire the update_lock mutex of the rate limit sysfs
attribute, that is held by rate_limit_us_store() during rate limit
updates, around the freq_update_delay_ns in sugov_start().
Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Hui Su <sh_def@163.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject adjustment, new changelog, edits of the new comment ]
[ rjw: Add empty code line after guard()() ]
Link: https://patch.msgid.link/20261013034235.2678177-1-sh_def@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/cpufreq_schedutil.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 22a1fbccb929f..9b5db92744aee 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -72,6 +72,18 @@ static void sugov_update_rate_limit_us(struct sugov_policy *sg_policy)
(s64)sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
}
+static void sugov_update_rate_limit_us_sync(struct sugov_policy *sg_policy)
+{
+ /*
+ * Serialize with rate_limit_us_store() to prevent this path from using
+ * a stale rate limit tunable value to set the limit for the given
+ * policy.
+ */
+ guard(mutex)(&sg_policy->tunables->attr_set.update_lock);
+
+ sugov_update_rate_limit_us(sg_policy);
+}
+
static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
{
s64 delta_ns;
@@ -859,7 +871,7 @@ static int sugov_start(struct cpufreq_policy *policy)
void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
unsigned int cpu;
- sugov_update_rate_limit_us(sg_policy);
+ sugov_update_rate_limit_us_sync(sg_policy);
sg_policy->last_freq_update_time = 0;
sg_policy->next_freq = 0;
sg_policy->work_in_progress = false;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 571/869] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 570/869] cpufreq: schedutil: Serialize sugov_start() against rate limit updates Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 572/869] kbuild: AutoFDO: Update split machine function argument for upstream rename Greg Kroah-Hartman
` (305 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 73d3d81832708137ba6332fc011663feaf97deee ]
xilinx_pl_dma_pcie_init_irq_domain() takes a reference to the PCIe
interrupt-controller child node with of_get_child_by_name(), but the
error paths after the two irq_domain_create_linear() calls and after
xilinx_pl_dma_pcie_init_msi_irq_domain() return directly without
dropping it. irq_domain_create_linear() gets its own reference on the
fwnode, so the domains do not consume the caller's one.
Add an err_put_node label that drops the reference before returning.
Fixes: 8d786149d78c ("PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260917132459.2153240-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-xilinx-dma-pl.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/controller/pcie-xilinx-dma-pl.c b/drivers/pci/controller/pcie-xilinx-dma-pl.c
index b037c8f315e46..e18eeecdc8a9a 100644
--- a/drivers/pci/controller/pcie-xilinx-dma-pl.c
+++ b/drivers/pci/controller/pcie-xilinx-dma-pl.c
@@ -581,7 +581,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
port->pldma_domain = irq_domain_create_linear(of_fwnode_handle(pcie_intc_node), 32,
&event_domain_ops, port);
if (!port->pldma_domain)
- return -ENOMEM;
+ goto err_put_node;
irq_domain_update_bus_token(port->pldma_domain, DOMAIN_BUS_NEXUS);
@@ -589,7 +589,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
&intx_domain_ops, port);
if (!port->intx_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
- return -ENOMEM;
+ goto err_put_node;
}
irq_domain_update_bus_token(port->intx_domain, DOMAIN_BUS_WIRED);
@@ -597,13 +597,17 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
ret = xilinx_pl_dma_pcie_init_msi_irq_domain(port);
if (ret != 0) {
irq_domain_remove(port->intx_domain);
- return -ENOMEM;
+ goto err_put_node;
}
of_node_put(pcie_intc_node);
raw_spin_lock_init(&port->lock);
return 0;
+
+err_put_node:
+ of_node_put(pcie_intc_node);
+ return -ENOMEM;
}
static int xilinx_pl_dma_pcie_setup_irq(struct pl_dma_pcie *port)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 572/869] kbuild: AutoFDO: Update split machine function argument for upstream rename
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 571/869] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 573/869] iommufd: Reject a zero-length dirty bitmap request Greg Kroah-Hartman
` (304 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 2b358510d5cc56164f83110ca1499c95a5a352cd ]
A recent LLVM commit [1] renamed the internal LLVM plugin option
'-split-machine-functions' to '-function-splitting=all', breaking the
AutoFDO + ThinLTO build with:
ld.lld: error: -plugin-opt=-: ld.lld: Unknown command line argument '-split-machine-functions'. Try: 'ld.lld --help'
The plugin option is needed for in-process ThinLTO, so handle the rename
accordingly using ld-option.
Cc: stable@vger.kernel.org
Closes: https://github.com/ClangBuiltLinux/linux/issues/2186
Fixes: 2fd65f7afd5a ("AutoFDO: Enable machine function split optimization for AutoFDO")
Link: https://github.com/llvm/llvm-project/commit/3e6acc87c58843e551d6e8e4bf06c26712b04622 [1]
Link: https://patch.msgid.link/20261014-update-autofdo-split-machine-function-option-v1-1-5c71b3005e89@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/Makefile.autofdo | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/Makefile.autofdo b/scripts/Makefile.autofdo
index 1caf2457e585c..0b14a05726ada 100644
--- a/scripts/Makefile.autofdo
+++ b/scripts/Makefile.autofdo
@@ -18,7 +18,7 @@ ifdef CONFIG_LTO_CLANG_THIN
KBUILD_LDFLAGS += --lto-sample-profile=$(CLANG_AUTOFDO_PROFILE)
endif
KBUILD_LDFLAGS += --mllvm=-enable-fs-discriminator=true --mllvm=-improved-fs-discriminator=true -plugin-opt=thinlto
- KBUILD_LDFLAGS += -plugin-opt=-split-machine-functions
+ KBUILD_LDFLAGS += $(call ld-option,-plugin-opt=-function-splitting=all,-plugin-opt=-split-machine-functions)
endif
export CFLAGS_AUTOFDO_CLANG
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 573/869] iommufd: Reject a zero-length dirty bitmap request
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 572/869] kbuild: AutoFDO: Update split machine function argument for upstream rename Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 574/869] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() Greg Kroah-Hartman
` (303 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Parri, Jason Gunthorpe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit f6b3fd8f573e801066c21b2aec3d2e949e61e48e ]
iommufd_check_iova_range() subtracts one from bitmap->length before it
checks the length, so a zero-length request wraps to SIZE_MAX. With
iova = 0 the wrapped value passes the overflow and alignment checks, and
the request reaches iova_bitmap_alloc() with length 0.
iova_bitmap_alloc() then sizes the bitmap from a length - 1 of SIZE_MAX,
so mapped_total_index is effectively unbounded. The scan uses
last_iova = ULONG_MAX, which spans the whole IOAS when an area is mapped
at IOVA 0. Reject a zero length before the subtraction.
Fixes: b9a60d6f850e ("iommufd: Add IOMMU_HWPT_GET_DIRTY_BITMAP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/20260925161142.189813-4-parri.andrea@gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommufd/io_pagetable.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
index a4d7a9d435603..77891d4d65fb1 100644
--- a/drivers/iommu/iommufd/io_pagetable.c
+++ b/drivers/iommu/iommufd/io_pagetable.c
@@ -568,6 +568,9 @@ int iommufd_check_iova_range(struct io_pagetable *iopt,
size_t iommu_pgsize = iopt->iova_alignment;
u64 last_iova;
+ if (!bitmap->length)
+ return -EINVAL;
+
if (check_add_overflow(bitmap->iova, bitmap->length - 1, &last_iova))
return -EOVERFLOW;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 574/869] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 573/869] iommufd: Reject a zero-length dirty bitmap request Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 575/869] crypto: qat - fix use of destroyed vf2pf_lock on VF restart Greg Kroah-Hartman
` (302 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahsan Atta, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <ahsan.atta@intel.com>
[ Upstream commit 4ad7c1bd5f3dcd3fd6efbb068d6ee2a68dddfece ]
state_lock is initialised at the end of adf_devmgr_add_dev(), but the VF
on host path whose id mapping already exists returns earlier via
'goto unlock'. That mapping outlives the VF, so this path is taken every
time a VF is recreated on a BDF that already hosted one, e.g.:
echo 0 > sriov_numvfs
echo 32 > sriov_numvfs
accel_dev is freshly allocated on each probe, so state_lock is left zeroed
and adf_dev_up() takes an uninitialised mutex. With CONFIG_DEBUG_MUTEXES
this is reported on a dh895xcc with 32 host-bound VFs:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
Call Trace:
adf_dev_up+0x27/0xe0 [intel_qat]
adf_probe+0x700/0xa80 [qat_dh895xccvf]
local_pci_probe+0xd5/0x190
The same happens on teardown when adf_dev_down() locks it again.
Initialise the lock next to the other per-device state, before the tables
are updated, so it is done on every path.
Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 81dd22d2083ff..680e6557fc946 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -137,6 +137,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
mutex_lock(&table_lock);
atomic_set(&accel_dev->ref_count, 0);
+ mutex_init(&accel_dev->state_lock);
/* PF on host or VF on guest - optimized to remove redundant is_vf */
if (!accel_dev->is_vf || !pf) {
@@ -210,7 +211,6 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
map->attached = true;
list_add_tail(&map->list, &vfs_table);
}
- mutex_init(&accel_dev->state_lock);
unlock:
mutex_unlock(&table_lock);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 575/869] crypto: qat - fix use of destroyed vf2pf_lock on VF restart
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 574/869] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 576/869] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32 Greg Kroah-Hartman
` (301 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahsan Atta, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <ahsan.atta@intel.com>
[ Upstream commit 4921634ac0a9a65aaa5e41308aabda3d3f562ee3 ]
adf_dev_stop_async() sends the RESTARTING_COMPLETE message after
adf_dev_down() has returned, but adf_dev_down() already destroyed the
lock that message takes.
Both run in sequence in the same worker, so every PF restart locks a
destroyed mutex. With CONFIG_DEBUG_MUTEXES on a dh895xcc with 32 host-bound
VFs this trips on the first PF reset:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
Workqueue: adf_vf_stop_wq adf_dev_stop_async [intel_qat]
Call Trace:
adf_gen2_pfvf_send+0x210/0x530 [intel_qat]
adf_vf2pf_notify_restart_complete+0x55/0x80 [intel_qat]
adf_dev_stop_async+0xdb/0x140 [intel_qat]
The notification cannot move before adf_dev_down(): the PF waits for it
before its own reset and the VF must tear down its rings first.
vf2pf_lock protects the VF2PF CSR and is unrelated to the PF2VF bottom half
it is initialised alongside. Tie its lifetime to the accel device, next to
state_lock in adf_devmgr_add_dev()/adf_devmgr_rm_dev(), so it stays valid
for messages sent outside the device up/down cycle. It is only touched for
VFs, which set is_vf before adf_devmgr_add_dev() and keep it set until
adf_devmgr_rm_dev().
Fixes: 6f1b5236348f ("crypto: qat - fix recovery flow for VFs")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 8 ++++++++
drivers/crypto/intel/qat/qat_common/adf_vf_isr.c | 2 --
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 680e6557fc946..833d3c8e4650c 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -138,6 +138,12 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
mutex_lock(&table_lock);
atomic_set(&accel_dev->ref_count, 0);
mutex_init(&accel_dev->state_lock);
+ /*
+ * The VF2PF lock is used to send messages to the PF outside of the
+ * device up/down cycle, so it must live as long as the accel device.
+ */
+ if (accel_dev->is_vf)
+ mutex_init(&accel_dev->vf.vf2pf_lock);
/* PF on host or VF on guest - optimized to remove redundant is_vf */
if (!accel_dev->is_vf || !pf) {
@@ -257,6 +263,8 @@ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
}
}
unlock:
+ if (accel_dev->is_vf)
+ mutex_destroy(&accel_dev->vf.vf2pf_lock);
mutex_destroy(&accel_dev->state_lock);
list_del(&accel_dev->list);
mutex_unlock(&table_lock);
diff --git a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
index a4636ec9f9cac..9ff6f66483016 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
@@ -118,7 +118,6 @@ static int adf_setup_pf2vf_bh(struct adf_accel_dev *accel_dev)
tasklet_init(&accel_dev->vf.pf2vf_bh_tasklet,
(void *)adf_pf2vf_bh_handler, (unsigned long)accel_dev);
- mutex_init(&accel_dev->vf.vf2pf_lock);
return 0;
}
@@ -126,7 +125,6 @@ static void adf_cleanup_pf2vf_bh(struct adf_accel_dev *accel_dev)
{
tasklet_disable(&accel_dev->vf.pf2vf_bh_tasklet);
tasklet_kill(&accel_dev->vf.pf2vf_bh_tasklet);
- mutex_destroy(&accel_dev->vf.vf2pf_lock);
}
static irqreturn_t adf_isr(int irq, void *privdata)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 576/869] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 575/869] crypto: qat - fix use of destroyed vf2pf_lock on VF restart Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 577/869] irqchip/imx-intmux: Fix runtime PM teardown on remove Greg Kroah-Hartman
` (300 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Thomas Gleixner,
Marc Zyngier, Zenghui Yu (Huawei), Radu Rendec, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit 5a9d62555e7164ec79a5fe70153d79cf1fdfd614 ]
GITS_TYPER_IDBITS is five bits, so id_bits reaches 32 and
min_t(unsigned int, ...) truncates BIT(32) to 0. nvecs becomes 0,
its_lpi_alloc() rejects that, and its_msi_prepare() returns -ENOMEM.
On 32-bit ARM the shift is undefined instead.
The clamp is correct for every value below the maximum, so only that
one value is affected.
Fixes: ce9e40a9a5e5c ("irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260908142632.2795308-3-fuad.tabba@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 8607ed0d98841..4443bf46e390d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3488,7 +3488,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
* Also honor the ITS's own EID limit.
*/
id_bits = FIELD_GET(GITS_TYPER_IDBITS, its->typer) + 1;
- nvecs = min_t(unsigned int, nvecs, BIT(id_bits));
+ nvecs = min_t(u64, nvecs, BIT_ULL(id_bits));
nr_ites = max(2, nvecs);
sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
sz = max(sz, ITS_ITT_ALIGN);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 577/869] irqchip/imx-intmux: Fix runtime PM teardown on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 576/869] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 578/869] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe() Greg Kroah-Hartman
` (299 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Thomas Gleixner,
Frank Li, Radu Rendec, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit b167c1a30e9e020e4c5e102c7a555943742c024b ]
imx_intmux_probe() enables the IPG clock and then drops its runtime PM
reference with pm_runtime_put(). With CONFIG_PM enabled, the runtime
suspend callback disables the IPG clock. With CONFIG_PM disabled, the
clock remains enabled after probe.
imx_intmux_remove() accesses the CHANIER registers without first making
sure that the device is runtime active. The device may therefore be
runtime suspended with the IPG clock disabled when these registers are
accessed. In addition, the remove path only calls pm_runtime_disable()
and does not balance the clock enable when CONFIG_PM is disabled.
Resume the device and acquire a runtime PM reference before accessing
the registers. If resume fails, skip the register accesses but still
tear down the chained handlers and IRQ domains. Disable runtime PM
afterwards, drop the acquired reference without triggering another
runtime suspend, and explicitly disable the IPG clock.
This keeps the clock enabled while the hardware registers are accessed
and balances the clk_prepare_enable() performed during probe for both
CONFIG_PM configurations.
This issue was found by manual code inspection.
Fixes: bb403111e017 ("irqchip/imx-intmux: Implement intmux runtime power management")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914134211.1734163-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-imx-intmux.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/irqchip/irq-imx-intmux.c b/drivers/irqchip/irq-imx-intmux.c
index 5f9b204d350b2..18e214e5b1b59 100644
--- a/drivers/irqchip/irq-imx-intmux.c
+++ b/drivers/irqchip/irq-imx-intmux.c
@@ -289,12 +289,16 @@ static int imx_intmux_probe(struct platform_device *pdev)
static void imx_intmux_remove(struct platform_device *pdev)
{
struct intmux_data *data = platform_get_drvdata(pdev);
- int i;
+ int i, ret;
+
+ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ dev_warn(&pdev->dev, "failed to resume device: %d\n", ret);
for (i = 0; i < data->channum; i++) {
/* disable all interrupt sources of this channel */
- writel_relaxed(0, data->regs + CHANIER(i));
-
+ if (ret >= 0)
+ writel_relaxed(0, data->regs + CHANIER(i));
irq_set_chained_handler_and_data(data->irqchip_data[i].irq,
NULL, NULL);
@@ -302,6 +306,11 @@ static void imx_intmux_remove(struct platform_device *pdev)
}
pm_runtime_disable(&pdev->dev);
+ if (ret >= 0) {
+ pm_runtime_put_noidle(&pdev->dev);
+ clk_disable_unprepare(data->ipg_clk);
+ pm_runtime_set_suspended(&pdev->dev);
+ }
}
#ifdef CONFIG_PM
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 578/869] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 577/869] irqchip/imx-intmux: Fix runtime PM teardown on remove Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 579/869] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks Greg Kroah-Hartman
` (298 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit af9c707eb065a7d48eb92dc15acdb4346acf5db0 ]
of_clk_get_by_name() returns the clock with an elevated reference count
that mchp_eic_probe() keeps for the lifetime of the driver, but none of
the probe error paths drops it, so the reference is leaked whenever
probe fails after the clock has been obtained.
Put the reference in the error cleanup. The clk_prepare_enable()
failure path must jump there directly as it cannot call
clk_disable_unprepare() on a clock that was never enabled.
Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916190349.2094401-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-mchp-eic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index 31093a8ab67c3..82cb0513bbb8d 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -233,7 +233,7 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
ret = clk_prepare_enable(eic->clk);
if (ret)
- goto unmap;
+ goto clk_put;
for (i = 0; i < MCHP_EIC_NIRQ; i++) {
struct of_phandle_args irq;
@@ -270,6 +270,8 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
clk_unprepare:
clk_disable_unprepare(eic->clk);
+clk_put:
+ clk_put(eic->clk);
unmap:
iounmap(eic->base);
free:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 579/869] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 578/869] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 580/869] ALSA: ump: Correct return size of fill_rpn() Greg Kroah-Hartman
` (297 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thomas Gleixner,
Radu Rendec, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 0ca21fe111457c843624a835641bb490e704bb2f ]
irq_gc_shutdown() calls the irq_pm_shutdown() callbacks from
syscore_shutdown() with interrupts enabled. aic_pm_shutdown() and
aic5_pm_shutdown() take the generic chip lock with raw_spin_lock(), and
irq_gc_eoi() takes the same lock from the interrupt handler. An
interrupt from the chip while the lock is held spins in irq_gc_eoi()
and hangs the reboot.
Lockdep reports this on every reboot of a SAM9X75 Curiosity board:
WARNING: inconsistent lock state
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
busybox/101 [HC0[0]:SC0[0]:HE1:SE1] takes:
c1c2b434 (&gc->lock){?.-.}-{2:2}, at: aic5_pm_shutdown+0x34/0xd8
{IN-HARDIRQ-W} state was registered at:
...
irq_gc_eoi+0x28/0x60
handle_fasteoi_irq+0x120/0x214
...
aic5_pm_shutdown from irq_gc_shutdown+0x4c/0x58
irq_gc_shutdown from syscore_shutdown+0x5c/0x9c
syscore_shutdown from kernel_restart+0x34/0x78
kernel_restart from sys_reboot+0x180/0x25c
Use the irqsave guard, as
commit 33517881ede7 ("irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code")
did for brcmstb-l2.
Fixes: b1479ebb7720 ("irqchip: atmel-aic: Add atmel AIC/AIC5 drivers")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260926004124.88221-1-kmehltretter@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-atmel-aic.c | 2 +-
drivers/irqchip/irq-atmel-aic5.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 1dcc52760ecae..4a7935e75e4dd 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -123,7 +123,7 @@ static void aic_pm_shutdown(struct irq_data *d)
{
struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
- guard(raw_spinlock)(&gc->lock);
+ guard(raw_spinlock_irqsave)(&gc->lock);
irq_reg_writel(gc, 0xffffffff, AT91_AIC_IDCR);
irq_reg_writel(gc, 0xffffffff, AT91_AIC_ICCR);
}
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 1f14b401f71d0..07a317ed06ef4 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -217,7 +217,7 @@ static void aic5_pm_shutdown(struct irq_data *d)
struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
int i;
- guard(raw_spinlock)(&bgc->lock);
+ guard(raw_spinlock_irqsave)(&bgc->lock);
for (i = 0; i < dgc->irqs_per_chip; i++) {
irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 580/869] ALSA: ump: Correct return size of fill_rpn()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 579/869] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 581/869] gfs2: fix the escaped block copy in gfs2_before_commit() Greg Kroah-Hartman
` (296 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 85e8c5f933ee3dbc9d061e121237797e9fa05315 ]
The RPN/NRPN conversion in fill_rpn() is supposed to return the number
of bytes of the resultant UMP packet, but it returns boolean values.
This would result in the incorrect ump_bytes in the converter, which
will confuse stream processing. Correct to the right value 8 as a MIDI
2.0 UMP packet.
Fixes: e6ce8a28c768 ("ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception")
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261015075439.50088-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/ump_convert.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/ump_convert.c b/sound/core/ump_convert.c
index 85cc67de63306..0a7972d91ec52 100644
--- a/sound/core/ump_convert.c
+++ b/sound/core/ump_convert.c
@@ -323,7 +323,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc,
cc->cc_data_lsb);
reset_rpn(cc);
- return 1;
+ return 8;
}
/* convert to a MIDI 1.0 Channel Voice message */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 581/869] gfs2: fix the escaped block copy in gfs2_before_commit()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 580/869] ALSA: ump: Correct return size of fill_rpn() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 582/869] spi: jcore: fix divide-by-zero when speed_hz is zero Greg Kroah-Hartman
` (295 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tal Zussman, Andreas Gruenbacher,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tal Zussman <tz2294@columbia.edu>
[ Upstream commit 1a4aeb6d6a08af1a2e2c52c84170561625819377 ]
Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where
appropriate") made the escaped buffer copy read from the mempool page
it had just allocated instead of from the buffer, so the block written
to the log is whatever the pool page last held. If the journal is
replayed after a crash, the block is restored from that and the file's
data is corrupted. Only escaped buffers are affected: jdata blocks
whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio
instead.
Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/lops.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 0ed81a685fcd0..59e3d295a2a17 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -690,7 +690,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit,
page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
p = page_address(page);
- memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size);
+ memcpy_from_folio(p, bd2->bd_bh->b_folio,
+ bh_offset(bd2->bd_bh),
+ bd2->bd_bh->b_size);
*(__be32 *)p = 0;
clear_buffer_escaped(bd2->bd_bh);
unlock_buffer(bd2->bd_bh);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 582/869] spi: jcore: fix divide-by-zero when speed_hz is zero
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 581/869] gfs2: fix the escaped block copy in gfs2_before_commit() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 583/869] efi/libstub: arm64: Dont use the platform register x18 Greg Kroah-Hartman
` (294 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 7db773075501248893c22b11bedc6745d6d0be45 ]
jcore_spi_baudrate() computes hw->clock_freq / 2 / speed without
validating speed. The SPI core fills transfer.speed_hz from
spi->max_speed_hz when it is zero, and jcore_spi_probe() never sets
host->max_speed_hz, so the clamp in __spi_setup() is skipped. A
spi_device created via the sysfs new_device interface (or a DT node
without spi-max-frequency) therefore has max_speed_hz == 0, and any
SPI_IOC_MESSAGE transfer reaches jcore_spi_baudrate() with speed == 0,
causing a division by zero and a kernel panic.
Clamp speed to a minimum of 1 Hz before the division so the divisor is
never zero. The computed divider then truncates to the register field
width and the transfer simply runs at the slowest supported rate.
Verified by inspection of the __spi_setup() clamp and
__spi_validate()'s speed_hz handling; the division-by-zero path
requires the J-Core controller, which was not available.
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 2cb1b3b3ac0a ("spi: add driver for J-Core SPI controller")
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-jcore-divzero-v1-1-a8205d30f2d1@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-jcore.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/spi/spi-jcore.c b/drivers/spi/spi-jcore.c
index e37ca22e04ba6..2bde899eb2b49 100644
--- a/drivers/spi/spi-jcore.c
+++ b/drivers/spi/spi-jcore.c
@@ -84,6 +84,8 @@ static void jcore_spi_baudrate(struct jcore_spi *hw, int speed)
{
if (speed == hw->speed_hz)
return;
+ if (speed <= 0)
+ speed = 1;
hw->speed_hz = speed;
if (speed >= hw->clock_freq / 2)
hw->speed_reg = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 583/869] efi/libstub: arm64: Dont use the platform register x18
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 582/869] spi: jcore: fix divide-by-zero when speed_hz is zero Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 584/869] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table Greg Kroah-Hartman
` (293 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 4c86b5f3fa78347fa9cbc9e8ec06615b2f80e397 ]
The UEFI specification designates x18, the platform register, as "do not
use" on AArch64, so that UEFI code is compatible both with an OS that
assigns a fixed role to x18, and with one that uses it as a temporary
register.
The arm64 EFI stub and the EFI zboot decompressor only avoid x18 if the
kernel is built with shadow call stacks, as that is the only case where
-ffixed-x18 is added to KBUILD_CFLAGS, which the stub inherits.
Otherwise, the compiler is free to use x18 as a temporary register, and
it does so.
So pass -ffixed-x18 unconditionally when building the stub for arm64,
so that the image can be run by loaders that rely on x18 being left
alone, such as a kernel that uses it for its shadow call stack.
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 94b05e4451dd3..c532ba5503522 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -22,7 +22,7 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \
# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
# disable the stackleak plugin
-cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) \
+cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) -ffixed-x18 \
-fno-unwind-tables -fno-asynchronous-unwind-tables
cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \
-DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 584/869] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 583/869] efi/libstub: arm64: Dont use the platform register x18 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 585/869] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved Greg Kroah-Hartman
` (292 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit aaf3ed0f46298e18ec8bc477cf0a37478e41f2ea ]
The LINUX_EFI_MEMRESERVE table is the root of a linked list of memory
reservations that need to persist across kexec, such as the GICv3 LPI
pending and property tables, which cannot be moved once the
redistributors have been enabled. Each kernel adds its own reservations
to the list that it finds via the EFI configuration table, and honours
the ones made by its predecessors.
The EFI stub installs a new, empty table unconditionally, replacing any
existing one. This is fine on a cold boot, but not if the stub is being
executed by a loader that passes on the configuration tables of an
earlier kernel, e.g., a kexec loader that runs the incoming kernel's EFI
stub, as the reservations made by earlier kernels would be lost.
So leave an existing table in place, and only install a new one if none
exists yet.
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/efi-stub.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index 874f63b4a3830..adc5d121a33c5 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -73,6 +73,14 @@ static void install_memreserve_table(void)
efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
efi_status_t status;
+ /*
+ * If an earlier boot stage installed a memreserve table already, e.g.,
+ * a kexec loader passing on the persistent reservations made by the
+ * previous kernel, use it as is: installing a new one would replace it.
+ */
+ if (get_efi_config_table(memreserve_table_guid))
+ return;
+
status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
(void **)&rsv);
if (status != EFI_SUCCESS) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 585/869] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 584/869] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 586/869] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded Greg Kroah-Hartman
` (291 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 1d4ce2901f1e25b06d447c0b02d105d6dd3550d8 ]
OUTSIDE_GUEST_MODE indicates to the rest of KVM that the vcpu has
exited. So far, this is set as soon as we return from the notional
hypervisor (which with VHE is just a function call away).
However, code that uses OUTSIDE_GUEST_MODE as a synchronisation point
relies on the vcpu state to have been written back to the in-memory
structures. Clearly, this is not what is happening.
Move the publication of OUTSIDE_GUEST_MODE to the point where the state
is actually written, and give this write release semantics to ensure the
correct ordering.
Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-3-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index b52c162cb380e..ab01b6c961132 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1242,13 +1242,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
smp_store_mb(vcpu->mode, IN_GUEST_MODE);
if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
- vcpu->mode = OUTSIDE_GUEST_MODE;
isb(); /* Ensure work in x_flush_hwstate is committed */
if (kvm_vcpu_has_pmu(vcpu))
kvm_pmu_sync_hwstate(vcpu);
if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
kvm_timer_sync_user(vcpu);
kvm_vgic_sync_hwstate(vcpu);
+ smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
local_irq_enable();
preempt_enable();
continue;
@@ -1264,7 +1264,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
ret = kvm_arm_vcpu_enter_exit(vcpu);
- vcpu->mode = OUTSIDE_GUEST_MODE;
vcpu->stat.exits++;
/*
* Back from guest
@@ -1298,6 +1297,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
kvm_arch_vcpu_ctxsync_fp(vcpu);
+ /*
+ * The state that was pushed into the CPU on entering
+ * the guest has been synchronised back, let's
+ * advertise we're outside of the guest.
+ */
+ smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
+
/*
* We must ensure that any pending interrupts are taken before
* we exit guest timing so that timer ticks are accounted as
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 586/869] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 585/869] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 587/869] KVM: arm64: Turn vcpu->arch.pause into a counter Greg Kroah-Hartman
` (290 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 22b6557ad05bf05c73246f62c19af3e04017270e ]
IN_GUEST_MODE is advertised too late, when state has already been moved
onto CPU registers and cannot be observed by another CPU anymore.
Move the IN_GUEST_MODE publication ahead of the state being loaded, and
immediately check for pending request. This ensures that there is no
window of opportunity for another CPU to observe OUTSIDE_GUEST_MODE and
yet for state to be loaded.
This also simplifies the "state rollback", which solely amounts to
synchronising the timer when no irqchip is present.
Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-4-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arm.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index ab01b6c961132..c8a8d9ce4b14e 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1229,31 +1229,33 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
local_irq_disable();
- kvm_vgic_flush_hwstate(vcpu);
-
- kvm_pmu_update_vcpu_events(vcpu);
-
/*
* Ensure we set mode to IN_GUEST_MODE after we disable
* interrupts and before the final VCPU requests check.
* See the comment in kvm_vcpu_exiting_guest_mode() and
* Documentation/virt/kvm/vcpu-requests.rst
+ *
+ * Requests to self must be posted before this point, or
+ * won't be taken into account until the next exit. No state
+ * loading other than what happens at vcpu_load() time can
+ * be done before we have checked for pending requests.
*/
smp_store_mb(vcpu->mode, IN_GUEST_MODE);
if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
- isb(); /* Ensure work in x_flush_hwstate is committed */
- if (kvm_vcpu_has_pmu(vcpu))
- kvm_pmu_sync_hwstate(vcpu);
if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
kvm_timer_sync_user(vcpu);
- kvm_vgic_sync_hwstate(vcpu);
smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
local_irq_enable();
preempt_enable();
continue;
}
+ /* From here onwards, we are commited to entering the guest */
+ kvm_vgic_flush_hwstate(vcpu);
+
+ kvm_pmu_update_vcpu_events(vcpu);
+
kvm_arch_vcpu_ctxflush_fp(vcpu);
/**************************************************************
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 587/869] KVM: arm64: Turn vcpu->arch.pause into a counter
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 586/869] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 588/869] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer Greg Kroah-Hartman
` (289 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit e64309198eda29415a95113def92aa40196cd422 ]
We have situations where we can call kvm_arm_halt_guest() without
holding config_lock, which means that halt and resume can overlap in
funny ways when called from separate contexts, and result in situations
where a vcpu is resumed while other parts of KVM assume it is halted.
Consequences are left to the imagination of the reader.
Fix this sorry situation by turning kvm_vcpu_arch::pause into an
atomic counter, which makes the races described above harmless.
Fixes: 3b92830ad41b2 ("KVM: arm/arm64: implement kvm_arm_[halt,resume]_guest")
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015100539.1011760-5-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_host.h | 7 +++----
arch/arm64/kvm/arm.c | 21 ++++++++++++---------
2 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 419e37112a6f0..b7334f98deaac 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -833,11 +833,10 @@ struct kvm_vcpu_arch {
/*
* Don't run the guest (internal implementation need).
*
- * Contrary to the flags above, this is set/cleared outside of
- * a vcpu context, and thus cannot be mixed with the flags
- * themselves (or the flag accesses need to be made atomic).
+ * Contrary to the flags above, this is updated outside of
+ * a vcpu context, and thus cannot be mixed with the flags.
*/
- bool pause;
+ atomic_t pause;
/*
* We maintain more than a single set of debug registers to support
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index c8a8d9ce4b14e..4e0db01a528a8 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -500,6 +500,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
kvm_arm_pvtime_vcpu_init(&vcpu->arch);
vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
+ atomic_set(&vcpu->arch.pause, 0);
/*
* This vCPU may have been created after mpidr_data was initialized.
@@ -765,6 +766,11 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
return ret;
}
+static bool vcpu_can_run(struct kvm_vcpu *vcpu)
+{
+ return !kvm_arm_vcpu_stopped(vcpu) && !atomic_read(&vcpu->arch.pause);
+}
+
/**
* kvm_arch_vcpu_runnable - determine if the vcpu can be scheduled
* @v: The VCPU pointer
@@ -780,8 +786,7 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
(kvm_timer_should_notify_user(v) ||
kvm_pmu_should_notify_user(v)));
- return ((irq_lines || kvm_vgic_vcpu_pending_irq(v))
- && !kvm_arm_vcpu_stopped(v) && !v->arch.pause);
+ return ((irq_lines || kvm_vgic_vcpu_pending_irq(v)) && vcpu_can_run(v));
}
bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
@@ -937,7 +942,7 @@ void kvm_arm_halt_guest(struct kvm *kvm)
struct kvm_vcpu *vcpu;
kvm_for_each_vcpu(i, vcpu, kvm)
- vcpu->arch.pause = true;
+ atomic_inc(&vcpu->arch.pause);
kvm_make_all_cpus_request(kvm, KVM_REQ_SLEEP);
}
@@ -947,8 +952,8 @@ void kvm_arm_resume_guest(struct kvm *kvm)
struct kvm_vcpu *vcpu;
kvm_for_each_vcpu(i, vcpu, kvm) {
- vcpu->arch.pause = false;
- __kvm_vcpu_wake_up(vcpu);
+ if (atomic_dec_and_test(&vcpu->arch.pause))
+ __kvm_vcpu_wake_up(vcpu);
}
}
@@ -956,11 +961,9 @@ static void kvm_vcpu_sleep(struct kvm_vcpu *vcpu)
{
struct rcuwait *wait = kvm_arch_vcpu_get_wait(vcpu);
- rcuwait_wait_event(wait,
- (!kvm_arm_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
- TASK_INTERRUPTIBLE);
+ rcuwait_wait_event(wait, vcpu_can_run(vcpu), TASK_INTERRUPTIBLE);
- if (kvm_arm_vcpu_stopped(vcpu) || vcpu->arch.pause) {
+ if (!vcpu_can_run(vcpu)) {
/* Awaken to handle a signal, request we sleep again later. */
kvm_make_request(KVM_REQ_SLEEP, vcpu);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 588/869] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 587/869] KVM: arm64: Turn vcpu->arch.pause into a counter Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 589/869] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Greg Kroah-Hartman
` (288 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit f0be928a41384ea93c876364f360779f70359249 ]
npcm_fiu_uma_read() and npcm_fiu_uma_write() use a 16-byte on-stack
staging buffer (u32 data_reg[4]) and move data_size bytes to or from
it. data_size comes straight from op->data.nbytes, which is supplied
by the SPI MEM operation and is not bounded by the driver:
npcm_fiu_exec_op() only validates op->addr.nbytes, and no
adjust_op_size callback truncates the transfer to the controller FIFO
size.
A SPI MEM operation with addr.nbytes == 0 and data.nbytes > 16
therefore overflows data_reg[] on the kernel stack (write path) or
reads past it (read path), corrupting the stack.
Reject data_size larger than the staging buffer in both UMA helpers
by returning -EOPNOTSUPP, so spi_mem falls back to the generic SPI
message path. The chunked path in npcm_fiu_manualwrite() always passes
at most CHUNK_SIZE bytes, so it is unaffected.
Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Cc: stable@vger.kernel.org # 5.4+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-npcm-fiu-uma-datasize-v1-1-7dee91cadee6@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-npcm-fiu.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
index cccd17f247754..79328ae89fbb7 100644
--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -343,6 +343,10 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
u32 val;
u32 i;
+ /* data_reg holds at most 16 bytes */
+ if (data_size > sizeof(data_reg))
+ return -EOPNOTSUPP;
+
regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
NPCM_FIU_UMA_CTS_DEV_NUM,
(spi_get_chipselect(mem->spi, 0) <<
@@ -398,6 +402,10 @@ static int npcm_fiu_uma_write(struct spi_mem *mem,
u32 val;
u32 i;
+ /* data_reg holds at most 16 bytes */
+ if (data_size > sizeof(data_reg))
+ return -EOPNOTSUPP;
+
regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
NPCM_FIU_UMA_CTS_DEV_NUM,
(spi_get_chipselect(mem->spi, 0) <<
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 589/869] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 588/869] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 590/869] mfd: tps65217: Check return value when masking interrupt sources Greg Kroah-Hartman
` (287 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Andreas Kemnade,
Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit 0473a5b0663663b75573bf284beb77459e07c461 ]
tps65217_probe() ignores the return value of tps65217_irq_init(), so
when the irq domain creation fails the probe still completes and the
driver ends up bound with a NULL tps->irq_domain. Unloading the
module then makes tps65217_remove() call irq_domain_remove() on the
NULL pointer and oops the kernel. On top of that, irq_find_mapping()
may fall back to the default irq domain and dispose of mappings that
belong to other interrupt controllers.
Check the return value and abort the probe on failure so the error
is reported and no inconsistent state is left for removal.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20261002113624.178588-2-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede76..2d04d9e0ae29c 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -333,7 +333,9 @@ static int tps65217_probe(struct i2c_client *client)
}
if (client->irq) {
- tps65217_irq_init(tps, client->irq);
+ ret = tps65217_irq_init(tps, client->irq);
+ if (ret)
+ return ret;
} else {
int i;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 590/869] mfd: tps65217: Check return value when masking interrupt sources
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 589/869] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 591/869] mfd: tps65217: Use devres for IRQ domain and wake teardown Greg Kroah-Hartman
` (286 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit 66ed12c1e5a986bee1dc63f9bd9c7f068138a69a ]
tps65217_irq_init() ignores the error returned by
tps65217_set_bits() when masking all interrupt sources. A failed
register write leaves the driver's software mask out of sync with the
hardware and may result in spurious interrupts.
Check the return value and propagate the error to the caller.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-3-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 2d04d9e0ae29c..ee640e3fcf7b4 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -155,8 +155,12 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
/* Mask all interrupt sources */
tps->irq_mask = TPS65217_INT_MASK;
- tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
- TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+ ret = tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
+ TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+ if (ret) {
+ dev_err(tps->dev, "Failed to mask interrupt sources: %d\n", ret);
+ return ret;
+ }
tps->irq_domain = irq_domain_create_linear(dev_fwnode(tps->dev), TPS65217_NUM_IRQ,
&tps65217_irq_domain_ops, tps);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 591/869] mfd: tps65217: Use devres for IRQ domain and wake teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 590/869] mfd: tps65217: Check return value when masking interrupt sources Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 592/869] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue Greg Kroah-Hartman
` (285 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit cffd44d2d89524e2dda6adc7b0dd59363be1c8e6 ]
Removing the parent device used to tear the IRQ domain down in
tps65217_remove() before the MFD children are unbound: the i2c core
only releases the parent's devres after the remove callback returns,
whereas devm_mfd_add_devices() registered its own devres action which
unbinds the children. Children that requested interrupts from the
domain (e.g. tps65217-charger) therefore call free_irq() on virtual
IRQs whose descriptors have already been disposed. With
CONFIG_SPARSE_IRQ free_irq() then returns early without stopping the
threaded handler, leaking the irqaction, the IRQ kthread and a module
reference.
Register the domain teardown as a devres action right after the domain
is created instead. Devres actions are released in reverse order of
registration, so the MFD children release their IRQs first, then the
parent interrupt is freed and its thread stopped, and only then is the
domain torn down. The same ordering covers probe failure, which no
longer needs manual cleanup, and the remove callback can be dropped
entirely.
Balance the enable_irq_wake() in tps65217_irq_init() by registering
disable_irq_wake() as a devres action as well. Only do so when
enabling actually succeeded, since the parent chip may not support
setting wake-up.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-4-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 57 +++++++++++++++++++++++++++++-------------
1 file changed, 39 insertions(+), 18 deletions(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index ee640e3fcf7b4..569c28c8b20f5 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -146,6 +146,31 @@ static const struct irq_domain_ops tps65217_irq_domain_ops = {
.map = tps65217_irq_map,
};
+static void tps65217_irq_cleanup(void *data)
+{
+ struct tps65217 *tps = data;
+ unsigned int virq;
+
+ if (!tps->irq_domain)
+ return;
+
+ for (int i = 0; i < TPS65217_NUM_IRQ; i++) {
+ virq = irq_find_mapping(tps->irq_domain, i);
+ if (virq)
+ irq_dispose_mapping(virq);
+ }
+
+ irq_domain_remove(tps->irq_domain);
+ tps->irq_domain = NULL;
+}
+
+static void tps65217_irq_wake_disable(void *data)
+{
+ unsigned long irq = (unsigned long)data;
+
+ disable_irq_wake(irq);
+}
+
static int tps65217_irq_init(struct tps65217 *tps, int irq)
{
int ret;
@@ -169,6 +194,10 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
return -ENOMEM;
}
+ ret = devm_add_action_or_reset(tps->dev, tps65217_irq_cleanup, tps);
+ if (ret)
+ return ret;
+
ret = devm_request_threaded_irq(tps->dev, irq, NULL,
tps65217_irq_thread, IRQF_ONESHOT,
"tps65217-irq", tps);
@@ -178,7 +207,16 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
return ret;
}
- enable_irq_wake(irq);
+ ret = enable_irq_wake(irq);
+ if (ret) {
+ dev_warn(tps->dev, "failed to enable IRQ wake: %d\n", ret);
+ return 0;
+ }
+
+ ret = devm_add_action_or_reset(tps->dev, tps65217_irq_wake_disable,
+ (void *)(unsigned long)irq);
+ if (ret)
+ return ret;
return 0;
}
@@ -379,22 +417,6 @@ static int tps65217_probe(struct i2c_client *client)
return 0;
}
-static void tps65217_remove(struct i2c_client *client)
-{
- struct tps65217 *tps = i2c_get_clientdata(client);
- unsigned int virq;
- int i;
-
- for (i = 0; i < TPS65217_NUM_IRQ; i++) {
- virq = irq_find_mapping(tps->irq_domain, i);
- if (virq)
- irq_dispose_mapping(virq);
- }
-
- irq_domain_remove(tps->irq_domain);
- tps->irq_domain = NULL;
-}
-
static const struct i2c_device_id tps65217_id_table[] = {
{"tps65217", TPS65217},
{ /* sentinel */ }
@@ -408,7 +430,6 @@ static struct i2c_driver tps65217_driver = {
},
.id_table = tps65217_id_table,
.probe = tps65217_probe,
- .remove = tps65217_remove,
};
static int __init tps65217_init(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 592/869] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 591/869] mfd: tps65217: Use devres for IRQ domain and wake teardown Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 593/869] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op Greg Kroah-Hartman
` (284 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladyslav Tymoshchuk,
Srinivas Kandagatla, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladyslav Tymoshchuk <tvlad744@gmail.com>
[ Upstream commit 0337b8129cf676b8eb767b2a1f312955760a5460 ]
On every prepare in queue mode, q6apm_dai_prepare() frees and allocates
the fragments again, and q6apm_alloc_fragments() resets dsp_buf, so the
first buffer queued after it is the first one of the ring. The hw
pointer that q6apm_dai_pointer() reports is left as it was.
q6apm-dai used to keep its own position and cleared it in prepare.
Since commit a93dad6f4e6a ("ASoC: q6apm-dai: make use of
q6apm_get_hw_pointer") the position comes from the hw pointer, so a
stream that is prepared again, e.g. to recover from an xrun, reports
the position of the previous run until the DSP returns its first
buffer, while ALSA has reset its own pointer to 0.
Reset the hw pointer together with dsp_buf.
Fixes: a93dad6f4e6a ("ASoC: q6apm-dai: make use of q6apm_get_hw_pointer")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261014162703.10172-3-tvlad744@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6apm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 9122876e00a2a..50d5d2143daaf 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -223,6 +223,7 @@ int q6apm_map_memory_regions(struct q6apm_graph *graph, unsigned int dir, phys_a
mutex_lock(&graph->lock);
data->dsp_buf = 0;
+ atomic_set(&data->hw_ptr, 0);
if (data->buf) {
mutex_unlock(&graph->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 593/869] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 592/869] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 594/869] PCI/PM: Restore BARs after powering up during enumeration Greg Kroah-Hartman
` (283 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 9e44f0df3fff215d9033089e85980048c3ac132a ]
bcm_qspi_mspi_exec_mem_op() builds a local command buffer cmd[6]
holding one opcode byte, up to four address bytes and one spare
byte, and sets t[0].len = op->addr.nbytes + op->dummy.nbytes + 1.
bcm_qspi_exec_mem_op() only validates op->addr.nbytes <= 4 and never
bounds op->dummy.nbytes, which spi_mem_check_op() also leaves
unrestricted. With addr.nbytes = 4 and dummy.nbytes >= 2 the length
becomes 7 or more, so write_to_hw() reads past cmd[] on the kernel
stack and pushes the leaked bytes into the hardware TXRAM.
Reject operations whose dummy phase does not fit the remaining byte
of cmd[] by requiring op->dummy.nbytes <= 1, so such transfers fall
back to the generic SPI path instead of overrunning the buffer.
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 5f195ee7d830c ("spi: bcm-qspi: Implement the spi_mem interface")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-bcm-qspi-dummy-bytes-v1-1-c319da3c2497@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm-qspi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index ae5545be0a45c..de333a4a3200d 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1197,8 +1197,9 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
u32 addr = 0, len;
u_char *buf;
+ /* cmd[] holds 1 opcode + 4 address + 1 dummy byte at most */
if (!op->data.nbytes || !op->addr.nbytes || op->addr.nbytes > 4 ||
- op->data.dir != SPI_MEM_DATA_IN)
+ op->dummy.nbytes > 1 || op->data.dir != SPI_MEM_DATA_IN)
return -EOPNOTSUPP;
buf = op->data.buf.in;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 594/869] PCI/PM: Restore BARs after powering up during enumeration
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 593/869] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 595/869] spi: amd: fix len==0 underflow and FIFO overflow Greg Kroah-Hartman
` (282 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Rafael J. Wysocki,
Keng-Yu Lin, Bjorn Helgaas, Desnes Nunes, Sasha Levin,
Mario Limonciello (AMD)
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keng-Yu Lin <keng-yu.lin@hpe.com>
[ Upstream commit f043083843cac1105206437d8c58e725b6412fad ]
Commit 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when
initializing") added pci_pm_power_up_and_verify_state() to pci_pm_init().
The helper ignores pci_power_up()'s return value indicating that BARs need
restoring. Its resume callers restore saved configuration afterwards;
pci_pm_init() does not.
D3hot-to-D0 may reset a device and lose its BARs (PCI PM 1.2, sec 5.4.1).
After enumeration powers it up, pci_enable_device() reads D0 and skips the
full power-up path. Previously, a device still in D3hot at enable time took
that path, including BAR restoration.
On AMD Venice SP7, two AMD xHCI controllers [1022:17d2] are in runtime
D3hot with No_Soft_Reset clear before kdump. Diagnostic reads on
v7.3-rc6-37 show the following for 0000:01:00.4 in the crash kernel:
PMCSR BAR0
before the platform power call 0003 f4100004
after the platform power call 0003 f4100004
after native D0 power-up 0000 00000004
The upper BAR DWORD stays zero. pci_power_up() returns 1, but the BAR
address remains zero while dev->resource[0] still contains 0xf4100000.
Without BAR restoration, the crash kernel hangs during boot. The last
console output includes:
pci 0000:01:00.4: enabling device (0000 -> 0002)
Restoring both controllers' BARs gives matching readbacks and allows kdump
to save a vmcore and reboot. An AMD Turin xHCI [1022:1557] shows the same
BAR loss; restoring its BAR also allows kdump to complete.
Read the initial power state first. Otherwise, pci_power_up() may request a
BAR restore based on a cached PCI_UNKNOWN state, even when the device is
already in D0.
For devices already in D0, only synchronize the platform state so
that ACPI calls such as _REG still run. For other states, use
pci_set_full_power_state() to power up the device and restore BARs
when needed.
Fixes: 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing")
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/CAJZ5v0ie2AvCbdv8-zkpYzHLcTwUPUj+=WWOQjDAPmSepSAQPg@mail.gmail.com/
Signed-off-by: Keng-Yu Lin <keng-yu.lin@hpe.com>
[bhelgaas: shorten comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Reviewed-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015020811.1132314-1-keng-yu.lin@hpe.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 8cfcd71163031..25720f28518ad 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3242,7 +3242,15 @@ void pci_pm_init(struct pci_dev *dev)
}
poweron:
- pci_pm_power_up_and_verify_state(dev);
+ pci_update_current_state(dev, PCI_UNKNOWN);
+ if (dev->current_state == PCI_D0) {
+ /* No need for full power-up, just sync-up platform state */
+ platform_pci_set_power_state(dev, PCI_D0);
+ } else {
+ /* Power up the device and restore BARs if necessary */
+ pci_set_full_power_state(dev, false);
+ }
+ pci_update_current_state(dev, PCI_D0);
pm_runtime_forbid(&dev->dev);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 595/869] spi: amd: fix len==0 underflow and FIFO overflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 594/869] PCI/PM: Restore BARs after powering up during enumeration Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 596/869] erofs: use on-disk blkszbits for lz4 max pcluster bound Greg Kroah-Hartman
` (281 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit e2f4edfc061e493fddde16c4bbe1c4f230f41e4a ]
amd_spi_fifo_xfer() unconditionally decrements xfer->len when a tx_buf
is present. The SPI core does not reject zero-length transfers, so a
transfer submitted through the SPI_IOC_MESSAGE ioctl with len == 0 and
a tx_buf makes the u32 len wrap to 0xFFFFFFFF, and the following
per-byte loop writes far past the FIFO window.
The driver also never checks the cumulative FIFO offset against
AMD_SPI_FIFO_SIZE. The core splits each transfer down to the
controller's max transfer size but does not bound the total message
length, so a message of several transfers whose total exceeds the FIFO
overflows it with out-of-bounds MMIO writes (tx) and reads (rx).
Skip zero-length transfers and reject any transfer that would run past
the end of the FIFO window.
Tested with a user-space replica of the fifo_xfer length arithmetic
(ASAN build): a zero-length transfer with tx_buf makes len-- wrap to
0xffffffff, and skipping zero-length transfers avoids the wrap. No AMD
SPI hardware was available, so the FIFO bound check was verified by
inspection against AMD_SPI_FIFO_SIZE.
Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support")
Cc: stable@vger.kernel.org # 5.8+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-amd-fifo-fix-v1-1-9fec9ab753e8@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-amd.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
index 71a6e5c475b03..ddf89e5353c55 100644
--- a/drivers/spi/spi-amd.c
+++ b/drivers/spi/spi-amd.c
@@ -322,11 +322,22 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
list_for_each_entry(xfer, &message->transfers,
transfer_list) {
+ /* Skip zero-length transfers to avoid len underflow below */
+ if (!xfer->len)
+ continue;
+
if (xfer->speed_hz)
amd_set_spi_freq(amd_spi, xfer->speed_hz);
else
amd_set_spi_freq(amd_spi, spi->max_speed_hz);
+ /* Reject transfers that would overflow the FIFO window */
+ if (fifo_pos + xfer->len >
+ AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+ message->status = -EMSGSIZE;
+ goto fin_msg;
+ }
+
if (xfer->tx_buf) {
buf = (u8 *)xfer->tx_buf;
if (!tx_len) {
@@ -369,6 +380,12 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
list_for_each_entry(xfer, &message->transfers, transfer_list)
if (xfer->rx_buf) {
+ /* Reject transfers that would overflow the FIFO window */
+ if (fifo_pos + xfer->len >
+ AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+ message->status = -EMSGSIZE;
+ goto fin_msg;
+ }
buf = (u8 *)xfer->rx_buf;
/* Read data from FIFO to receive buffer */
for (i = 0; i < xfer->len; i++)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 596/869] erofs: use on-disk blkszbits for lz4 max pcluster bound
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 595/869] spi: amd: fix len==0 underflow and FIFO overflow Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 597/869] ring-buffer: Take cpus_read_lock() when changing the subbuf order Greg Kroah-Hartman
` (280 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gyokhan Kochmarla, Gao Xiang,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gyokhan Kochmarla <gyokhan@amazon.de>
[ Upstream commit 90b7e4a7a16443d9f6807b5c1dde52074d9f74c0 ]
z_erofs_load_lz4_config() rejects a valid LZ4 image when the kernel's
page size differs from the image's block size. It bounds the on-disk
max_pclusterblks with erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE), which
expands to Z_EROFS_PCLUSTER_MAX_SIZE >> sb->s_blocksize_bits.
At the point this runs, sb->s_blocksize_bits still holds PAGE_SHIFT:
erofs_fc_fill_super() seeds s_blocksize_bits to PAGE_SHIFT before
reading the superblock, and only corrects it down to the on-disk
blkszbits after erofs_read_superblock() returns. The LZ4 config is
parsed inside erofs_read_superblock(), before that correction, so the
bound is computed with the wrong shift.
On a 64K-page kernel mounting a 4K-block image (e.g. one built with
mkfs.erofs -C 262144 on a 4K-page host), the bound evaluates to
1 MiB >> 16 = 16 blocks instead of the correct 1 MiB >> 12 = 256
blocks. The image's legitimate max_pclusterblks of 64 then fails the
check, mount returns -EINVAL, and booting from such an image as the
root filesystem panics:
erofs (device dm-0): too large lz4 pclusterblks 64
Kernel panic - not syncing: VFS: Unable to mount root fs
sbi->blkszbits already holds the on-disk block size at this point, so
compute the bound from it directly. This makes the check independent of
the host page size and of superblock-parse ordering.
commit 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block
support") already handled the same ordering hazard for the superblock
checksum path by using sbi->blkszbits in erofs_superblock_csum_verify();
the lz4 config path was missed.
Fixes: 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block support")
Cc: stable@vger.kernel.org
Assisted-by: Kirocrew:gpt-5.6-sol
Signed-off-by: Gyokhan Kochmarla <gyokhan@amazon.de>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/decompressor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 48a0c84cec755..858fe65ba84d0 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -23,7 +23,7 @@ static int z_erofs_load_lz4_config(struct super_block *sb,
if (!sbi->lz4.max_pclusterblks) {
sbi->lz4.max_pclusterblks = 1; /* reserved case */
} else if (sbi->lz4.max_pclusterblks >
- erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE)) {
+ Z_EROFS_PCLUSTER_MAX_SIZE >> sbi->blkszbits) {
erofs_err(sb, "too large lz4 pclusterblks %u",
sbi->lz4.max_pclusterblks);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 597/869] ring-buffer: Take cpus_read_lock() when changing the subbuf order
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 596/869] erofs: use on-disk blkszbits for lz4 max pcluster bound Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 598/869] dax: Return errors from dax_core_init() Greg Kroah-Hartman
` (279 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Vincent Donnefort,
Steven Rostedt, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 453d0f47b174cac387af48d303c503b84f82212e ]
A CPU coming online for the first time gets its per CPU buffer allocated
by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that
happens while ring_buffer_subbuf_order_set() is running, the CPU shows up
after the allocation loop and the install loop walks it with an empty
new_pages list, corrupting the buffer.
Take cpus_read_lock() as ring_buffer_resize() does.
Cc: stable@vger.kernel.org
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index f74acc78866d8..dcb762664ce73 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7004,6 +7004,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
+ guard(cpus_read_lock)();
+
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 598/869] dax: Return errors from dax_core_init()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 597/869] ring-buffer: Take cpus_read_lock() when changing the subbuf order Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 599/869] dax: fix dax_range_compare_iter() to use correct size and address offset Greg Kroah-Hartman
` (278 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Gregory Price (Meta),
Dave Jiang, Alison Schofield, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit 4da700e2cadf84a6e858391d5be51d64dcba080f ]
dax_core_init() returns success when either the character device
number allocation or DAX bus registration fails, even though the
error paths have already released the initialized resources.
For modular DAX, this allows the module to remain loaded despite
failed initialization, leaving subsequent users and module removal
to access resources that have already been released.
Return the error code from the failed operation so that module
loading fails rather than reporting successful initialization
after the resources have been released.
Fixes: 9567da0b408a ("device-dax: Introduce bus + driver model")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261012151857.22534-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index efa5f61860190..9b46166fd2148 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -601,7 +601,7 @@ static int __init dax_core_init(void)
unregister_chrdev_region(dax_devt, MINORMASK+1);
err_chrdev:
dax_fs_exit();
- return 0;
+ return rc;
}
static void __exit dax_core_exit(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 599/869] dax: fix dax_range_compare_iter() to use correct size and address offset
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 598/869] dax: Return errors from dax_core_init() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 600/869] ublk: reset the FETCH round in release also without a disk Greg Kroah-Hartman
` (277 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Jan Kara,
Alison Schofield, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit a4bfbfb4e98a62b589ac7ca9e73e9612bfe8cab7 ]
dax_range_compare_iter() has two bugs in how it calls
dax_iomap_direct_access() and uses the returned addresses:
1. The size argument passed to dax_iomap_direct_access() is
ALIGN(pos + len, PAGE_SIZE), which is an absolute file offset
rather than a length. This causes the underlying dax_direct_access()
to request a massively inflated nr_pages via PHYS_PFN(size).
2. The addresses returned by dax_iomap_direct_access() are page-aligned
starting addresses, but memcmp() compares from saddr/daddr directly
without adding the page-in-page offset of pos1/pos2. When pos1/pos2
are not page-aligned, this compares the wrong data.
Fix the size by computing ALIGN(len + offset_in_page(pos), PAGE_SIZE),
matching the pattern used in dax_iomap_copy_around(). Fix the address
by adding offset_in_page(pos1)/offset_in_page(pos2) to saddr/daddr in
the memcmp() call.
Fixes: 6f7db3894ae2 ("fsdax: dedup file range to use a compare function")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261011064840.1296-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dax.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/dax.c b/fs/dax.c
index 69ac2562cec31..155f8024b30df 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2168,6 +2168,7 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
loff_t pos1 = it_src->pos, pos2 = it_dest->pos;
u64 dest_len;
void *saddr, *daddr;
+ size_t size1, size2;
int id, ret;
len = min(len, min(smap->length, dmap->length));
@@ -2183,17 +2184,18 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
}
id = dax_read_lock();
- ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE),
- &saddr, NULL);
+ size1 = ALIGN(len + offset_in_page(pos1), PAGE_SIZE);
+ ret = dax_iomap_direct_access(smap, pos1, size1, &saddr, NULL);
if (ret < 0)
goto out_unlock;
- ret = dax_iomap_direct_access(dmap, pos2, ALIGN(pos2 + len, PAGE_SIZE),
- &daddr, NULL);
+ size2 = ALIGN(len + offset_in_page(pos2), PAGE_SIZE);
+ ret = dax_iomap_direct_access(dmap, pos2, size2, &daddr, NULL);
if (ret < 0)
goto out_unlock;
- *same = !memcmp(saddr, daddr, len);
+ *same = !memcmp(saddr + offset_in_page(pos1),
+ daddr + offset_in_page(pos2), len);
if (!*same)
len = 0;
dax_read_unlock(id);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 600/869] ublk: reset the FETCH round in release also without a disk
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 599/869] dax: fix dax_range_compare_iter() to use correct size and address offset Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 601/869] ublk: reset the FETCH round under ub->mutex Greg Kroah-Hartman
` (276 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit f06ca594eafcdf58a399a0f92480631192e06032 ]
The release of /dev/ublkcN resets the queues only when the device has a
disk. Without one it skips ublk_reset_ch_dev():
server fetches, never starts; old server exits
or STOP_DEV removed the disk release: no disk → skip reset
ios stay ACTIVE / CANCELED,
nr_io_ready stays full
new server opens /dev/ublkcN FETCH: -EBUSY (still ready), or
-EINVAL after a partial round
→ the device can only be deleted
All uring_cmds are done when the release work runs, with or without a
disk, so the reset is safe either way. Do it in both cases. Then a new
server can fetch and start the device again, as the STOP_DEV entry in
Documentation/block/ublk.rst says ("ublk device is ready for the new
process").
Fixes: 82a8a30c581b ("ublk: improve detection and handling of ublk server exit")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-5-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index f44512ed12176..f85d66cee9c3a 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1761,12 +1761,13 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
}
/*
- * disk isn't attached yet, either device isn't live, or it has
- * been removed already, so we needn't to do anything
+ * No disk: the device isn't live, or it has been removed already.
+ * There are no requests to abort, but the round still has to be
+ * reset, so that a new server can fetch and start the device.
*/
disk = ublk_get_disk(ub);
if (!disk)
- goto out;
+ goto reset;
/*
* All uring_cmd are done now, so abort any request outstanding to
@@ -1827,10 +1828,9 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
unlock:
mutex_unlock(&ub->mutex);
ublk_put_disk(disk);
-
+reset:
/* all uring_cmd has been done now, reset device & ubq */
ublk_reset_ch_dev(ub);
-out:
clear_bit(UB_STATE_OPEN, &ub->state);
/* put the reference grabbed in ublk_ch_release() */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 601/869] ublk: reset the FETCH round under ub->mutex
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 600/869] ublk: reset the FETCH round in release also without a disk Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 602/869] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev() Greg Kroah-Hartman
` (275 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit 84824afdb5a4dc127fbd7036142d7611c5e53651 ]
The release work resets the FETCH round without ub->mutex, while
START_DEV checks it under ub->mutex:
START_DEV (ub->mutex) release work
all queues ready? yes
ublksrv_tgid matches? yes
ublk_reset_ch_dev():
io->cmd = NULL, nr_queue_ready = 0
go live: a request then reaches ublk_queue_cmd() with a NULL io->cmd
Do the reset under ub->mutex. Then START_DEV sees the round either ready
or reset. The work already takes ub->mutex when there is a disk, after
it has aborted the requests; nothing holding ub->mutex waits for it.
Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-6-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index f85d66cee9c3a..c9109731d29ba 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1766,8 +1766,10 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
* reset, so that a new server can fetch and start the device.
*/
disk = ublk_get_disk(ub);
- if (!disk)
+ if (!disk) {
+ mutex_lock(&ub->mutex);
goto reset;
+ }
/*
* All uring_cmd are done now, so abort any request outstanding to
@@ -1799,7 +1801,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
/* double check after grabbing lock */
if (!ub->ub_disk)
- goto unlock;
+ goto reset;
/*
* Transition the device to the nosrv state. What exactly this
@@ -1825,12 +1827,14 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
WRITE_ONCE(ublk_get_queue(ub, i)->fail_io, true);
}
}
-unlock:
- mutex_unlock(&ub->mutex);
- ublk_put_disk(disk);
reset:
- /* all uring_cmd has been done now, reset device & ubq */
+ /*
+ * All uring_cmd has been done now, reset device & ubq. Under
+ * ub->mutex, so START_DEV sees the round either ready or reset.
+ */
ublk_reset_ch_dev(ub);
+ mutex_unlock(&ub->mutex);
+ ublk_put_disk(disk);
clear_bit(UB_STATE_OPEN, &ub->state);
/* put the reference grabbed in ublk_ch_release() */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 602/869] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 601/869] ublk: reset the FETCH round under ub->mutex Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 603/869] ipv6: defrag: orphan skb before queuing Greg Kroah-Hartman
` (274 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 56453199d28f0072a8196fba14b2d702632e2219 ]
skb_copy_and_csum_dev() copies everything up to the checksum start out
of the linear area, and BUG()s if the checksum start is past the end of
the linear area. It misses the other direction: a CHECKSUM_PARTIAL skb
that has been pulled past its csum_start gives a negative offset, which
gets past the check and becomes a ~4GB copy. It also trusts
csum_offset when it stores the folded checksum. So far
skb_copy_and_csum_bits() BUG()ing on a short skb has covered for that,
but once it returns instead, a bad csum_offset would write past the end
of the caller's buffer.
The function returns void and its callers are drivers copying a frame
into a bounce buffer just before handing it to the hardware. There's
nothing for them to back out of, so check both ends of csum_start and
that the checksum field fits in the frame, and if not, copy the whole
frame with skb_copy_bits() without filling in the checksum, with a
DEBUG_NET_WARN_ON_ONCE() for debug kernels. The frame
goes out with a bad checksum and is dropped by the receiver. If even
that copy fails, zero the buffer so the driver doesn't send stale bytes.
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Cc: stable? The trailers only have Assisted-by: and Signed-off-by:. No
Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-5-b9a5f732895b@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1808bed195af1..227c889fba578 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3899,7 +3899,18 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
else
csstart = skb_headlen(skb);
- BUG_ON(csstart > skb_headlen(skb));
+ if (unlikely(csstart < 0 || csstart > skb_headlen(skb) ||
+ (skb->ip_summed == CHECKSUM_PARTIAL &&
+ csstart + skb->csum_offset + sizeof(__sum16) >
+ skb->len))) {
+ DEBUG_NET_WARN_ON_ONCE(1);
+ /* Send the frame without the checksum filled in, or send
+ * zeroes if we can't even copy it.
+ */
+ if (skb_copy_bits(skb, 0, to, skb->len))
+ memset(to, 0, skb->len);
+ return;
+ }
skb_copy_from_linear_data(skb, to, csstart);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 603/869] ipv6: defrag: orphan skb before queuing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 602/869] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 604/869] sctp: hold transport reference across connect wait Greg Kroah-Hartman
` (273 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Eric Dumazet,
Fernando Fernandez Mancera, Zixuan Chai, Ren Wei, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zixuan Chai <petalzu987@gmail.com>
[ Upstream commit 5dfa91a5ec53cfbf907a1fca095ac3ac7a4e94c9 ]
IPv4 and nf_conntrack fragment queues orphan skbs before returning
-EINPROGRESS, but ip6_frag_queue() leaves the socket association intact.
Commit 18685451fc4e ("inet: inet_defrag: prevent sk release while still in
use") moved skb_orphan() into ip_frag_queue() and nf_ct_frag6_queue(), but
missed ip6_frag_queue().
Without orphaning, inet_frag_reasm_finish() clears fp->sk on frag_list
skbs but leaves fp->destructor set to sock_pfree. Freeing the reassembled
skb then calls sock_pfree() with a NULL socket. A socket using
SOCK_RCU_FREE may also be released while its fragment is queued, leaving a
stale socket pointer; this is a second consequence of the same missing
orphan.
Orphan the skb before returning -EINPROGRESS so the queued fragment no
longer retains the socket association or destructor.
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Link: https://patch.msgid.link/5c396b7011168cd98b9812df4d6bbd00a96048e7.1791008591.git.petalzu987@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/reassembly.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 25ec8001898df..c10a8a9d607e8 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -227,6 +227,7 @@ static int ip6_frag_queue(struct net *net,
}
skb_dst_drop(skb);
+ skb_orphan(skb);
return -EINPROGRESS;
insert_error:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 604/869] sctp: hold transport reference across connect wait
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 603/869] ipv6: defrag: orphan skb before queuing Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 605/869] RDS/IB: validate receive fragment completions Greg Kroah-Hartman
` (272 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Seung Min Shin,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seung Min Shin <guncraft2000@naver.com>
[ Upstream commit 5bef8649bb9ac4b2a014bcc227202ebd2df824be ]
sctp_sendmsg_to_asoc() selects a transport before waiting for a new
interleaved association to become established. sctp_wait_for_connect()
drops the socket lock while sleeping.
While the lock is dropped, backlog processing can handle a COOKIE ACK and
an ASCONF DEL-IP that removes the selected transport. sctp_assoc_rm_peer()
then marks the transport dead and drops its association-owned reference.
The transport can be freed through RCU before the send path resumes.
After the wait, the stale pointer is assigned to newly created DATA or
I-DATA chunks and later dereferenced by sctp_outq_select_transport().
Hold a reference to the selected transport across
sctp_wait_for_connect(). After the socket lock is reacquired, abort the
send if the transport was marked dead. Callers without a selected
transport pass NULL and retain their existing behavior.
Cc: stable@vger.kernel.org
Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Seung Min Shin <guncraft2000@naver.com>
Link: https://patch.msgid.link/20261011162750.1529631-1-guncraft2000@naver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 03588ac5c382c..8c9970352952e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -75,7 +75,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc,
struct sctp_transport *transport,
long *timeo_p, size_t msg_len);
static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
-static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
+static int sctp_wait_for_connect(struct sctp_association *,
+ struct sctp_transport *, long *timeo_p);
static int sctp_wait_for_accept(struct sock *sk, long timeo);
static void sctp_wait_for_close(struct sock *sk, long timeo);
static void sctp_destruct_sock(struct sock *sk);
@@ -1244,7 +1245,7 @@ static int __sctp_connect(struct sock *sk, struct sockaddr *kaddrs,
*assoc_id = asoc->assoc_id;
timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
- return sctp_wait_for_connect(asoc, &timeo);
+ return sctp_wait_for_connect(asoc, NULL, &timeo);
out_free:
pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
@@ -1846,7 +1847,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
if (asoc->ep->intl_enable) {
timeo = sock_sndtimeo(sk, 0);
- err = sctp_wait_for_connect(asoc, &timeo);
+ err = sctp_wait_for_connect(asoc, transport, &timeo);
if (err || sk->sk_shutdown & RCV_SHUTDOWN) {
err = -ESRCH;
goto err;
@@ -1889,7 +1890,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
if (unlikely(wait_connect)) {
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
- sctp_wait_for_connect(asoc, &timeo);
+ sctp_wait_for_connect(asoc, NULL, &timeo);
}
err = msg_len;
@@ -9337,7 +9338,9 @@ static bool sctp_writeable(const struct sock *sk)
/* Wait for an association to go into ESTABLISHED state. If timeout is 0,
* returns immediately with EINPROGRESS.
*/
-static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
+static int sctp_wait_for_connect(struct sctp_association *asoc,
+ struct sctp_transport *transport,
+ long *timeo_p)
{
struct sock *sk = asoc->base.sk;
int err = 0;
@@ -9346,12 +9349,16 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
- /* Increment the association's refcnt. */
+ /* Hold references while the socket lock is dropped. */
+ if (transport)
+ sctp_transport_hold(transport);
sctp_association_hold(asoc);
for (;;) {
prepare_to_wait_exclusive(&asoc->wait, &wait,
TASK_INTERRUPTIBLE);
+ if (transport && transport->dead)
+ goto do_transport_dead;
if (!*timeo_p)
goto do_nonblock;
if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -9380,7 +9387,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
out:
finish_wait(&asoc->wait, &wait);
- /* Release the association's refcnt. */
+ if (transport)
+ sctp_transport_put(transport);
sctp_association_put(asoc);
return err;
@@ -9399,6 +9407,10 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
do_nonblock:
err = -EINPROGRESS;
goto out;
+
+do_transport_dead:
+ err = -EAGAIN;
+ goto out;
}
static int sctp_wait_for_accept(struct sock *sk, long timeo)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 605/869] RDS/IB: validate receive fragment completions
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 604/869] sctp: hold transport reference across connect wait Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 606/869] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 Greg Kroah-Hartman
` (271 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sungbyeongchan, Giovanni Vignone,
Robert van Eijk, Paolo Gentry, Shubham Antil, Allison Henderson,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Antil <shubham@octane.security>
[ Upstream commit 65cf6863606b0507a7c3bd1711317e4f5d6b8b7e ]
rds_ib_process_recv() accounts every receive fragment as contributing
min(i_recv_data_rem, RDS_FRAG_SIZE) bytes, regardless of the completion
length. When a completion is shorter than the header-declared amount,
receive accounting can advance beyond the payload supplied by the
completion.
Only an IB_WC_RECV completion has the buffer layout expected by this
receive path. Other successful completion opcodes must not be interpreted
as ordinary receive completions.
Reject successful completions with any other opcode before processing
their length. For ordinary receive completions, require enough payload
to cover the amount accounted to the fragment before linking its page
into the incoming message.
This is compatible with the current transmit paths. MSG_ZEROCOPY is
restricted to RDS/TCP, while RDS/IB copied and page-vector messages use
full-sized non-final scatterlist entries.
Found during an LLM-assisted source audit and validated under KMSAN with
a malformed short receive completion.
Reported-by: sungbyeongchan <tjdqudcks0424@naver.com>
Closes: https://lore.kernel.org/netdev/20261006205204.1322102-1-tjdqudcks0424@naver.com/
Reported-by: Giovanni Vignone <gio@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Robert van Eijk <robert@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Paolo Gentry <paolo@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
Cc: stable@vger.kernel.org
Signed-off-by: Shubham Antil <shubham@octane.security>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20261013025729.40815-1-shubham@octane.security
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_recv.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 0b52e060988d5..ad4ff441bc983 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -949,6 +949,12 @@ static void rds_ib_process_recv(struct rds_connection *conn,
}
}
+ if (data_len < min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)) {
+ rds_ib_conn_error(conn,
+ "fragment shorter than header-declared length; forcing reconnect\n");
+ goto done;
+ }
+
list_add_tail(&recv->r_frag->f_item, &ibinc->ii_frags);
recv->r_frag = NULL;
@@ -1004,7 +1010,12 @@ void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
* event is processed.
*/
if (wc->status == IB_WC_SUCCESS) {
- rds_ib_process_recv(conn, recv, wc->byte_len, state);
+ if (wc->opcode != IB_WC_RECV)
+ rds_ib_conn_error(conn,
+ "recv completion had unexpected opcode %u, disconnecting and reconnecting\n",
+ wc->opcode);
+ else
+ rds_ib_process_recv(conn, recv, wc->byte_len, state);
} else {
/* We expect errors as the qp is drained during shutdown */
if (rds_conn_up(conn) || rds_conn_connecting(conn))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 606/869] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 605/869] RDS/IB: validate receive fragment completions Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 607/869] cpufreq: loongson3: Adjust the width of id and val in smc_message Greg Kroah-Hartman
` (270 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huacai Chen, Zhongqiu Han,
Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 48a82a3f44576a1b227f964fdb150e1cae7455bf ]
32BIT Loongson machines don't have SMC and FreqCtrl registers, so make
this driver depend on MACH_LOONGSON64 (only for LoongArch based 64bit
machines currently).
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 78702a08364f3..73c1b62c1b37b 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -289,6 +289,7 @@ endif
if LOONGARCH
config LOONGSON3_CPUFREQ
tristate "Loongson3 CPUFreq Driver"
+ depends on MACH_LOONGSON64
help
This option adds a CPUFreq driver for Loongson processors which
support software configurable cpu frequency.
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 607/869] cpufreq: loongson3: Adjust the width of id and val in smc_message
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 606/869] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 608/869] cpufreq: loongson3: Replace per-package mutex with per-node Greg Kroah-Hartman
` (269 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 290814d3c22b300eb36b74dc76ad36bd7fdc1220 ]
The id field of smc_message is usually stand for the CPU ID. In the past
this driver was only tested for desktop and laptop productions so 4-bits
are enough. But now we have servers that can have as many as 256 cores,
so we need 8-bits CPU ID.
On the other hand, the val field is usually stand for CPU frequency so
12-bits are enough to represent 4GHz, and for higher frequencies there
is an extra bit to extend (enough for 8GHz).
In theory, this is a incompatible change, but fortunately the old SMC
firmwares are not widely shipped and can be updated on the air, thus we
can safely adjust the widths.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1e8715ea1b771..630f679aa7395 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -21,9 +21,9 @@
union smc_message {
u32 value;
struct {
- u32 id : 4;
+ u32 id : 8;
u32 info : 4;
- u32 val : 16;
+ u32 val : 12;
u32 cmd : 6;
u32 extra : 1;
u32 complete : 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 608/869] cpufreq: loongson3: Replace per-package mutex with per-node
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 607/869] cpufreq: loongson3: Adjust the width of id and val in smc_message Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 609/869] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks Greg Kroah-Hartman
` (268 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 5d7802ada30b3101f408706b7399b0e170d2febd ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. So replace the
per-package mutex with per-node one.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 630f679aa7395..e3cd78a5ab187 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -169,7 +169,7 @@ struct loongson3_freq_data {
struct cpufreq_frequency_table table[];
};
-static struct mutex cpufreq_mutex[MAX_PACKAGES];
+static struct mutex cpufreq_mutex[MAX_NUMNODES];
static struct cpufreq_driver loongson3_cpufreq_driver;
static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
@@ -177,14 +177,14 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
{
int retries;
unsigned int cpu = raw_smp_processor_id();
- unsigned int package = cpu_data[cpu].package;
+ unsigned int nid = cpu_to_node(cpu);
union smc_message msg, last;
- mutex_lock(&cpufreq_mutex[package]);
+ mutex_lock(&cpufreq_mutex[nid]);
last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
if (!last.complete) {
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
}
@@ -208,11 +208,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
}
if (!msg.complete || msg.cmd != CMD_OK) {
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
}
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return msg.val;
}
@@ -337,7 +337,7 @@ static int loongson3_cpufreq_probe(struct platform_device *pdev)
{
int i, ret;
- for (i = 0; i < MAX_PACKAGES; i++) {
+ for (i = 0; i < MAX_NUMNODES; i++) {
ret = devm_mutex_init(&pdev->dev, &cpufreq_mutex[i]);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 609/869] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 608/869] cpufreq: loongson3: Replace per-package mutex with per-node Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 610/869] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones Greg Kroah-Hartman
` (267 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit e38360d7c62c8fa530b58905f99a4557d4d6b352 ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have discrete
global physical CPU IDs while the core ID inside the packages are always
continuous. In these cases we should use global physical CPU IDs to get
and set frequencies.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index e3cd78a5ab187..1ae821e265fbf 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -16,6 +16,7 @@
#include <asm/idle.h>
#include <asm/loongarch.h>
#include <asm/loongson.h>
+#include <asm/smp.h>
/* Message */
union smc_message {
@@ -219,38 +220,40 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
static unsigned int loongson3_cpufreq_get(unsigned int cpu)
{
- int ret;
+ int ret, core = cpu_logical_map(cpu);
- ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
- return ret * KILO;
+ return (ret < 0) ? 0 : ret * KILO;
}
static int loongson3_cpufreq_target(struct cpufreq_policy *policy, unsigned int index)
{
- int ret;
+ int ret, core = cpu_logical_map(policy->cpu);
- ret = do_service_request(cpu_data[policy->cpu].core,
- FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO, index, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO,
+ index, 0);
return (ret >= 0) ? 0 : ret;
}
static int configure_freq_table(int cpu)
{
- int i, ret, boost_level, max_level, freq_level;
+ int i, ret, core, boost_level, max_level, freq_level;
struct platform_device *pdev = cpufreq_get_driver_data();
struct loongson3_freq_data *data;
if (per_cpu(freq_data, cpu))
return 0;
- ret = do_service_request(cpu, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
+ core = cpu_logical_map(cpu);
+
+ ret = do_service_request(core, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
if (ret < 0)
return ret;
max_level = ret;
- ret = do_service_request(cpu, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
+ ret = do_service_request(core, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
if (ret < 0)
return ret;
boost_level = ret;
@@ -263,7 +266,7 @@ static int configure_freq_table(int cpu)
data->def_freq_level = boost_level - 1;
for (i = 0; i < freq_level; i++) {
- ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
if (ret < 0) {
devm_kfree(&pdev->dev, data);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 610/869] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 609/869] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 611/869] fuse: dont launder folios of a bad inode Greg Kroah-Hartman
` (266 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xi Ruoyao, Huacai Chen, Zhongqiu Han,
Viresh Kumar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 81792daacfb41ca07b04bd3956ea9e672080cc98 ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. However, IOCSR
read/write can only perform on the current node, while sometimes we want
to perform on other nodes (e.g. when switch governor, the get and target
callbacks are not run on target core). So replace IOCSR read/write with
MMIO ones.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Tested-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 34 +++++++++++++++++++++++------
1 file changed, 27 insertions(+), 7 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1ae821e265fbf..aea7c31e155a4 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -17,6 +17,7 @@
#include <asm/loongarch.h>
#include <asm/loongson.h>
#include <asm/smp.h>
+#include <asm/numa.h>
/* Message */
union smc_message {
@@ -165,6 +166,12 @@ union smc_message {
#define FREQ_MAX_LEVEL 16
+#define MMIO_SMCMBX(node) \
+ ((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_SMCMBX))
+
+#define MMIO_MISC_FUNC(node) \
+ ((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_MISC_FUNC))
+
struct loongson3_freq_data {
unsigned int def_freq_level;
struct cpufreq_frequency_table table[];
@@ -177,13 +184,27 @@ static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 extra)
{
int retries;
- unsigned int cpu = raw_smp_processor_id();
- unsigned int nid = cpu_to_node(cpu);
+ unsigned int cpu = 0, nid;
union smc_message msg, last;
+#ifdef CONFIG_SMP
+ switch (cmd) {
+ case CMD_GET_FREQ_INFO:
+ case CMD_SET_FREQ_INFO:
+ case CMD_GET_FREQ_LEVEL_NUM:
+ case CMD_GET_FREQ_LEVEL_INFO:
+ case CMD_GET_FREQ_BOOST_LEVEL:
+ cpu = cpu_number_map(id);
+ break;
+ default:
+ cpu = raw_smp_processor_id();
+ }
+#endif
+ nid = cpu_to_node(cpu);
+
mutex_lock(&cpufreq_mutex[nid]);
- last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+ last.value = readl(MMIO_SMCMBX(nid));
if (!last.complete) {
mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
@@ -196,12 +217,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
msg.extra = extra;
msg.complete = 0;
- iocsr_write32(msg.value, LOONGARCH_IOCSR_SMCMBX);
- iocsr_write32(iocsr_read32(LOONGARCH_IOCSR_MISC_FUNC) | IOCSR_MISC_FUNC_SOFT_INT,
- LOONGARCH_IOCSR_MISC_FUNC);
+ writel(msg.value, MMIO_SMCMBX(nid));
+ writel(readl(MMIO_MISC_FUNC(nid)) | IOCSR_MISC_FUNC_SOFT_INT, MMIO_MISC_FUNC(nid));
for (retries = 0; retries < 10000; retries++) {
- msg.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+ msg.value = readl(MMIO_SMCMBX(nid));
if (msg.complete)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 611/869] fuse: dont launder folios of a bad inode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 610/869] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 612/869] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree Greg Kroah-Hartman
` (265 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e8200299b0556976e13c,
Joanne Koong, Horst Birthelmer, Miklos Szeredi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit 01d0f3d294af126f517d92c11e100525537f8be4 ]
fuse_flush() and fuse_writepages() reject writing back dirty data for
any inode that has been marked bad, but fuse_launder_folio() doesn't.
This can cause the following warning in fuse_write_file_get() to
trigger, as reported by syzbot:
WARNING: fs/fuse/file.c:2043 at fuse_write_file_get fs/fuse/file.c:2043 [inline]
WARNING: fs/fuse/file.c:2043 at fuse_iomap_writeback_range+0x7c8/0x18f0 fs/fuse/file.c:2227
Call Trace:
iomap_writeback_folio+0x1526/0x2490 fs/iomap/buffered-io.c:2022
fuse_launder_folio+0x17b/0x240 fs/fuse/file.c:2331
folio_unmap_invalidate+0x4cd/0x830 mm/truncate.c:634
invalidate_inode_pages2_range+0x629/0xb30 mm/truncate.c:726
fuse_open+0x5a6/0x770 fs/fuse/file.c:297
This can be hit on a writeback cache mount:
1) a writeable file is open and a buffered write dirties some pages
2) another thread opens the same file read-only. fuse_open() passes the
bad inode check and sends OPEN to the server.
3) a SETATTR reply with the wrong file type marks the inode bad
4) the writeable file is closed. Flush and release skip writeback
because the inode is bad. The pages stay dirty but the file gets
removed from write_files.
5) server replies to the OPEN. The reply has no FOPEN_KEEP_CACHE, so
fuse_open() calls invalidate_inode_pages2().
6) the invalidation finds the dirty pages and calls
fuse_launder_folio(), which finds no wriable file and hits the
WARN_ON in fuse_write_file_get().
Instead of trying to write back dirty data for the bad inode,
fuse_launder_folio() should return -EIO.
Fixes: 5d069dbe8aaf ("fuse: fix bad inode")
Reported-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e8200299b0556976e13c
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reviewed-by: Horst Birthelmer <hbirthelmer@ddn.com>
Tested-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 18a3ef3a96953..22b3f37ec88b8 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2271,6 +2271,9 @@ static int fuse_launder_folio(struct folio *folio)
.wb_ctx = &data,
};
+ if (fuse_is_bad(wpc.inode))
+ return -EIO;
+
if (folio_clear_dirty_for_io(folio)) {
err = iomap_writeback_folio(&wpc, folio);
err = fuse_iomap_writeback_submit(&wpc, err);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 612/869] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 611/869] fuse: dont launder folios of a bad inode Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 613/869] fuse: fix copy_file_range reply handling race Greg Kroah-Hartman
` (264 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Miklos Szeredi,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit e7ccc777a040343b80f95f4cc5c12ce1df3187f4 ]
The vring size was read after virtio_fs_find_instance() had dropped
virtio_fs_mutex, so a concurrent virtio_fs_remove() could free the
virtqueue first. The reference from the lookup keeps the virtio_fs
alive, but not its virtqueues.
Hold the mutex across the lookup and the read.
This issue was found by an in-house static analysis tool.
Fixes: a7f0d7aab0b4 ("virtiofs: split requests that exceed virtqueue size")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/virtio_fs.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 2b3daa93e299a..e475f7f9e83d4 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -454,26 +454,23 @@ static int virtio_fs_add_instance(struct virtio_device *vdev,
return ret;
}
-/* Return the virtio_fs with a given tag, or NULL */
+/* Return the virtio_fs with a given tag, or NULL.
+ * Callers hold virtio_fs_mutex, which also keeps the virtqueues alive.
+ */
static struct virtio_fs *virtio_fs_find_instance(const char *tag)
{
struct virtio_fs *fs;
- mutex_lock(&virtio_fs_mutex);
+ lockdep_assert_held(&virtio_fs_mutex);
list_for_each_entry(fs, &virtio_fs_instances, list) {
if (strcmp(fs->tag, tag) == 0) {
kobject_get(&fs->kobj);
- goto found;
+ return fs;
}
}
- fs = NULL; /* not found */
-
-found:
- mutex_unlock(&virtio_fs_mutex);
-
- return fs;
+ return NULL; /* not found */
}
static void virtio_fs_free_devs(struct virtio_fs *fs)
@@ -1675,13 +1672,17 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
* in fc->iq->priv. Once fuse_conn is going away, it calls ->put()
* to drop the reference to this object.
*/
+ mutex_lock(&virtio_fs_mutex);
fs = virtio_fs_find_instance(fsc->source);
+ if (fs)
+ virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
+ mutex_unlock(&virtio_fs_mutex);
+
if (!fs) {
pr_info("virtio-fs: tag <%s> not found\n", fsc->source);
return -EINVAL;
}
- virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
if (WARN_ON(virtqueue_size <= FUSE_HEADER_OVERHEAD))
goto out_err;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 613/869] fuse: fix copy_file_range reply handling race
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 612/869] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 614/869] ublk: pin module while release work is pending Greg Kroah-Hartman
` (263 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Miklos Szeredi,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
[ Upstream commit bf4ccbaad8bdff8c90fd290ed6135b63f89ee8a7 ]
__fuse_copy_file_range() selects its request opcode and output buffer
using fc->no_copy_file_range_64, then reads the flag again to handle the
reply. Copies to different destination inodes can run concurrently on
the same connection, so the flag may change while a request is pending.
For example, task A submits FUSE_COPY_FILE_RANGE_64 and waits for its
reply. Task B submits the same opcode, receives -ENOSYS and sets
no_copy_file_range_64. When A receives a successful reply, it reads the
uninitialized outarg.size instead of outarg_64.bytes_copied. This can
produce an incorrect return value, page cache invalidation range and
inode size update, and disclose stack contents if automatic stack
initialization is disabled.
If A also receives -ENOSYS, it instead mistakes that reply for rejection
of the legacy opcode and sets no_copy_file_range, skipping the legacy
fallback and unnecessarily disabling copy offload for the connection.
KCSAN reported the conflicting accesses:
BUG: KCSAN: data-race in __fuse_copy_file_range / __fuse_copy_file_range
read to 0xffff8881014a4d4d of 1 bytes by task 123 on cpu 4:
__fuse_copy_file_range+0x1a7/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
write to 0xffff8881014a4d4d of 8 bytes by task 119 on cpu 0:
__fuse_copy_file_range+0x633/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
The bug can lead to leak kernel base address for KASLR bypass, the
corresponding reproducer can be provided per request.
Use args.opcode for both -ENOSYS handling and output buffer selection.
It records the opcode actually sent and is updated on fallback, keeping
each reply tied to its request regardless of concurrent flag updates.
Fixes: 7a37f55af7af ("fuse: add COPY_FILE_RANGE_64 that allows large copies")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 22b3f37ec88b8..f72d74e3c5f03 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3078,7 +3078,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
}
err = fuse_simple_request(fm, &args);
if (err == -ENOSYS) {
- if (fc->no_copy_file_range_64) {
+ if (args.opcode == FUSE_COPY_FILE_RANGE) {
fc->no_copy_file_range = 1;
err = -EOPNOTSUPP;
} else {
@@ -3089,7 +3089,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
if (err)
goto out;
- bytes_copied = fc->no_copy_file_range_64 ?
+ bytes_copied = args.opcode == FUSE_COPY_FILE_RANGE ?
outarg.size : outarg_64.bytes_copied;
if (bytes_copied > len) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 614/869] ublk: pin module while release work is pending
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 613/869] fuse: fix copy_file_range reply handling race Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 615/869] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again Greg Kroah-Hartman
` (262 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sonotri, Ming Lei, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sonotri <sono7ri@gmail.com>
[ Upstream commit afc9cde716b29ce814798d649a95f9128ba42b43 ]
ublk_ch_release() takes a device reference and queues exit_work. The VFS
module reference held through the file operations is dropped after
->release() returns. A queued work item does not acquire its own module
reference for the callback.
Consequently, normal module removal can start while exit_work is pending or
executing. In addition to the worker callback itself, the final device put
can invoke ublk_cdev_rel(), which is also module code.
Take a module reference while ->release() is still covered by the file
operations reference and drop it only after the worker has completed its
final device put. A rearming worker retains the same reference.
Merely canceling exit_work during module exit is insufficient. The worker
is the terminal path for the device reference taken by ublk_ch_release(),
so its cancellation would strand that reference and skip the associated
cleanup.
Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
Cc: stable@vger.kernel.org
Signed-off-by: sonotri <sono7ri@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261015120654.241354-1-sono7ri@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c9109731d29ba..8c33a5f86c3d6 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1839,6 +1839,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
/* put the reference grabbed in ublk_ch_release() */
ublk_put_device(ub);
+ module_put(THIS_MODULE);
}
static int ublk_ch_release(struct inode *inode, struct file *filp)
@@ -1851,6 +1852,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
*/
ublk_get_device(ub);
+ /* Keep the worker's callback and final device release code resident. */
+ __module_get(THIS_MODULE);
INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
schedule_delayed_work(&ub->exit_work, 0);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 615/869] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 614/869] ublk: pin module while release work is pending Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 616/869] mptcp: reset msk state on early connect failure Greg Kroah-Hartman
` (261 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, Vlastimil Babka (SUSE),
Harry Yoo (Meta), Pedro Falcato, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit c57fbbe42e907fa26c5ffada52d913d4ca5fa66e ]
Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for
alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is
accounted only through SLAB_ACCOUNT on its bucket caches. With
CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and
kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches,
which do not account it; the same happens when kmem_buckets_create()
fails. Either way, the allocation is not charged to the sender's memory
cgroup.
Allocate with GFP_KERNEL_ACCOUNT again, as before that commit, so the
allocation is charged whichever cache serves it.
Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with
CONFIG_SLAB_BUCKETS as y and n.
Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261014052344.384723-2-kees@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
ipc/msgutil.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index 7a03f6d03de3a..2b93abb808e7b 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -63,7 +63,8 @@ static struct msg_msg *alloc_msg(size_t len)
size_t alen;
alen = min(len, DATALEN_MSG);
- msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL);
+ msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen,
+ GFP_KERNEL_ACCOUNT);
if (msg == NULL)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 616/869] mptcp: reset msk state on early connect failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 615/869] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 6.18 617/869] mptcp: fix subflow bitfield misuse Greg Kroah-Hartman
` (260 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quanye Yang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanye Yang <quanyeyang@proton.me>
[ Upstream commit 29afe67082b2d33ab2e90c56c337235d725f023f ]
mptcp_connect() can fall back before the subflow SYN is sent, for
example when the netns is in an MPTCP blackhole, token allocation fails,
or MD5SIG is in use. If the subsequent subflow connect() fails
immediately (EAFNOSUPPORT, ENETUNREACH, ...), __inet_stream_connect()
returns while the socket is still SS_UNCONNECTED and never calls
->disconnect(). This was reported by Clashiko [1].
The error path only dropped the token and moved the msk back to
TCP_CLOSE. MPTCP_FALLBACK_DONE, allow_subflows and
request_mptcp were left as after early fallback, so a later
connect() on the same fd stayed TCP-only.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/633 [1]
Fixes: 0235d075a592 ("mptcp: mark as fallback even early ones")
Cc: stable@vger.kernel.org
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-1-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index e14a49180eefe..df09dcfd15ce3 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3921,9 +3921,16 @@ static int mptcp_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
* subflow_finish_connect()
*/
if (unlikely(err)) {
- /* avoid leaving a dangling token in an unconnected socket */
mptcp_token_destroy(msk);
mptcp_set_state(sk, TCP_CLOSE);
+
+ spin_lock_bh(&msk->fallback_lock);
+ msk->allow_subflows = true;
+ msk->allow_infinite_fallback = true;
+ clear_bit(MPTCP_FALLBACK_DONE, &msk->flags);
+ spin_unlock_bh(&msk->fallback_lock);
+
+ mptcp_subflow_ctx_reset(mptcp_subflow_ctx(ssk));
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 617/869] mptcp: fix subflow bitfield misuse
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 616/869] mptcp: reset msk state on early connect failure Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 618/869] ALSA: seq: oss: Skip events until fully initialized Greg Kroah-Hartman
` (259 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 7538fa33bb2f66b8b809ff39d58308be48e197a0 ]
The subflow status bitfield is protected by the subflow socket lock,
with one notable exception: the `close_event_done` bit is actually under
the msk socket lock protection.
As reported by Clashiko [1], flipping the latter bit may corrupt other
entries in the same bitfield.
Move the `close_event_done` outside the bitfield, in a 32bit hole.
Link: https://lore.kernel.org/178959153492.22033.1944011998010756543@kernel.org
Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-2-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index dc8920a6a90c3..184831b5b624a 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -543,14 +543,16 @@ struct mptcp_subflow_context {
closing : 1, /* must not pass rx data to msk anymore */
valid_csum_seen : 1, /* at least one csum validated */
is_mptfo : 1, /* subflow is doing TFO */
- close_event_done : 1, /* has done the post-closed part */
mpc_drop : 1, /* the MPC option has been dropped in a rtx */
resetting : 1, /* subflow is resetting */
- __unused : 8;
+ __unused : 9;
bool data_avail;
bool scheduled;
bool pm_listener; /* a listener managed by the kernel PM? */
bool fully_established; /* path validated */
+ bool close_event_done; /* has done the post-closed part,
+ * protected by msk socket lock
+ */
u32 lent_mem_frag;
u32 remote_nonce;
u64 thmac;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 618/869] ALSA: seq: oss: Skip events until fully initialized
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 6.18 617/869] mptcp: fix subflow bitfield misuse Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 619/869] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P Greg Kroah-Hartman
` (258 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 68d4a6ea6cc6091a05836f783bc17d525d266d0b ]
When an OSS sequencer device is opened, it creates a sequencer port,
then further initializes the internal states like a timer instance,
etc. Since the sequencer port is published, an event can be already
delivered, and this may hit unexpected event handling, which can
eventually cause a NULL dereference (like the timer start/stop event
triggered before the timer initialization).
For avoiding such a race, introduce a simple guard and skips the event
processing until the port is fully initialized.
At releasing the device, in turn, clear this guard, so that any input
events will be discarded during the teardown.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261016161930.482309-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/oss/seq_oss_device.h | 1 +
sound/core/seq/oss/seq_oss_event.c | 3 +++
sound/core/seq/oss/seq_oss_init.c | 2 ++
3 files changed, 6 insertions(+)
diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
index 935cf3df0b30f..571186db4fa59 100644
--- a/sound/core/seq/oss/seq_oss_device.h
+++ b/sound/core/seq/oss/seq_oss_device.h
@@ -72,6 +72,7 @@ struct seq_oss_devinfo {
int cseq; /* sequencer client number */
int port; /* sequencer port number */
int queue; /* sequencer queue number */
+ bool initialized;
struct snd_seq_addr addr; /* address of this device */
diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
index 122735862044d..20f4c5ce763cc 100644
--- a/sound/core/seq/oss/seq_oss_event.c
+++ b/sound/core/seq/oss/seq_oss_event.c
@@ -425,6 +425,9 @@ snd_seq_oss_event_input(struct snd_seq_event *ev, int direct, void *private_data
struct seq_oss_devinfo *dp = (struct seq_oss_devinfo *)private_data;
union evrec *rec;
+ if (!dp || !smp_load_acquire(&dp->initialized))
+ return 0; /* ignored */
+
if (ev->type != SNDRV_SEQ_EVENT_ECHO)
return snd_seq_oss_midi_input(ev, direct, private_data);
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 973f057eb731f..102c9358ce481 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -258,6 +258,7 @@ snd_seq_oss_open(struct file *file, int level)
client_table[dp->index] = dp;
num_clients++;
+ smp_store_release(&dp->initialized, true);
return 0;
@@ -403,6 +404,7 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp)
client_table[dp->index] = NULL;
num_clients--;
+ smp_store_release(&dp->initialized, false);
snd_seq_oss_reset(dp);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 619/869] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 618/869] ALSA: seq: oss: Skip events until fully initialized Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 620/869] power: supply: qcom_smbx: set the charge enable after software control Greg Kroah-Hartman
` (257 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Gerardo Lopez Hernandez,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
[ Upstream commit d933955c456e0573b40eae4f72a3af37ab1c15c3 ]
The Acer Aspire AL16-31P (Intel Alder Lake-N, Realtek ALC269VC,
PCI/codec SSID 2782:1718) has its internal speakers wired to pin 0x1b,
but the BIOS marks that pin as not connected (0x411111f0) and only
exposes pin 0x14 as the speaker. As a result the internal speakers are
silent while headphones, HDMI and Bluetooth work.
This is the same layout as the Infinix Y4 Max and MEDION E15433, which
share the 0x2782 subsystem vendor. Reuse their fixup, which configures
pin 0x1b as an internal speaker and limits the internal mic boost.
Tested by booting with snd-hda-intel model=2782:1705: the fixup is
picked, pin 0x1b is used as a speaker output, the internal speakers
work, and they are muted when headphones are plugged in.
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
Link: https://patch.msgid.link/20261017005039.9139-1-gamaerry@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 03265550c0eef..c81ecda4e7b6e 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7723,6 +7723,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x2782, 0x1701, "Infinix Y4 Max", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x2782, 0x1718, "Acer Aspire AL16-31P", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x4900, "MEDION E15443", ALC233_FIXUP_MEDION_MTL_SPK),
SND_PCI_QUIRK(0x2782, 0xa128, "Positivo N15RPE-S", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x2782, 0xa212, "Lunnen Ground 14", ALC269VC_FIXUP_LUNNEN_GROUND_14),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 620/869] power: supply: qcom_smbx: set the charge enable after software control
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 619/869] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 621/869] power: supply: cros_charge-control: restore EC state on resume Greg Kroah-Hartman
` (256 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabricio Akio, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabricio Akio <fabricioakio@gmail.com>
[ Upstream commit 1fba787142011145e1071cee9448b3677fb2323d ]
The init sequence sets CHARGING_ENABLE_CMD before CHGR_CFG2 selects
software control of the charge enable.
The Motorola Moto X4's bootloader leaves the charger watchdog armed to
disable charging when it bites, which it does after a few minutes in
fastboot. Charging then stays disabled in the next boot until the cable
is replugged. Setting the command after CHGR_CFG2 re-enables it.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fabricio Akio <fabricioakio@gmail.com>
Link: https://patch.msgid.link/20261002-qcom-smbx-enable-order-v1-1-7df92bd809db@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 55fe31aa3df3d..ad2cf516e2ded 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -812,11 +812,7 @@ static const struct smb_init_register smb_init_seq[] = {
.mask = SOC_LT_CHG_RECHARGE_THRESH_SEL_BIT |
VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT,
.val = VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT },
- /* Enable charging */
{ .addr = USBIN_OPTIONS_1_CFG, .mask = HVDCP_EN_BIT, .val = 0 },
- { .addr = CHARGING_ENABLE_CMD,
- .mask = CHARGING_ENABLE_CMD_BIT,
- .val = CHARGING_ENABLE_CMD_BIT },
/*
* Match downstream defaults
* CHG_EN_SRC_BIT - charger enable is controlled by software
@@ -837,6 +833,13 @@ static const struct smb_init_register smb_init_seq[] = {
AUTO_RECHG_BIT | EN_ANALOG_DROP_IN_VBATT_BIT |
CHARGER_INHIBIT_BIT,
.val = CHARGER_INHIBIT_BIT },
+ /*
+ * Set the enable command only once CHGR_CFG2 has selected software
+ * control, or a charger its watchdog has disabled stays disabled.
+ */
+ { .addr = CHARGING_ENABLE_CMD,
+ .mask = CHARGING_ENABLE_CMD_BIT,
+ .val = CHARGING_ENABLE_CMD_BIT },
/* STAT pin software override, match downstream. Parallel charging? */
{ .addr = STAT_CFG,
.mask = STAT_SW_OVERRIDE_CFG_BIT,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 621/869] power: supply: cros_charge-control: restore EC state on resume
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 620/869] power: supply: qcom_smbx: set the charge enable after software control Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 622/869] power: supply: generic-adc-battery: fix status with no supplier Greg Kroah-Hartman
` (255 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Pam, Tzung-Bi Shih,
Thomas Weißschuh, Sebastian Reichel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Pam <andrew@fastmailteam.com>
[ Upstream commit 1f2a40f954c848dff9d8bb6d81e404f9e47f0e81 ]
The EC resets its charge control configuration when the AP powers off,
so configured sustainer thresholds and charge behaviour are lost across
hibernation.
Nothing notices the reset. Commit 4fc88ba435da ("power: supply:
cros_charge-control: adopt EC charge state on probe"), in the
power-supply tree, made the driver adopt the EC's charge state, but only
at probe, and a resume is not a probe. Sysfs therefore keeps reporting
the configured values while the EC charges the battery to full. On a
Framework Laptop 16 (Ryzen AI 300, charge control command version 3)
with charge_control_end_threshold set to 80, a hibernate and resume
cycle leaves the attribute still reading 80 while the battery charges
past it to 100%.
Add a system sleep resume hook that reprograms the EC from the cached
state. The same EC behaviour and the same fix already exist for another
driver, see commit 2643187ccb86 ("platform/x86: ayaneo-ec: Add suspend
hook").
Reprogramming the EC is only strictly required after hibernation, but it
is cheap and idempotent, so hook every resume path rather than rely on
the EC preserving its state across each kind of sleep transition.
Note that re-reading the state from the EC on resume, by reusing
cros_chctl_init_state() or otherwise, would be wrong even on the command
versions that support GET: the EC has been reset to its defaults by the
time the hook runs, so adopting that state would silently discard the
configuration the user asked for. The driver's cached state is the only
remaining record of it, which is why it is pushed to the EC rather than
refreshed from it.
Fixes: c6ed48ef5259 ("power: supply: add ChromeOS EC based charge control driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Andrew Pam <andrew@fastmailteam.com>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20261005043418.243937-1-andrew@fastmailteam.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/cros_charge-control.c | 29 +++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/cros_charge-control.c b/drivers/power/supply/cros_charge-control.c
index 53e6a77e03fcf..6a6022f377b7a 100644
--- a/drivers/power/supply/cros_charge-control.c
+++ b/drivers/power/supply/cros_charge-control.c
@@ -14,6 +14,7 @@
#include <linux/platform_data/cros_ec_commands.h>
#include <linux/platform_data/cros_ec_proto.h>
#include <linux/platform_device.h>
+#include <linux/pm.h>
#include <linux/types.h>
#define EC_CHARGE_CONTROL_BEHAVIOURS (BIT(POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO) | \
@@ -294,6 +295,7 @@ static int cros_chctl_probe(struct platform_device *pdev)
priv->dev = dev;
priv->cros_ec = cros_ec;
+ dev_set_drvdata(dev, priv);
if (priv->cmd_version == 1)
priv->psy_ext = &cros_chctl_psy_ext_v1;
@@ -319,13 +321,38 @@ static int cros_chctl_probe(struct platform_device *pdev)
return devm_battery_hook_register(dev, &priv->battery_hook);
}
+static int cros_chctl_resume(struct device *dev)
+{
+ struct cros_chctl_priv *priv = dev_get_drvdata(dev);
+ int ret;
+
+ /*
+ * The EC resets its charge control state when the AP powers off, so the
+ * configuration is lost across hibernation, while the values exposed to
+ * userspace still describe it. The cached state is the only remaining
+ * record of that configuration: reprogram the EC from it rather than
+ * re-reading the EC, which would adopt the reset defaults instead.
+ */
+ guard(mutex)(&priv->lock);
+ ret = cros_chctl_configure_ec(priv);
+ if (ret)
+ dev_err(dev, "failed to restore charge control state: %d\n", ret);
+
+ return ret;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(cros_chctl_pm_ops, NULL, cros_chctl_resume);
+
static const struct platform_device_id cros_chctl_id[] = {
{ "cros-charge-control", 0 },
{}
};
static struct platform_driver cros_chctl_driver = {
- .driver.name = "cros-charge-control",
+ .driver = {
+ .name = "cros-charge-control",
+ .pm = pm_sleep_ptr(&cros_chctl_pm_ops),
+ },
.probe = cros_chctl_probe,
.id_table = cros_chctl_id,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 622/869] power: supply: generic-adc-battery: fix status with no supplier
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 621/869] power: supply: cros_charge-control: restore EC state on resume Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 623/869] power: supply: qcom_battmgr: Notify charger supplies of online changes Greg Kroah-Hartman
` (254 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Douglas, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Douglas <me@timdoug.com>
[ Upstream commit 8ae5a3f40045ff486826ed6b6a83e39a0f380073 ]
power_supply_am_i_supplied() returns -ENODEV when no registered power
supply supplies the battery. generic-adc-battery's gab_work() tests this
return value as a boolean, so -ENODEV takes the supplied branch and
reports CHARGING, or NOT_CHARGING if the charge-finished GPIO is asserted,
instead of DISCHARGING.
This was noticed while bringing up an out-of-tree Linux port to the
WikiReader: the driver reported CHARGING on a device powered by two AAA
batteries with no charging hardware.
Only a positive return value indicates an online supplier, so treat zero
and negative returns as discharging.
Fixes: 46cecd130d55 ("power: supply: Fix power_supply_am_i_supplied to return -ENODEV when apropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013022153.6707-1-me@timdoug.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/generic-adc-battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
index c69c9b9fa0eba..df5f91bc1d0f6 100644
--- a/drivers/power/supply/generic-adc-battery.c
+++ b/drivers/power/supply/generic-adc-battery.c
@@ -135,7 +135,7 @@ static void gab_work(struct work_struct *work)
adc_bat = container_of(delayed_work, struct gab, bat_work);
status = adc_bat->status;
- if (!power_supply_am_i_supplied(adc_bat->psy))
+ if (power_supply_am_i_supplied(adc_bat->psy) <= 0)
adc_bat->status = POWER_SUPPLY_STATUS_DISCHARGING;
else if (gab_charge_finished(adc_bat))
adc_bat->status = POWER_SUPPLY_STATUS_NOT_CHARGING;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 623/869] power: supply: qcom_battmgr: Notify charger supplies of online changes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 622/869] power: supply: generic-adc-battery: fix status with no supplier Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 624/869] alpha: handle VM_FAULT_HWPOISON in do_page_fault() Greg Kroah-Hartman
` (253 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brandon Williams, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brandon Williams <turbine.bmw@gmail.com>
[ Upstream commit 87fd20da8ca8bacdaa9bff5860167f208077dc51 ]
On SC8280XP and X1E80100 the AC, USB and wireless supplies take their
online state from the charging source in the battery status response.
The firmware sends no notification for those supplies when the charging
source changes, and the driver only announces the battery, so userspace
never learns that the charger was plugged in or out. UPower keeps the
state it read at startup: a laptop booted on the charger never goes on
battery.
Call power_supply_changed() for a supply whose online state changes when
a status response is parsed. A supply that is not registered yet, when
the battery is read during probe, reports its state when it registers.
Tested on a Microsoft Surface Pro 11 (X1E80100): after restarting UPower
on the charger, unplugging now sets OnBattery, and plugging in clears it.
Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Brandon Williams <turbine.bmw@gmail.com>
Link: https://patch.msgid.link/20261013-upstream-battmgr-charger-online-v1-1-731973e133a0@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_battmgr.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
index 7454ec0e99633..03ffaad3b53df 100644
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -1258,6 +1258,23 @@ static unsigned int qcom_battmgr_sc8280xp_convert_temp(unsigned int temperature)
return DIV_ROUND_CLOSEST(temperature, 10);
}
+/*
+ * The charger supplies' online state comes from the battery status response,
+ * and the firmware sends no notification of its own when it changes, so
+ * announce the change here. A supply that is not registered yet announces its
+ * state when it is.
+ */
+static void qcom_battmgr_sc8280xp_set_online(struct power_supply *psy,
+ bool *online, bool value)
+{
+ if (*online == value)
+ return;
+
+ *online = value;
+ if (psy)
+ power_supply_changed(psy);
+}
+
static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
const struct qcom_battmgr_message *resp,
size_t len)
@@ -1327,9 +1344,12 @@ static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
battmgr->status.temperature = qcom_battmgr_sc8280xp_convert_temp(le32_to_cpu(resp->status.temperature));
source = le32_to_cpu(resp->status.charging_source);
- battmgr->ac.online = source == BATTMGR_CHARGING_SOURCE_AC;
- battmgr->usb.online = source == BATTMGR_CHARGING_SOURCE_USB;
- battmgr->wireless.online = source == BATTMGR_CHARGING_SOURCE_WIRELESS;
+ qcom_battmgr_sc8280xp_set_online(battmgr->ac_psy, &battmgr->ac.online,
+ source == BATTMGR_CHARGING_SOURCE_AC);
+ qcom_battmgr_sc8280xp_set_online(battmgr->usb_psy, &battmgr->usb.online,
+ source == BATTMGR_CHARGING_SOURCE_USB);
+ qcom_battmgr_sc8280xp_set_online(battmgr->wls_psy, &battmgr->wireless.online,
+ source == BATTMGR_CHARGING_SOURCE_WIRELESS);
if (battmgr->info.last_full_capacity != 0) {
/*
* 100 * battmgr->status.capacity can overflow a 32bit
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 624/869] alpha: handle VM_FAULT_HWPOISON in do_page_fault()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 623/869] power: supply: qcom_battmgr: Notify charger supplies of online changes Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 625/869] alpha: load the MMU context when switch_mm() switches the current task Greg Kroah-Hartman
` (252 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Magnus Lindholm, Matt Turner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit 4bef20bbb9e02568a009efa4d404ce2621289be5 ]
do_page_fault() handles VM_FAULT_OOM, VM_FAULT_SIGSEGV and
VM_FAULT_SIGBUS and then falls into BUG() for anything else in
VM_FAULT_ERROR. VM_FAULT_HWPOISON and VM_FAULT_HWPOISON_LARGE are in
that set, so a fault on a poisoned page takes down the kernel instead of
delivering a signal.
Alpha does not select ARCH_SUPPORTS_MEMORY_FAILURE, so the machine check
paths cannot produce these. UFFDIO_POISON can: it installs a poison PTE
marker without any memory failure support, and a subsequent access
returns VM_FAULT_HWPOISON. Registering an anonymous range with
userfaultfd, poisoning it and reading it back reliably hits the BUG():
Kernel bug at arch/alpha/mm/fault.c:188
poison(50809): Kernel Bug 1
pc is at do_page_fault+0x4e8/0x550
ra is at do_page_fault+0xfc/0x550
The BUG() fires with mmap_read_lock() still held, so the faulting task
is left unkillable in D state holding the lock, and shutdown stalls
behind it. A UFFD_USER_MODE_ONLY userfaultfd is always allowed, so any
local user can do this.
Deliver SIGBUS with BUS_MCEERR_AR instead, reporting the size of the
poisoned area, as the other architectures do. That is the huge page size
for VM_FAULT_HWPOISON_LARGE, which becomes reachable once alpha
implements huge pages.
Tested on an UP1500 (EV68AL): the reproducer above now takes a SIGBUS
and the kernel logs
poison[373]: hardware memory error at 0000020000030000 pc 00000200010007ec
with no oops, no wedged task and no taint.
A backport needs the show_signal_msg() call dropped, since alpha only
has it since commit 9ca6af1aac40 ("alpha: select
SYSCTL_EXCEPTION_TRACE").
Fixes: fc71884a5f59 ("mm: userfaultfd: add new UFFDIO_POISON ioctl")
Cc: stable@vger.kernel.org # 6.6+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Link: https://lore.kernel.org/r/20261007-alpha-hugepages-v2-2-8e108af2d961@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/mm/fault.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index a9816bbc9f34d..f40ac0826a854 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -8,6 +8,7 @@
#include <linux/sched/signal.h>
#include <linux/kernel.h>
#include <linux/mm.h>
+#include <linux/hugetlb.h>
#include <asm/io.h>
#define __EXTERN_INLINE inline
@@ -89,6 +90,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
struct mm_struct *mm = current->mm;
const struct exception_table_entry *fixup;
int si_code = SEGV_MAPERR;
+ unsigned int lsb;
vm_fault_t fault;
unsigned int flags = FAULT_FLAG_DEFAULT;
@@ -161,6 +163,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
goto bad_area;
else if (fault & VM_FAULT_SIGBUS)
goto do_sigbus;
+ else if (fault & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ goto do_sigbus_mceerr;
BUG();
}
@@ -222,6 +226,21 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
goto no_context;
return;
+ do_sigbus_mceerr:
+ mmap_read_unlock(mm);
+ if (!user_mode(regs))
+ goto no_context;
+ /*
+ * Report the size of the poisoned area, which for a hugetlb fault
+ * is the size of the huge page that could not be mapped.
+ */
+ lsb = PAGE_SHIFT;
+ if (fault & VM_FAULT_HWPOISON_LARGE)
+ lsb = hstate_index_to_shift(VM_FAULT_GET_HINDEX(fault));
+ show_signal_msg(regs, address, SIGBUS, "hardware memory error");
+ force_sig_mceerr(BUS_MCEERR_AR, (void __user *) address, lsb);
+ return;
+
do_sigsegv:
force_sig_fault(SIGSEGV, si_code, (void __user *) address);
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 625/869] alpha: load the MMU context when switch_mm() switches the current task
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 624/869] alpha: handle VM_FAULT_HWPOISON in do_page_fault() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 626/869] alpha: run check_mmu_context() from finish_arch_post_lock_switch() Greg Kroah-Hartman
` (251 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 9b8be19d5dc9525a408942e2e8012873199e7455 ]
ev5_switch_mm() only prepares the incoming PCB. The context is installed
by PAL_swpctx, which alpha_switch_to() issues against that PCB on the way
out of the scheduler.
Direct callers reach switch_mm() without going through alpha_switch_to():
kthread_use_mm(), which borrows an mm for the current kernel thread,
sched_force_init_mm() on the CPU-hotplug teardown path, and
do_shoot_lazy_tlb(), which switches to init_mm from an IPI. None explicitly
loads the context, so the task can carry on running under whatever was
loaded before. For kthread_use_mm(), current->mm then names the borrowed
mm even though its context has not been loaded. The other two callers
change active_mm while leaving current->mm NULL.
The stale page-table root need not be swapper_pg_dir; it may belong to a
user process that ran on the CPU earlier, and the kthread's user accesses
can then read and write that process's memory wherever the stale mappings
allow. Translations taken that way can also end up tagged with the
borrowed mm's ASN: ev5_switch_mm() writes that ASN into the PCB, which the
next PAL_swpctx installs against the stale ptbr. An address the stale
tables do not map faults instead, and since do_page_fault() resolves
faults against current->mm without reloading the context, the same access
can fault again on return.
sched_force_init_mm() needs CONFIG_HOTPLUG_CPU and do_shoot_lazy_tlb()
needs CONFIG_MMU_LAZY_TLB_SHOOTDOWN. Alpha selects neither, so only
kthread_use_mm() is reachable in practice. Test the caller's identity
rather than special-casing individual callers.
The scheduler passes the incoming task, which is not current until
alpha_switch_to() runs; all three direct callers pass current. Test for
that and load the context the way activate_mm() does. All three run with
interrupts disabled across the switch, so this completes before any
shootdown can be taken and needs no asn_lock handshake.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Tested-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index eee8fe836a59e..d366f89fee585 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -130,6 +130,8 @@ __get_new_mm_context(struct mm_struct *mm, long cpu)
return next;
}
+extern void __load_new_mm_context(struct mm_struct *);
+
__EXTERN_INLINE void
ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
struct task_struct *next)
@@ -139,6 +141,16 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
unsigned long mmc;
long cpu = smp_processor_id();
+ /*
+ * kthread_use_mm(), sched_force_init_mm() and do_shoot_lazy_tlb()
+ * switch current's mm without alpha_switch_to(), which loads the
+ * context. The latter two require options Alpha does not select.
+ */
+ if (next == current) {
+ __load_new_mm_context(next_mm);
+ return;
+ }
+
#ifdef CONFIG_SMP
cpu_data[cpu].asn_lock = 1;
barrier();
@@ -160,7 +172,6 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
task_thread_info(next)->pcb.asn = mmc & HARDWARE_ASN_MASK;
}
-extern void __load_new_mm_context(struct mm_struct *);
asmlinkage void do_page_fault(unsigned long address, unsigned long mmcsr,
long cause, struct pt_regs *regs);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 626/869] alpha: run check_mmu_context() from finish_arch_post_lock_switch()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 625/869] alpha: load the MMU context when switch_mm() switches the current task Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 627/869] alpha: only use a targeted tbi() when the target mm is really current Greg Kroah-Hartman
` (250 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 020d2e70b7538b66eee3c3480d2b8921fb182f0c ]
check_mmu_context() clears asn_lock and acts on need_new_asn, but it
runs only as the tail of switch_to(), after alpha_switch_to() returns.
A newly forked user task never gets there: its first context switch
resumes at ret_from_fork and reaches schedule_tail() without returning
to the code following alpha_switch_to().
asn_lock is left set on that CPU, so the new user task can run with
interrupts enabled while shootdown IPIs keep taking the deferred path.
The handshake meant to complete those invalidations never runs.
New kernel threads also reach schedule_tail(), but context_switch()
does not call switch_mm() for a task without an mm. They therefore do
not set asn_lock in the first place and are not affected by this bug.
Move check_mmu_context() to finish_arch_post_lock_switch(), which is
called by finish_task_switch() for both existing and newly created tasks.
Drop the now redundant call from switch_to().
The hook runs after finish_lock_switch() releases the rq lock and enables
interrupts. An IPI arriving before asn_lock is cleared retires the slot
through flush_tlb_other(); an IPI arriving afterwards can flush directly,
since PAL_swpctx has already installed the incoming context.
Set need_new_asn whether ev5_switch_mm() reuses or allocates an ASN. An
IPI in that interval can zero either slot. Without this, the allocated
case can return to user space with a live ASN but a zero context slot,
which a later context-based shootdown shortcut could mistake for an
inactive CPU. check_mmu_context() reloads only when the slot is zero.
Call the hook unconditionally. Alpha selects ARCH_NO_PREEMPT, and neither
kthread_use_mm() nor sched_force_init_mm() sleeps between the direct
switch and this hook. RCU_STRICT_GRACE_PERIOD can enable PREEMPT_COUNT,
but cannot make those callers migrate there. Testing preemptible() would
only leave asn_lock set in that configuration.
This requires the preceding direct-switch fix, "alpha: load the MMU
context when switch_mm() switches the current task". It installs the
borrowed context before kthread_use_mm() reaches this hook, so clearing
asn_lock cannot expose a targeted invalidate against the wrong context.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 15 +++++++++++++--
arch/alpha/include/asm/switch_to.h | 1 -
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index d366f89fee585..f41d7c73fdd64 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -162,8 +162,8 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
next_mm->context[cpu] = mmc;
}
#ifdef CONFIG_SMP
- else
- cpu_data[cpu].need_new_asn = 1;
+ /* A deferred shootdown can also invalidate a newly allocated ASN. */
+ cpu_data[cpu].need_new_asn = 1;
#endif
/* Always update the PCB ASN. Another thread may have allocated
@@ -192,6 +192,17 @@ do { \
#define check_mmu_context() do { } while(0)
#endif
+/*
+ * Also called from kthread_use_mm() with preemption enabled. Alpha has
+ * no kernel preemption, so the task is still on the CPU that ran
+ * switch_mm().
+ */
+#define finish_arch_post_lock_switch finish_arch_post_lock_switch
+static inline void finish_arch_post_lock_switch(void)
+{
+ check_mmu_context();
+}
+
__EXTERN_INLINE void
ev5_activate_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm)
{
diff --git a/arch/alpha/include/asm/switch_to.h b/arch/alpha/include/asm/switch_to.h
index 762b7f975310c..35c4b2c9d9923 100644
--- a/arch/alpha/include/asm/switch_to.h
+++ b/arch/alpha/include/asm/switch_to.h
@@ -9,7 +9,6 @@ extern struct task_struct *alpha_switch_to(unsigned long, struct task_struct *);
#define switch_to(P,N,L) \
do { \
(L) = alpha_switch_to(virt_to_phys(&task_thread_info(N)->pcb), (P)); \
- check_mmu_context(); \
} while (0)
#endif /* __ALPHA_SWITCH_TO_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 627/869] alpha: only use a targeted tbi() when the target mm is really current
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 626/869] alpha: run check_mmu_context() from finish_arch_post_lock_switch() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 628/869] alpha: invalidate the local context in flush_tlb_page() Greg Kroah-Hartman
` (249 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 0d92845ac5dbc79e4ac4810b33c673f4c1c227e3 ]
ipi_flush_tlb_page() gates a targeted tbi() on current->active_mm.
tbi() acts on the address space context currently loaded on the CPU, so
it is only guaranteed to reach an mm's translations when a thread of
that mm is running there. current->active_mm is not sufficient: under
lazy TLB an idle or kernel task keeps an mm as its active_mm while a
different ASN is loaded, so the invalidate is issued against the wrong
context and the stale entry can survive. Nothing retires the old ASN
afterwards either, mm->context[cpu] still being valid, so the resuming
thread can reuse it.
Test current->mm instead and otherwise fall back to flush_tlb_other(),
which clears mm->context[cpu] and forces a fresh ASN at the next switch
whatever is loaded now.
For an mm borrowed through kthread_use_mm(), patch 1 of this series
installs the context before the task can take a shootdown IPI. The
current->mm test therefore covers that case as well.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-4-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index ed06367ece574..1ad448105201f 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -669,7 +669,8 @@ ipi_flush_tlb_page(void *x)
struct flush_tlb_page_struct *data = x;
struct mm_struct * mm = data->mm;
- if (mm == current->active_mm && !asn_locked())
+ /* A targeted tbi() needs a thread of MM to be current. */
+ if (mm == current->mm && !asn_locked())
flush_tlb_current_page(mm, data->vma, data->addr);
else
flush_tlb_other(mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 628/869] alpha: invalidate the local context in flush_tlb_page()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 627/869] alpha: only use a targeted tbi() when the target mm is really current Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 629/869] alpha: fix the local TLB invalidate " Greg Kroah-Hartman
` (248 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit c0db730bf05eb3c10c1fae64b19f6913dce129fc ]
When the target mm is not the calling CPU's active_mm, flush_tlb_page()
does nothing locally, and smp_call_function() reaches only the other CPUs.
This CPU may still hold translations for the mm and can later reuse the
old ASN together with them.
Add the missing else branch. flush_tlb_other() clears mm->context[cpu] so
a fresh ASN is taken at the next switch. Add this before changing the
current->active_mm test to current->mm: that change will also send lazy
callers here, so their local invalidate must already be in place.
The uniprocessor implementations of flush_tlb_mm() and
flush_icache_user_page() in asm/tlbflush.h and asm/cacheflush.h already
contain exactly this branch.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-5-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 1ad448105201f..e4ba0aab8a669 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -697,6 +697,9 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
data.vma = vma;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 629/869] alpha: fix the local TLB invalidate in flush_tlb_page()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 628/869] alpha: invalidate the local context in flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 630/869] alpha: fix the local TLB invalidate in the UP flush_tlb_page() Greg Kroah-Hartman
` (247 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 32f4dd420d626f96128fcfeea2ab24760b4f21a6 ]
flush_tlb_page() invalidates the calling CPU itself before asking the
others, and gates that on current->active_mm. For a non-executable vma
that means a targeted tbi(2, addr), which acts on the context currently
loaded and is only guaranteed to invalidate the intended translations
when the target mm's context is the loaded one. A lazy active_mm does
not establish that, so as in ipi_flush_tlb_page() the target mm's stale
translations can survive, and nothing forces the old ASN to be retired
afterwards.
Test current->mm instead. A lazy caller then takes the flush_tlb_other()
branch added by the previous patch, retiring its local context. Adding
that branch first preserves the local invalidate at every step, including
on EV7 where a targeted tbi() against a foreign ASN appeared to work.
Which callers reach here with a foreign mm depends on the configuration.
folio_mkclean(), from the writeback flusher kworker that has no mm of its
own, accounted for about half the calls during writeback of a shared
mapping and none at all on anonymous memory. Those counts were measured
with CONFIG_COMPACTION=n: with COMPACTION=y, asm/pgtable.h overrides
ptep_clear_flush() to call migrate_flush_tlb_page(), which rendezvouses
with every CPU and handles the context itself, so folio_mkclean() does
not reach this function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-6-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e4ba0aab8a669..a5a42ae4a7d80 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -684,7 +684,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
preempt_disable();
- if (mm == current->active_mm) {
+ /* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current. */
+ if (mm == current->mm) {
flush_tlb_current_page(mm, vma, addr);
if (atomic_read(&mm->mm_users) <= 1) {
int cpu, this_cpu = smp_processor_id();
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 630/869] alpha: fix the local TLB invalidate in the UP flush_tlb_page()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 629/869] alpha: fix the local TLB invalidate " Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 631/869] alpha: invalidate the local context in flush_tlb_mm() Greg Kroah-Hartman
` (246 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit c825bf802a7a43fd302c879ef25c975e067a2e94 ]
The uniprocessor flush_tlb_page() in asm/tlbflush.h has the same wrong
test as the SMP one: a targeted tbi() is only guaranteed to invalidate
the intended translations when the target mm's context is loaded, but
the gate is current->active_mm, which a lazily borrowed mm also
satisfies.
Test current->mm instead. The else branch it falls to already exists
here, so unlike the SMP side this is the whole fix.
arch/alpha/kernel/smp.c is not built with CONFIG_SMP=n, so this is how
the same defect reaches a uniprocessor, where the flusher kworker
necessarily shares the only CPU with the writer.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-7-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/tlbflush.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
index 0c8529997f54e..9ae1902faf8ec 100644
--- a/arch/alpha/include/asm/tlbflush.h
+++ b/arch/alpha/include/asm/tlbflush.h
@@ -87,7 +87,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
{
struct mm_struct *mm = vma->vm_mm;
- if (mm == current->active_mm)
+ /* A targeted tbi() needs a thread of MM to be current. */
+ if (mm == current->mm)
flush_tlb_current_page(mm, vma, addr);
else
flush_tlb_other(mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 631/869] alpha: invalidate the local context in flush_tlb_mm()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 630/869] alpha: fix the local TLB invalidate in the UP flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 632/869] alpha: invalidate the local context in flush_icache_user_page() Greg Kroah-Hartman
` (245 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 721bb7a129771f0ff9cef1dd5abfc106ef65feba ]
flush_tlb_mm() has the same caller-CPU omission that was fixed in
flush_tlb_page(): when the target mm is not the calling CPU's active_mm
nothing happens locally, and smp_call_function() handles only the other
CPUs, so this CPU may later reuse the old ASN together with the
translations it still holds.
The active_mm test itself is left alone here. That path calls
flush_tlb_current(), which loads a fresh context through
__load_new_mm_context() rather than issuing a targeted tbi() against
whatever ASN happens to be loaded, so it does not depend on which context
is current.
The uniprocessor implementation in asm/tlbflush.h already has the missing
branch. Counted over a fork-heavy run, flush_tlb_mm() was entered with the
mm not this CPU's active_mm 2934 times, and 632 times while otherwise idle.
The proposed Alpha hugetlb support routes hugetlb invalidations through
flush_tlb_range(), which calls this function. Unmapping or migrating a
hugetlb folio from another context will also need this local invalidate.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-8-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index a5a42ae4a7d80..988e397b0b8a7 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -649,6 +649,9 @@ flush_tlb_mm(struct mm_struct *mm)
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
smp_call_function(ipi_flush_tlb_mm, mm, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 632/869] alpha: invalidate the local context in flush_icache_user_page()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 631/869] alpha: invalidate the local context in flush_tlb_mm() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 633/869] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() Greg Kroah-Hartman
` (244 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 4244c555ac440a445cc168f860b2677099d761f9 ]
flush_icache_user_page() has the same caller-CPU omission that the
previous patch fixed in flush_tlb_mm(): when the target mm is not the
calling CPU's active_mm nothing happens locally, and smp_call_function()
handles only the other CPUs, so this CPU may later reuse the old ASN
together with the translations it still holds.
This matters here in particular because the function exists for
operating on another process's mappings: the comment above it describes
setting breakpoints through ptrace, and access_remote_vm() reaches it
through copy_to_user_page(). The calling CPU is therefore often running
something other than the target mm.
As in flush_tlb_mm(), the uniprocessor implementation in
asm/cacheflush.h already has the missing case.
No imb() is needed, here or in ipi_flush_icache_page(). Alpha's
user-space I-cache flush works by allocating a new ASN rather than by
invalidating the I-cache: the entries stay, but they are tagged with the
old ASN and can no longer match. An imb() is only required when the ASN
space wraps and numbers are reused, and __get_new_mm_context() already
does one in that case.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-9-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 988e397b0b8a7..e21bc3920bece 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -758,6 +758,9 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
smp_call_function(ipi_flush_icache_page, mm, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 633/869] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 632/869] alpha: invalidate the local context in flush_icache_user_page() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 634/869] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms Greg Kroah-Hartman
` (243 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 16266d50c51eb5eb98f1c345c5aa9ff359a305aa ]
After the on_each_cpu() rendezvous, migrate_flush_tlb_page() walks the
other CPUs and zeroes their mm->context[cpu] when mm_users is at most one,
described as mimicking flush_tlb_mm()'s mm_users<=1 optimization.
It is not one. flush_tlb_mm() tests mm_users before deciding whether to
send the IPIs; here every CPU has already been visited and waited for, so
nothing is saved. The callback has also just set each CPU's own slot
correctly, so the loop only overwrites it, and does so while that CPU may
still be running in the address space.
Remove it. The shootdown shortcuts in flush_tlb_mm(), flush_tlb_page()
and flush_icache_user_page() clear remote slots too; once the next patch
removes those as well, every runtime update of mm->context[cpu] is made by
CPU cpu itself. That patch relies on the invariant when it reads those
slots to decide whether a shootdown can be skipped, so this one is tagged
for stable as its prerequisite.
Fixes: dd5712f3379c ("alpha: fix user-space corruption during memory compaction")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/mm/tlbflush.c | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index ccbc317b9a348..239c72b8a7412 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -90,22 +90,6 @@ void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
*/
preempt_disable();
on_each_cpu(ipi_flush_mm_and_page, &d, 1);
-
- /*
- * mimic flush_tlb_mm()'s mm_users<=1 optimization.
- */
- if (atomic_read(&mm->mm_users) <= 1) {
-
- int cpu, this_cpu;
- this_cpu = smp_processor_id();
-
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (READ_ONCE(mm->context[cpu]))
- WRITE_ONCE(mm->context[cpu], 0);
- }
- }
preempt_enable();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 634/869] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 633/869] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 635/869] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A Greg Kroah-Hartman
` (242 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit fe221b7b2d3ecd042dd391f74ff6a6fdeb7c2038 ]
flush_tlb_mm(), flush_tlb_page() and flush_icache_user_page() skip the
shootdown IPI when mm_users <= 1, on the assumption that no other CPU can
be running the mm. A task that borrows an mm through kthread_use_mm()
takes mmgrab() rather than mmget(), so it never appears in mm_users, and
kthread_use_mm() may be handed an mm that is already the caller's
active_mm and loaded on that CPU. Such a CPU was not only left without
an IPI, its mm->context[cpu] was cleared from under it.
mm->context[cpu] is already the record of which CPUs hold an ASN for the
mm. Test it rather than clearing it: take the shortcut only when no
other CPU has one, and otherwise fall through to the IPI, which
invalidates those CPUs properly. A CPU that merely ran the mm in the
past also holds a context and now costs an IPI, which errs in the safe
direction.
Change ipi_flush_tlb_mm(), ipi_flush_icache_page() and the migration
callback ipi_flush_mm_and_page() to test current->mm, like
ipi_flush_tlb_page(). A CPU that only retains the mm lazily then clears
its own slot through flush_tlb_other(), rather than publishing a new ASN
on every IPI or migration rendezvous. The migration callback still does
its per-VA tbi() afterwards. Returning to the mm allocates a fresh ASN
through ev5_switch_mm(), or through the direct-load path when
kthread_use_mm() switches current's mm.
Once these historical slots are gone, the shortcut is available again
if mm_users remains at most one and no other CPU has taken or kept a
context. An explicit kthread_use_mm() borrower has current->mm set and
still receives the invalidate it needs.
The caller-side tests in flush_tlb_mm() and flush_icache_user_page()
remain current->active_mm. A kernel thread that flushes its lazily held
mm can therefore publish its own context slot. Those branches also
perform the shortcut check, which excludes the calling CPU's slot, so
leave them unchanged. This is distinct from a remote lazy CPU keeping
its slot populated through repeated callbacks.
Together with the preceding patch, dropping these clearing loops leaves
every runtime write to mm->context[] targeting the writing CPU's own slot,
so the array becomes a lockless publication of which CPUs may be using the
mm, with a single writer per slot. Mark the two stores that are now
observed from other CPUs; flush_tlb_other() already uses WRITE_ONCE().
The uniprocessor flush_icache_user_page() is left alone, as nothing reads
another CPU's slot there, and init_new_context() runs before the mm is
shared.
Order the slot reads after the page-table changes with smp_mb(). On the
publishing CPU, the store in ev5_switch_mm() precedes the mb() in Alpha's
arch_spin_unlock(), when finish_lock_switch() drops the rq lock. This
relies on Alpha's unlock implementation, not a generic scheduler promise
of a full barrier on unlock; document that reliance at the store. Also
issue smp_mb() after publishing in __load_new_mm_context(), before loading
and using the mm.
This covers every caller, including check_mmu_context(), which can
publish a replacement after finish_lock_switch() has already run.
This requires the preceding removal of remote slot clearing from
migrate_flush_tlb_page(). It also requires the stale-TLB series to set
need_new_asn on both the reused and newly allocated ASN paths. Otherwise
an IPI between finish_lock_switch() and check_mmu_context() can zero a
new slot while asn_lock is set, and the task can return to user space
with a live ASN that the shortcut cannot see.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org> # 53ab52cfe5ce: alpha: load the MMU context when switch_mm() switches the current task
Cc: <stable@vger.kernel.org> # 01df8f401888: alpha: run check_mmu_context() from finish_arch_post_lock_switch()
Cc: <stable@vger.kernel.org> # ef43cfc28c42: alpha: only use a targeted tbi() when the target mm is really current
Cc: <stable@vger.kernel.org> # 738cf8f7a78f: alpha: invalidate the local context in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 62c92086f30e: alpha: fix the local TLB invalidate in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 3faee097b939: alpha: fix the local TLB invalidate in the UP flush_tlb_page()
Cc: <stable@vger.kernel.org> # b2c3b654bb64: alpha: invalidate the local context in flush_tlb_mm()
Cc: <stable@vger.kernel.org> # f19ae6f51a38: alpha: invalidate the local context in flush_icache_user_page()
Cc: <stable@vger.kernel.org> # 471e7f9c890b: alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 7 +++-
arch/alpha/kernel/smp.c | 52 ++++++++++++++--------------
arch/alpha/mm/fault.c | 4 ++-
arch/alpha/mm/tlbflush.c | 2 +-
4 files changed, 36 insertions(+), 29 deletions(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index f41d7c73fdd64..09f356934b90a 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -159,7 +159,12 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
mmc = next_mm->context[cpu];
if ((mmc ^ asn) & ~HARDWARE_ASN_MASK) {
mmc = __get_new_mm_context(next_mm, cpu);
- next_mm->context[cpu] = mmc;
+ /*
+ * Ordered before any user access through the mm by the
+ * mb() in arch_spin_unlock(), when finish_lock_switch()
+ * drops the rq lock.
+ */
+ WRITE_ONCE(next_mm->context[cpu], mmc);
}
#ifdef CONFIG_SMP
/* A deferred shootdown can also invalidate a newly allocated ASN. */
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e21bc3920bece..11768aa292a48 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -625,12 +625,30 @@ static void
ipi_flush_tlb_mm(void *x)
{
struct mm_struct *mm = x;
- if (mm == current->active_mm && !asn_locked())
+ if (mm == current->mm && !asn_locked())
flush_tlb_current(mm);
else
flush_tlb_other(mm);
}
+/* True if a CPU other than this one holds an ASN for MM. */
+static bool
+mm_context_elsewhere(struct mm_struct *mm)
+{
+ int cpu, this_cpu = smp_processor_id();
+
+ /* Pairs with the barrier the publishing CPU issues before using MM. */
+ smp_mb();
+
+ for_each_online_cpu(cpu) {
+ if (cpu == this_cpu)
+ continue;
+ if (READ_ONCE(mm->context[cpu]))
+ return true;
+ }
+ return false;
+}
+
void
flush_tlb_mm(struct mm_struct *mm)
{
@@ -638,14 +656,8 @@ flush_tlb_mm(struct mm_struct *mm)
if (mm == current->active_mm) {
flush_tlb_current(mm);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
@@ -690,14 +702,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
/* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current. */
if (mm == current->mm) {
flush_tlb_current_page(mm, vma, addr);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
@@ -728,7 +734,7 @@ static void
ipi_flush_icache_page(void *x)
{
struct mm_struct *mm = (struct mm_struct *) x;
- if (mm == current->active_mm && !asn_locked())
+ if (mm == current->mm && !asn_locked())
__load_new_mm_context(mm);
else
flush_tlb_other(mm);
@@ -747,14 +753,8 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
if (mm == current->active_mm) {
__load_new_mm_context(mm);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index f40ac0826a854..53e170e965915 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -46,7 +46,9 @@ __load_new_mm_context(struct mm_struct *next_mm)
struct pcb_struct *pcb;
mmc = __get_new_mm_context(next_mm, smp_processor_id());
- next_mm->context[smp_processor_id()] = mmc;
+ WRITE_ONCE(next_mm->context[smp_processor_id()], mmc);
+ /* Publish the context before this CPU can access the mm. */
+ smp_mb();
pcb = ¤t_thread_info()->pcb;
pcb->asn = mmc & HARDWARE_ASN_MASK;
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index 239c72b8a7412..a2aef90e6234b 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -66,7 +66,7 @@ static void ipi_flush_mm_and_page(void *x)
struct tlb_mm_and_addr *d = x;
/* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
- if (d->mm == current->active_mm && !asn_locked())
+ if (d->mm == current->mm && !asn_locked())
__load_new_mm_context(d->mm);
else
flush_tlb_other(d->mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 635/869] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 634/869] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 636/869] spi: ch341: handle transfers without a TX or RX buffer Greg Kroah-Hartman
` (241 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Maksimov, Vasiliy Kovalev,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit f6e8d5ebde5ceb7d3c0eef6e9e4d82862b503ade ]
ASUS X55A requires the same workaround like other machines with
VT1802, otherwise it loses the codec power on a few nodes and the
sound stays silent.
Link: https://bugzilla.altlinux.org/45606
Cc: <stable@vger.kernel.org>
Tested-by: Nikita Maksimov <nickstogramm@yandex.ru>
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://patch.msgid.link/20261017101257.215166-1-kovalev@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/via.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/via.c b/sound/hda/codecs/via.c
index 6becea9bb810c..b35eb727cf2ad 100644
--- a/sound/hda/codecs/via.c
+++ b/sound/hda/codecs/via.c
@@ -933,6 +933,7 @@ static const struct hda_fixup via_fixups[] = {
static const struct hda_quirk vt2002p_fixups[] = {
SND_PCI_QUIRK(0x1043, 0x13f7, "Asus B23E", VIA_FIXUP_POWER_SAVE),
SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+ SND_PCI_QUIRK(0x1043, 0x1c33, "Asus X55A", VIA_FIXUP_POWER_SAVE),
SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
{}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 636/869] spi: ch341: handle transfers without a TX or RX buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 635/869] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 637/869] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check Greg Kroah-Hartman
` (240 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 84182c48999f856c3865e4a537c244f9569c9f6c ]
ch341_transfer_one() unconditionally copies from trans->tx_buf into the
TX packet and hands trans->rx_buf to usb_bulk_msg() for the readback.
The SPI core allows half-duplex transfers where either of the buffers
is NULL, so a transfer without TX data crashes the kernel on the memcpy
and a transfer without RX data makes usb_bulk_msg() store the received
data at address 0.
The CH341A clocks data in both directions on every transfer; there is
no mode to disable a direction. Set SPI_CONTROLLER_MUST_TX and
SPI_CONTROLLER_MUST_RX so the SPI core fills in dummy buffers for
half-duplex transfers.
Fixes: 8846739f52af ("spi: add ch341a usb2spi driver")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013054339.77477-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ch341.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c
index 3eaa8f176f63a..170240a0dde89 100644
--- a/drivers/spi/spi-ch341.c
+++ b/drivers/spi/spi-ch341.c
@@ -189,6 +189,12 @@ static int ch341_probe(struct usb_interface *intf,
ctrl->transfer_one = ch341_transfer_one;
ctrl->set_cs = ch341_set_cs;
ctrl->auto_runtime_pm = false;
+ /*
+ * The CH341A SPI_STREAM command clocks data in both directions on
+ * every transfer, so the driver always needs a TX and an RX buffer;
+ * let the SPI core supply dummy buffers for half-duplex transfers.
+ */
+ ctrl->flags = SPI_CONTROLLER_MUST_TX | SPI_CONTROLLER_MUST_RX;
usb_set_intfdata(intf, ch341);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 637/869] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 636/869] spi: ch341: handle transfers without a TX or RX buffer Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 638/869] hwmon: (sht4x) Reject incomplete heater command transfers Greg Kroah-Hartman
` (239 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Verdonck, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Verdonck <tom.verdonck@inspiral.be>
[ Upstream commit ce3ff350c4a3b9466bd67bfe2adb2e3bea732b9e ]
sht4x stores in ->heating_complete the jiffies deadline at which the
current heater pulse finishes. It is set once at probe (to jiffies) and
only updated when the heater is explicitly enabled via sysfs, so in the
common case where the heater is never used it stays frozen at its probe
value.
->heating_complete is an unsigned long compared with time_before(),
whose signed difference is only meaningful while the two values are
within LONG_MAX jiffies of each other. Because the deadline is frozen,
jiffies keeps advancing away from it, and after 2^31 jiffies the
difference flips sign. On a 32-bit HZ=100 kernel that happens ~248.5
days after boot. time_before() in sht4x_read_values() then wrongly
reports that heating is still in progress and the read path executes
msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));
with a bogus, huge delta, blocking the temperature read for a very long
time instead of returning data. The heater_enable sysfs attributes are
affected the same way (spurious -EBUSY and "1" readback).
Store the deadline as a 64-bit jiffies value and compare it with
get_jiffies_64()/time_before64(), which does not wrap in any practical
uptime.
Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Tom Verdonck <tom.verdonck@inspiral.be>
Link: https://patch.msgid.link/7b2087ccb963e097cf3f6333efaec0c46549003b.1790358356.git.tom.verdonck@inspiral.be
[groeck: Squashed 'Fix torn read' patch into this one]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht4x.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index 5a76361bb1350..f757265a82a6d 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -67,7 +67,7 @@ DECLARE_CRC8_TABLE(sht4x_crc8_table);
*/
struct sht4x_data {
struct i2c_client *client;
- unsigned long heating_complete; /* in jiffies */
+ u64 heating_complete; /* in jiffies */
bool data_pending;
u32 heater_power; /* in milli-watts */
u32 heater_time; /* in milli-seconds */
@@ -92,14 +92,14 @@ static int sht4x_read_values(struct sht4x_data *data)
u8 crc;
u8 cmd[SHT4X_CMD_LEN] = {SHT4X_CMD_MEASURE_HPM};
u8 raw_data[SHT4X_RESPONSE_LENGTH];
- unsigned long curr_jiffies;
+ u64 curr_jiffies;
- curr_jiffies = jiffies;
- if (time_before(curr_jiffies, data->heating_complete))
+ curr_jiffies = get_jiffies_64();
+ if (time_before64(curr_jiffies, data->heating_complete))
msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));
if (data->data_pending &&
- time_before(jiffies, data->heating_complete + data->update_interval)) {
+ time_before64(get_jiffies_64(), data->heating_complete + data->update_interval)) {
data->data_pending = false;
} else {
next_update = data->last_updated +
@@ -237,7 +237,9 @@ static ssize_t heater_enable_show(struct device *dev,
{
struct sht4x_data *data = dev_get_drvdata(dev);
- return sysfs_emit(buf, "%u\n", time_before(jiffies, data->heating_complete));
+ guard(hwmon_lock)(dev);
+
+ return sysfs_emit(buf, "%u\n", time_before64(get_jiffies_64(), data->heating_complete));
}
static ssize_t heater_enable_store(struct device *dev,
@@ -279,14 +281,14 @@ static ssize_t heater_enable_store(struct device *dev,
guard(hwmon_lock)(dev);
- if (time_before(jiffies, data->heating_complete))
+ if (time_before64(get_jiffies_64(), data->heating_complete))
return -EBUSY;
ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
if (ret < 0)
return ret;
- data->heating_complete = jiffies + msecs_to_jiffies(heating_time_bound);
+ data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
data->data_pending = true;
return count;
}
@@ -410,7 +412,7 @@ static int sht4x_probe(struct i2c_client *client)
data->client = client;
data->heater_power = 200;
data->heater_time = 1000;
- data->heating_complete = jiffies;
+ data->heating_complete = get_jiffies_64();
crc8_populate_msb(sht4x_crc8_table, SHT4X_CRC8_POLYNOMIAL);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 638/869] hwmon: (sht4x) Reject incomplete heater command transfers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 637/869] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 639/869] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Greg Kroah-Hartman
` (238 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 0e1d292233c83d41530df6ffa4ec5a382f118b12 ]
heater_enable_store() treats a zero return from i2c_master_send() as
success. It updates the heater state and returns count, so another
attempt to enable the heater fails with -EBUSY.
i2c-virtio can return zero when the first message fails. Require
SHT4X_CMD_LEN before updating the heater state, as sht4x_probe()
already does for the reset command.
Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261017205234.1084949-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht4x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index f757265a82a6d..83dc3ca67046b 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -287,6 +287,8 @@ static ssize_t heater_enable_store(struct device *dev,
ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
if (ret < 0)
return ret;
+ if (ret != SHT4X_CMD_LEN)
+ return -EIO;
data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
data->data_pending = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 639/869] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 638/869] hwmon: (sht4x) Reject incomplete heater command transfers Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 640/869] lib/buildid: reject file offsets that do not fit in pgoff_t Greg Kroah-Hartman
` (237 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0f98b0c0bdeaab2dc2fd,
Sanan Hasanov, Guenter Roeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanan Hasanov <sanan.hasanov@ucf.edu>
[ Upstream commit e4fdc82f55cf0e3d5df5c88278da5baa76a109d1 ]
ccp_raw_event() is the HID ->raw_event() callback and takes
wait_input_report_lock with a plain spin_lock(). This callback can run
in very different contexts depending on the transport: from process
context (e.g. uhid, via a write() to /dev/uhid) with softirqs and
interrupts enabled, and from URB completion, which is softirq context
for HCDs using HCD_BH and hard interrupt context for HCDs that do not
(e.g. OHCI, UHCI).
Taking the lock from process context with softirqs enabled while the
same lock is also taken from softirq context can deadlock if the
softirq interrupts the lock holder on the same CPU. Lockdep reports:
WARNING: inconsistent lock state
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
...
spin_lock include/linux/spinlock.h:347 [inline]
ccp_raw_event+0x51/0x110 drivers/hwmon/corsair-cpro.c:161
__hid_input_report+0x41c/0x580 drivers/hid/hid-core.c:2175
hid_irq_in+0x492/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x378/0x540 drivers/usb/core/hcd.c:1657
dummy_timer+0xa91/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:2023
For the same reason, the spin_lock_bh() in send_usb_cmd() is not
sufficient when ccp_raw_event() is called from hard interrupt context.
Use spin_lock_irqsave() in ccp_raw_event(), since it may be called with
interrupts already disabled, and spin_lock_irq() in send_usb_cmd(),
which always runs in process context.
Fixes: d02abd57e794 ("hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock")
Reported-by: syzbot+0f98b0c0bdeaab2dc2fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0f98b0c0bdeaab2dc2fd
Cc: stable@vger.kernel.org
Signed-off-by: Sanan Hasanov <sanan.hasanov@ucf.edu>
Link: https://patch.msgid.link/20261008205310.30832-1-sanan.hasanou@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/corsair-cpro.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c
index bf7775a731fbe..17bb080eb9bb6 100644
--- a/drivers/hwmon/corsair-cpro.c
+++ b/drivers/hwmon/corsair-cpro.c
@@ -135,9 +135,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
* the raw event parsing and marked the ccp->wait_input_report
* completion as done.
*/
- spin_lock_bh(&ccp->wait_input_report_lock);
+ spin_lock_irq(&ccp->wait_input_report_lock);
reinit_completion(&ccp->wait_input_report);
- spin_unlock_bh(&ccp->wait_input_report_lock);
+ spin_unlock_irq(&ccp->wait_input_report_lock);
ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);
if (ret < 0)
@@ -156,15 +156,16 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
{
struct ccp_device *ccp = hid_get_drvdata(hdev);
+ unsigned long flags;
/* only copy buffer when requested */
- spin_lock(&ccp->wait_input_report_lock);
+ spin_lock_irqsave(&ccp->wait_input_report_lock, flags);
if (!completion_done(&ccp->wait_input_report)) {
memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
ccp->buffer_recv_size = size;
complete_all(&ccp->wait_input_report);
}
- spin_unlock(&ccp->wait_input_report_lock);
+ spin_unlock_irqrestore(&ccp->wait_input_report_lock, flags);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 640/869] lib/buildid: reject file offsets that do not fit in pgoff_t
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 639/869] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 641/869] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT Greg Kroah-Hartman
` (236 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Andrii Nakryiko,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
[ Upstream commit 0007654a7bf13ef2a19afd398bbc6507087f19fd ]
On a 32-bit kernel, parsing the build ID of a crafted ELF file can copy
far more than the intended bytes into a 64-byte on-stack buffer in
__build_id_parse(), corrupting the stack of whatever context fetches the
build ID. This might be reachable without privilege: perf records a build ID
for PERF_RECORD_MMAP2 on the no-fault path when a process mmaps its own file
(build_id_parse_nofault() from perf_event_mmap()), and BPF build-id stack
maps do the same.
freader_get_folio() turns a 64-bit file offset into a page cache index
with file_off >> PAGE_SHIFT and passes it to filemap_get_folio().
pgoff_t is unsigned long, 32-bit on a 32-bit kernel, so an ELF64 e_phoff
of 2^44 + k * PAGE_SIZE truncates to index k. filemap_get_folio()
returns the cached folio at index k, whose folio_pos() is far below the
requested file_off. In freader_fetch() the folio does not contain
file_off, so the "crossing folio boundaries" path computes
part_sz = folio_off + folio_sz - file_off as a large u64 (file_off is
much larger), and the following memcpy() truncates it to size_t and
copies a page into the 64-byte buffer. On a 64-bit kernel the index is
not truncated, the folio is not cached and the fetch returns -EFAULT, so
only 32-bit kernels are affected.
Reject a file offset that cannot be represented as a page cache index
before the lookup, so such a file fails the build ID parse cleanly as it
already does on 64-bit.
Reproduced on i386 under QEMU with CONFIG_STACKPROTECTOR_STRONG: mmapping
a crafted ELF (ELFCLASS64, e_phoff = 2^44) while a perf event with
attr.build_id is open panics with "stack-protector: Kernel stack is
corrupted in: __build_id_parse"; with this patch the parse returns
-EFAULT and the mmap completes cleanly. Built for i386 with W=1, no new
warnings.
Fixes: de3ec364c3c3 ("lib/buildid: add single folio-based file reader abstraction")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/buildid.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/buildid.c b/lib/buildid.c
index ef112a7084ef1..015a1f9d2b48b 100644
--- a/lib/buildid.c
+++ b/lib/buildid.c
@@ -66,6 +66,10 @@ static int freader_get_folio(struct freader *r, loff_t file_off)
freader_put_folio(r);
+ /* the page index must fit in pgoff_t */
+ if (file_off < 0 || file_off > MAX_LFS_FILESIZE)
+ return -EFAULT;
+
/* only use page cache lookup - fail if not already cached */
r->folio = filemap_get_folio(r->file->f_mapping, file_off >> PAGE_SHIFT);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 641/869] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 640/869] lib/buildid: reject file offsets that do not fit in pgoff_t Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 642/869] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA Greg Kroah-Hartman
` (235 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Ambrozewicz, Kent Gibson,
Bartosz Golaszewski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
[ Upstream commit 974d2712cb15014019595799b3ed68fef5fe9695 ]
When a line is requested or reconfigured through the v2 uAPI,
gpio_v2_line_config_flags_to_desc_flags() copies the requested
configuration into the descriptor flags, GPIOD_FLAG_IS_OUT included,
before gpiod_direction_input_nonotify() or
gpiod_direction_output_nonotify() asks the driver for the direction.
If the driver refuses, for instance with -EOPNOTSUPP from
.direction_input() for a line that can only be an output, the ioctl
fails but the flag keeps the refused direction. gpiod_free_commit()
does not touch GPIOD_FLAG_IS_OUT, so this outlives the failed request,
and GPIO_V2_GET_LINEINFO_IOCTL reports the line as an input while the
hardware still drives it, until a request without direction flags
makes gpiod_request_commit() read the direction back from the driver:
GPIO_V2_GET_LINE_IOCTL, line 0, input: -EOPNOTSUPP
GPIO_V2_GET_LINEINFO_IOCTL, line 0: input
GPIO_V2_GET_LINE_IOCTL, line 0, no direction: ok
GPIO_V2_GET_LINEINFO_IOCTL, line 0: output
GPIO_V2_LINE_SET_CONFIG_IOCTL updates the flags in the same order.
There the line stays requested, and since commit 92ac7de3175e
("gpiolib: don't allow setting values on input lines")
GPIO_V2_LINE_SET_VALUES_IOCTL on it then fails with -EPERM, though the
line is still an output. A line whose driver refuses to make it an
output is likewise reported as one.
gpiod_direction_input_nonotify() and gpiod_direction_output_nonotify()
set or clear GPIOD_FLAG_IS_OUT themselves once the driver has accepted
the direction, emulated open drain and open source included, and
nothing between the copy and those calls reads the flag. Leave it to
them, as the v1 uAPI already does.
The other flags that the helper copies stay as they are. Active low,
drive and bias are what gpiod_direction_*() applies, drive and bias
possibly before the driver refuses the direction; edges and event
clock are the character device's own. None of them is read back from
the driver, so there is no earlier state that is more accurate to go
back to. A failed request releases the line, which clears them, and a
failed reconfiguration leaves the line, like the lines before it, with
what was applied up to the failure.
Reproduced under QEMU with a test GPIO chip whose line 0 refuses input
and line 1 refuses output: both refused requests and both refused
reconfigurations leave the line info with the refused direction, and
setting the value of the reconfigured output fails with -EPERM. With
this change the line info shows the direction of the hardware in all
four cases and setting the value works. First seen on real hardware
with v6.12.
Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Reviewed-by: Kent Gibson <warthog618@gmail.com>
Link: https://patch.msgid.link/20261016-gpiolib-cdev-direction-v2-1-aambrozewicz@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-cdev.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index d67d361cc4562..1afda8ea5769b 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -1253,11 +1253,6 @@ static void gpio_v2_line_config_flags_to_desc_flags(u64 lflags,
assign_bit(GPIOD_FLAG_ACTIVE_LOW, &flags,
lflags & GPIO_V2_LINE_FLAG_ACTIVE_LOW);
- if (lflags & GPIO_V2_LINE_FLAG_OUTPUT)
- set_bit(GPIOD_FLAG_IS_OUT, &flags);
- else if (lflags & GPIO_V2_LINE_FLAG_INPUT)
- clear_bit(GPIOD_FLAG_IS_OUT, &flags);
-
assign_bit(GPIOD_FLAG_EDGE_RISING, &flags,
lflags & GPIO_V2_LINE_FLAG_EDGE_RISING);
assign_bit(GPIOD_FLAG_EDGE_FALLING, &flags,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 642/869] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 641/869] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 643/869] netfilter: nf_reject: initialize IPCB at inet ingress Greg Kroah-Hartman
` (234 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, George Christidis, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Christidis <gxristidis@gmail.com>
[ Upstream commit 40409fa23d32c8ed51e832031daa6decd9d6fd11 ]
The UX3402VA (1043:16a3) BIOS leaves pin 0x19 unconfigured, so the
headset mic does not work. Use ALC294_FIXUP_ASUS_SPI_HEADSET_MIC like
the UX3405MA, it sets up the mic and keeps the CS35L41 speaker fixup.
Tested on a UX3402VA: headset mic, internal mic and speakers work.
Fixes: 07058dceb038 ("ALSA: hda/realtek: Splitting the UX3402 into two separate models")
Cc: stable@vger.kernel.org
Signed-off-by: George Christidis <gxristidis@gmail.com>
Link: https://patch.msgid.link/20261018-for-linus-v1-1-4d8e9ff27d89@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index c81ecda4e7b6e..404a93f552cb4 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7222,7 +7222,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1664, "ASUS ExpertBook PM3406CHA", ALC256_FIXUP_ASUS_PM3406CHA),
SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
- SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
SND_PCI_QUIRK(0x1043, 0x16d3, "ASUS UX5304VA", ALC245_FIXUP_CS35L41_SPI_2),
SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 643/869] netfilter: nf_reject: initialize IPCB at inet ingress
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 642/869] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 644/869] hwmon: (coretemp) Fix handling of isolated SMT siblings Greg Kroah-Hartman
` (233 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Lee,
Pablo Neira Ayuso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit 73a73d442f9986353fe284bd1b504d0313d0f153 ]
The inet ingress hook runs before ip_rcv_core() and ip6_rcv_core(), so
neither IPCB nor IP6CB has been initialized when nft_reject_inet passes
a packet to nf_send_unreach() or nf_send_unreach6(). skb->cb can
therefore retain metadata from an earlier protocol layer.
For IPv4, icmp_send() treats IPCB(skb)->opt as parsed IPv4 options.
Stale option offsets can make __ip_options_echo() copy an
attacker-controlled length into its 40-byte reply option buffer and
overflow the stack. On an unpatched v7.2-rc5 kernel, the IPv4
reproducer produced:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo()
Write of size 255
For IPv6, icmpv6_send() consumes IP6CB(skb) as parsed IPv6 metadata. It
always uses iif for source selection and, when MIP6 is enabled, uses
dsthao as an extension-header offset. These fields must not be stale.
For NF_INET_INGRESS, clear the address-family-specific control block and
restore its input interface before constructing the ICMP error. This
matches similar initialization normally performed by ip_rcv_core() and
ip6_rcv_core().
Fixes: 117ca1f8920c ("netfilter: nft_reject_inet: allow to use reject from inet ingress")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/netfilter/nf_reject_ipv4.c | 5 +++++
net/ipv6/netfilter/nf_reject_ipv6.c | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 59ec465a9df98..7cb33af671e26 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -357,6 +357,11 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
if (!skb_valid_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
return;
+ if (hook == NF_INET_INGRESS) {
+ memset(IPCB(skb_in), 0, sizeof(*IPCB(skb_in)));
+ IPCB(skb_in)->iif = skb_in->skb_iif;
+ }
+
if (skb_csum_unnecessary(skb_in) ||
!nf_reject_verify_csum(skb_in, dataoff, proto)) {
icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 07cdaa10da0d0..5e08d8529cc88 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -444,6 +444,11 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
skb_in->dev = net->loopback_dev;
+ if (hooknum == NF_INET_INGRESS) {
+ memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
+ IP6CB(skb_in)->iif = skb_in->skb_iif;
+ }
+
if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 644/869] hwmon: (coretemp) Fix handling of isolated SMT siblings
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 643/869] netfilter: nf_reject: initialize IPCB at inet ingress Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 645/869] hwmon: (gigabyte_waterforce) reject short input reports Greg Kroah-Hartman
` (232 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcelo Tosatti, Ximing Zhang,
Asaf Nuri Bertizlioğlu, Guenter Roeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ximing Zhang <xzhangjr@gmail.com>
[ Upstream commit 37c1974a0ec4ec4624a270291a179c53f8f4fbca ]
Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to
isolated CPUs") prevents create_core_data() from creating temperature
data for an isolated CPU. coretemp_cpu_online(), however, still adds
that CPU to pdata->cpumask.
When an isolated SMT thread is processed before a housekeeping sibling,
the mask makes coretemp_cpu_online() believe that the core is already
represented. The housekeeping sibling then gets no temperature
attributes. Package attributes are similarly not retried when the first
CPU processed in a die is isolated.
The mask is also used to select a replacement CPU when a sensor target
goes offline. Including isolated CPUs permits the driver to retarget a
sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an
isolated CPU.
Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check
to coretemp_cpu_online(). Sensor creation is then deferred to an eligible
CPU, and hotplug replacement targets remain on housekeeping CPUs.
Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with
nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock
driver omitted Core 1 after module load and retained its readable sensor
after CPU 5 was offlined. The patched driver exposed Core 1, removed it
when CPU 5 went offline, and restored it when CPU 5 returned.
Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs")
Cc: stable@vger.kernel.org
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Ximing Zhang <xzhangjr@gmail.com>
Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index e8697d6b9998a..c9b7e435eda81 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -559,9 +559,6 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
u32 eax, edx;
int err;
- if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
- return 0;
-
tdata = init_temp_data(pdata, cpu, pkg_flag);
if (!tdata)
return -ENOMEM;
@@ -681,6 +678,14 @@ static int coretemp_cpu_online(unsigned int cpu)
if (!cpu_has(c, X86_FEATURE_DTHERM))
return -ENODEV;
+ /*
+ * Keep isolated CPUs out of pdata->cpumask. Besides tracking the CPUs
+ * available to this driver, the mask is used to select the CPU on which
+ * to read the temperature MSRs.
+ */
+ if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
+ return 0;
+
pdata = platform_get_drvdata(pdev);
if (!pdata->hwmon_dev) {
struct device *hwmon;
@@ -710,8 +715,8 @@ static int coretemp_cpu_online(unsigned int cpu)
}
/*
- * Check whether a thread sibling is already online. If not add the
- * interface for this CPU core.
+ * Check whether a housekeeping thread sibling is already online. If
+ * not, add the interface for this CPU core.
*/
if (!cpumask_intersects(&pdata->cpumask, topology_sibling_cpumask(cpu)))
coretemp_add_core(pdev, cpu, 0);
@@ -741,9 +746,9 @@ static int coretemp_cpu_offline(unsigned int cpu)
cpumask_clear_cpu(cpu, &pd->cpumask);
/*
- * If this is the last thread sibling, remove the CPU core
- * interface, If there is still a sibling online, transfer the
- * target cpu of that core interface to it.
+ * If this is the last housekeeping thread sibling, remove the CPU core
+ * interface. If there is still a housekeeping sibling online, transfer
+ * the target CPU of that core interface to it.
*/
target = cpumask_any_and(&pd->cpumask, topology_sibling_cpumask(cpu));
if (target >= nr_cpu_ids) {
@@ -755,7 +760,8 @@ static int coretemp_cpu_offline(unsigned int cpu)
}
/*
- * If all cores in this pkg are offline, remove the interface.
+ * If all housekeeping cores in this pkg are offline, remove the
+ * interface.
*/
tdata = get_temp_data(pd, -1);
if (cpumask_empty(&pd->cpumask)) {
@@ -768,7 +774,7 @@ static int coretemp_cpu_offline(unsigned int cpu)
/*
* Check whether this core is the target for the package
- * interface. We need to assign it to some other cpu.
+ * interface. We need to assign it to some other housekeeping CPU.
*/
if (tdata && tdata->cpu == cpu) {
target = cpumask_first(&pd->cpumask);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 645/869] hwmon: (gigabyte_waterforce) reject short input reports
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 644/869] hwmon: (coretemp) Fix handling of isolated SMT siblings Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 646/869] f2fs: flush SIT journal during filesystem resize Greg Kroah-Hartman
` (231 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 400be69515c327ced60082b27ede902a8d93cbdb ]
The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.
Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.
Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/gigabyte_waterforce.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c
index 4eea05f8b569c..f4d0376dd68e0 100644
--- a/drivers/hwmon/gigabyte_waterforce.c
+++ b/drivers/hwmon/gigabyte_waterforce.c
@@ -257,6 +257,9 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
{
struct waterforce_data *priv = hid_get_drvdata(hdev);
+ if (size <= FIRMWARE_VER_START_OFFSET_2)
+ return 0;
+
if (data[0] == get_firmware_ver_cmd[0] && data[1] == get_firmware_ver_cmd[1]) {
/* Received a firmware version report */
priv->firmware_version =
@@ -269,6 +272,8 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
if (data[0] != get_status_cmd[0] || data[1] != get_status_cmd[1])
return 0;
+ if (size <= WATERFORCE_TEMP_SENSOR)
+ return 0;
priv->temp_input[0] = data[WATERFORCE_TEMP_SENSOR] * 1000;
priv->speed_input[0] = get_unaligned_le16(data + WATERFORCE_FAN_SPEED);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 646/869] f2fs: flush SIT journal during filesystem resize
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 645/869] hwmon: (gigabyte_waterforce) reject short input reports Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 647/869] f2fs: fix submit accounting for IPU writeback Greg Kroah-Hartman
` (230 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Daeho Jeong,
Chao Yu, Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
[ Upstream commit a6ede405455106bf42164ec96fd84008c5aabdd9 ]
During a filesystem resize, SBI_IS_RESIZEFS prevents new SIT entries
from being added to the journal and forces existing entries to the SIT
area. However, f2fs_flush_sit_entries() returns early when there are no
new dirty sentries, leaving existing journal entries behind.
After the main area shrinks, a later checkpoint can access a journal
entry whose segment number is outside the new geometry and trigger
f2fs_bug_on().
Only take the zero-dirty fast path when entries may be written back to
the journal. This lets resize drain existing entries through
remove_sits_in_journal() even when there are no new dirty sentries.
Cc: stable@kernel.org
Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 510d073f8ec54..23f9b76ee0145 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4687,7 +4687,7 @@ void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc)
down_write(&sit_i->sentry_lock);
- if (!sit_i->dirty_sentries)
+ if (!sit_i->dirty_sentries && to_journal)
goto out;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 647/869] f2fs: fix submit accounting for IPU writeback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 646/869] f2fs: flush SIT journal during filesystem resize Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 648/869] dax: fix wrong error code returned from dax_dedupe_file_range_compare() Greg Kroah-Hartman
` (229 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Seongjae Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seongjae Jeong <jsjlee1020@gmail.com>
[ Upstream commit 6d1f622b9c069378cdb83088be2b15a9b480b8a3 ]
f2fs_write_cache_pages() uses the submitted count, which is set to
fio.submitted in f2fs_write_single_data_page(), to update nwritten
and decrement wbc->nr_to_write.
In the OPU path, f2fs_submit_page_write() sets fio->submitted to 1.
However, in the IPU path, fio->submitted is never set and remains zero.
As a result, successful IPU writes are not accounted for.
This can cause asynchronous writeback to continue beyond its budget.
Set fio->submitted in f2fs_inplace_write_data() after a page is
successfully merged into a bio or submitted, so that successful
IPU writes are included in the writeback accounting.
Cc: stable@kernel.org
Fixes: d68f735b3bc9 ("f2fs: check io submission more precisely")
Signed-off-by: Seongjae Jeong <jsjlee1020@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 23f9b76ee0145..46f14f891843c 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4087,6 +4087,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
else
err = f2fs_submit_page_bio(fio);
if (!err) {
+ fio->submitted = 1;
f2fs_update_device_state(fio->sbi, fio->ino,
fio->new_blkaddr, 1);
f2fs_update_iostat(fio->sbi, fio_inode(fio),
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 648/869] dax: fix wrong error code returned from dax_dedupe_file_range_compare()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 647/869] f2fs: fix submit accounting for IPU writeback Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 649/869] rtc: cmos: Disable ACPI RTC event before handling it Greg Kroah-Hartman
` (228 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Jan Kara,
Darrick J. Wong, Alison Schofield, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit 9b036546a02c6c9a5133f9c1e93503896595c6ba ]
When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
positive return value from iomap_iter() indicating more iterations remain.
This positive value leaks to the caller, where vfs_dedupe_file_range()
interprets it as success (bytes_deduped = len), causing userspace to
incorrectly believe deduplication completed.
Return 'status' instead to propagate the actual error code.
Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261015143426.17620-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dax.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dax.c b/fs/dax.c
index 155f8024b30df..30d0c7e4b30cb 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2235,7 +2235,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
status = dax_range_compare_iter(&src_iter, &dst_iter,
min(src_iter.len, dst_iter.len), same);
if (status < 0)
- return ret;
+ return status;
src_iter.status = dst_iter.status = status;
}
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 649/869] rtc: cmos: Disable ACPI RTC event before handling it
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 648/869] dax: fix wrong error code returned from dax_dedupe_file_range_compare() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 650/869] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() Greg Kroah-Hartman
` (227 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta),
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 3f67038df8b5cba07254d1cff60d73e988b49ab7 ]
Users of RTC_UIE_ON can stop receiving update interrupts when rtc-cmos
handles alarms through ACPI. In one 50-run test, 40 runs passed and 10
timed out after receiving between one and four of five expected events.
The ACPI ff_rt_clk counter stopped at 218, exactly matching the number
of events delivered to userspace, and reported:
218 STS disabled unmasked
rtc_handler() runs in the threaded ACPI SCI handler and calls
cmos_interrupt(), which schedules rtc->irqwork. The work can run before
rtc_handler() returns:
ACPI SCI thread rtc->irqwork
cmos_interrupt()
schedule_work()
__rtc_set_alarm()
rtc_wake_on()
acpi_clear_event()
acpi_disable_event()
The SCI thread then disables the event that the worker enabled for the
next alarm. That alarm sets its status while delivery remains disabled,
so no update interrupt reaches userspace.
Clear and disable the current ACPI RTC event before cmos_interrupt()
schedules the work. The worker can then enable the next event without
the handler undoing it. With this ordering, 150 runs delivered all 750
events without a stall.
Fixes: 311ee9c151ad ("rtc: cmos: allow using ACPI for RTC alarm instead of HPET")
Cc: stable@vger.kernel.org
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Link: https://patch.msgid.link/20261015173029.3091872-2-gourry@gourry.net
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-cmos.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b537f40654b72..9dfa1f4ef7ff6 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -753,7 +753,9 @@ static u32 rtc_handler(void *context)
unsigned char rtc_intr;
unsigned long flags;
-
+ /* Quiesce this event before rtc->irqwork can arm the next one. */
+ acpi_clear_event(ACPI_EVENT_RTC);
+ acpi_disable_event(ACPI_EVENT_RTC, 0);
/*
* Always update rtc irq when ACPI is used as RTC Alarm.
* Or else, ACPI SCI is enabled during suspend/resume only,
@@ -776,8 +778,6 @@ static u32 rtc_handler(void *context)
}
pm_wakeup_hard_event(dev);
- acpi_clear_event(ACPI_EVENT_RTC);
- acpi_disable_event(ACPI_EVENT_RTC, 0);
return ACPI_INTERRUPT_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 650/869] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 649/869] rtc: cmos: Disable ACPI RTC event before handling it Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 651/869] rtc: pcf8563: pass the driver data to the alarm interrupt handler Greg Kroah-Hartman
` (226 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Mario Limonciello (AMD),
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit 22b9306f1fcf86f80b55f05f08d10a9951ba970a ]
amd_pmc_verify_czn_rtc() opens the RTC with rtc_class_open(), which
takes both a device reference and a module reference on the RTC
driver. The matching release is rtc_class_close(), and it is never
called. Every return path after the device has been opened, the ones
that return 0 as well as the ones that report an error, leaves both
references behind, so each S0i3 suspend leaks them.
Release the reference with a __free() cleanup on the declaration,
which covers every return path without adding labels.
rtc_class_close() does not accept a NULL argument, so the cleanup
helper has to guard against one: rtc_class_open() may fail and the
declaration still has to be cleaned up.
Found by code review.
Fixes: 59348401ebed ("platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261011121759.3267678-1-make_ruc2021@163.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 5 +++--
include/linux/rtc.h | 2 ++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index fea41c8c1899a..8abb80e1803f9 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -14,6 +14,7 @@
#include <linux/array_size.h>
#include <linux/bitfield.h>
#include <linux/bits.h>
+#include <linux/cleanup.h>
#include <linux/debugfs.h>
#include <linux/delay.h>
#include <linux/dmi.h>
@@ -554,7 +555,6 @@ static int amd_pmc_wa_irq1(struct amd_pmc_dev *pdev)
static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
{
- struct rtc_device *rtc_device;
time64_t then, now, duration;
struct rtc_wkalrm alarm;
struct rtc_time tm;
@@ -570,7 +570,8 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
if (pdev->major < 64 || (pdev->major == 64 && pdev->minor < 53))
return 0;
- rtc_device = rtc_class_open("rtc0");
+ struct rtc_device *rtc_device __free(rtc_class_close) =
+ rtc_class_open("rtc0");
if (!rtc_device)
return 0;
rc = rtc_read_alarm(rtc_device, &alarm);
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 95da051fb155d..116ac3cd5d54e 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -13,6 +13,7 @@
#define _LINUX_RTC_H_
+#include <linux/cleanup.h>
#include <linux/types.h>
#include <linux/interrupt.h>
#include <linux/nvmem-provider.h>
@@ -199,6 +200,7 @@ extern void rtc_update_irq(struct rtc_device *rtc,
extern struct rtc_device *rtc_class_open(const char *name);
extern void rtc_class_close(struct rtc_device *rtc);
+DEFINE_FREE(rtc_class_close, struct rtc_device *, if (_T) rtc_class_close(_T));
extern int rtc_irq_set_state(struct rtc_device *rtc, int enabled);
extern int rtc_irq_set_freq(struct rtc_device *rtc, int freq);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 651/869] rtc: pcf8563: pass the driver data to the alarm interrupt handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 650/869] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 652/869] hwmon: (sht3x) Return the consumed count for heater writes Greg Kroah-Hartman
` (225 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Velkov, Nobuhiro Iwamtasu,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Velkov <iav@iav.lv>
[ Upstream commit 5831f5fef10030c175e585d51b0e793dc6fef6ab ]
pcf8563_irq() takes its dev_id as struct pcf8563, but probe still
registers the interrupt with the i2c client. The handler then takes the
regmap pointer from the wrong structure: the first alarm oopses, the
level-low INT is never acknowledged, and the interrupt gets disabled as
spurious.
Only an RTC that has an interrupt (client->irq > 0) reaches this path.
Fixes: 00f1bb9b8486 ("rtc: pcf8563: Switch to regmap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Igor Velkov <iav@iav.lv>
Reviewed-by: Nobuhiro Iwamtasu <iwamatsu@nigauri.org>
Link: https://patch.msgid.link/20261004-pcf8563-irq-data-v1-1-f176763ddf2f@iav.lv
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-pcf8563.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 7083d927820f9..c23f04bdd95ff 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -531,7 +531,7 @@ static int pcf8563_probe(struct i2c_client *client)
err = devm_request_threaded_irq(&client->dev, client->irq,
NULL, pcf8563_irq,
IRQF_SHARED | IRQF_ONESHOT | irqflags,
- pcf8563_driver.driver.name, client);
+ pcf8563_driver.driver.name, pcf8563);
if (err) {
dev_err(&client->dev, "unable to request IRQ %d\n",
client->irq);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 652/869] hwmon: (sht3x) Return the consumed count for heater writes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 651/869] rtc: pcf8563: pass the driver data to the alarm interrupt handler Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 653/869] hwmon: (acpi_power_meter) Fix 18.45 TW bug Greg Kroah-Hartman
` (224 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 817ac527100c8e20684211eb919ffd6d875adc7a ]
heater_enable_store() returns the result of i2c_master_send(), which is
the two-byte command length on success rather than the sysfs input
count. This can report more bytes than were supplied, or a partial write
for a fully processed input. For example, writing "on\n" returns two
instead of three, so a caller retrying the remaining newline gets
-EINVAL even though the heater command succeeded. Retrying the remainder
of "off\n" can also send the heater-off command twice.
Return count after a complete command transfer. Preserve negative I2C
errors and return -EIO for nonnegative incomplete transfers, so a
zero-message transfer is not reported as a successful zero-byte write.
Keep the existing boolean parsing, command selection and locking.
Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht3x.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/sht3x.c b/drivers/hwmon/sht3x.c
index 5d04013efb522..c3e68bde709df 100644
--- a/drivers/hwmon/sht3x.c
+++ b/drivers/hwmon/sht3x.c
@@ -543,7 +543,10 @@ static ssize_t heater_enable_store(struct device *dev,
mutex_unlock(&data->i2c_lock);
- return ret;
+ if (ret != SHT3X_CMD_LENGTH)
+ return ret < 0 ? ret : -EIO;
+
+ return count;
}
static int update_interval_read(struct device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 653/869] hwmon: (acpi_power_meter) Fix 18.45 TW bug
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 652/869] hwmon: (sht3x) Return the consumed count for heater writes Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 654/869] Input: always accept EV_SYN in input_event() Greg Kroah-Hartman
` (223 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Grant Slater, Armin Wolf,
Guenter Roeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 0b6eda22f9ab67ddb2a872b0c3fc578ad9f4e27e ]
The ACPI specification says:
"If an error occurs while obtaining the meter reading or if the value
is not available then an Integer with all bits set is returned"
This integer can also be 64-bit wide on ACPI 2.0 and later systems,
so we have to check for that too.
Compile-tested only.
Reported-by: Grant Slater <github@firefishy.com>
Closes: https://github.com/lm-sensors/lm-sensors/issues/460
Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug")
Cc: stable@vger.kernel.org
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/acpi_power_meter.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index de408df0c4d78..667dffde33015 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -10,6 +10,7 @@
#include <linux/hwmon.h>
#include <linux/hwmon-sysfs.h>
#include <linux/jiffies.h>
+#include <linux/limits.h>
#include <linux/mutex.h>
#include <linux/dmi.h>
#include <linux/slab.h>
@@ -31,7 +32,12 @@
#define POWER_METER_CAN_NOTIFY (1 << 3)
#define POWER_METER_IS_BATTERY (1 << 8)
#define UNKNOWN_HYSTERESIS 0xFFFFFFFF
-#define UNKNOWN_POWER 0xFFFFFFFF
+/*
+ * ACPI integers can either be 32-bit or 64-bit wide, so
+ * we have to check for both values.
+ */
+#define UNKNOWN_POWER_32 U32_MAX
+#define UNKNOWN_POWER_64 U64_MAX
#define METER_NOTIFY_CONFIG 0x80
#define METER_NOTIFY_TRIP 0x81
@@ -454,7 +460,7 @@ static int power_meter_read(struct device *dev, enum hwmon_sensor_types type,
ret = update_meter(res);
if (ret)
return ret;
- if (res->power == UNKNOWN_POWER)
+ if (res->power == UNKNOWN_POWER_32 || res->power == UNKNOWN_POWER_64)
return -ENODATA;
*val = res->power * 1000;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 654/869] Input: always accept EV_SYN in input_event()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 653/869] hwmon: (acpi_power_meter) Fix 18.45 TW bug Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 655/869] Revert "Input: matrix_keypad - force switch rows to input mode" Greg Kroah-Hartman
` (222 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Kosina, Dmitry Torokhov,
Sasha Levin, Karlos Abel
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit c1d13bfdb9c75c2885d10332174a887349eb0b51 ]
Commit 0cd587735205 ("Input: preallocate memory to hold event values")
moved allocation of dev->vals into input_allocate_device(), which caused
input core to accumulate events reported while seeding initial device
state before input_register_device().
However, because EV_SYN is only set in dev->evbit during
input_register_device() (and some drivers also overwrite dev->evbit
directly before registration), any EV_SYN/SYN_REPORT events sent before
registration were dropped by is_event_supported(), leaving those seeded
events stuck in dev->vals until the next SYN_REPORT after registration.
Always accept EV_SYN in input_event() and input_inject_event() without
checking dev->evbit so input_sync() flushes dev->vals as intended.
Reported-by: Karlos Abel <kabel@voidship.net>,
Fixes: 0cd587735205 ("Input: preallocate memory to hold event values")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/asx50uz6iafsyAd5@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/input.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a500e1e276c21..9907dd9ec880a 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -391,7 +391,7 @@ void input_handle_event(struct input_dev *dev,
void input_event(struct input_dev *dev,
unsigned int type, unsigned int code, int value)
{
- if (is_event_supported(type, dev->evbit, EV_MAX)) {
+ if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
guard(spinlock_irqsave)(&dev->event_lock);
input_handle_event(dev, type, code, value);
}
@@ -415,7 +415,7 @@ void input_inject_event(struct input_handle *handle,
struct input_dev *dev = handle->dev;
struct input_handle *grab;
- if (is_event_supported(type, dev->evbit, EV_MAX)) {
+ if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
guard(spinlock_irqsave)(&dev->event_lock);
guard(rcu)();
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 655/869] Revert "Input: matrix_keypad - force switch rows to input mode"
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 654/869] Input: always accept EV_SYN in input_event() Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 656/869] cgroup: fix cgroup.kill for exited thread group leader Greg Kroah-Hartman
` (221 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Kochetkov, Siarhei Volkau,
Paul Cercueil, Dmitry Torokhov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <al.kochet@gmail.com>
[ Upstream commit 1527451f87dfe368b8ddeeb501c24ac9bde6b589 ]
This reverts commit 01c84b03d80aab9f04c4e3e1f9085f4202ff7c29.
The commit makes every scan call gpiod_direction_input() on the row
GPIOs. On pin controllers where GPIO input and interrupt are separate
pinmux functions this switches the row pins out of interrupt mode, and
enable_row_irqs() does not switch them back: it only unmasks the
interrupts. Row interrupts then never arrive and the keypad stops
working. Seen with a matrix keypad on an Allwinner A64 board (PINE
A64-LTS); it works again with the commit reverted.
The workaround is not needed on Ingenic either: the author of the
reverted commit re-tested all available JZ47xx SoCs and they all report
the live pin state in interrupt mode, see the thread in Link.
Fixes: 01c84b03d80a ("Input: matrix_keypad - force switch rows to input mode")
Link: https://lore.kernel.org/all/4130C026-2A83-408B-836A-ECA044491C47@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Acked-by: Siarhei Volkau <lis8215@gmail.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Link: https://patch.msgid.link/20261002100935.449473-1-al.kochet@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/matrix_keypad.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index e50a6fea9a602..4247772892caa 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -135,9 +135,6 @@ static void matrix_keypad_scan(struct work_struct *work)
memset(new_state, 0, sizeof(new_state));
- for (row = 0; row < keypad->num_row_gpios; row++)
- gpiod_direction_input(keypad->row_gpios[row]);
-
/* assert each column and read the row status out */
for (col = 0; col < keypad->num_col_gpios; col++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 656/869] cgroup: fix cgroup.kill for exited thread group leader
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 655/869] Revert "Input: matrix_keypad - force switch rows to input mode" Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 657/869] netdevsim: reject cls_bpf programs bound to another device Greg Kroah-Hartman
` (220 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kir Kolyshkin, Oleg Nesterov,
Tejun Heo, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kir Kolyshkin <kolyshkin@gmail.com>
[ Upstream commit da13e0e72a7329c95642c44b2d03d194ab071e04 ]
cgroup.kill does not work in case a process' thread group leader is gone
but other threads are still running. This is because __cgroup_kill()
only walks the thread group leaders and sends SIGKILL to each of them
with send_sig(), which uses PIDTYPE_PID:
1. The exited leader is still listed by CSS_TASK_ITER_PROCS as long as
the process has live threads, but a signal directed at a single
exiting task never takes effect: complete_signal() does not look for
another thread to deliver it to, and __send_signal_locked() now drops
it altogether. The process keeps running.
2. The live threads of such a process can be migrated to another cgroup
by writing any of their IDs to cgroup.procs, while the exited leader
stays behind. The destination cgroup has no thread group leader to
iterate, so writing to its cgroup.kill does nothing at all.
In both cases the cgroup stays populated after cgroup.kill, and a
process inside a container can use this to survive the container being
killed. This also works with a private PID namespace when the init of
the container is the process, as the PID namespace is not torn down
while init has live threads.
Case 1 can be fixed by using do_send_sig_info(..., PIDTYPE_TGID) instead
of send_sig(), so that the signal is taken by a live thread even if the
task found by the iterator is exiting. Note it was pointed out by Eric
in [1] while reviewing v2 of cgroup.kill patchset, and v3 was meant to
switch to it, but the change was only made in cgroup_post_fork(),
leaving __cgroup_kill() with send_sig().
Case 2 can only be fixed by iterating over all threads, so this is what
the fix also does. Once a thread group is being killed, its other
threads are skipped since they already have a fatal signal pending.
I ran some performance checks and the added cost is ~60 ns per every
thread on my laptop (and less than a millisecond for 10K threads),
which seems low. The time to "populated 0" seems unchanged.
The issue was found in crun by Anthropic's OSS Scanner, and crun is
getting a workaround for it [2] (which does what we needed to do
before cgroup.kill was added).
[1] https://lore.kernel.org/all/m1v97x6niq.fsf@fess.ebiederm.org/
[2] https://github.com/containers/crun/pull/2351
Fixes: 661ee6280931 ("cgroup: introduce cgroup.kill")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cgroup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 07e1e29228197..28db81da10b81 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4219,7 +4219,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
cgrp->kill_seq++;
spin_unlock_irq(&css_set_lock);
- css_task_iter_start(&cgrp->self, CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED, &it);
+ css_task_iter_start(&cgrp->self, CSS_TASK_ITER_THREADED, &it);
while ((task = css_task_iter_next(&it))) {
/* Ignore kernel threads here. */
if (task->flags & PF_KTHREAD)
@@ -4229,7 +4229,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
if (__fatal_signal_pending(task))
continue;
- send_sig(SIGKILL, task, 0);
+ do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID);
}
css_task_iter_end(&it);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 657/869] netdevsim: reject cls_bpf programs bound to another device
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 656/869] cgroup: fix cgroup.kill for exited thread group leader Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 658/869] net: gro: dont chain linear parts larger than gso_size into frag_list Greg Kroah-Hartman
` (219 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko (nipa), Victor Nogueira,
Jamal Hadi Salim, Simon Horman, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit 5820ca58b409402505b9e904d1ded4908e0b6b81 ]
The issue:
nsim_bpf_setup_tc_block_cb() installs any device-bound SCHED_CLS program
without checking that its offload device matches the target netdev. The
core cls_bpf attach path rejects a mismatching program, but a netdev that
joins a shared block later is replayed the stored filter by
cls_bpf_reoffload() before it is inserted into block->ports, so the
attach-time check cannot see it. The driver callback is the
authoritative per-device acceptance boundary and must enforce the match
itself, as nfp already does in nfp_net_bpf_offload().
Without the check, replaying a device-bound program onto a different
bpf_offload_dev installs it into that device's netdevsim state, which
trips the WARN in nsim_bpf_uninit() (ns->bpf_offloaded set on a foreign
device) and can dereference a NULL prog->aux->offload in
nsim_prog_set_loaded().
The Fix:
Reject a device-bound program whose offload device does not match the
target netdev, with -EINVAL and an extack so the rejected replay is not
silent. The check is intentionally narrower than nfp's: it fires only
for a dev-bound program, so nsim's bpf_tc_non_bound_accept mode (which
admits an unbound program onto the device) is unaffected. Teardown is
never blocked: the guard is on the program being installed and an unbind
passes cls_bpf.prog = NULL.
Conditions to recreate the bug:
- CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
- load and pin a dev-bound SCHED_CLS program for netdevsim device B
- install the program on a shared block owned by B
- add an independently backed netdevsim device C to that block; the
bind replays the filter to C's callback, and C's
ports/0/bpf_offloaded_id takes the B-bound program id.
The reported Sashiko review is at
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809094418.901607-1-jhs@mojatatu.com
Fixes: 31d3ad832948 ("netdevsim: add bpf offload support")
Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
Cc: stable@vger.kernel.org
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-2@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/netdevsim/bpf.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 5f17f68f3c083..319f75e42f7c3 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -150,6 +150,17 @@ int nsim_bpf_setup_tc_block_cb(enum tc_setup_type type,
return -EOPNOTSUPP;
}
+ /* A dev-bound program can be replayed here when a netdev joins
+ * a shared block, after the core attach-time check has run;
+ * enforce the device match as nfp does.
+ */
+ if (prog && bpf_prog_is_dev_bound(prog->aux) &&
+ !bpf_offload_dev_match(prog, ns->netdev)) {
+ NSIM_EA(cls_bpf->common.extack,
+ "program bound to a different device");
+ return -EINVAL;
+ }
+
if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
return -EOPNOTSUPP;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 658/869] net: gro: dont chain linear parts larger than gso_size into frag_list
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 657/869] netdevsim: reject cls_bpf programs bound to another device Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 659/869] ALSA: compress: fix buffer leak on failed SET_PARAMS Greg Kroah-Hartman
` (218 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sorah Fukumori, Chase Hiltz,
Eric Dumazet, Jason Xing, Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sorah Fukumori <her@sorah.jp>
[ Upstream commit 679f6929a66db9f5a6611dad37545fbd705962d5 ]
skb_gro_receive() chains an skb into the frag_list of the held packet
when its payload cannot be attached as page frags: when its head is
not a page fragment and still holds payload, or when its head and
frags would overflow the frags[] array of the last packet. Since commit
5eddb24901ee ("gro: add support of (hw)gro packets to gro stack"), that
skb may itself be a GSO packet whose linear part holds several
gso_size segments. skb_segment() cannot split the linear part of a
frag_list member across segments, so segmenting the aggregate in
software, e.g. when forwarding it to a device without NETIF_F_FRAGLIST,
hits
BUG_ON(skb_headlen(list_skb) > len);
Fully linear GSO packets come from generic XDP. When the program does
not support frags, netif_skb_check_for_xdp() linearizes any nonlinear
skb with pskb_expand_head() and skb_linearize() and keeps its GSO
metadata. GRO on the device runs before generic XDP, so each aggregate
passed by the program carries all of its payload in a kmalloc'ed head.
A tunnel that decapsulates these packets and runs GRO again through
gro_cells then builds the bad frag_list. This was first seen on a
router that forwards TCP received over VXLAN, with a non-frags XDP
program attached in SKB mode to the underlying bond because one slave
lacks native XDP:
kernel BUG at net/core/skbuff.c:4917!
RIP: 0010:skb_segment+0xbb6/0xf40
Call Trace:
tcp_gso_segment
ipv6_gso_segment
skb_mac_gso_segment
__skb_gso_segment
validate_xmit_skb
__dev_queue_xmit
ip6_output
ip6_sublist_rcv_finish
ipv6_list_rcv
netif_receive_skb_list_internal
gro_complete
dev_gro_receive
gro_receive_skb
gro_cell_poll
__napi_poll
net_rx_action
It reproduces with three network namespaces: TCP sent over VXLAN on an
IPv6 veth link to a router namespace that has an XDP_PASS program
without frags support attached to the underlay veth in generic mode
and GRO enabled on its VXLAN device, and forwards to a veth with
tx-scatter-gather-fraglist disabled.
A program with frags support in generic mode gives similar packets.
skb_pp_cow_data() rebuilds the skb with up to about a page of linear
data in a page_pool head_frag and keeps the GSO metadata, so once
frags[] is full the next such packet is chained through frag_list
with more than gso_size bytes in its head as well.
Refuse the merge when the linear part to be chained exceeds the held
packet's gso_size. tcp_gro_receive() then flushes the held packet and
the skb starts a new GRO packet as its head, whose linear length
skb_segment() handles.
Fixes: 5eddb24901ee ("gro: add support of (hw)gro packets to gro stack")
Cc: stable@vger.kernel.org
Assisted-by: claude-opus-5-5
Signed-off-by: Sorah Fukumori <her@sorah.jp>
Tested-by: Chase Hiltz <me@chasehil.tz>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://patch.msgid.link/20261013130250.3643916-1-her@sorah.jp
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/gro.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/gro.c b/net/core/gro.c
index 252d7851d1aee..f96e5024758e2 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -192,6 +192,10 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
}
merge:
+ /* skb_segment() cannot split the linear part of a frag_list member. */
+ if (unlikely(headlen > offset + skb_shinfo(p)->gso_size))
+ return -E2BIG;
+
/* sk ownership - if any - completely transferred to the aggregated packet */
skb->destructor = NULL;
skb->sk = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 659/869] ALSA: compress: fix buffer leak on failed SET_PARAMS
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 658/869] net: gro: dont chain linear parts larger than gso_size into frag_list Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 660/869] ALSA: compress: reject buffer geometry change on gapless next_track Greg Kroah-Hartman
` (217 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit fbc74ca9fbf7e0b8f6872ccac62f9f4a1f3b5e53 ]
When the driver has neither ops->copy nor a preallocated dma_buffer_p,
snd_compr_allocate_buffer() kmallocs runtime->buffer. If
ops->set_params() then rejects the parameters, SET_PARAMS fails, the
stream stays in the OPEN state and keeps the buffer. The next
SET_PARAMS allocates a new buffer and overwrites the pointer, so
repeated SET_PARAMS calls with parameters that the driver rejects leak
one buffer per call.
Release the framework-owned buffer when ops->set_params() fails on an
OPEN stream, so that a failed SET_PARAMS leaves no buffer behind and
the buffer is allocated only once per successful setup. Use the same
ownership check as snd_compr_free().
Fixes: b21c60a4edd2 ("ALSA: core: add support for compress_offload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 065cdfaef1eaa..c4114186b0d11 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -661,8 +661,15 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
return -ENOMEM;
retval = stream->ops->set_params(stream, params);
- if (retval)
+ if (retval) {
+ /* the stream stays OPEN: drop the buffer of the rejected setup */
+ if (stream->runtime->state == SNDRV_PCM_STATE_OPEN &&
+ !stream->runtime->dma_buffer_p) {
+ kfree(stream->runtime->buffer);
+ stream->runtime->buffer = NULL;
+ }
return retval;
+ }
if (stream->next_track)
return retval;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 660/869] ALSA: compress: reject buffer geometry change on gapless next_track
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 659/869] ALSA: compress: fix buffer leak on failed SET_PARAMS Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 661/869] ALSA: compress: add missing OPEN-state gate to SET_METADATA Greg Kroah-Hartman
` (216 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 82da1acad6fd60b6072dd5f3383e6a55efdd2ac7 ]
snd_compr_set_params() is invoked from the gapless next_track
re-entry path, which calls snd_compr_allocate_buffer() again and lets
buffer_size change while total_bytes_available and
total_bytes_transferred still hold values computed for the previous
buffer. snd_compr_calc_avail() then derives an avail/count value from
those stale counters against the new buffer_size, and
snd_compr_write_data() copy_from_user()s that many bytes into the
new, potentially smaller buffer, overflowing it with user-controlled
length and content.
The buffer is set up once, with the initial SET_PARAMS, and neither the
core nor the DSP expects it to change for a gapless track transition.
Do not call snd_compr_allocate_buffer() on the next_track path and
reject a request that changes the buffer geometry, so that the codec
parameters that the driver receives match the buffer in use.
Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index c4114186b0d11..b707bdbb97069 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -656,9 +656,19 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
if (retval)
return retval;
- retval = snd_compr_allocate_buffer(stream, params);
- if (retval)
- return -ENOMEM;
+ if (stream->next_track) {
+ /*
+ * total_bytes_available/transferred still refer to the
+ * current buffer; its geometry must not change.
+ */
+ if (params->buffer.fragment_size != stream->runtime->fragment_size ||
+ params->buffer.fragments != stream->runtime->fragments)
+ return -EINVAL;
+ } else {
+ retval = snd_compr_allocate_buffer(stream, params);
+ if (retval)
+ return retval;
+ }
retval = stream->ops->set_params(stream, params);
if (retval) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 661/869] ALSA: compress: add missing OPEN-state gate to SET_METADATA
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 660/869] ALSA: compress: reject buffer geometry change on gapless next_track Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 662/869] ALSA: compress: reject restarting an ACTIVE task via origin_seqno Greg Kroah-Hartman
` (215 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Vinod Koul,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 931f5714b7921290cd1a4742e185aeeae7270ee6 ]
snd_compr_set_metadata() calls stream->ops->set_metadata() straight
after copy_from_user(), without ever checking runtime->state, even
though the function's own comment says a parameter change should only
be allowed once the stream has left the OPEN state. Every other
metadata/param entry point in this file (SET_PARAMS, WRITE, ...)
enforces that gate.
A codec driver's set_metadata callback can assume SET_PARAMS has
already run and initialised its private state; calling it while the
stream is still OPEN can operate on that uninitialised state.
Add the OPEN-state check the existing comment already documents.
Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index b707bdbb97069..1bf943b189cd0 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -748,6 +748,9 @@ snd_compr_set_metadata(struct snd_compr_stream *stream, unsigned long arg)
* we should allow parameter change only when stream has been
* opened not in other cases
*/
+ if (stream->runtime->state == SNDRV_PCM_STATE_OPEN)
+ return -EBADFD;
+
if (copy_from_user(&metadata, (void __user *)arg, sizeof(metadata)))
return -EFAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 662/869] ALSA: compress: reject restarting an ACTIVE task via origin_seqno
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 661/869] ALSA: compress: add missing OPEN-state gate to SET_METADATA Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 663/869] ALSA: mtpav: restore negation dropped in guard() conversion Greg Kroah-Hartman
` (214 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Vinod Koul,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 0ade01edd33181b65393cf3864cb2ac7c5eb1487 ]
snd_compr_task_start_prepare() only rejects tasks with
state >= SND_COMPRESS_TASK_STATE_FINISHED. Since the enum is
IDLE(0) < ACTIVE(1) < FINISHED(2), this accepts ACTIVE tasks and
rejects FINISHED ones, the opposite of what the origin_seqno
mechanism needs: origin_seqno is meant to let a caller reuse a
FINISHED task's buffers for a new job, not to restart a task that is
still queued with the driver.
The seqno lookup path in snd_compr_task_start() has its own explicit
"task->state != IDLE" guard, but the origin_seqno lookup path relies
solely on this function, so it can restart an ACTIVE task, causing
ops->task_start() to be called twice for the same task and
runtime->active_tasks to be incremented twice without a matching
finish/stop.
Accept IDLE and FINISHED, reject ACTIVE, on both entry paths.
Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 1bf943b189cd0..e1b2da84f7782 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -1142,7 +1142,9 @@ static int snd_compr_task_start_prepare(struct snd_compr_task_runtime *task,
{
if (task == NULL)
return -EINVAL;
- if (task->state >= SND_COMPRESS_TASK_STATE_FINISHED)
+ /* only an unqueued or already finished task may be (re)started */
+ if (task->state != SND_COMPRESS_TASK_STATE_IDLE &&
+ task->state != SND_COMPRESS_TASK_STATE_FINISHED)
return -EBUSY;
if (utask->input_size > task->input->size)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 663/869] ALSA: mtpav: restore negation dropped in guard() conversion
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 662/869] ALSA: compress: reject restarting an ACTIVE task via origin_seqno Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 664/869] ALSA: emux: Stop voices before freeing zones in all cases Greg Kroah-Hartman
` (213 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Yan, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit 47c3d5b885a4fcf65238c0cc525dd3c1cc65aa89 ]
commit 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
claims to be "Merely code refactoring, and no behavior change", but
it accidentally dropped the "!" from
if (! (portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED))
in snd_mtpav_output_trigger().
Restore the negation.
Fixes: 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020090959.570101-1-wangyan01@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/mtpav.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index 1ed6d4f0cb625..288a873a27e61 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -443,7 +443,7 @@ static void snd_mtpav_output_trigger(struct snd_rawmidi_substream *substream, in
scoped_guard(spinlock_irqsave, &mtp_card->spinlock) {
if (up) {
- if ((portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
+ if (!(portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
if (mtp_card->istimer++ == 0)
snd_mtpav_add_output_timer(mtp_card);
portp->mode |= MTPAV_MODE_OUTPUT_TRIGGERED;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 664/869] ALSA: emux: Stop voices before freeing zones in all cases
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 663/869] ALSA: mtpav: restore negation dropped in guard() conversion Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 665/869] gpiolib: Free chip resources when allocating the label fails Greg Kroah-Hartman
` (212 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 8a5d87c2ba30e8de31cfbe888fd4d95f43c63db9 ]
The emux voice caches the soundfont zone pointer in vp->zone, which
is referred to later, e.g. in snd_emux_send_effect(). For avoiding
dangling pointers, the soundfont code calls the sample_reset callback
to stop all voices before freeing zones. However, in a few cases
(e.g. emu10k1's missing sample_reset or the call path via
remove_info()), the sample reset isn't called properly, leaving the
playing voices.
Fix it by always registering the sample_reset callback, falling back
to snd_emux_terminate_all() when the driver has no own ops, and by
calling sample_reset in remove_info() before freeing the zones.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/synth/emux/emux.c | 10 +++++++---
sound/synth/emux/soundfont.c | 9 +++++++++
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index 01444fc960d08..863d35aff1960 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -71,7 +71,12 @@ static int sf_sample_free(void *private_data, struct snd_sf_sample *sp,
static void sf_sample_reset(void *private_data)
{
struct snd_emux *emu = private_data;
- emu->ops.sample_reset(emu);
+
+ /* stop all voices that might refer to zones and samples to be freed */
+ if (emu->ops.sample_reset)
+ emu->ops.sample_reset(emu);
+ else
+ snd_emux_terminate_all(emu);
}
int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, char *name)
@@ -96,8 +101,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch
sf_cb.private_data = emu;
sf_cb.sample_new = sf_sample_new;
sf_cb.sample_free = sf_sample_free;
- if (emu->ops.sample_reset)
- sf_cb.sample_reset = sf_sample_reset;
+ sf_cb.sample_reset = sf_sample_reset;
emu->sflist = snd_sf_new(&sf_cb, emu->memhdr);
if (emu->sflist == NULL)
return -ENOMEM;
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 30793a131746e..2f8ba39d4a6f6 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -443,6 +443,15 @@ remove_info(struct snd_sf_list *sflist, struct snd_soundfont *sf,
struct snd_sf_zone *prev, *next, *p;
int removed = 0;
+ /* stop voices before freeing the zones they might refer to */
+ for (p = sf->zones; p; p = p->next) {
+ if (!p->mapped && p->bank == bank && p->instr == instr) {
+ if (sflist->callback.sample_reset)
+ sflist->callback.sample_reset(sflist->callback.private_data);
+ break;
+ }
+ }
+
prev = NULL;
for (p = sf->zones; p; p = next) {
next = p->next;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 665/869] gpiolib: Free chip resources when allocating the label fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 664/869] ALSA: emux: Stop voices before freeing zones in all cases Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 666/869] ALSA: line6: Handle period elapsed calls outside the locks Greg Kroah-Hartman
` (211 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Bartosz Golaszewski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 8381e1f15e27087fcb6f07046a526ac8b9b9b2b9 ]
If desc_set_label() fails after the chip's request callback succeeds,
gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the
free callback. The caller receives an error and has no GPIO to release,
leaving resources acquired by the request callback held.
Call the chip's free callback, if present, before clearing the requested
bit on label allocation failure. Leave request callback errors on the
existing path to avoid freeing a failed request.
Cc: stable@vger.kernel.org
Fixes: 1f2bcb8c8ccd ("gpio: protect the descriptor label with SRCU")
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261018044456.1259250-1-pocj8ur4in@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index d0efcb96d2769..635b77c0eab53 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2464,10 +2464,13 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
ret = desc_set_label(desc, label ? : "?");
if (ret)
- goto out_clear_bit;
+ goto out_free_gpio;
return 0;
+out_free_gpio:
+ if (guard.gc->free)
+ guard.gc->free(guard.gc, offset);
out_clear_bit:
clear_bit(GPIOD_FLAG_REQUESTED, &desc->flags);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 666/869] ALSA: line6: Handle period elapsed calls outside the locks
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 665/869] gpiolib: Free chip resources when allocating the label fails Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 667/869] gpio: davinci: Clear interrupt status in every bank on suspend Greg Kroah-Hartman
` (210 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 443ed4edc2678cc51c5a01e7dffc4c890be40051 ]
LINE6 driver may call snd_pcm_period_elapsed() for both playback and
capture substreams at processing the playback substream, and this may
lead to a ABBA deadlock.
Move the actual calls of snd_pcm_period_elapsed() outside the locks
for avoiding it. The capture period notification at submitting the
initial playback URBs (only with the impulse mode) is simply skipped,
as it's done in the lock context; it'll be caught up at the next
period.
Fixes: f56742cc4189 ("ALSA: line6: Add LINE6_CAP_IN_NEEDS_OUT, a void playback stream during capture")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5a9de389-e6ea-410d-8322-e74e14152603
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020113118.234689-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/line6/capture.c | 25 ++++++++++++++++---------
sound/usb/line6/capture.h | 2 +-
sound/usb/line6/playback.c | 31 +++++++++++++++++++++----------
3 files changed, 38 insertions(+), 20 deletions(-)
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index 9ef4faa006a03..46acd2f44c440 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -125,24 +125,21 @@ void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf, int fsize)
line6pcm->in.pos_done -= runtime->buffer_size;
}
-void line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
+/* update the capture position and check whether we need period_elapsed call */
+bool line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
{
- struct snd_pcm_substream *substream =
- get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE);
-
line6pcm->in.bytes += length;
if (line6pcm->in.bytes >= line6pcm->in.period) {
line6pcm->in.bytes %= line6pcm->in.period;
- spin_unlock(&line6pcm->in.lock);
- snd_pcm_period_elapsed(substream);
- spin_lock(&line6pcm->in.lock);
+ return true;
}
+ return false;
}
/*
* Callback for completed capture URB.
*/
-static void audio_in_callback(struct urb *urb)
+static bool handle_audio_in(struct urb *urb)
{
int i, index, length = 0, shutdown = 0;
struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
@@ -207,8 +204,18 @@ static void audio_in_callback(struct urb *urb)
if (!test_bit(LINE6_STREAM_IMPULSE, &line6pcm->in.running) &&
test_bit(LINE6_STREAM_PCM, &line6pcm->in.running))
- line6_capture_check_period(line6pcm, length);
+ return line6_capture_check_period(line6pcm, length);
}
+
+ return false;
+}
+
+static void audio_in_callback(struct urb *urb)
+{
+ struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
+
+ if (handle_audio_in(urb))
+ snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
}
/* open capture callback */
diff --git a/sound/usb/line6/capture.h b/sound/usb/line6/capture.h
index 90572dae134ee..628315389efcf 100644
--- a/sound/usb/line6/capture.h
+++ b/sound/usb/line6/capture.h
@@ -17,7 +17,7 @@ extern const struct snd_pcm_ops snd_line6_capture_ops;
extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
int fsize);
-extern void line6_capture_check_period(struct snd_line6_pcm *line6pcm,
+extern bool line6_capture_check_period(struct snd_line6_pcm *line6pcm,
int length);
extern int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm);
extern int line6_submit_audio_in_all_urbs(struct snd_line6_pcm *line6pcm);
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 2e70ca5456c5a..495a983a0c51f 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -136,6 +136,8 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,
/*
Find a free URB, prepare audio data, and submit URB.
must be called in line6pcm->out.lock context
+ Returns 1 if snd_pcm_period_elapsed() needs to be called for the
+ capture stream after releasing the lock, 0 if not, or a negative error
*/
static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
{
@@ -151,6 +153,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
line6pcm->properties->rates.rats[0].den *
(line6pcm->line6->intervals_per_second / LINE6_ISO_INTERVAL);
struct urb *urb_out;
+ bool capture_period_elapsed = false;
index = find_first_zero_bit(&line6pcm->out.active_urbs,
line6pcm->line6->iso_buffers);
@@ -260,8 +263,9 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
urb_out->transfer_buffer,
urb_out->
transfer_buffer_length);
- line6_capture_check_period(line6pcm,
- urb_out->transfer_buffer_length);
+ capture_period_elapsed =
+ line6_capture_check_period(line6pcm,
+ urb_out->transfer_buffer_length);
}
} else {
if (!(line6pcm->line6->properties->capabilities & LINE6_CAP_HWMON)
@@ -283,24 +287,26 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
dev_err(line6pcm->line6->ifcdev,
"URB out #%d submission failed (%d)\n", index, ret);
- return 0;
+ return capture_period_elapsed;
}
/*
Submit all currently available playback URBs.
must be called in line6pcm->out.lock context
+ The capture period notification is skipped here since we can't call
+ snd_pcm_period_elapsed() in the lock; it'll be caught up at the next one.
*/
int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm)
{
- int ret = 0, i;
+ int ret, i;
for (i = 0; i < line6pcm->line6->iso_buffers; ++i) {
ret = submit_audio_out_urb(line6pcm);
if (ret < 0)
- break;
+ return ret;
}
- return ret;
+ return 0;
}
/*
@@ -316,6 +322,8 @@ static void audio_out_callback(struct urb *urb)
const int bytes_per_frame =
line6pcm->properties->bytes_per_channel *
line6pcm->properties->playback_hw.channels_max;
+ bool capture_period_elapsed = false;
+ bool playback_period_elapsed = false;
#if USE_CLEAR_BUFFER_WORKAROUND
memset(urb->transfer_buffer, 0, urb->transfer_buffer_length);
@@ -358,19 +366,22 @@ static void audio_out_callback(struct urb *urb)
shutdown = 1;
if (!shutdown) {
- submit_audio_out_urb(line6pcm);
+ capture_period_elapsed = submit_audio_out_urb(line6pcm) > 0;
if (test_bit(LINE6_STREAM_PCM, &line6pcm->out.running)) {
line6pcm->out.bytes += length;
if (line6pcm->out.bytes >= line6pcm->out.period) {
line6pcm->out.bytes %= line6pcm->out.period;
- spin_unlock(&line6pcm->out.lock);
- snd_pcm_period_elapsed(substream);
- spin_lock(&line6pcm->out.lock);
+ playback_period_elapsed = true;
}
}
}
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
+
+ if (capture_period_elapsed)
+ snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
+ if (playback_period_elapsed)
+ snd_pcm_period_elapsed(substream);
}
/* open playback callback */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 667/869] gpio: davinci: Clear interrupt status in every bank on suspend
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 666/869] ALSA: line6: Handle period elapsed calls outside the locks Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 668/869] gpio: pca953x: Handle direction register read errors in IRQ paths Greg Kroah-Hartman
` (209 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sahaj Chaudhari, Bartosz Golaszewski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
[ Upstream commit 800d7627f552bbf602a1736b638aee0ada3fbf87 ]
davinci_gpio_save_context() saves the registers of each 32-GPIO
register bank, but clears interrupt status only after the loop. At that
point g refers to the last bank, so pending status in all preceding
banks is left uncleared.
Move the interrupt-status write into the per-bank loop so that the
existing suspend-time clearing covers every register bank. Single-bank
controllers retain the same behavior.
Fixes: 0651a730924b ("gpio: davinci: Add support for system suspend/resume PM")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018170622.3406158-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-davinci.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 5de42f1143dab..80b3b36cf703a 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -593,10 +593,10 @@ static void davinci_gpio_save_context(struct davinci_gpio_controller *chips,
context->set_data = readl_relaxed(&g->set_data);
context->set_rising = readl_relaxed(&g->set_rising);
context->set_falling = readl_relaxed(&g->set_falling);
- }
- /* Clear all interrupt status registers */
- writel_relaxed(GENMASK(31, 0), &g->intstat);
+ /* Clear stale interrupt status for this bank. */
+ writel_relaxed(GENMASK(31, 0), &g->intstat);
+ }
}
static void davinci_gpio_restore_context(struct davinci_gpio_controller *chips,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 668/869] gpio: pca953x: Handle direction register read errors in IRQ paths
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 667/869] gpio: davinci: Clear interrupt status in every bank on suspend Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 669/869] blk-mq: clear stale inactive flag on hctx reuse Greg Kroah-Hartman
` (208 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sahaj Chaudhari, Bartosz Golaszewski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
[ Upstream commit a0fe269293509acdd93b9cfb3f46636f7b91b33a ]
Three IRQ paths ignore the result of reading the direction registers
and then use the destination bitmap. pca953x_read_regs() does not populate
that bitmap when regmap_bulk_read() fails, leaving the callers to use
uninitialized stack data.
This can select incorrect GPIOs for direction changes during IRQ bus
synchronization, corrupt the saved input state during IRQ setup, or
produce incorrect pending interrupt decisions.
Check the read result at all three sites. Release irq_lock without
changing GPIO directions on failure, leave the IRQ history untouched
when pending detection fails, and propagate the error from IRQ setup.
The read helper already logs the error.
Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018165003.3372368-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-pca953x.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 4eeac12ad0ed3..7ebc4f9662c91 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -863,6 +863,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
DECLARE_BITMAP(irq_mask, MAX_LINE);
DECLARE_BITMAP(reg_direction, MAX_LINE);
int level;
+ int ret;
guard(mutex)(&chip->i2c_lock);
@@ -877,7 +878,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
}
/* Switch direction to input if needed */
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ goto out;
bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
@@ -889,6 +892,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
for_each_set_bit(level, irq_mask, gc->ngpio)
pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
+out:
mutex_unlock(&chip->irq_lock);
}
@@ -983,7 +987,9 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
}
/* Remove output pins from the equation */
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ return false;
bitmap_copy(old_stat, chip->irq_stat, gc->ngpio);
@@ -1084,7 +1090,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
* interrupt. We have to rely on the previous read for
* this purpose.
*/
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ return ret;
bitmap_and(chip->irq_stat, irq_stat, reg_direction, gc->ngpio);
mutex_init(&chip->irq_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 669/869] blk-mq: clear stale inactive flag on hctx reuse
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 668/869] gpio: pca953x: Handle direction register read errors in IRQ paths Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 670/869] drm/amdgpu: require _PR3 for BOCO Greg Kroah-Hartman
` (207 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
[ Upstream commit afc1de47a7ab607ae6403c4bfda36b0bf3cd342f ]
When the last CPU mapped to an hctx goes offline,
blk_mq_hctx_notify_offline() sets BLK_MQ_S_INACTIVE. Updating the
number of hardware queues exits every hctx and parks it on
q->unused_hctx_list. A later update can reuse a parked hctx through
blk_mq_alloc_and_init_hctx(), at any queue index, and nothing clears
the flag.
If the reused hctx is mapped to an online CPU, blk_mq_get_tag() keeps
returning BLK_MQ_NO_TAG for it. __blk_mq_alloc_requests() sleeps and
retries, expecting CPU hotplug to move the task to another CPU, so a
task that stays on that CPU never gets a tag. Onlining the original CPU
doesn't recover it either, because blk_mq_hctx_notify_online() only
clears the flag on the hctx that CPU now maps to.
Clear BLK_MQ_S_INACTIVE in blk_mq_init_hctx() so a reused hctx starts
like a freshly allocated one. A reused hctx has no cpuhp instances at
that point, so the offline callback can't set the flag again before
blk_mq_add_hw_queues_cpuhp() registers it. Clearing the flag in
blk_mq_exit_hctx() is not enough, because a parked hctx keeps its cpuhp
instances until blk_mq_remove_hw_queues_cpuhp(). Preserve the other
hctx state flags.
Reproduced with null_blk on v7.3 in a four-vCPU arm64 QEMU/KVM guest:
modprobe null_blk nr_devices=0
mkdir /sys/kernel/config/nullb/nullb0
cd /sys/kernel/config/nullb/nullb0
echo 4 > submit_queues; echo 1 > memory_backed; echo 16 > size
echo 1 > power
echo 0 > /sys/devices/system/cpu/cpu3/online
echo 2 > submit_queues
echo 4 > submit_queues
Offlining CPU3 marks hctx3 inactive. After the two updates it comes back
as hctx1 and is mapped to CPU0:
# cat /sys/block/nullb0/mq/1/cpu_list
0
# cat /sys/kernel/debug/block/nullb0/hctx1/state
INACTIVE
A 4K O_DIRECT read pinned to CPU0 hangs in D state, while the same read
on CPU1 and CPU2 completes. Onlining CPU3 again leaves hctx1 inactive
and the CPU0 read still hangs. With this change hctx1 state is empty and
the reads on CPU0, CPU1 and CPU2 complete, before and after onlining
CPU3.
Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20261020125129.430600-1-nirmoyd@nvidia.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 73ee5a9ea51d6..cced68a0e3c53 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4016,6 +4016,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
goto fail;
hctx->queue_num = hctx_idx;
+ clear_bit(BLK_MQ_S_INACTIVE, &hctx->state);
hctx->tags = set->tags[hctx_idx];
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 670/869] drm/amdgpu: require _PR3 for BOCO
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 669/869] blk-mq: clear stale inactive flag on hctx reuse Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 671/869] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0 Greg Kroah-Hartman
` (206 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Luigi Lauro,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luigi Lauro <luigi.lauro@gmail.com>
[ Upstream commit 28f3d169f162ca7e803c5a1f7e1bb55bdc915d1c ]
amdgpu_device_supports_boco() returns true for an AMD_IS_PX device on a
system with a hybrid ATPX method even when the device has no ACPI power
resource (_PR3). On an APU mini PC with a discrete GPU attached over
OCuLink, the iGPU's ATPX method reports hybrid graphics, the dGPU is
flagged AMD_IS_PX, and runtime PM in auto mode picks BOCO:
amdgpu: ATPX Hybrid Graphics
amdgpu 0000:c6:00.0: Using BOCO for runtime pm
In BOCO mode the driver leaves powering the device off to the PCI core,
which can only do it through _PR3 on the upstream bridge. No device on
this dGPU's path has _PR3, so when it runtime suspends the card stays
powered, with its fans at about 700 rpm.
Require has_pr3 for BOCO, as the function's description ("dGPU with ACPI
power resources") says. The same card then picks BACO, which powers it
down:
amdgpu 0000:c6:00.0: Using BACO for runtime pm
This only changes systems with a hybrid ATPX method and no _PR3 on the
dGPU's upstream bridge, where BOCO cannot cut the power today. Tested on
one such system only, an RX 9070 XT (Navi 48) over OCuLink with a Ryzen
AI 9 HX 470, with the change backported to 7.2.9: the stock module logs
"Using BOCO", the patched one "Using BACO"; BACO runtime suspend powers
the card off and it resumes cleanly. Not tested on a hybrid laptop or a
Thunderbolt eGPU.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5980
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1a039805354a44aab7abb2a6e685212d48b17a5e)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 88dda7dd2cd1c..4a1b8795d117b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -442,10 +442,8 @@ bool amdgpu_device_supports_boco(struct amdgpu_device *adev)
if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
return false;
- if (adev->has_pr3 ||
- ((adev->flags & AMD_IS_PX) && amdgpu_is_atpx_hybrid()))
- return true;
- return false;
+ /* BOCO needs a platform power resource (_PR3) to cut the power */
+ return adev->has_pr3;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 671/869] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 670/869] drm/amdgpu: require _PR3 for BOCO Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 672/869] drm/amdgpu: reset CIK ASIC on Apple boards " Greg Kroah-Hartman
` (205 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 5b56ede880317bd912f914d5cd38ba1d357677fa ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. The EFI stub enables the iGPU on
these machines through apple_set_os(). On a MacBookPro11,5 (Radeon R9
M370X, 1002:6821, subsystem 106b:0149), the driver adopts this layout
at init:
MC_VM_FB_LOCATION=0x007f0000, HDP_NONSURFACE_BASE=0
VRAM at 0x0-0x7fffffff, GART table at 0x1400000
The driver posts the ASIC again on S3 resume and after a GPU reset.
The VBIOS asic_init table then moves VRAM back to the VBIOS default:
MC_VM_FB_LOCATION=0xf47ff400, HDP_NONSURFACE_BASE=0xf4000000
gmc_v6_0 does not reprogram these registers. The GART table is then
no longer in VRAM, and the gfx ring test times out:
amdgpu: ring gfx test failed (-110)
amdgpu: resume of IP block <gfx_v6_0> failed -110
Reset and post the ASIC at driver load on Apple boards with VRAM at 0.
The driver then uses the VBIOS layout (VRAM at 0xf400000000) from the
start, and later posts keep it. After the reset, FB_BASE is not 0, so
a module reload does not reset the ASIC again.
The test is the same one that commit c54e4d105077 ("drm/amdgpu: make
Mac FB workaround generic") uses: an Apple subsystem vendor and VRAM at
0. The VI quirk for the MacBookPro14,3 resets at load for the same
reason:
commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")
Other Apple SI boards get the same reset if FB_BASE reads 0 at load.
Tested on a MacBookPro11,5 with 7.2.5 and this patch: the panel comes
up at boot, and 4 of 4 deep S3 cycles resume. Without the patch, S3
resume fails every time. The GPU reset path is not tested.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5978
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 60dd16ae10f286cb9cce5b6027b2d5ee869637af)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/si.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index e0f139de79915..0c96a40fe4b4a 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -1524,6 +1524,16 @@ static bool si_need_full_reset(struct amdgpu_device *adev)
static bool si_need_reset_on_init(struct amdgpu_device *adev)
{
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 672/869] drm/amdgpu: reset CIK ASIC on Apple boards with VRAM at 0
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 671/869] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0 Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 673/869] drm/amdgpu: reset VI " Greg Kroah-Hartman
` (204 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 095f634ea0aa5b9da19495520b5fc1a155b2c137 ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default. The SI fix resets and
posts the ASIC at load, so the driver uses the VBIOS layout from the
start:
"drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0"
No MacBookPro has a CIK GPU, and no affected CIK board is known. Add
the same test to cik_need_reset_on_init(), so that SI, CIK and VI
handle this firmware layout in the same way. gmc_v7_0 reads
MC_VM_FB_LOCATION once at init and does not reprogram it. A CIK board
with VRAM at 0 therefore has the same problem as the SI boards.
After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.
Only compile-tested.
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6bb4b79d6a6c461b40750fd67cb4e2a070e20b67)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/cik.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 9cd63b4177bf2..4bc35b5f7c47c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1932,6 +1932,16 @@ static bool cik_need_reset_on_init(struct amdgpu_device *adev)
{
u32 clock_cntl, pc;
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
if (adev->flags & AMD_IS_APU)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 673/869] drm/amdgpu: reset VI ASIC on Apple boards with VRAM at 0
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 672/869] drm/amdgpu: reset CIK ASIC on Apple boards " Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 674/869] drm/amdkfd: fix doorbell allocation race creating duplicate allocations Greg Kroah-Hartman
` (203 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 92a5184787b81e67f7b831ad860ca9b053505cf8 ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default. gmc_v8_0 reads
MC_VM_FB_LOCATION once at init and reprograms it only on SR-IOV. On
bare metal, the driver then keeps using the old layout.
vi_reset_quirks[] handles this for the MacBookPro14,3 by PCI ID:
commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")
Add the test that SI and CIK use: an Apple subsystem vendor and VRAM at
0. Other Polaris MacBookPros then get the same reset at load, for
example the MacBookPro13,3 if its firmware leaves VRAM at 0. These
boards are not tested.
Keep vi_reset_quirks[]. Its MacBookPro15,1 entries fix a different
failure, a module reload after S3:
commit a5be7ad8f5f0 ("drm/amdgpu: reset VI ASIC on MacBookPro15,1")
VRAM is not at 0 at that point, so the new test may not cover it.
After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.
Only compile-tested.
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c2335b685b1e1e387f2fea1c67f56b5b8a8b6dc6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/vi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index ce54e29381079..bb81251319084 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1425,6 +1425,16 @@ static bool vi_need_reset_on_init(struct amdgpu_device *adev)
unsigned int i;
u32 clock_cntl, pc;
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
for (i = 0; i < ARRAY_SIZE(vi_reset_quirks); i++)
if (adev->pdev->device == vi_reset_quirks[i].device &&
adev->pdev->subsystem_vendor == vi_reset_quirks[i].subsystem_vendor &&
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 674/869] drm/amdkfd: fix doorbell allocation race creating duplicate allocations
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 673/869] drm/amdgpu: reset VI " Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 675/869] drm/amd/display: dont WARN when removing an unallocated MST payload Greg Kroah-Hartman
` (202 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henry Martin, Felix Kuehling,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <bsdhenrymartin@gmail.com>
[ Upstream commit bebad45050945a3d668d6701fb77ae2571c5d44b ]
The check-and-allocate sequence on pdd->qpd.proc_doorbells is
lockless at every call site of kfd_alloc_process_doorbells():
kfd_get_process_doorbells() (mmap of /dev/kfd),
kfd_ioctl_create_queue() and the CRIU restore path each test the
pointer under different locking (or none), so two racing threads can
both observe NULL and each allocate a doorbell BO and bitmap,
orphaning one allocation and handing the two mappings different
backing pages.
Move the serialization into kfd_alloc_process_doorbells() itself,
using a new per-process-device mutex so all three call sites are
covered regardless of their own locking. The device-global
kfd->doorbell_mutex is not suitable here: it is acquired under
dqm->lock on the kernel-doorbell path (start_cpsch() -> pm_init() ->
kq_initialize() -> kfd_get_kernel_doorbell()), so holding it across
the sleeping allocations above would create a lock-ordering
inversion with dqm->lock via TTM eviction, and it would also
serialize doorbell setup of unrelated processes behind a
device-wide lock for per-process state.
This issue was discovered by Tencent CodeBuddy Security.
v3 (Felix Kuehling):
- Removed unlocked check in kfd_get_process_doorbell flagged as
problematic by Sashiko Bot. Fall back to the locked check inside
kfd_alloc_process_doorbells
- Added missing mutex_destroy
v4 (Felix Kuehling):
- Removed unlocked checks around other kfd_alloc_process_doorbells calls
Fixes: 16f0013157bf ("drm/amdkfd: Allocate doorbells only when needed")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4e27ba5ad5f76932d4f6cbacd25c81c2dd40ec4a)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 18 +++++++-----------
drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 23 +++++++++++++++++------
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++
4 files changed, 29 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 04c2d412fa7da..c224d78a770a1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -352,12 +352,10 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
}
}
- if (!pdd->qpd.proc_doorbells) {
- err = kfd_alloc_process_doorbells(dev->kfd, pdd);
- if (err) {
- pr_debug("failed to allocate process doorbells\n");
- goto err_bind_process;
- }
+ err = kfd_alloc_process_doorbells(dev->kfd, pdd);
+ if (err) {
+ pr_debug("failed to allocate process doorbells\n");
+ goto err_bind_process;
}
err = kfd_queue_acquire_buffers(pdd, &q_properties);
@@ -2282,11 +2280,9 @@ static int criu_restore_devices(struct kfd_process *p,
goto exit;
}
- if (!pdd->qpd.proc_doorbells) {
- ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
- if (ret)
- goto exit;
- }
+ ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
+ if (ret)
+ goto exit;
}
/*
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index fdcf7f2d1b5b4..6af268a031f22 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -239,11 +239,9 @@ phys_addr_t kfd_get_process_doorbells(struct kfd_process_device *pdd)
struct amdgpu_device *adev = pdd->dev->adev;
uint32_t first_db_index;
- if (!pdd->qpd.proc_doorbells) {
- if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
- /* phys_addr_t 0 is error */
- return 0;
- }
+ if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
+ /* phys_addr_t 0 is error */
+ return 0;
first_db_index = amdgpu_doorbell_index_on_bar(adev,
pdd->qpd.proc_doorbells,
@@ -257,12 +255,21 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
int r;
struct qcm_process_device *qpd = &pdd->qpd;
+ mutex_lock(&pdd->doorbell_mutex);
+
+ /* Another thread may have won the check-and-allocate race */
+ if (qpd->proc_doorbells) {
+ mutex_unlock(&pdd->doorbell_mutex);
+ return 0;
+ }
+
/* Allocate bitmap for dynamic doorbell allocation */
qpd->doorbell_bitmap = bitmap_zalloc(KFD_MAX_NUM_OF_QUEUES_PER_PROCESS,
GFP_KERNEL);
if (!qpd->doorbell_bitmap) {
DRM_ERROR("Failed to allocate process doorbell bitmap\n");
- return -ENOMEM;
+ r = -ENOMEM;
+ goto unlock;
}
r = init_doorbell_bitmap(&pdd->qpd, kfd);
@@ -284,11 +291,15 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
DRM_ERROR("Failed to allocate process doorbells\n");
goto err;
}
+
+ mutex_unlock(&pdd->doorbell_mutex);
return 0;
err:
bitmap_free(qpd->doorbell_bitmap);
qpd->doorbell_bitmap = NULL;
+unlock:
+ mutex_unlock(&pdd->doorbell_mutex);
return r;
}
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f2cda82cbed4c..ef1afeaa8d85d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -769,6 +769,9 @@ struct kfd_process_device {
/* per-process-per device QCM data structure */
struct qcm_process_device qpd;
+ /* Serializes process doorbell allocation for this device */
+ struct mutex doorbell_mutex;
+
/*Apertures*/
uint64_t lds_base;
uint64_t lds_limit;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 8ed513a77d38f..0b760aab11c6f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1089,6 +1089,7 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)
}
atomic_dec(&pdd->dev->kfd->kfd_processes_count);
+ mutex_destroy(&pdd->doorbell_mutex);
kfree(pdd);
p->pdds[i] = NULL;
@@ -1628,6 +1629,7 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev,
pdd->dev = dev;
INIT_LIST_HEAD(&pdd->qpd.queues_list);
INIT_LIST_HEAD(&pdd->qpd.priv_queue_list);
+ mutex_init(&pdd->doorbell_mutex);
pdd->qpd.dqm = dev->dqm;
pdd->qpd.pqm = &p->pqm;
pdd->qpd.evicted = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 675/869] drm/amd/display: dont WARN when removing an unallocated MST payload
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 674/869] drm/amdkfd: fix doorbell allocation race creating duplicate allocations Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 676/869] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs Greg Kroah-Hartman
` (201 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Lin, Mario Limonciello, Ray Wu,
Daniel Wheeler, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit b18a7c6d75bcc883b39497863cc88c9ef4c6c85f ]
[Why]
On an MST teardown that runs through the reset path
(dcn31_reset_hw_ctx_wrap -> link_set_dpms_off -> deallocate_mst_payload),
fill_dc_mst_payload_table_from_drm() is asked to remove a payload whose
vcpi is not present in link->mst_stream_alloc_table and trips:
WARNING: .../amdgpu_dm_helpers.c:275 fill_dc_mst_payload_table_from_drm
This is a legitimate case, not an error: deallocate_mst_payload() can be
called for a stream whose MST payload was never programmed into DC's
HW-maintained table (a new stream created for a modeset whose enable
never completed, as already documented in deallocate_mst_payload()).
There is simply nothing to remove.
[How]
Drop the ASSERT and fall through to the fill loop, which rebuilds the
allocation table from the remaining entries. The table ends up unchanged,
which is correct: the payload being removed was never in it.
Note the loop must not early-return here - the caller passes a zeroed
proposed_table, so returning early would zero the whole link's table and
drop the other MST streams sharing the link.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5875
Reviewed-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 88a27f624dc0ebc14a7ab274a84d977ce8513cb6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index 7633af2429198..e8f4e7b7af570 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -225,7 +225,7 @@ fill_dc_mst_payload_table_from_drm(struct dc_link *link,
break;
}
}
- ASSERT(i != copy_of_link_table.stream_count);
+ /* Payload absent from HW table when never allocated: nothing to remove. */
}
/* Fill payload info*/
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 676/869] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 675/869] drm/amd/display: dont WARN when removing an unallocated MST payload Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:55 ` [PATCH 6.18 677/869] drm/amd/pm: reapply umd profile state after recovery Greg Kroah-Hartman
` (200 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Philip Yang,
Felix Kuehling, Jesse Zhang, Felix Kuehling, Alex Deucher,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit d577b68a854d0f590f480777249b041507d0708c ]
For AMDGPU_GEM_USERPTR_ANONONLY, amdgpu_ttm_tt_get_user_pages() only
checks the VMA at the start of the range for a backing file, and
amdgpu_hmm_range_get_pages() then faults in the whole range, across any
other VMAs. The check used to reject ranges ending beyond the first VMA
(vma->vm_end < end), which got lost when the code moved to HMM.
An ANONONLY userptr over one page of file-backed memory is rejected
with -EPERM, but one over an anonymous page followed by the same
file-backed page is accepted.
Restore the check and reject ANONONLY userptrs that cross more than one
VMA. The second userptr is now rejected too.
v2: reject ranges spanning multiple VMAs instead of walking every VMA
(Christian)
v3: cast num_pages to u64 to avoid an overflow (Christian)
Fixes: 6826cb3b92a3 ("drm/amdgpu: support userptr cross VMAs case with HMM")
Cc: Christian König <christian.koenig@amd.com>
Cc: Philip Yang <Philip.Yang@amd.com>
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 75d753ed4704d5efc72164d9e546b2a282e42ae2)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 08c31d78b3fae..918f38965cf21 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -766,7 +766,8 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo,
goto out_unlock;
}
if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) &&
- vma->vm_file)) {
+ (vma->vm_file ||
+ vma->vm_end < start + (u64)ttm->num_pages * PAGE_SIZE))) {
r = -EPERM;
goto out_unlock;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 677/869] drm/amd/pm: reapply umd profile state after recovery
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 676/869] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs Greg Kroah-Hartman
@ 2026-11-07 13:55 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 678/869] drm/amdkfd: dont drop an SVM CWSR reference that was never taken Greg Kroah-Hartman
` (199 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kevin Wang, Kenneth Feng,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Wang <kevin.wang@amd.com>
[ Upstream commit ad6eb088a508d927641c8a76d1ca7911dfb7c80b ]
Resume and full GPU reset retain the selected UMD profile level in
driver state.
The GFX and PMFW state behind it is reinitialized.
Add a generic DPM reapply path after CG and PG restoration.
It restores the UMD GFX state and asks the PM backend to replay the
retained level.
v2:
- Reapply only GFX CG to preserve the profile-owned GFX PG reference.
- Fall back to AUTO when reapply fails without failing device recovery.
- Propagate PowerPlay DPM errors before accepting AUTO fallback.
- Limit workload-profile error reporting to the swSMU reapply path.
This covers:
- PCI runtime resume
- Full GPU reset recovery
- System resume, including S3 and s2idle
Signed-off-by: Kevin Wang <kevin.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fd0699fc9f4266fc07d6ce6dbb484fac04601106)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 ---
.../gpu/drm/amd/include/kgd_pp_interface.h | 2 +
drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 85 ++++++++++++++++++
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 1 +
.../gpu/drm/amd/pm/powerplay/amd_powerplay.c | 33 +++++--
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 87 +++++++++++++++++--
7 files changed, 201 insertions(+), 27 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 4a1b8795d117b..2e0998de67ed1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3589,6 +3589,12 @@ static int amdgpu_device_ip_late_init(struct amdgpu_device *adev)
amdgpu_device_set_cg_state(adev, AMD_CG_STATE_GATE);
amdgpu_device_set_pg_state(adev, AMD_PG_STATE_GATE);
+ r = amdgpu_dpm_reapply_umd_profile(adev);
+ if (r) {
+ dev_err(adev->dev, "Failed to restore UMD profile state: %d\n", r);
+ return r;
+ }
+
amdgpu_device_fill_reset_magic(adev);
r = amdgpu_device_enable_mgpu_fan_boost();
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 845ebe041563f..fc2823771cc40 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2904,19 +2904,6 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
return 0;
}
-static void amdgpu_restore_umd_profile_pstate_after_runpm(struct amdgpu_device *adev)
-{
- enum amd_dpm_forced_level level;
- uint32_t profile_mode_mask = AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD |
- AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK |
- AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK |
- AMD_DPM_FORCED_LEVEL_PROFILE_PEAK;
-
- level = amdgpu_dpm_get_performance_level(adev);
- if (level & profile_mode_mask)
- amdgpu_asic_update_umd_stable_pstate(adev, true);
-}
-
static int amdgpu_pmops_runtime_resume(struct device *dev)
{
struct pci_dev *pdev = to_pci_dev(dev);
@@ -2962,7 +2949,6 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
if (adev->pm.rpm_mode == AMDGPU_RUNPM_PX)
drm_dev->switch_power_state = DRM_SWITCH_POWER_ON;
- amdgpu_restore_umd_profile_pstate_after_runpm(adev);
adev->in_runpm = false;
return 0;
}
diff --git a/drivers/gpu/drm/amd/include/kgd_pp_interface.h b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
index 2b0cdb2a2775d..834ce6d1a40ef 100644
--- a/drivers/gpu/drm/amd/include/kgd_pp_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
@@ -426,6 +426,8 @@ struct amd_pm_funcs {
int (*print_clock_levels)(void *handle, enum pp_clock_type type, char *buf);
int (*emit_clock_levels)(void *handle, enum pp_clock_type type, char *buf, int *offset);
int (*force_performance_level)(void *handle, enum amd_dpm_forced_level level);
+ int (*reapply_performance_level)(void *handle,
+ enum amd_dpm_forced_level level);
int (*get_sclk_od)(void *handle);
int (*set_sclk_od)(void *handle, uint32_t value);
int (*get_mclk_od)(void *handle);
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
index d1c4d7f4accc3..402354846c569 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
@@ -1085,6 +1085,91 @@ static void amdgpu_dpm_exit_umd_state(struct amdgpu_device *adev)
AMD_PG_STATE_GATE);
}
+/**
+ * amdgpu_dpm_reapply_umd_profile - Restore the active UMD profile
+ * @adev: amdgpu device
+ *
+ * Resume and reset retain the selected DPM level in software, but the
+ * underlying GFX and PMFW state is lost. Reapply a retained UMD profile
+ * after the common resume path has restored its default CG and PG state.
+ */
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev)
+{
+ const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
+ enum amd_dpm_forced_level level;
+ int ret, fallback_ret;
+
+ if (!pp_funcs || !pp_funcs->reapply_performance_level ||
+ !pp_funcs->force_performance_level)
+ return 0;
+
+ /* Serialize the retained level with the GFX and PMFW reprogramming. */
+ mutex_lock(&adev->pm.mutex);
+ if (adev->pm.dpm.thermal_active) {
+ dev_warn(adev->dev,
+ "Cannot restore UMD profile while thermal control is active\n");
+ ret = 0;
+ goto unlock;
+ }
+
+ if (pp_funcs->get_performance_level)
+ level = pp_funcs->get_performance_level(adev->powerplay.pp_handle);
+ else
+ level = adev->pm.dpm.forced_level;
+
+ switch (level) {
+ case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+ break;
+ default:
+ ret = 0;
+ goto unlock;
+ }
+
+ /* The active profile already owns the GFX PG reference. */
+ ret = amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+ AMD_CG_STATE_UNGATE);
+ if (ret)
+ goto fallback_auto;
+
+ ret = amdgpu_asic_update_umd_stable_pstate(adev, true);
+ if (ret)
+ goto fallback_auto;
+
+ ret = pp_funcs->reapply_performance_level(adev->powerplay.pp_handle,
+ level);
+ if (ret)
+ goto fallback_auto;
+
+unlock:
+ mutex_unlock(&adev->pm.mutex);
+
+ return ret;
+
+fallback_auto:
+ dev_warn(adev->dev, "Failed to restore UMD profile state: %d\n", ret);
+
+ /* Restore normal CG before releasing the profile's PG reference. */
+ amdgpu_asic_update_umd_stable_pstate(adev, false);
+ amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+ AMD_CG_STATE_GATE);
+ mutex_unlock(&adev->pm.mutex);
+
+ mutex_lock(&adev->pm.stable_pstate_ctx_lock);
+ fallback_ret = amdgpu_dpm_force_performance_level(adev,
+ AMD_DPM_FORCED_LEVEL_AUTO);
+ if (fallback_ret)
+ dev_warn(adev->dev, "Failed to fall back to AUTO performance level: %d\n",
+ fallback_ret);
+ else
+ adev->pm.stable_pstate_ctx = NULL;
+ mutex_unlock(&adev->pm.stable_pstate_ctx_lock);
+
+ return 0;
+}
+
int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
enum amd_dpm_forced_level level)
{
diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
index 13a834575ed77..db78f44da0508 100644
--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
+++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
@@ -482,6 +482,7 @@ void amdgpu_dpm_set_power_state(struct amdgpu_device *adev,
enum amd_dpm_forced_level amdgpu_dpm_get_performance_level(struct amdgpu_device *adev);
int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
enum amd_dpm_forced_level level);
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev);
int amdgpu_dpm_get_pp_num_states(struct amdgpu_device *adev,
struct pp_states_info *states);
int amdgpu_dpm_dispatch_task(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
index 05c5e7d19ca1c..4edca695e73ad 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -367,24 +367,46 @@ static void pp_dpm_en_umd_pstate(struct pp_hwmgr *hwmgr,
}
}
-static int pp_dpm_force_performance_level(void *handle,
- enum amd_dpm_forced_level level)
+static int pp_dpm_apply_performance_level(struct pp_hwmgr *hwmgr,
+ enum amd_dpm_forced_level level,
+ bool reapply)
{
- struct pp_hwmgr *hwmgr = handle;
+ int ret;
if (!hwmgr || !hwmgr->pm_en)
return -EINVAL;
- if (level == hwmgr->dpm_level)
+ if (!reapply && level == hwmgr->dpm_level)
return 0;
pp_dpm_en_umd_pstate(hwmgr, &level);
hwmgr->request_dpm_level = level;
- hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+ ret = hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+ if (ret)
+ return ret;
+
+ ret = phm_force_dpm_levels(hwmgr, level);
+ if (ret)
+ return ret;
+
+ hwmgr->dpm_level = level;
return 0;
}
+static int pp_dpm_force_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ return pp_dpm_apply_performance_level(handle, level, false);
+}
+
+static int
+pp_dpm_reapply_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ return pp_dpm_apply_performance_level(handle, level, true);
+}
+
static enum amd_dpm_forced_level pp_dpm_get_performance_level(
void *handle)
{
@@ -1569,6 +1591,7 @@ static const struct amd_pm_funcs pp_dpm_funcs = {
.load_firmware = pp_dpm_load_fw,
.wait_for_fw_loading_complete = pp_dpm_fw_loading_complete,
.force_performance_level = pp_dpm_force_performance_level,
+ .reapply_performance_level = pp_dpm_reapply_performance_level,
.get_performance_level = pp_dpm_get_performance_level,
.get_current_power_state = pp_dpm_get_current_power_state,
.dispatch_tasks = pp_dpm_dispatch_tasks,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index e0e208a0d9f94..0df4b36ec3a8f 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -2314,6 +2314,13 @@ static int smu_set_powergating_state(struct amdgpu_ip_block *ip_block,
return 0;
}
+static void smu_enter_umd_pstate(struct smu_context *smu)
+{
+ smu_gpo_control(smu, false);
+ smu_gfx_ulv_control(smu, false);
+ smu_deep_sleep_control(smu, false);
+}
+
static int smu_enable_umd_pstate(void *handle,
enum amd_dpm_forced_level *level)
{
@@ -2332,9 +2339,7 @@ static int smu_enable_umd_pstate(void *handle,
/* enter umd pstate, save current level, disable gfx cg*/
if (*level & profile_mode_mask) {
smu_dpm_ctx->saved_dpm_level = smu_dpm_ctx->dpm_level;
- smu_gpo_control(smu, false);
- smu_gfx_ulv_control(smu, false);
- smu_deep_sleep_control(smu, false);
+ smu_enter_umd_pstate(smu);
amdgpu_asic_update_umd_stable_pstate(smu->adev, true);
}
} else {
@@ -2393,7 +2398,8 @@ static void smu_power_profile_mode_put(struct smu_context *smu,
static int smu_adjust_power_state_dynamic(struct smu_context *smu,
enum amd_dpm_forced_level level,
- bool skip_display_settings)
+ bool skip_display_settings,
+ bool force_performance_level)
{
int ret = 0;
struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
@@ -2420,7 +2426,7 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
}
}
- if (smu_dpm_ctx->dpm_level != level) {
+ if (force_performance_level || smu_dpm_ctx->dpm_level != level) {
ret = smu_asic_set_performance_level(smu, level);
if (ret) {
if (ret == -EOPNOTSUPP)
@@ -2443,6 +2449,39 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
return ret;
}
+static int
+smu_reapply_power_state_dynamic(struct smu_context *smu,
+ enum amd_dpm_forced_level level)
+{
+ struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+ int ret;
+
+ ret = smu_apply_clocks_adjust_rules(smu);
+ if (ret) {
+ dev_err(smu->adev->dev, "Failed to apply clocks adjust rules!");
+ return ret;
+ }
+
+ ret = smu_asic_set_performance_level(smu, level);
+ if (ret) {
+ if (ret == -EOPNOTSUPP)
+ dev_info(smu->adev->dev, "set performance level %d not supported",
+ level);
+ else
+ dev_err(smu->adev->dev, "Failed to set performance level %d",
+ level);
+ return ret;
+ }
+
+ smu_dpm_ctx->dpm_level = level;
+
+ if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL ||
+ smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM)
+ return 0;
+
+ return smu_bump_power_profile_mode(smu, NULL, 0);
+}
+
static int smu_handle_task(struct smu_context *smu,
enum amd_dpm_forced_level level,
enum amd_pp_task task_id)
@@ -2457,13 +2496,13 @@ static int smu_handle_task(struct smu_context *smu,
ret = smu_pre_display_config_changed(smu);
if (ret)
return ret;
- ret = smu_adjust_power_state_dynamic(smu, level, false);
+ ret = smu_adjust_power_state_dynamic(smu, level, false, false);
break;
case AMD_PP_TASK_COMPLETE_INIT:
- ret = smu_adjust_power_state_dynamic(smu, level, true);
+ ret = smu_adjust_power_state_dynamic(smu, level, true, false);
break;
case AMD_PP_TASK_READJUST_POWER_STATE:
- ret = smu_adjust_power_state_dynamic(smu, level, true);
+ ret = smu_adjust_power_state_dynamic(smu, level, true, false);
break;
default:
break;
@@ -2592,6 +2631,37 @@ static int smu_force_performance_level(void *handle,
return ret;
}
+static int
+smu_reapply_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ struct smu_context *smu = handle;
+ struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+
+ if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
+ return -EOPNOTSUPP;
+
+ if (!smu->is_apu && !smu_dpm_ctx->dpm_context)
+ return -EINVAL;
+
+ switch (level) {
+ case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (smu_dpm_ctx->dpm_level != level)
+ return -EINVAL;
+
+ smu_enter_umd_pstate(smu);
+
+ return smu_reapply_power_state_dynamic(smu, level);
+}
+
static int smu_set_display_count(void *handle, uint32_t count)
{
struct smu_context *smu = handle;
@@ -3932,6 +4002,7 @@ static const struct amd_pm_funcs swsmu_pm_funcs = {
.print_clock_levels = smu_print_ppclk_levels,
.emit_clock_levels = smu_emit_ppclk_levels,
.force_performance_level = smu_force_performance_level,
+ .reapply_performance_level = smu_reapply_performance_level,
.read_sensor = smu_read_sensor,
.get_apu_thermal_limit = smu_get_apu_thermal_limit,
.set_apu_thermal_limit = smu_set_apu_thermal_limit,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 678/869] drm/amdkfd: dont drop an SVM CWSR reference that was never taken
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-11-07 13:55 ` [PATCH 6.18 677/869] drm/amd/pm: reapply umd profile state after recovery Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 679/869] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950 Greg Kroah-Hartman
` (198 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesse Zhang, Felix Kuehling,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit 030d47cc6720e0f07b502876cdbd266e309f9461 ]
When kfd_queue_acquire_buffers() fails, its error path calls
kfd_queue_release_buffers(), which also drops a queue_refcount on the
SVM range at ctx_save_restore_area_address. The SVM range is the last
buffer acquired, and kfd_queue_buffer_svm_get() takes no reference when
it fails, so on every error path this reference was never taken. If
another queue of the process uses that CWSR range, its reference is
dropped instead, and unmapping the range no longer evicts that queue
while its CWSR area is unmapped from the GPU.
On navi31, with queue A using an SVM CWSR range: munmap() of the range
logs
Freeing queue vital buffer 0x..., queue evicted
but after a CREATE_QUEUE that reuses A's CWSR address with an unmapped
write pointer (-EINVAL), the same munmap() leaves A running without the
message.
Only put the BOs on the acquire error path. The warning and the eviction
are back after the failed CREATE_QUEUE.
Fixes: b049504e211e ("drm/amdkfd: Validate user queue svm memory residency")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9a08122e6361ef73f4b512d5db9596d561305519)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 6f06516da32a8..eaa284e551829 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -231,6 +231,15 @@ void kfd_queue_buffer_put(struct amdgpu_bo **bo)
amdgpu_bo_unref(bo);
}
+static void kfd_queue_put_bos(struct queue_properties *properties)
+{
+ kfd_queue_buffer_put(&properties->wptr_bo);
+ kfd_queue_buffer_put(&properties->rptr_bo);
+ kfd_queue_buffer_put(&properties->ring_bo);
+ kfd_queue_buffer_put(&properties->eop_buf_bo);
+ kfd_queue_buffer_put(&properties->cwsr_bo);
+}
+
int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
{
struct kfd_topology_device *topo_dev;
@@ -341,7 +350,13 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
* dropping the VM reservation.
*/
kfd_queue_unref_bo_vas(pdd, properties);
- kfd_queue_release_buffers(pdd, properties);
+ /*
+ * The SVM CWSR range is the last thing acquired and a failed
+ * kfd_queue_buffer_svm_get() takes nothing, so only the BOs are held
+ * here. Dropping the SVM reference would drop the one of another queue
+ * using the same CWSR address.
+ */
+ kfd_queue_put_bos(properties);
return err;
}
@@ -350,11 +365,7 @@ int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_prope
struct kfd_topology_device *topo_dev;
u64 total_cwsr_size;
- kfd_queue_buffer_put(&properties->wptr_bo);
- kfd_queue_buffer_put(&properties->rptr_bo);
- kfd_queue_buffer_put(&properties->ring_bo);
- kfd_queue_buffer_put(&properties->eop_buf_bo);
- kfd_queue_buffer_put(&properties->cwsr_bo);
+ kfd_queue_put_bos(properties);
topo_dev = kfd_topology_device_by_id(pdd->dev->id);
if (!topo_dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 679/869] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 678/869] drm/amdkfd: dont drop an SVM CWSR reference that was never taken Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 680/869] drm/amd/display: Fix swap in median3() for DSC rate control Greg Kroah-Hartman
` (197 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shahzeb Ahmed, Manjunath Gaonkar,
Elena Sakhnovitch, Apurv Mishra, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
[ Upstream commit 232213c9bd7f703836164f23160b76657094a7db ]
Add extra type-2 TLB flush for GC 9.5.0, similar race condition was
observed as Vega20+XGMI. Add to GC 9.4.3 and 9.4.4 too, as they share
the same multi-XCD TLB topology.
Reported-by: Shahzeb Ahmed <shahzeb.ahmed@amd.com>
Reported-by: Manjunath Gaonkar <Manjunath.Gaonkar@amd.com>
Signed-off-by: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
Reviewed-by: Apurv Mishra <apurv.mishra@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 138cfb165ae6aa98c0767b431e718d1a8199db28)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 0f0d6cd52d916..230a346db3b1b 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2186,10 +2186,22 @@ static int gmc_v9_0_hw_init(struct amdgpu_ip_block *ip_block)
* (type 2), which flushes both. Due to a race condition with
* concurrent memory accesses using the same TLB cache line, we still
* need a second TLB flush after this.
+ *
+ * GC 9.4.3, 9.4.4 and 9.5.0 hit a similar race.
*/
- adev->gmc.flush_tlb_needs_extra_type_2 =
- amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 0) &&
- adev->gmc.xgmi.num_physical_nodes;
+ switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
+ case IP_VERSION(9, 4, 0):
+ adev->gmc.flush_tlb_needs_extra_type_2 =
+ adev->gmc.xgmi.num_physical_nodes;
+ break;
+ case IP_VERSION(9, 4, 3):
+ case IP_VERSION(9, 4, 4):
+ case IP_VERSION(9, 5, 0):
+ adev->gmc.flush_tlb_needs_extra_type_2 = true;
+ break;
+ default:
+ break;
+ }
/* The sequence of these two function calls matters.*/
gmc_v9_0_init_golden_registers(adev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 680/869] drm/amd/display: Fix swap in median3() for DSC rate control
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 679/869] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950 Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 681/869] drm/amdkfd: wait for a GPU reset before freeing a BO Greg Kroah-Hartman
` (196 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keita Morisaki, Dan Wheeler,
Roman Li, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keita Morisaki <kmta1236@gmail.com>
[ Upstream commit 7b23bf82ccbdb4cf0752f2b8686e7319a7ce497f ]
median3() is meant to return the median of three values, but its last
compare-and-swap step swaps b and c instead of a and b. When c is
smaller than both a and b, it returns max(a, b) instead of min(a, b).
For example, median3(2, 3, 1) returns 3 instead of 2.
_do_calc_rc_params() always passes 0 as the first argument, and the
second argument is never below 12. So whenever the third argument is
negative, first_line_bpg_offset (and second_line_bpg_offset for 4:2:0)
is set to the second argument instead of 0.
Fix this by swapping a and b in the last step, as intended.
Note that this change does not affect valid DSC configurations. The
third argument is negative only when bits per pixel exceeds the
uncompressed rate of the colour format:
- 3 * bpc for 4:4:4, 3 * bpc + 2 for RGB
- 2 * bpc for 4:2:2
- 1.5 * bpc for 4:2:0
Fixes: 97bda0322b8a ("drm/amd/display: Add DSC support for Navi (v2)")
Signed-off-by: Keita Morisaki <kmta1236@gmail.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1ddc4bc97a62fc89d9d3681413d9f977e1fa1a83)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
index ef75eb7d5adc3..940de620e3308 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
@@ -46,7 +46,7 @@ static int median3(int a, int b, int c)
if (b > c)
swap(b, c);
if (a > b)
- swap(b, c);
+ swap(a, b);
return b;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 681/869] drm/amdkfd: wait for a GPU reset before freeing a BO
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 680/869] drm/amd/display: Fix swap in median3() for DSC rate control Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 682/869] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates Greg Kroah-Hartman
` (195 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, William Palacek,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Palacek <William.Palacek@amd.com>
[ Upstream commit 47d799a718439764432d8ef3a0952af45f025f76 ]
When a GPU reset takes the reset domain, KFD eviction cannot unmap
user queues: execute_queues_cpsch() fails its trylock with -EIO, so
the queues keep running until the ASIC is reset. The TLB flush is also
skipped while the reset is in progress. If the process unmaps and frees
a BO in that window, its pages are released while a queue can still
access them through stale translations.
On MI300X, munmap() then crashes in free_swap_cache() on a small bogus
page pointer in its mmu_gather batch page:
BUG: unable to handle page fault for address: 0000000000002900
RIP: 0010:free_swap_cache+0x5/0xb0
Call Trace:
free_pages_and_swap_cache+0x3a/0x60
tlb_batch_pages_flush+0x43/0x80
tlb_flush_mmu+0x3d/0x110
zap_pte_range+0x80d/0xcd0
...
do_vmi_align_munmap+0x3e8/0x5b0
do_vmi_munmap+0xdf/0x190
__vm_munmap+0xad/0x180
__x64_sys_munmap+0x1b/0x30
In a traced crash the bogus pointer was the read pointer value of an SDMA
queue the process had just destroyed, at the read pointer's page offset:
the queue's writeback landed in its freed rptr page after the page was
reused as the batch page.
commit f0b4440cdc18 ("drm/amdkfd: Fix mode1 reset crash issue") fixed
this race on process exit by waiting for the reset to complete before
freeing the process's BOs. Free through the ioctl has the same race.
Wait for the reset there too, using the same helper.
Fixes: 9c33e5fd4fb6 ("drm/amdgpu: fix locking scope when flushing tlb")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: William Palacek <William.Palacek@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 06ff8ce77726b15a98fcc285dd6005cb3f48558b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 +
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +-
3 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index c224d78a770a1..1ec77554da503 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1222,6 +1222,9 @@ static int kfd_ioctl_free_memory_of_gpu(struct file *filep,
goto err_unlock;
}
+ /* Queues a reset could not stop may still access the buffer */
+ kfd_process_wait_gpu_reset_complete(p);
+
ret = amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev,
(struct kgd_mem *)mem, pdd->drm_priv, &size);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index ef1afeaa8d85d..1f5f528188980 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1084,6 +1084,7 @@ void kfd_unref_process(struct kfd_process *p);
int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger);
int kfd_process_restore_queues(struct kfd_process *p);
void kfd_suspend_all_processes(void);
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p);
int kfd_resume_all_processes(void);
struct kfd_process_device *kfd_process_device_data_by_id(struct kfd_process *process,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 0b760aab11c6f..1c591953cc80d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1144,7 +1144,7 @@ static void kfd_process_remove_sysfs(struct kfd_process *p)
/*
* If any GPU is ongoing reset, wait for reset complete.
*/
-static void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
{
int i;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 682/869] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 681/869] drm/amdkfd: wait for a GPU reset before freeing a BO Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 683/869] amdkfd: Fix memory availability double accounting of kfd pinned objects Greg Kroah-Hartman
` (194 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prike Liang, Christian König,
John Fisher, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fisher <jfisher84@gmail.com>
[ Upstream commit 53d9ef2f518add783bb48a69d77bbc8aea99e911 ]
amdgpu_vm_make_compute() switches a VM from SDMA to CPU page table
updates when a KFD process acquires it. It syncs "with the last SDMA
update/clear" through amdgpu_bo_sync_wait() on the root PD, but that
walks the reservation with DMA_RESV_USAGE_READ, and the clears of the
VM's page tables (the root PD from amdgpu_vm_init(), and the PDs/PTs
the seq64 mapping allocates at the render node's open) are added there
by amdgpu_vm_sdma_commit() with DMA_RESV_USAGE_BOOKKEEP only:
amdgpu_vm_pt_clear() commits them with a NULL fence, so they do not
reach vm->last_update. The CPU path's own waits (amdgpu_vm_cpu_update(),
amdgpu_bo_kmap()) use DMA_RESV_USAGE_KERNEL. None of them waits for a
clear that is still queued.
When one is, the CPU writes the first entries of the new compute VM (the
KFD trap handler's TBA/TMA page at AMDGPU_VA_RESERVED_TRAP_START, mapped
during ACQUIRE_VM) into a page directory the SDMA then clears. The
entries are gone, the handler's page is unmapped, and the first wave
save of any queue of the process faults in the SQC instruction fetch at
the handler's address (GCVM_L2_PROTECTION_FAULT_STATUS 0x008012B1,
PERMISSION_FAULTS 0xb). The MES then fails REMOVE_QUEUE and SUSPEND, and
the device takes a MODE1 reset with VRAM lost on 7.2.9; on 7.3-rc6 the
queue is reset instead.
The window is the time between the render node's open and ACQUIRE_VM.
ROCr spends milliseconds there and is practically never hit; a minimal
KFD client that opens the render node and acquires the VM at once is hit
most of the time. On a Radeon AI PRO R9700 (gfx1201, Resizable BAR, so
vm_update_mode defaults to CPU updates for compute VMs), a wave reading
the trap handler's page right after queue creation found it unmapped in
8 of 12 runs; a 5 ms sleep between the open and ACQUIRE_VM made that 0
of 9, and the same sleep after queue creation instead 3 of 3.
The wait covered these jobs until commit 926c79ad6ecd ("drm/amdgpu:
promote the implicit sync to the dependent read fences") narrowed
amdgpu_sync_resv() from DMA_RESV_USAGE_BOOKKEEP to DMA_RESV_USAGE_READ;
the VM's page table jobs have been added with BOOKKEEP since commit
4247084057cf ("drm/amdgpu: use DMA_RESV_USAGE_BOOKKEEP v2"), so from
v6.16 on the sync in amdgpu_vm_make_compute() waits for nothing of
them.
Record the clears in vm->last_update, as amdgpu_vm_update_pdes() does
with its updates, and wait for it, uninterruptibly, before switching the
update functions. The clears all go through vm->delayed, so the last one
covers the earlier ones; immediate clears are not recorded, as before.
With this, on 7.3-rc6 and on 7.2.9, the same client reads the handler
10 of 10 times, 8 busy queues on the 4 compute slots complete in 5 of 5
runs on 7.3-rc6 and 3 of 3 on 7.2.9 (1 of 6 before), 16 and 32 queues
complete on 7.3-rc6, and two processes with 8 queues each complete
together on both, with no fault.
Fixes: 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences")
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John Fisher <jfisher84@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9ec91b35baba45209c3fcd00f086224a158dd512)
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +----
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +-
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index f78ac6777ee5c..c9614a99b40d1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2720,10 +2720,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
if (vm->use_cpu_for_update) {
/* Sync with last SDMA update/clear before switching to CPU */
- r = amdgpu_bo_sync_wait(vm->root.bo,
- AMDGPU_FENCE_OWNER_UNDEFINED, true);
- if (r)
- goto unreserve_bo;
+ dma_fence_wait(vm->last_update, false);
vm->update_funcs = &amdgpu_vm_cpu_funcs;
r = amdgpu_vm_pt_map_tables(adev, vm);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
index f794fb1cc06e6..a05f34259d578 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -421,7 +421,7 @@ int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,
if (r)
goto exit;
- r = vm->update_funcs->commit(¶ms, NULL);
+ r = vm->update_funcs->commit(¶ms, &vm->last_update);
exit:
drm_dev_exit(idx);
return r;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 683/869] amdkfd: Fix memory availability double accounting of kfd pinned objects
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 682/869] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 684/869] drm/amdkfd: correct vram_available calculation Greg Kroah-Hartman
` (193 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Phillips, Felix Kuehling,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Phillips <daniel.phillips@amd.com>
[ Upstream commit 16df12d7158fb55f20d6e985abd1996cbabab9f8 ]
Pinned objects that are not kfd objects reduce the total vram available
to kfd, so we subtract the total size of pinned objects from kdf vram
availability. However this double counts objects pinned by kfd itself,
because they are counted both as used and pinned. So track the total
size of objects pinned by kfd and add it back to kfd availability to
remove the double accounting.
Signed-off-by: Daniel Phillips <daniel.phillips@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b8257bdb26ca5d9a75f4b81f629422f17afa221b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index c59b5d9cd36b6..b15798489af0c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -104,6 +104,7 @@ struct amdgpu_kfd_dev {
struct kfd_dev *dev;
int64_t vram_used[MAX_XCP];
uint64_t vram_used_aligned[MAX_XCP];
+ atomic64_t vram_pinned;
bool init_complete;
struct work_struct reset_work;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index d56728b257f49..bf4cea36d3ad4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1518,6 +1518,11 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
pr_err("Error in Pinning BO to domain: %d\n", domain);
amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
+
+ if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
+ atomic64_add(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
out:
amdgpu_bo_unreserve(bo);
return ret;
@@ -1540,6 +1545,11 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
return;
amdgpu_bo_unpin(bo);
+
+ if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
+ atomic64_sub(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
amdgpu_bo_unreserve(bo);
}
@@ -1661,6 +1671,7 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- adev->kfd.vram_used_aligned[xcp_id]
- atomic64_read(&adev->vram_pin_size)
+ + atomic64_read(&adev->kfd.vram_pinned)
- reserved_for_pt
- reserved_for_ras;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 684/869] drm/amdkfd: correct vram_available calculation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 683/869] amdkfd: Fix memory availability double accounting of kfd pinned objects Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 685/869] ipv6: remove ifaddr from hash during ifdown list cleanup Greg Kroah-Hartman
` (192 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philip Yang, Zhen Han, Mukul Joshi,
Lijo Lazar, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Han <Zhen.Han@amd.com>
[ Upstream commit 9131cc85d0dedd8ba4cae60dbe5985d081551f30 ]
reserve_mem_limit() computes available VRAM as
vram_size - reserved - vram_pin_size - kfd.vram_used
However, kfd.vram_used already includes BOs that are later pinned.
Pinning does not consume extra VRAM. Subtracting
vram_pin_size counts those bytes twice and causes fake-OOM
while VRAM is still free.
Reuse get_available_memory() in reserve_mem_limit(). Move
ALIGN_DOWN to the ioctl so the userspace ABI is unchanged. The
VRAM counter is a parameter: the ioctl passes vram_used_aligned[],
the gate passes vram_used[] so a 4K BO is not charged 2MB.
kfd.vram_pinned is only updated in gpuvm_pin_bo(). dma-buf pin
calls amdgpu_bo_pin() only, so the counter stays zero. Update it
from amdgpu_bo_pin() through a KFD helper, on first pin and last
unpin, matching vram_pin_size.
Track per-XCP pins in vram_pin_size_xcp[] and kfd.vram_pinned[].
Pins that are not owned by a single partition go to
vram_pin_size_common, which every partition subtracts.
A KFD VRAM BO always carries a partition, so the KFD credit is only
correct for xcp >= 0. Call the helper for both branches and let it
warn once and skip if that ever stops holding: without the credit the
BO would be subtracted through vram_pin_size_common and never added
back, which is the double counting this patch removes, and
kfd.vram_pinned[] would be indexed out of bounds.
Suggested-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Zhen Han <Zhen.Han@amd.com>
Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 894cbb31c50e3cf49657130396bbf6c0475304e4)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 11 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 20 +++-
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 94 +++++++++++--------
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 33 +++++++
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 12 ++-
5 files changed, 127 insertions(+), 43 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 803b6fc360a07..034f2d03e367e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1195,8 +1195,17 @@ struct amdgpu_device {
struct mutex mn_lock;
DECLARE_HASHTABLE(mn_hash, 7);
- /* tracking pinned memory */
+ /* tracking pinned memory
+ *
+ * vram_pin_size = sum(vram_pin_size_xcp[]) + vram_pin_size_common
+ *
+ * vram_pin_size total pin size in device
+ * vram_pin_size_xcp[i] pins owned by partition i (bo->xcp_id = i, i >= 0)
+ * vram_pin_size_common pins not owned by any partition, bo->xcp_id = -1
+ */
atomic64_t vram_pin_size;
+ atomic64_t vram_pin_size_xcp[MAX_XCP];
+ atomic64_t vram_pin_size_common;
atomic64_t visible_pin_size;
atomic64_t gart_pin_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index b15798489af0c..21dbc8675f4e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -40,6 +40,12 @@
extern uint64_t amdgpu_amdkfd_total_mem_size;
+/*
+ * Align VRAM availability to 2MB to avoid fragmentation caused by 4K
+ * allocations in the tail 2MB BO chunk.
+ */
+#define VRAM_AVAILABLITY_ALIGN (1 << 21)
+
enum TLB_FLUSH_TYPE {
TLB_FLUSH_LEGACY = 0,
TLB_FLUSH_LIGHTWEIGHT,
@@ -104,7 +110,7 @@ struct amdgpu_kfd_dev {
struct kfd_dev *dev;
int64_t vram_used[MAX_XCP];
uint64_t vram_used_aligned[MAX_XCP];
- atomic64_t vram_pinned;
+ atomic64_t vram_pinned[MAX_XCP];
bool init_complete;
struct work_struct reset_work;
@@ -375,6 +381,8 @@ void amdgpu_amdkfd_gpuvm_destroy_cb(struct amdgpu_device *adev,
* Allows KFD to release its resources associated with the GEM object.
*/
void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo);
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id);
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id);
void amdgpu_amdkfd_reserve_system_mem(uint64_t size);
#else
static inline
@@ -392,6 +400,16 @@ static inline
void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
{
}
+
+static inline
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
+
+static inline
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
#endif
#if IS_ENABLED(CONFIG_HSA_AMD_SVM)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index bf4cea36d3ad4..35dffb14a20aa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -46,12 +46,6 @@
#define AMDGPU_USERPTR_RESTORE_DELAY_MS 1
#define AMDGPU_RESERVE_MEM_LIMIT (3UL << 29)
-/*
- * Align VRAM availability to 2MB to avoid fragmentation caused by 4K allocations in the tail 2MB
- * BO chunk
- */
-#define VRAM_AVAILABLITY_ALIGN (1 << 21)
-
/* Impose limit on how much memory KFD can use */
static struct {
uint64_t max_system_mem_limit;
@@ -73,6 +67,8 @@ static const char * const domain_bit_to_string[] = {
#define domain_string(domain) domain_bit_to_string[ffs(domain)-1]
static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work);
+static size_t __get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id, int64_t vram_used);
static bool kfd_mem_is_attached(struct amdgpu_vm *avm,
struct kgd_mem *mem)
@@ -169,13 +165,8 @@ void amdgpu_amdkfd_reserve_system_mem(uint64_t size)
int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
uint64_t size, u32 alloc_flag, int8_t xcp_id)
{
- uint64_t reserved_for_pt =
- ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
- struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
- uint64_t reserved_for_ras = (con ? con->reserved_pages_in_bytes : 0);
size_t system_mem_needed, ttm_mem_needed, vram_needed;
int ret = 0;
- uint64_t vram_size = 0;
system_mem_needed = 0;
ttm_mem_needed = 0;
@@ -196,7 +187,6 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
if (WARN_ONCE(xcp_id < 0, "invalid XCP ID %d", xcp_id))
return -EINVAL;
- vram_size = KFD_XCP_MEMORY_SIZE(adev, xcp_id);
if (adev->apu_prefer_gtt) {
system_mem_needed = size;
ttm_mem_needed = size;
@@ -232,14 +222,11 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
* VRAM check since ttm_mem_limit check already cover this allocation
*/
- if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {
- uint64_t vram_available =
- vram_size - reserved_for_pt - reserved_for_ras -
- atomic64_read(&adev->vram_pin_size);
- if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {
- ret = -ENOMEM;
- goto release;
- }
+ if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu) &&
+ vram_needed > __get_available_memory(adev, xcp_id,
+ adev->kfd.vram_used[xcp_id])) {
+ ret = -ENOMEM;
+ goto release;
}
/* Update memory accounting by decreasing available system
@@ -318,6 +305,30 @@ void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
kfree(bo->kfd_bo);
}
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+ if (!bo->kfd_bo)
+ return;
+
+ if (WARN_ONCE(xcp_id < 0, "KFD BO pinned in VRAM with no partition"))
+ return;
+
+ atomic64_add(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+ if (!bo->kfd_bo)
+ return;
+
+ if (WARN_ONCE(xcp_id < 0, "KFD BO unpinned in VRAM with no partition"))
+ return;
+
+ atomic64_sub(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
/**
* create_dmamap_sg_bo() - Creates a amdgpu_bo object to reflect information
* about USERPTR or DOOREBELL or MMIO BO.
@@ -1519,10 +1530,6 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
- if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
- atomic64_add(amdgpu_bo_size(bo),
- &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
out:
amdgpu_bo_unreserve(bo);
return ret;
@@ -1546,10 +1553,6 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
amdgpu_bo_unpin(bo);
- if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
- atomic64_sub(amdgpu_bo_size(bo),
- &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
amdgpu_bo_unreserve(bo);
}
@@ -1653,8 +1656,9 @@ int amdgpu_amdkfd_criu_resume(void *p)
return ret;
}
-size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
- uint8_t xcp_id)
+/* Caller must hold kfd_mem_limit.mem_limit_lock. */
+static size_t __get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id, int64_t vram_used)
{
uint64_t reserved_for_pt =
ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
@@ -1663,15 +1667,17 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
ssize_t available;
uint64_t vram_available, system_mem_available, ttm_mem_available;
- spin_lock(&kfd_mem_limit.mem_limit_lock);
+ lockdep_assert_held(&kfd_mem_limit.mem_limit_lock);
+
if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- - adev->kfd.vram_used_aligned[xcp_id];
+ - vram_used;
else
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- - adev->kfd.vram_used_aligned[xcp_id]
- - atomic64_read(&adev->vram_pin_size)
- + atomic64_read(&adev->kfd.vram_pinned)
+ - vram_used
+ - atomic64_read(&adev->vram_pin_size_xcp[xcp_id])
+ - atomic64_read(&adev->vram_pin_size_common)
+ + atomic64_read(&adev->kfd.vram_pinned[xcp_id])
- reserved_for_pt
- reserved_for_ras;
@@ -1686,19 +1692,29 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
available = min3(system_mem_available, ttm_mem_available,
vram_available);
- available = ALIGN_DOWN(available, PAGE_SIZE);
} else {
- available = ALIGN_DOWN(vram_available, VRAM_AVAILABLITY_ALIGN);
+ available = vram_available;
}
- spin_unlock(&kfd_mem_limit.mem_limit_lock);
-
if (available < 0)
available = 0;
return available;
}
+size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id)
+{
+ size_t available;
+
+ spin_lock(&kfd_mem_limit.mem_limit_lock);
+ available = __get_available_memory(adev, xcp_id,
+ adev->kfd.vram_used_aligned[xcp_id]);
+ spin_unlock(&kfd_mem_limit.mem_limit_lock);
+
+ return available;
+}
+
int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
struct amdgpu_device *adev, uint64_t va, uint64_t size,
void *drm_priv, struct kgd_mem **mem,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index cdab2c098cfab..c2f13584a5a32 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -917,6 +917,19 @@ void amdgpu_bo_unref(struct amdgpu_bo **bo)
*bo = NULL;
}
+/* Map a BO onto vram_pin_size_xcp[]. bo->xcp_id < 0 means "any partition":
+ * such pins are not owned by a single partition and go to
+ * vram_pin_size_common, which every partition subtracts.
+ */
+static int amdgpu_bo_get_xcp(struct amdgpu_bo *bo)
+{
+ s8 xcp = bo->xcp_id;
+
+ if (xcp >= 0 && xcp < MAX_XCP)
+ return xcp;
+ return -1;
+}
+
/**
* amdgpu_bo_pin - pin an &amdgpu_bo buffer object
* @bo: &amdgpu_bo buffer object to be pinned
@@ -997,7 +1010,17 @@ int amdgpu_bo_pin(struct amdgpu_bo *bo, u32 domain)
ttm_bo_pin(&bo->tbo);
if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+ int xcp = amdgpu_bo_get_xcp(bo);
+
atomic64_add(amdgpu_bo_size(bo), &adev->vram_pin_size);
+ if (xcp >= 0) {
+ atomic64_add(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_xcp[xcp]);
+ } else {
+ atomic64_add(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_common);
+ }
+ amdgpu_amdkfd_account_vram_pin(bo, xcp);
atomic64_add(amdgpu_vram_mgr_bo_visible_size(bo),
&adev->visible_pin_size);
} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
@@ -1030,7 +1053,17 @@ void amdgpu_bo_unpin(struct amdgpu_bo *bo)
dma_buf_unpin(bo->tbo.base.import_attach);
if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+ int xcp = amdgpu_bo_get_xcp(bo);
+
atomic64_sub(amdgpu_bo_size(bo), &adev->vram_pin_size);
+ if (xcp >= 0) {
+ atomic64_sub(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_xcp[xcp]);
+ } else {
+ atomic64_sub(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_common);
+ }
+ amdgpu_amdkfd_account_vram_unpin(bo, xcp);
atomic64_sub(amdgpu_vram_mgr_bo_visible_size(bo),
&adev->visible_pin_size);
} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 1ec77554da503..b90bfbd121f88 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1035,11 +1035,19 @@ static int kfd_ioctl_get_available_memory(struct file *filep,
{
struct kfd_ioctl_get_available_memory_args *args = data;
struct kfd_process_device *pdd = kfd_lock_pdd_by_id(p, args->gpu_id);
+ struct amdgpu_device *adev;
+ size_t available;
if (!pdd)
return -EINVAL;
- args->available = amdgpu_amdkfd_get_available_memory(pdd->dev->adev,
- pdd->dev->node_id);
+
+ adev = pdd->dev->adev;
+ available = amdgpu_amdkfd_get_available_memory(adev, pdd->dev->node_id);
+ if (adev->apu_prefer_gtt)
+ args->available = ALIGN_DOWN(available, PAGE_SIZE);
+ else
+ args->available = ALIGN_DOWN(available, VRAM_AVAILABLITY_ALIGN);
+
kfd_unlock_pdd(pdd);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 685/869] ipv6: remove ifaddr from hash during ifdown list cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 684/869] drm/amdkfd: correct vram_available calculation Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 686/869] ipv6: serialize address publication with device teardown Greg Kroah-Hartman
` (191 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 6ace56ed7b13a9c6d4cb7ef0d82d3a3d53324a63 ]
addrconf_ifdown() clears the address hash before snapshotting the
per-device address list. A concurrent ipv6_add_addr() can publish an
address after the hash scan and before the list snapshot.
The ifdown path then removes the address from the device list and drops
the list-owned reference while it is still linked in the hash. Once the
remaining references are released, inet6_ifa_finish_destroy() warns, but
a DEAD address continues to kfree_rcu(). The hash therefore points to
freed memory that later RCU walkers can dereference.
This follow-on was found by source review and was not separately
triggered at runtime.
Remove each non-kept address from the hash immediately before removing
it from the per-device list. Keeping it hashed through the delete
notification blocks same-address publication until NETDEV_DOWN has been
delivered. hlist_del_init_rcu() is safe when the earlier hash scan
already removed the address.
This handles a late publisher captured by the list snapshot. The next
change serializes publication with teardown so an add cannot miss both
observations. Both changes are required when backporting the complete fix.
Fixes: 73a8bd74e261 ("ipv6: Revert 'administrative down' address handling changes.")
Cc: stable@vger.kernel.org
Reported-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20261004135117.GA206930@shredder
Link: https://lore.kernel.org/r/179161099539.434549.2238120015372268173@kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-2-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 81f5bda2a89fc..067d325291b9f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4006,6 +4006,10 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
}
if (!keep) {
+ spin_lock_bh(&net->ipv6.addrconf_hash_lock);
+ hlist_del_init_rcu(&ifa->addr_lst);
+ spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
+
write_lock_bh(&idev->lock);
list_del_rcu(&ifa->if_list);
write_unlock_bh(&idev->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 686/869] ipv6: serialize address publication with device teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 685/869] ipv6: remove ifaddr from hash during ifdown list cleanup Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 687/869] ipv6: initialize temporary ifaddr before publication Greg Kroah-Hartman
` (190 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 06227034e2d93942119b922cf05f2de9da0ad848 ]
ipv6_add_addr() checks idev state before allocating an ifaddr, but
publishes the object later. addrconf_ifdown() can mark and detach the
idev between the check and publication.
This happens when a non-loopback device MTU falls below IPV6_MIN_MTU. A
forced interleaving published an address on a dead idev, and
ipv6_get_ifaddr() still returned it after teardown. Later device deletion
remained blocked with:
unregister_netdevice: waiting for ac0 to become free. Usage count = 3
Protect the dead indication with idev->lock and keep that lock across
both hash and device-list publication. Recheck dead before publishing;
if teardown wins the lock, reject the unpublished object.
Non-unregister teardown does not set dead. The preceding change covers an
add that misses the initial hash scan but reaches the per-device list
snapshot. Both changes are required when backporting this fix.
Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20261012145306.GB779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-3-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 067d325291b9f..caf8f3bd2372f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1168,14 +1168,18 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
rcu_read_lock();
- err = ipv6_add_addr_hash(idev->dev, ifa);
+ write_lock_bh(&idev->lock);
+
+ if (idev->dead)
+ err = -ENODEV;
+ else
+ err = ipv6_add_addr_hash(idev->dev, ifa);
if (err < 0) {
+ write_unlock_bh(&idev->lock);
rcu_read_unlock();
goto out;
}
- write_lock_bh(&idev->lock);
-
/* Add to inet6_dev unicast addr list. */
ipv6_link_dev_addr(idev, ifa);
@@ -3884,7 +3888,9 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
* Do not dev_put!
*/
if (unregister) {
+ write_lock_bh(&idev->lock);
WRITE_ONCE(idev->dead, 1);
+ write_unlock_bh(&idev->lock);
/* protected by rtnl_lock */
RCU_INIT_POINTER(dev->ip6_ptr, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 687/869] ipv6: initialize temporary ifaddr before publication
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 686/869] ipv6: serialize address publication with device teardown Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 688/869] ipv6: do not restart DAD for a dead ifaddr Greg Kroah-Hartman
` (189 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit ed7f278812e540db507f683e5bf9b6d0a1f5bc1e ]
ipv6_create_tempaddr() holds a reference to the public ifaddr, publishes
the new temporary address through ipv6_add_addr(), and only then stores
the reference and final timestamps.
addrconf_ifdown() can remove the temporary address before ifpub is
stored, leaking the public ifaddr reference. Publishing ifpub alone is
insufficient: manage_tempaddrs() can then find the object before cstamp
and tstamp are final, update its lifetimes, and have the constructor
overwrite its timestamp with an older value.
This follow-on was found by source review and was not separately
triggered at runtime.
Pass the public ifaddr and both timestamps in ifa6_config. Initialize all
three fields before adding the temporary address to either the hash or
per-device lists. On success the existing public-ifaddr reference
transfers to the temporary object. On error it remains owned and released
by ipv6_create_tempaddr().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179122559913.434549.12720841717630168470@kernel.org
Link: https://lore.kernel.org/r/179161099665.434549.5858601179492551889@kernel.org
Link: https://lore.kernel.org/r/20261007164548.GA1153540@shredder
Link: https://lore.kernel.org/r/20261012145240.GA779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-4-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 3 +++
net/ipv6/addrconf.c | 20 +++++++++++++-------
2 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index b353dea9aedc8..03d6543a51890 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -80,6 +80,9 @@ struct ifa6_config {
u8 ifa_proto;
const struct in6_addr *peer_pfx;
+ struct inet6_ifaddr *ifpub;
+ unsigned long cstamp;
+ unsigned long tstamp;
u32 rt_priority;
u32 ifa_flags;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index caf8f3bd2372f..e277b78313686 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1155,10 +1155,19 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
ifa->flags |= IFA_F_TENTATIVE;
ifa->valid_lft = cfg->valid_lft;
ifa->prefered_lft = cfg->preferred_lft;
- ifa->cstamp = ifa->tstamp = jiffies;
ifa->tokenized = false;
ifa->rt = f6i;
+ ifa->ifpub = cfg->ifpub;
+ if (cfg->ifpub) {
+ ifa->cstamp = cfg->cstamp;
+ ifa->tstamp = cfg->tstamp;
+ } else {
+ unsigned long now = jiffies;
+
+ ifa->cstamp = now;
+ ifa->tstamp = now;
+ }
ifa->idev = idev;
in6_dev_hold(idev);
@@ -1491,6 +1500,9 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
cfg.pfx = &addr;
cfg.scope = ipv6_addr_scope(cfg.pfx);
+ cfg.ifpub = ifp;
+ cfg.cstamp = now;
+ cfg.tstamp = tmp_tstamp;
ift = ipv6_add_addr(idev, &cfg, block, NULL);
if (IS_ERR(ift)) {
@@ -1501,12 +1513,6 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
goto retry;
}
- spin_lock_bh(&ift->lock);
- ift->ifpub = ifp;
- ift->cstamp = now;
- ift->tstamp = tmp_tstamp;
- spin_unlock_bh(&ift->lock);
-
addrconf_dad_start(ift);
in6_ifa_put(ift);
in6_dev_put(idev);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 688/869] ipv6: do not restart DAD for a dead ifaddr
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 687/869] ipv6: initialize temporary ifaddr before publication Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 689/869] fbdev: bitblit: Fix glyph clipping when fbcon pans Greg Kroah-Hartman
` (188 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Daehyeon Ko, Ido Schimmel,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit ffb668669ce4144347973d8b2fad449e9be0563d ]
addrconf_dad_failure() can create a stable-privacy replacement without
RTNL. After ipv6_add_addr() publishes it, addrconf_ifdown() can mark the
new ifaddr DEAD, clear its route, and unlink it before the recovery path
takes ifp2->lock.
The recovery path then unconditionally changes the state back to PREDAD
and queues delayed DAD work. The MTU teardown path can leave IF_READY
set. For an optimistic address, addrconf_dad_begin() can consequently
pass the cleared NULL route to ip6_ins_rt().
This follow-on was found by source review and was not separately
triggered at runtime.
The new ifaddr is already initialized in PREDAD. Under ifp2->lock, record
the retry and queue DAD only if teardown has not changed the state to
DEAD. If teardown wins after this check, the work observes DEAD and exits
without reviving the address.
This complements the existing lock_errdad check that preserves the original
ifaddr's DEAD state after the same function reacquires its lock.
Fixes: 5f40ef77adb2 ("ipv6: do retries on stable privacy addresses")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20260513025509.3776405-1-lilinmao@kylinos.cn
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-5-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e277b78313686..527ae9fc1c41c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2198,6 +2198,7 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
if (ifp->flags & IFA_F_STABLE_PRIVACY) {
+ bool start_dad = false;
struct in6_addr new_addr;
struct inet6_ifaddr *ifp2;
int retries = ifp->stable_privacy_retry + 1;
@@ -2236,11 +2237,14 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
goto lock_errdad;
spin_lock_bh(&ifp2->lock);
- ifp2->stable_privacy_retry = retries;
- ifp2->state = INET6_IFADDR_STATE_PREDAD;
+ if (ifp2->state != INET6_IFADDR_STATE_DEAD) {
+ ifp2->stable_privacy_retry = retries;
+ start_dad = true;
+ }
spin_unlock_bh(&ifp2->lock);
- addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
+ if (start_dad)
+ addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
in6_ifa_put(ifp2);
lock_errdad:
spin_lock_bh(&ifp->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 689/869] fbdev: bitblit: Fix glyph clipping when fbcon pans
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 688/869] ipv6: do not restart DAD for a dead ifaddr Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 690/869] PCI: qcom-ep: Deinitialize endpoint on remove Greg Kroah-Hartman
` (187 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Tingjie Zhong,
Helge Deller, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tingjie Zhong <catme0w@live.cn>
[ Upstream commit 06fccf840640d8f6b0e08a1756f8d2f0435b4cbe ]
Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.
Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Tingjie Zhong <catme0w@live.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/bitblit.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 8f6a2d1736d39..86ae7a7252d21 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -18,6 +18,7 @@
#include <linux/console.h>
#include <asm/types.h>
#include "fbcon.h"
+#include "fbcon_rotate.h"
/*
* Accelerated handlers.
@@ -151,7 +152,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
const unsigned short *s, int count, int yy, int xx,
int fg, int bg)
{
+ struct fbcon_par *par = info->fbcon_par;
struct fb_image image;
+ u32 vyres = GETVYRES(par->p, info);
u32 width = DIV_ROUND_UP(vc->vc_font.width, 8);
u32 cellsize = width * vc->vc_font.height;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -168,10 +171,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
image.height = vc->vc_font.height;
image.depth = 1;
- if (image.dy >= info->var.yres)
+ if (image.dy >= vyres)
return;
- image.height = min(image.height, info->var.yres - image.dy);
+ image.height = min(image.height, vyres - image.dy);
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 690/869] PCI: qcom-ep: Deinitialize endpoint on remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 689/869] fbdev: bitblit: Fix glyph clipping when fbcon pans Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 691/869] net/rds: ib: dont enable IRQs in rds_ib_conn_free() Greg Kroah-Hartman
` (186 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ed1d71e41c7b2e755e0ef8e9af9cab9b6b185c4b ]
qcom_pcie_ep_probe() initializes the DesignWare PCIe endpoint with
dw_pcie_ep_init(). The probe failure paths call dw_pcie_ep_deinit() to
release the corresponding endpoint resources, but the remove path does
not perform the matching teardown after a successful probe.
As a result, resources initialized by the DesignWare endpoint core can
remain allocated when the endpoint controller is removed.
Notify endpoint functions about EPC deinitialization and call
dw_pcie_ep_deinit() before disabling the controller resources. Keep the
existing early return when the link is already disabled since Qualcomm
endpoint controllers depend on the host refclk for hardware cleanup.
This issue was found by manual code inspection.
Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916090126.2963064-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom-ep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
index f1bc0ac81a928..72bb2a2dd238e 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
+++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
@@ -920,6 +920,8 @@ static void qcom_pcie_ep_remove(struct platform_device *pdev)
if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED)
return;
+ pci_epc_deinit_notify(pcie_ep->pci.ep.epc);
+ dw_pcie_ep_deinit(&pcie_ep->pci.ep);
qcom_pcie_disable_resources(pcie_ep);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 691/869] net/rds: ib: dont enable IRQs in rds_ib_conn_free()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 690/869] PCI: qcom-ep: Deinitialize endpoint on remove Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 692/869] net: unix: reject negative max_dgram_qlen values Greg Kroah-Hartman
` (185 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c3741bb338b5c6d6a4aa,
Nguyen Ngoc Thang, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
[ Upstream commit f6fa1d60ec3ceb7e6c26aa91eadfef34f94014e1 ]
__rds_conn_create() calls trans->conn_free() with rds_conn_lock held
and IRQs disabled when it loses the race to insert a connection.
rds_ib_conn_free() takes the device list lock with spin_lock_irq() and
releases it with spin_unlock_irq(), so IRQs are turned on while
rds_conn_lock is still held:
raw_local_irq_restore() called with IRQs enabled
WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20
_raw_spin_unlock_irqrestore+0x67/0x80
__rds_conn_create+0x1de5/0x2290
rds_conn_create_outgoing+0x43/0x60
rds_sendmsg+0xfca/0x20e0
__sys_sendto+0x408/0x5a0
It needs an RDS socket bound to an address on an RDMA device (e.g. rxe)
and two concurrent sendto() calls to the same new destination.
The TCP and loopback ->conn_free() callbacks already use irqsave, so
do the same here.
Fixes: 745cbccac3fe ("RDS: Rewrite connection cleanup, fixing oops on rmmod")
Reported-by: syzbot+c3741bb338b5c6d6a4aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c3741bb338b5c6d6a4aa
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_cm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 1c6e3b3f39d00..c8771aa7df53a 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -1271,6 +1271,7 @@ void rds_ib_conn_free(void *arg)
{
struct rds_ib_connection *ic = arg;
spinlock_t *lock_ptr;
+ unsigned long flags;
rdsdebug("ic %p\n", ic);
@@ -1281,9 +1282,10 @@ void rds_ib_conn_free(void *arg)
*/
lock_ptr = ic->rds_ibdev ? &ic->rds_ibdev->spinlock : &ib_nodev_conns_lock;
- spin_lock_irq(lock_ptr);
+ /* May be called with IRQs already disabled (see __rds_conn_create()) */
+ spin_lock_irqsave(lock_ptr, flags);
list_del(&ic->ib_node);
- spin_unlock_irq(lock_ptr);
+ spin_unlock_irqrestore(lock_ptr, flags);
rds_ib_recv_free_caches(ic);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 692/869] net: unix: reject negative max_dgram_qlen values
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 691/869] net/rds: ib: dont enable IRQs in rds_ib_conn_free() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 693/869] net/smc: queue the copied chunk when smc_tx_sendmsg() faults Greg Kroah-Hartman
` (184 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingjie Wang, Kuniyuki Iwashima,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingjie Wang <1075151112@qq.com>
[ Upstream commit 1a4e7bc6e3457ad95515a9d2c042452c3161bb2c ]
net.unix.max_dgram_qlen is parsed as a signed int and copied to the u32
sock::sk_max_ack_backlog when an AF_UNIX socket is created. Consequently,
a negative value such as -1 is accepted and converted to UINT_MAX. Since
the receive queue length is also u32, its fullness check cannot become true
for that limit.
max_dgram_qlen has no documented negative sentinel. Its existing signed
interface represents nonnegative values only through INT_MAX; negative bit
patterns are not a supported encoding for the upper half of the u32
consumer range.
Switch to proc_dointvec_minmax and make the established 0..INT_MAX input
range explicit. This rejects negative values without adding new accepted
values or changing the default and zero-value behavior. Very large valid
values can still make the queue limit impractical to reach; this change
corrects the input domain rather than imposing a new resource ceiling.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/tencent_A643419B56079E9A448D97922763FF069F08@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/networking/ip-sysctl.rst | 3 ++-
net/unix/sysctl_net_unix.c | 4 +++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 27a861053b2f5..c2ca933f7bdbc 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -3729,5 +3729,6 @@ l3mdev_accept - BOOLEAN
max_dgram_qlen - INTEGER
The maximum length of dgram socket receive queue
- Default: 10
+ Possible values: 0 - INT_MAX
+ Default: 10
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index e02ed6e3955c0..bb93cf3aa6fee 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -19,7 +19,9 @@ static struct ctl_table unix_table[] = {
.data = &init_net.unx.sysctl_max_dgram_qlen,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_INT_MAX,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 693/869] net/smc: queue the copied chunk when smc_tx_sendmsg() faults
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 692/869] net: unix: reject negative max_dgram_qlen values Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 694/869] alpha: determine tininess after rounding in the FP emulation Greg Kroah-Hartman
` (183 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit c0703534b223a5c6993e0f000fd1c3abe621fb65 ]
When a send wraps the end of the send buffer, smc_tx_sendmsg() copies
the data in two chunks. If memcpy_from_msg() faults on the second one,
smc_tx_sendmsg() returns send_done, which already counts the first
chunk, but leaves tx_curs_prep and sndbuf_space as they were. send()
reports bytes the peer never receives, and the next send() overwrites
them. Any caller can hit this on its own stream with a buffer whose
tail is unreadable.
On a fault in the second chunk, queue the first one. The next pass
retries the rest and returns send_done if it faults again, so send()
reports only what it queued, as TCP does.
Fixes: e6727f39004b ("smc: send data (through RDMA)")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20261013-b4-disp-872a3689-v1-1-2a4c63b04761@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_tx.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 3144b4b1fe290..495fb1354728c 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -249,6 +249,13 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
rc = memcpy_from_msg(sndbuf_base + chunk_off,
msg, chunk_len);
if (rc) {
+ if (chunk) {
+ /* send_done counts the first chunk:
+ * queue it and retry the rest
+ */
+ copylen -= chunk_len;
+ break;
+ }
smc_sndbuf_sync_sg_for_device(conn);
if (send_done)
return send_done;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 694/869] alpha: determine tininess after rounding in the FP emulation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 693/869] net/smc: queue the copied chunk when smc_tx_sendmsg() faults Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 695/869] ocfs2: reserve metadata for a new xattr block and its value tree Greg Kroah-Hartman
` (182 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Magnus Lindholm, Matt Turner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit b74843b38da8f1186fd7d447646c835b47096a15 ]
IEEE 754 lets an architecture determine tininess of a floating-point
result either before or after rounding, but requires the same choice for
every operation. Alpha determines it after rounding, and stdlib's
tst-tininess confirms the hardware does so for the results it produces
itself.
The soft-fp emulation has no notion of the distinction and always
determines tininess before rounding, so a result that the hardware would
not consider tiny is reported as underflowing whenever the instruction
happens to trap for software completion. The two paths then disagree on
the same machine. A multiply of the largest subnormal double by
1 + 2^-52 rounds up to the smallest normal and raises no underflow when
the operands are normal, but raises it when an operand is subnormal and
the instruction traps:
glibc math testsuite, test-float32x-float64-mul:
Failure: mul_double (0x3.ffffffffffffcp-1024, 0x1.0000000000001p+0):
Exception "Underflow" set
Add _FP_TININESS_AFTER_ROUNDING, as glibc's copy of soft-fp has, and set
it for alpha. It determines tininess by rounding a copy of the result as
if the exponent range were unbounded, which is what the definition asks
for. A plain check of whether the rounded result came out normal is not
equivalent: it differs for values that are still tiny once rounded with
an unbounded exponent range but reach the smallest normal on the coarser
subnormal grid. That plain check is what the hardware itself does (it
decides tininess from the delivered result), and it is why a divide such
as -0x4p-128 / 0x1.000002p+0 in FE_DOWNWARD delivers -0x1p-126 and raises
nothing although the result is tiny after rounding. Such cases do not
trap, so the emulation never sees them; where it does get control, it
follows the definition rather than reproducing that deviation, which is
what glibc's soft-fp does as well.
The macro defaults to zero, so powerpc, sh and sparc keep determining
tininess before rounding as they do now.
Cc: stable@vger.kernel.org # 5.15+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-3-c99d75608e60@gmail.com
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/sfp-machine.h | 4 ++++
include/math-emu/op-common.h | 23 +++++++++++++++++++++--
include/math-emu/soft-fp.h | 8 ++++++++
3 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/arch/alpha/include/asm/sfp-machine.h b/arch/alpha/include/asm/sfp-machine.h
index 5fe63afbd474f..bff1ad963c689 100644
--- a/arch/alpha/include/asm/sfp-machine.h
+++ b/arch/alpha/include/asm/sfp-machine.h
@@ -59,6 +59,10 @@
R##_c = FP_CLS_NAN; \
} while (0)
+/* Alpha determines tininess after rounding, so the emulation must do the
+ same as the hardware does for the results it produces itself. */
+#define _FP_TININESS_AFTER_ROUNDING 1
+
/* Obtain the current rounding mode. */
#define FP_ROUNDMODE mode
#define FP_RND_NEAREST (FPCR_DYN_NORMAL >> FPCR_DYN_SHIFT)
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index 8ce066c035cfa..1d1ce5c08efcf 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -135,6 +135,24 @@ do { \
else \
{ \
/* we've got a denormalized number */ \
+ int _FP_PACK_CANONICAL_is_tiny = 1; \
+ if (_FP_TININESS_AFTER_ROUNDING && X##_e == 0) \
+ { \
+ /* Architectures that detect tininess after rounding \
+ only signal underflow if the result is still \
+ subnormal once rounded as if the exponent range \
+ were unbounded. Round a copy to find out. */ \
+ FP_DECL_##fs(_FP_PACK_CANONICAL_T); \
+ /* The class field is not used by the rounding below, \
+ and is unused entirely where this block is dead. */ \
+ (void)_FP_PACK_CANONICAL_T##_c; \
+ _FP_FRAC_COPY_##wc(_FP_PACK_CANONICAL_T, X); \
+ _FP_PACK_CANONICAL_T##_s = X##_s; \
+ _FP_PACK_CANONICAL_T##_e = X##_e; \
+ _FP_ROUND(wc, _FP_PACK_CANONICAL_T); \
+ if (_FP_FRAC_OVERP_##wc(fs, _FP_PACK_CANONICAL_T)) \
+ _FP_PACK_CANONICAL_is_tiny = 0; \
+ } \
X##_e = -X##_e + 1; \
if (X##_e <= _FP_WFRACBITS_##fs) \
{ \
@@ -161,8 +179,9 @@ do { \
_FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
} \
} \
- if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
- (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
+ if (_FP_PACK_CANONICAL_is_tiny \
+ && ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
+ (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW))) \
FP_SET_EXCEPTION(FP_EX_UNDERFLOW); \
} \
else \
diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
index 5650c16283830..02ada0a9fca16 100644
--- a/include/math-emu/soft-fp.h
+++ b/include/math-emu/soft-fp.h
@@ -31,6 +31,14 @@
#include <endian.h>
#endif
+/* Whether the architecture determines tininess of a floating-point
+ result after rounding rather than before it. IEEE 754 permits either
+ but requires the same choice for every operation, so this has to agree
+ with what the hardware does for the results it produces itself. */
+#ifndef _FP_TININESS_AFTER_ROUNDING
+#define _FP_TININESS_AFTER_ROUNDING 0
+#endif
+
#define _FP_WORKBITS 3
#define _FP_WORK_LSB ((_FP_W_TYPE)1 << 3)
#define _FP_WORK_ROUND ((_FP_W_TYPE)1 << 2)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 695/869] ocfs2: reserve metadata for a new xattr block and its value tree
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 694/869] alpha: determine tininess after rounding in the FP emulation Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 696/869] ocfs2: reserve value tree metadata when moving an xattr into the inode Greg Kroah-Hartman
` (181 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 8ad5fa0c11246d260d7b12c9672e604b1f431b2e ]
Patch series "ocfs2: fix metadata reservation for xattr value trees".
ocfs2_calc_xattr_set_need() reserves too little metadata for a new xattr
value's extent tree on three paths. The reservation cannot be topped up
once the transaction has started, so ocfs2_add_clusters_in_btree() gives
up with RESTART_META when the value root fills and nothing is left.
ocfs2_xattr_extend_allocation() turns that into -ENOSPC, after
ocfs2_xa_cleanup_value_truncate() has dropped the entry and leaked the
clusters already handed out; before commit 0cdc7dde00ec ("ocfs2: fix
missing metadata reservation for large xattrs") it was a BUG_ON() instead.
It takes a fragmented cluster allocator to get there, since the first
extent always fits in the root.
Patch 1 fixes the create side of meta_guess: commit 3ed2be719eb9 ("ocfs2:
allow for more than one data extent when creating xattr") replaced the
block reserved for the new xattr block with the two the value tree needs
instead of adding them together.
Patch 2 fixes the arm that moves an xattr back into the inode, which
charges credits for a value tree but no metadata for one.
Patch 3 drops a second copy of the same reservation on the path that falls
through to meta_guess. That one is cleanup rather than a fix and is not
for stable, and it must not be backported without patch 1: the duplicate
it removes is what currently covers the shortfall patch 1 fixes.
This patch (of 3):
The create side of meta_guess in ocfs2_calc_xattr_set_need() reserves
metadata for the new value's extent tree and nothing for the xattr block
that will hold it:
} else {
credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
meta_add += ocfs2_extend_meta_needed(el);
...
Commit 3ed2be719eb9 ("ocfs2: allow for more than one data extent when
creating xattr") meant to add that tree on top of the meta_add += 1 the
branch already had, but it moved the 1 into the else arm instead, so the
external-value case lost it. The 1 is not optional: it is what
ocfs2_create_xattr_block() takes from meta_ac through
ocfs2_claim_metadata(), and it is spent before the value tree exists.
ocfs2_extend_meta_needed() on the empty def_xv list returns 2, so the
branch reserves 2 where 3 are needed. The xattr block consumes one, and
when the cluster allocator is fragmented enough that the value needs more
than one extent, ocfs2_add_clusters_in_btree() comes back around with a
full value root and ocfs2_alloc_context_bits_left() of 1 against a
threshold of 2. It answers RESTART_META, which
ocfs2_xattr_extend_allocation() turns into a BUG_ON(). Commit
0cdc7dde00ec ("ocfs2: fix missing metadata reservation for large xattrs")
downgraded that to -ENOSPC, at the cost of leaking the clusters already
handed out: ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters
arm, drops the entry and leaves the clusters for fsck.ocfs2 to reclaim.
Reserve for the block and the tree separately.
Link: https://lore.kernel.org/20261010113454.1420939-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261010113454.1420939-2-joseph.qi@linux.alibaba.com
Fixes: 3ed2be719eb9 ("ocfs2: allow for more than one data extent when creating xattr")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index b5029c4e3784e..a47a038b3311b 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3243,7 +3243,13 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
- meta_add += ocfs2_extend_meta_needed(el);
+ /*
+ * One block for the xattr block we may have to
+ * allocate, the rest for growing the value tree it
+ * would hold. If ocfs2_xattr_ibody_set() succeeds
+ * instead, that first block goes unused.
+ */
+ meta_add += 1 + ocfs2_extend_meta_needed(el);
credits += ocfs2_calc_extend_credits(inode->i_sb,
el);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 696/869] ocfs2: reserve value tree metadata when moving an xattr into the inode
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 695/869] ocfs2: reserve metadata for a new xattr block and its value tree Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 697/869] ocfs2: deal with legacy signed dir index name hash values Greg Kroah-Hartman
` (180 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit f5aee8ae5f85f8dfa78160e5c4963494319cdd64 ]
ocfs2_calc_xattr_set_need() charges no metadata for the case where an
xattr living in an xattr block or bucket moves back into the inode:
if (old_in_xb) {
if (ocfs2_xattr_can_be_in_inode(inode, xi, xis)) {
clusters_add += new_clusters;
credits += ...;
if (!ocfs2_xattr_is_local(xe))
credits += ocfs2_calc_extend_credits(...);
goto out;
}
}
The credits for extending a value tree are there but the matching blocks
are not, so meta_add stays 0, ocfs2_init_xattr_set_ctxt() skips
ocfs2_reserve_new_metadata_blocks() and ctxt->meta_ac is left NULL.
This is the shape commit 0cdc7dde00ec ("ocfs2: fix missing metadata
reservation for large xattrs") fixed for the xattr block case, and it is
reached the same way: namevalue_size() charges a value larger than
OCFS2_XATTR_INLINE_SIZE as only OCFS2_XATTR_ROOT_SIZE, so
ocfs2_xattr_can_be_in_inode() accepts a new value that will be stored
outside. ocfs2_xa_prepare_entry() installs a value root from def_xv and
grows it, and once the cluster allocator is fragmented enough to need a
second extent ocfs2_add_clusters_in_btree() finds the root full with no
meta_ac at all and answers RESTART_META. ocfs2_xattr_extend_allocation()
turns that into -ENOSPC, or into a BUG_ON() without that commit, and
ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters arm, dropping
the entry and leaking the clusters already handed out until fsck.ocfs2
reclaims them.
Reserve for the value tree here too. The entry moves back into the inode
rather than into a new xattr block, so unlike the create side of
meta_guess this needs no block of its own.
Link: https://lore.kernel.org/20261010113454.1420939-3-joseph.qi@linux.alibaba.com
Fixes: 78f30c314a74 ("ocfs2/xattr: Reserve meta/data at the beginning of ocfs2_xattr_set.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index a47a038b3311b..ab117ed2623e7 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3143,6 +3143,14 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
credits += ocfs2_calc_extend_credits(
inode->i_sb,
&def_xv.xv.xr_list);
+ /*
+ * A value too big to stay inline is only charged as
+ * OCFS2_XATTR_ROOT_SIZE above, so it can still need a
+ * value tree of its own. No xattr block is allocated
+ * on this path, so the tree is all we reserve for.
+ */
+ if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
+ meta_add += ocfs2_extend_meta_needed(&def_xv.xv.xr_list);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 697/869] ocfs2: deal with legacy signed dir index name hash values
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 696/869] ocfs2: reserve value tree metadata when moving an xattr into the inode Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 698/869] ocfs2: use the stored hash when checking xattr bucket collision Greg Kroah-Hartman
` (179 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Anderson Ferneda, Heming Zhao, Mark Fasheh, Joel Becker,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit d1b49d5ea1bf43cce2b0e249a7f7a30dde133907 ]
Patch series "ocfs2: deal with legacy signed name hash values", v2.
Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") turned on
-funsigned-char globally, which changed the result of two naked 'char'
loads in ocfs2 hashing code:
str2hashbuf() val = msg[i] + (val << 8);
ocfs2_xattr_name_hash() hash = (hash << 5) ^ (hash >> 27) ^ *name++;
A name byte >= 0x80 used to sign-extend and now zero-extends. Both
results are written to disk, the first into the dx leaf when a directory
entry is indexed and the second into xe_name_hash when an xattr is
stored, so anything written by a pre-6.2 kernel is looked up under a
different hash and is no longer found. readdir and listxattr still list
those names because neither of them hashes, which makes this look like
the filesystem losing entries rather than like a lookup bug. Anderson
Ferneda reported it that way for directories with non-ASCII names [1].
Patches 1 and 3 do what ext4 did in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"): look up with the current
unsigned hash, retry with the legacy signed one on a miss, and always
store new entries under the unsigned hash. The retry is skipped when the
two hashes come out equal, so an ASCII name does not walk the index
twice. Both hash functions now spell out the signedness instead of
leaving it to -funsigned-char, as commit 854f0912f813 ("ext4: make xattr
char unsignedness in hash explicit") did, so a backport to a kernel
without the flag still computes both variants correctly.
Patch 2 is a separate fix, placed before patch 3 so that every commit in
the series is correct on its own. ocfs2_check_xattr_bucket_collision()
recomputes the hash of the name to decide whether splitting a full bucket
can make room for the entry being set. That is right for a new entry and
wrong for one that already exists, since an update leaves xe_name_hash
alone. Against a bucket holding legacy hashes the comparison does not
match, so the split goes ahead and cannot help: a bucket whose entries
all share one hash has no divide position. How that ends depends on
where the unsigned hash sorts. Below the legacy ones, the set fails with
-ENOSPC after growing the tree for nothing. Above them, it lands in the
empty bucket the split just appended and stores a second copy of the
entry there while the original stays behind, so listxattr reports the
name twice. Using the stored hash closes both.
Nothing retires a legacy hash at runtime. Deleting or updating an entry
does not rewrite it, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion, so the
retry stays for as long as the legacy entries do. Rebuilding the index
offline is what removes it for good.
This patch (of 3):
Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") set
-funsigned-char globally, which changed the result of the naked 'char'
load in str2hashbuf():
val = msg[i] + (val << 8);
A name byte >= 0x80 used to sign-extend and now zero-extends, so
ocfs2_dx_dir_name_hash() computes a different hash pair for every name
containing one. The pair is written into the dx leaf when the entry is
created, so an index built by an older kernel no longer matches and
ocfs2_dx_dir_search() returns -ENOENT for a name that readdir still
lists.
Search with the current unsigned hash and, on a miss, retry with the
legacy signed one, as ext4 does in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"). New entries are always
indexed under the unsigned hash. Skip the retry when the two hashes
are equal, so that a miss on an ASCII name does not walk the index
twice.
The retry costs a second walk of the dx tree, so a negative lookup of a
name containing a byte >= 0x80 does twice the work. That is bounded and
worth it, and directories whose dx root is still inline pay nothing
extra, since there the retry only rescans the root block that is already
loaded. Nothing retires it at runtime: a legacy entry keeps its legacy
hash, because neither deleting nor updating an entry rewrites the dx
hash, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion.
Rebuilding the index offline is what removes the cost for good.
Also spell out the signedness in str2hashbuf() instead of leaving the
current hash to -funsigned-char, as commit 854f0912f813 ("ext4: make
xattr char unsignedness in hash explicit") did, so that both variants
stay correct if this is backported to a kernel without the flag.
Link: https://lore.kernel.org/20261009083002.2621201-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261009083002.2621201-2-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Anderson Ferneda <anderson.ferneda@braza.com.br>
Closes: https://lore.kernel.org/ocfs2-devel/CP5P284MB2780AC2C3C2AB2CF2B6CB7AFBE942@CP5P284MB2780.BRAP284.PROD.OUTLOOK.COM/
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++--------
1 file changed, 65 insertions(+), 11 deletions(-)
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index fbfce8cd131aa..1dee6b8eaf2d0 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -221,7 +221,8 @@ static void TEA_transform(__u32 buf[4], __u32 const in[])
buf[1] += b1;
}
-static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
+static void str2hashbuf(const char *msg, int len, __u32 *buf, int num,
+ bool legacy_signed)
{
__u32 pad, val;
int i;
@@ -235,7 +236,10 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
for (i = 0; i < len; i++) {
if ((i % 4) == 0)
val = pad;
- val = msg[i] + (val << 8);
+ if (legacy_signed)
+ val = (signed char)msg[i] + (val << 8);
+ else
+ val = (unsigned char)msg[i] + (val << 8);
if ((i % 4) == 3) {
*buf++ = val;
val = pad;
@@ -248,8 +252,9 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
*buf++ = pad;
}
-static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
- struct ocfs2_dx_hinfo *hinfo)
+static void __ocfs2_dx_dir_name_hash(struct inode *dir, const char *name,
+ int len, struct ocfs2_dx_hinfo *hinfo,
+ bool legacy_signed)
{
struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
const char *p;
@@ -279,7 +284,7 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
p = name;
while (len > 0) {
- str2hashbuf(p, len, in, 4);
+ str2hashbuf(p, len, in, 4, legacy_signed);
TEA_transform(buf, in);
len -= 16;
p += 16;
@@ -290,6 +295,19 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
hinfo->minor_hash = buf[1];
}
+static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
+ struct ocfs2_dx_hinfo *hinfo)
+{
+ __ocfs2_dx_dir_name_hash(dir, name, len, hinfo, false);
+}
+
+static void ocfs2_dx_dir_name_hash_signed(struct inode *dir, const char *name,
+ int len,
+ struct ocfs2_dx_hinfo *hinfo)
+{
+ __ocfs2_dx_dir_name_hash(dir, name, len, hinfo, true);
+}
+
/*
* bh passed here can be an inode block or a dir data block, depending
* on the inode inline data flag.
@@ -961,10 +979,10 @@ static int ocfs2_dx_dir_lookup(struct inode *inode,
return ret;
}
-static int ocfs2_dx_dir_search(const char *name, int namelen,
- struct inode *dir,
- struct ocfs2_dx_root_block *dx_root,
- struct ocfs2_dir_lookup_result *res)
+static int __ocfs2_dx_dir_search(const char *name, int namelen,
+ struct inode *dir,
+ struct ocfs2_dx_root_block *dx_root,
+ struct ocfs2_dir_lookup_result *res)
{
int ret, i, found;
u64 phys;
@@ -977,8 +995,6 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
struct ocfs2_extent_list *dr_el;
struct ocfs2_dx_entry_list *entry_list;
- ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
-
if (ocfs2_dx_root_inline(dx_root)) {
entry_list = &dx_root->dr_entries;
goto search;
@@ -1075,6 +1091,44 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
return ret;
}
+static int ocfs2_dx_dir_search(const char *name, int namelen,
+ struct inode *dir,
+ struct ocfs2_dx_root_block *dx_root,
+ struct ocfs2_dir_lookup_result *res)
+{
+ struct ocfs2_dx_hinfo legacy;
+ int ret;
+
+ ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
+
+ ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+ if (ret != -ENOENT)
+ return ret;
+
+ /*
+ * Nothing under the current hash. The entry may have been indexed by
+ * an older kernel, which sign-extended the name bytes when hashing.
+ * New entries are always indexed under the unsigned hash, so only fall
+ * back to the legacy signed one when it can actually differ: an ASCII
+ * name hashes the same either way, and a genuine miss on one should
+ * not have to walk the index twice.
+ */
+ ocfs2_dx_dir_name_hash_signed(dir, name, namelen, &legacy);
+ if (legacy.major_hash == res->dl_hinfo.major_hash &&
+ legacy.minor_hash == res->dl_hinfo.minor_hash)
+ return ret;
+
+ res->dl_hinfo = legacy;
+
+ ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+ if (ret)
+ return ret;
+
+ pr_warn_once("ocfs2: directory index with signed name hash\n");
+
+ return 0;
+}
+
static int ocfs2_find_entry_dx(const char *name, int namelen,
struct inode *dir,
struct ocfs2_dir_lookup_result *lookup)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 698/869] ocfs2: use the stored hash when checking xattr bucket collision
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 697/869] ocfs2: deal with legacy signed dir index name hash values Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 699/869] ocfs2: deal with legacy signed xattr name hash values Greg Kroah-Hartman
` (178 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Anderson Ferneda, Mark Fasheh, Joel Becker,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit e39baff18b85cf8956aee138d7944b6581e8ba36 ]
ocfs2_check_xattr_bucket_collision() decides whether splitting a full
bucket can make room for the entry being set by recomputing the hash of
the name:
u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
return 0;
For a new entry that is the hash it will be stored under, so comparing it
is correct. An existing entry keeps the hash it already has: an update
never rewrites xe_name_hash, since ocfs2_xa_add_entry() is the only
writer of that field for a real entry and ocfs2_xa_prepare_entry() calls
it only when loc->xl_entry is NULL.
An entry stored by a kernel that sign-extended the name bytes when
hashing can still be updated, because ocfs2_xattr_find_entry() searches
a non-indexed xattr block by memcmp on the name and never looks at
xe_name_hash. Growing it past the space left in the block converts the
block into a tree, ocfs2_cp_xattr_block_to_bucket() fills the bucket in
stored hash order, and the update runs out of room in the bucket too.
The collision check then compares the unsigned hash against the legacy
hashes in the bucket and reports no collision.
ocfs2_xattr_set_entry_index_block() goes on to allocate a bucket that
ocfs2_divide_xattr_bucket() cannot fill: a bucket whose entries all share
one hash has no divide position, so all it does is append an empty bucket
with a sentinel hash one above the last entry's.
The re-search that follows depends on where the unsigned hash sorts.
Below the legacy ones, it comes back to the full bucket and the set fails
with -ENOSPC, having grown the tree for nothing. Above them, it lands on
the new empty bucket, which ocfs2_xattr_bucket_find() handles explicitly
and ocfs2_find_xe_in_bucket() scans zero times, so the set stores a second
copy of the entry under the unsigned hash and returns success. The
original stays in the full bucket, listxattr reports the name twice and
getxattr returns the new copy.
Pass the hash the entry is stored under instead: the stored one for an
existing entry, the unsigned one for a new entry. A tree whose entries
are all stored under the unsigned hash sees no change, since there the
two are the same value.
Link: https://lore.kernel.org/20261009083002.2621201-3-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Anderson Ferneda <anderson.ferneda@braza.com.br>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index ab117ed2623e7..523d5ac597f41 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -5531,16 +5531,14 @@ static int ocfs2_rm_xattr_cluster(struct inode *inode,
/*
* check whether the xattr bucket is filled up with the same hash value.
- * If we want to insert the xattr with the same hash, return -ENOSPC.
- * If we want to insert a xattr with different hash value, go ahead
- * and ocfs2_divide_xattr_bucket will handle this.
+ * If the entry being set carries that same hash, return -ENOSPC, since
+ * ocfs2_divide_xattr_bucket() has no divide position to work with.
+ * Otherwise go ahead and ocfs2_divide_xattr_bucket() will handle this.
*/
-static int ocfs2_check_xattr_bucket_collision(struct inode *inode,
- struct ocfs2_xattr_bucket *bucket,
- const char *name)
+static int ocfs2_check_xattr_bucket_collision(struct ocfs2_xattr_bucket *bucket,
+ u32 name_hash)
{
struct ocfs2_xattr_header *xh = bucket_xh(bucket);
- u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
return 0;
@@ -5609,6 +5607,7 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
struct ocfs2_xattr_search *xs,
struct ocfs2_xattr_set_ctxt *ctxt)
{
+ u32 name_hash;
int ret;
trace_ocfs2_xattr_set_entry_index_block(xi->xi_name);
@@ -5628,10 +5627,18 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
* the maximum number of collisions we will allow for then is
* one bucket's worth, so check it here whether we need to
* add a new bucket for the insert.
+ *
+ * An existing entry keeps the hash it was stored under, and that is
+ * the hash a split has to work with. A new entry is stored under the
+ * unsigned one, which is what ocfs2_xa_add_entry() will write.
*/
- ret = ocfs2_check_xattr_bucket_collision(inode,
- xs->bucket,
- xi->xi_name);
+ if (xs->not_found)
+ name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
+ xi->xi_name_len);
+ else
+ name_hash = le32_to_cpu(xs->here->xe_name_hash);
+
+ ret = ocfs2_check_xattr_bucket_collision(xs->bucket, name_hash);
if (ret) {
mlog_errno(ret);
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 699/869] ocfs2: deal with legacy signed xattr name hash values
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 698/869] ocfs2: use the stored hash when checking xattr bucket collision Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 700/869] ocfs2/cluster: initialize heartbeat regions before publishing them Greg Kroah-Hartman
` (177 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Anderson Ferneda, Mark Fasheh, Joel Becker,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 824d26d11448b4d4f19677bce27c7fe5e962f4c6 ]
Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") set
-funsigned-char globally, which changed the result of the naked 'char'
load in ocfs2_xattr_name_hash():
hash = (hash << OCFS2_HASH_SHIFT) ^
(hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT)) ^
*name++;
A name byte >= 0x80 used to sign-extend and now zero-extends, so the
hash no longer matches the xe_name_hash an older kernel stored. An
indexed xattr tree is searched by that hash alone, and both the bucket
binary search and the entry scan within it stop as soon as the wanted
hash falls below an entry's, so the entry is never reached: getxattr,
setxattr and removexattr return -ENODATA for a name that listxattr
still lists.
Search with the current unsigned hash and, on a miss, retry with the
legacy signed one, as ext4 does in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"). New entries are always
stored under the unsigned hash. Skip the retry when the two hashes are
equal, so that a miss on an ASCII name does not walk the tree twice.
A miss is not empty handed: ocfs2_xattr_bucket_find() leaves xs->bucket
holding the bucket a new entry would go into. So after a double miss
drop it and search once more with the unsigned hash, otherwise a new
entry would be placed by its legacy hash and stored under its unsigned
one, breaking the ordering the search relies on.
Only indexed trees are affected; inline xattrs and non-indexed xattr
blocks compare names with memcmp and never look at the hash.
Also spell out the signedness instead of leaving the current hash to
-funsigned-char, as commit 854f0912f813 ("ext4: make xattr char
unsignedness in hash explicit") did, so that both variants stay correct
if this is backported to a kernel without the flag.
Link: https://lore.kernel.org/20261009083002.2621201-4-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Anderson Ferneda <anderson.ferneda@braza.com.br>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 93 ++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 82 insertions(+), 11 deletions(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 523d5ac597f41..8013451927a83 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -533,9 +533,10 @@ static inline const char *ocfs2_xattr_prefix(int name_index)
return handler ? xattr_prefix(handler) : NULL;
}
-static u32 ocfs2_xattr_name_hash(struct inode *inode,
- const char *name,
- int name_len)
+static u32 __ocfs2_xattr_name_hash(struct inode *inode,
+ const char *name,
+ int name_len,
+ bool legacy_signed)
{
/* Get hash value of uuid from super block */
u32 hash = OCFS2_SB(inode->i_sb)->uuid_hash;
@@ -544,13 +545,30 @@ static u32 ocfs2_xattr_name_hash(struct inode *inode,
/* hash extended attribute name */
for (i = 0; i < name_len; i++) {
hash = (hash << OCFS2_HASH_SHIFT) ^
- (hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT)) ^
- *name++;
+ (hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT));
+ if (legacy_signed)
+ hash ^= (signed char)name[i];
+ else
+ hash ^= (unsigned char)name[i];
}
return hash;
}
+static u32 ocfs2_xattr_name_hash(struct inode *inode,
+ const char *name,
+ int name_len)
+{
+ return __ocfs2_xattr_name_hash(inode, name, name_len, false);
+}
+
+static u32 ocfs2_xattr_name_hash_signed(struct inode *inode,
+ const char *name,
+ int name_len)
+{
+ return __ocfs2_xattr_name_hash(inode, name, name_len, true);
+}
+
static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
{
return namevalue_size(name_len, value_len) +
@@ -3949,11 +3967,12 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
return ret;
}
-static int ocfs2_xattr_index_block_find(struct inode *inode,
- struct buffer_head *root_bh,
- int name_index,
- const char *name,
- struct ocfs2_xattr_search *xs)
+static int __ocfs2_xattr_index_block_find(struct inode *inode,
+ struct buffer_head *root_bh,
+ int name_index,
+ const char *name,
+ u32 name_hash,
+ struct ocfs2_xattr_search *xs)
{
int ret;
struct ocfs2_xattr_block *xb =
@@ -3962,7 +3981,6 @@ static int ocfs2_xattr_index_block_find(struct inode *inode,
struct ocfs2_extent_list *el = &xb_root->xt_list;
u64 p_blkno = 0;
u32 first_hash, num_clusters = 0;
- u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
if (le16_to_cpu(el->l_next_free_rec) == 0)
return -ENODATA;
@@ -3993,6 +4011,59 @@ static int ocfs2_xattr_index_block_find(struct inode *inode,
return ret;
}
+static int ocfs2_xattr_index_block_find(struct inode *inode,
+ struct buffer_head *root_bh,
+ int name_index,
+ const char *name,
+ struct ocfs2_xattr_search *xs)
+{
+ u32 name_hash, legacy_hash;
+ int name_len = strlen(name);
+ int ret;
+
+ name_hash = ocfs2_xattr_name_hash(inode, name, name_len);
+
+ ret = __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+ name_hash, xs);
+ if (ret != -ENODATA)
+ return ret;
+
+ /*
+ * Nothing under the current hash. The entry may have been stored by
+ * an older kernel, which sign-extended the name bytes when hashing.
+ * Skip the retry when the two hashes are equal, so that a name made
+ * only of ASCII does not have to walk the tree twice.
+ */
+ legacy_hash = ocfs2_xattr_name_hash_signed(inode, name, name_len);
+ if (legacy_hash == name_hash)
+ return ret;
+
+ /*
+ * A miss still leaves xs->bucket holding the bucket a new entry would
+ * be inserted into, so drop it before searching again.
+ */
+ ocfs2_xattr_bucket_relse(xs->bucket);
+
+ ret = __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+ legacy_hash, xs);
+ if (!ret) {
+ pr_warn_once("ocfs2: xattr tree with signed name hash\n");
+ return ret;
+ }
+ if (ret != -ENODATA)
+ return ret;
+
+ /*
+ * Not under either hash. Restore the unsigned placement, since that
+ * is where a new entry is stored: leaving the bucket where the legacy
+ * hash put it would break the ordering the search relies on.
+ */
+ ocfs2_xattr_bucket_relse(xs->bucket);
+
+ return __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+ name_hash, xs);
+}
+
static int ocfs2_iterate_xattr_buckets(struct inode *inode,
u64 blkno,
u32 clusters,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 700/869] ocfs2/cluster: initialize heartbeat regions before publishing them
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 699/869] ocfs2: deal with legacy signed xattr name hash values Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 701/869] Documentation: hyperv: Update documentation for sending VMBus packets Greg Kroah-Hartman
` (176 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Yufan Chen,
Christophe JAILLET, Kees Cook, Karl Mehltretter, Sunil Mushran,
Jia-Ju Bai, jjzuming, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit c5b7a30a5172317e1e3cba61d8c9f9c588c497bb ]
A region on o2hb_all_regions must have an initialized config item and
name. o2hb_heartbeat_group_make_item() currently links the zeroed region
under o2hb_live_lock, drops the lock, and only then initializes hr_item.
The lock therefore protects the list without protecting initialization
from readers of the published item.
With global heartbeat enabled, a DLM_QUERY_REGION from the current
joining node can pass the existing-domain and protocol checks while a
configfs mkdir creates another region. The DLM locks are not taken by
the constructor, and the network worker does not take the configfs
subsystem mutex. The following ordering is possible:
Configfs mkdir O2net receive worker
-------------- --------------------
Allocate reg
Lock o2hb_live_lock
Link into o2hb_all_regions
Unlock o2hb_live_lock
dlm_query_region_handler()
dlm_match_regions()
o2hb_get_all_regions()
Lock o2hb_live_lock
Copy 32 bytes from NULL name
Unlock o2hb_live_lock
config_item_init_type_name()
The query thus dereferences NULL. Initialize hr_item before linking the
region so the existing list lock also orders name initialization before
any reader. Reject a failed name allocation, since the initialization
helper does not propagate that error.
Use config_item_put() on initialized constructor failures to release the
name and respect references retained by o2hb_region_pin(). Initialize
the list heads, mutex and delayed works needed by o2hb_region_release()
before any such put, and leave the list node self-linked after rollback.
Keep the existing handler drain before removing a failed published item.
KASAN report as below:
==================================================================
BUG: KASAN: null-ptr-deref in o2hb_get_all_regions+0xbb/0x1f0
Read of size 32 at addr 0000000000000000 by task kworker/u16:1/14
CPU: 2 UID: 0 PID: 14 Comm: kworker/u16:1 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: o2net o2net_rx_until_empty
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
kasan_report+0xe0/0x110
? o2hb_get_all_regions+0xbb/0x1f0
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x23/0x60
o2hb_get_all_regions+0xbb/0x1f0
dlm_query_region_handler+0x4c2/0xc20
? __pfx_dlm_query_region_handler+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? trace_hardirqs_on+0x18/0x160
? srso_alias_return_thunk+0x5/0xfbef5
? kvm_clock_get_cycles+0x31/0x60
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_dlm_query_region_handler+0x10/0x10
o2net_rx_until_empty+0x1a50/0x3200
? reacquire_held_locks+0xdd/0x200
? __pfx_o2net_rx_until_empty+0x10/0x10
? lock_acquire+0x190/0x300
? process_one_work+0x935/0x1b40
? process_one_work+0x834/0x1b40
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? srso_alias_return_thunk+0x5/0xfbef5
process_one_work+0x9a8/0x1b40
? __pfx_process_one_work+0x10/0x10
? lock_acquire+0x190/0x300
? lock_is_held_type+0x8f/0x100
? srso_alias_return_thunk+0x5/0xfbef5
worker_thread+0x65c/0xe40
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0x177/0x220
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_worker_thread+0x10/0x10
kthread+0x351/0x460
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_kthread+0x10/0x10
ret_from_fork+0x659/0x940
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x74f/0xf70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
==================================================================
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0079-v5-f931a29339cadc0a2a70@gmail.com
Fixes: 536f0741f324 ("ocfs2/cluster: Track number of global heartbeat regions")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Kees Cook <kees@kernel.org>
Cc: Karl Mehltretter <kmehltretter@gmail.com>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/heartbeat.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 61e5eb0090d39..0888c44f677c1 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -2124,6 +2124,18 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
}
reg->hr_node_num = O2NM_MAX_NODES;
+ INIT_LIST_HEAD(®->hr_all_item);
+ mutex_init(®->hr_arming_mutex);
+ reg->hr_stopping = true;
+ INIT_DELAYED_WORK(®->hr_write_timeout_work, o2hb_write_timeout);
+ INIT_DELAYED_WORK(®->hr_nego_timeout_work, o2hb_nego_timeout);
+ INIT_LIST_HEAD(®->hr_handler_list);
+ config_item_init_type_name(®->hr_item, name, &o2hb_region_type);
+ if (!config_item_name(®->hr_item)) {
+ ret = -ENOMEM;
+ goto put_item;
+ }
+
spin_lock(&o2hb_live_lock);
reg->hr_region_num = 0;
if (o2hb_global_heartbeat_active()) {
@@ -2132,26 +2144,19 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
if (reg->hr_region_num >= O2NM_MAX_REGIONS) {
spin_unlock(&o2hb_live_lock);
ret = -EFBIG;
- goto free;
+ goto put_item;
}
set_bit(reg->hr_region_num, o2hb_region_bitmap);
}
list_add_tail(®->hr_all_item, &o2hb_all_regions);
spin_unlock(&o2hb_live_lock);
- config_item_init_type_name(®->hr_item, name, &o2hb_region_type);
-
/* this is the same way to generate msg key as dlm, for local heartbeat,
* name is also the same, so make initial crc value different to avoid
* message key conflict.
*/
reg->hr_key = crc32_le(reg->hr_region_num + O2NM_MAX_REGIONS,
name, strlen(name));
- mutex_init(®->hr_arming_mutex);
- reg->hr_stopping = true;
- INIT_DELAYED_WORK(®->hr_write_timeout_work, o2hb_write_timeout);
- INIT_DELAYED_WORK(®->hr_nego_timeout_work, o2hb_nego_timeout);
- INIT_LIST_HEAD(®->hr_handler_list);
ret = o2net_register_handler(O2HB_NEGO_TIMEOUT_MSG, reg->hr_key,
sizeof(struct o2hb_nego_msg),
o2hb_nego_timeout_handler,
@@ -2174,10 +2179,13 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
o2net_unregister_and_flush_handler_list(®->hr_handler_list);
remove_item:
spin_lock(&o2hb_live_lock);
- list_del(®->hr_all_item);
+ list_del_init(®->hr_all_item);
if (o2hb_global_heartbeat_active())
clear_bit(reg->hr_region_num, o2hb_region_bitmap);
spin_unlock(&o2hb_live_lock);
+put_item:
+ config_item_put(®->hr_item);
+ return ERR_PTR(ret);
free:
kfree(reg);
return ERR_PTR(ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 701/869] Documentation: hyperv: Update documentation for sending VMBus packets
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 700/869] ocfs2/cluster: initialize heartbeat regions before publishing them Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 702/869] platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming Greg Kroah-Hartman
` (175 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Kelley, Naman Jain, Wei Liu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <mhkelley58@gmail.com>
[ Upstream commit 6a3d77a0a8cf69cf3d234305e6711729eb5d10c4 ]
The functions for sending VMBus packets have changed.
vmbus_sendpacket_mpb_desc() can target multiple ranges, and
vmbus_sendpacket_pagebuffer() has been removed. vmbus_sendpacket_getid()
has been added. Update the documentation accordingly.
Fixes: 45a442fe369e ("Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/virt/hyperv/vmbus.rst | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/Documentation/virt/hyperv/vmbus.rst b/Documentation/virt/hyperv/vmbus.rst
index 654bb48499724..c546e821ce6b2 100644
--- a/Documentation/virt/hyperv/vmbus.rst
+++ b/Documentation/virt/hyperv/vmbus.rst
@@ -141,14 +141,15 @@ Three functions exist to send VMBus channel messages:
1. vmbus_sendpacket(): Control-only messages and messages with
embedded data -- no GPAs
-2. vmbus_sendpacket_pagebuffer(): Message with list of GPAs
- identifying data to transfer. An offset and length is
- associated with each GPA so that multiple discontinuous areas
- of guest memory can be targeted.
-3. vmbus_sendpacket_mpb_desc(): Message with list of GPAs
- identifying data to transfer. A single offset and length is
- associated with a list of GPAs. The GPAs must describe a
- single logical area of guest memory to be targeted.
+2. vmbus_sendpacket_getid(): Similar to vmbus_sendpacket() but returns
+ a transaction ID that is matched against a reply from the Hyper-V
+ host. Useful when the struct completion (or other rendezvous data)
+ must reside on the caller's stack. By invalidating the transaction
+ ID before exiting the function due to a timeout or other error, a
+ late arriving interrupt is assured to not trash the stack.
+3. vmbus_sendpacket_mpb_desc(): Message with one or more data ranges
+ to target. Each range consists of a single offset and length plus
+ a list of GPAs that describe a logical area of guest memory.
Historically, Linux guests have trusted Hyper-V to send well-formed
and valid messages, and Linux drivers for synthetic devices did not
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 702/869] platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 701/869] Documentation: hyperv: Update documentation for sending VMBus packets Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 703/869] writeback: reset dirtied_when when switching wbs Greg Kroah-Hartman
` (174 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartu Alev, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartu Alev <bartualev@gmail.com>
[ Upstream commit 3d9a175707eeb15a2d577af1e669b98e0236719b ]
The fourth state flag of kbd_rgb_state_index is named "keyboard" and has
long been treated as having no effect. In hardware the flag, BIT(7) of
the payload sent to the TUF RGB state device, gates whether the keyboard
backlight stays lit while the machine powers off: with the bit set the
keyboard lights up white during the ACPI S5 sequence, with the bit clear
the machine powers off dark. Verified by A/B testing both values on a
TUF Gaming A15 (FA507NV).
Rename the fourth field and its index entry from "keyboard" to
"shutdown". The write format is unchanged, the value is still
positional, and the diff is two variable names and one string, so it
backports cleanly.
Fixes: 61f64515299e ("platform/x86: asus-wmi: Implement TUF laptop keyboard power states")
Cc: stable@vger.kernel.org
Signed-off-by: Bartu Alev <bartualev@gmail.com>
Link: https://patch.msgid.link/20261010101601.888709-3-bartualev@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 486c12b232d14..c8cc47df9294e 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -998,10 +998,10 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
- u32 flags, cmd, boot, awake, sleep, keyboard;
+ u32 flags, cmd, boot, awake, sleep, shutdown;
int err;
- if (sscanf(buf, "%d %d %d %d %d", &cmd, &boot, &awake, &sleep, &keyboard) != 5)
+ if (sscanf(buf, "%d %d %d %d %d", &cmd, &boot, &awake, &sleep, &shutdown) != 5)
return -EINVAL;
if (cmd)
@@ -1014,7 +1014,7 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
flags |= BIT(3);
if (sleep)
flags |= BIT(5);
- if (keyboard)
+ if (shutdown)
flags |= BIT(7);
/* 0xbd is the required default arg0 for the method. Nothing happens otherwise */
@@ -1028,7 +1028,7 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
static DEVICE_ATTR_WO(kbd_rgb_state);
static DEVICE_STRING_ATTR_RO(kbd_rgb_state_index, 0444,
- "cmd boot awake sleep keyboard");
+ "cmd boot awake sleep shutdown");
static struct attribute *kbd_rgb_state_attrs[] = {
&dev_attr_kbd_rgb_state.attr,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 703/869] writeback: reset dirtied_when when switching wbs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 702/869] platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 704/869] writeback: clear old wb dirty state after inode switches Greg Kroah-Hartman
` (173 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Sun, Tejun Heo, Jan Kara,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <sunjunchao@bytedance.com>
[ Upstream commit 13b9a606dd0a6cf9bac12894c97b9546d22a7425 ]
When switching a dirty inode to another wb, inode_do_switch_wbs() puts
it at the newest end of the target b_dirty list instead of searching
for its sorted position. This requires updating dirtied_when, which
move_expired_inodes() uses to decide where to stop scanning.
However, the switch updates dirtied_time_when instead. This leaves
b_dirty out of order and can make the scan stop before reaching older
inodes. It also resets the lazytime expiration timestamp, potentially
delaying timestamp writeback.
Update dirtied_when instead, preserving both the constant-time insertion
and the lazytime expiration timestamp. Correct the field name in the
comment and document the distinction between the two inode timestamps.
Fixes: 9a6ebbdbd412 ("writeback: Avoid excessively long inode switching times")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Link: https://patch.msgid.link/20261016115230.3640770-2-sunjunchao@bytedance.com
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fs-writeback.c | 6 +++---
include/linux/fs.h | 4 +++-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 094d2872881d3..b74a7387bea74 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -454,12 +454,12 @@ static bool inode_do_switch_wbs(struct inode *inode,
if (inode->i_state & I_DIRTY_ALL) {
/*
* We need to keep b_dirty list sorted by
- * dirtied_time_when. However properly sorting the
+ * dirtied_when. However properly sorting the
* inode in the list gets too expensive when switching
* many inodes. So just attach inode at the end of the
- * dirty list and clobber the dirtied_time_when.
+ * dirty list and clobber the dirtied_when.
*/
- inode->dirtied_time_when = jiffies;
+ inode->dirtied_when = jiffies;
inode_io_list_move_locked(inode, new_wb,
&new_wb->b_dirty);
} else {
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 55ecd9d26b4fb..349b7fc57db36 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -847,7 +847,9 @@ struct inode {
/* 32-bit hole */
struct rw_semaphore i_rwsem;
- unsigned long dirtied_when; /* jiffies of first dirtying */
+ /* Timestamp for writeback list ordering and age checks (jiffies). */
+ unsigned long dirtied_when;
+ /* Start time for deciding when lazytime updates need writeback (jiffies). */
unsigned long dirtied_time_when;
struct hlist_node i_hash;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 704/869] writeback: clear old wb dirty state after inode switches
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (702 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 703/869] writeback: reset dirtied_when when switching wbs Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 705/869] ALSA: aloop: Update the PCM Slave controls for a matching playback Greg Kroah-Hartman
` (172 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Sun,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <sunjunchao@bytedance.com>
[ Upstream commit a396fe9f74ea367ae3fab2dcb70b24e83db9f0cb ]
Switching an inode to another wb updates the target wb's dirty-I/O state,
but no longer checks whether the source wb's dirty-I/O lists became empty.
The check was lost when inode_io_list_del_locked(inode, old_wb) was
removed to support tracking clean attached inodes.
If the last dirty inode is moved, WB_has_dirty_io remains set on the old
wb and its bandwidth contribution remains in bdi->tot_write_bandwidth.
This can keep an empty wb scheduled for periodic writeback and overstate
the total bandwidth used to distribute writeback work.
Call wb_io_lists_depopulated() on the old wb after the batch of inode
switches, while its list_lock is still held. This clears the flag and
removes the bandwidth contribution if its dirty-I/O lists are empty.
Fixes: f3b6a6df38aa ("writeback, cgroup: keep list of inodes attached to bdi_writeback")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Link: https://patch.msgid.link/20261016115230.3640770-3-sunjunchao@bytedance.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fs-writeback.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b74a7387bea74..3025fc7ddfe84 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -534,6 +534,7 @@ static void process_inode_switch_wbs(struct bdi_writeback *new_wb,
}
}
+ wb_io_lists_depopulated(old_wb);
spin_unlock(&new_wb->list_lock);
spin_unlock(&old_wb->list_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 705/869] ALSA: aloop: Update the PCM Slave controls for a matching playback
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (703 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 704/869] writeback: clear old wb dirty state after inode switches Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 706/869] sh: maple: Use the matching IRQ cookie when invoking free_irq() Greg Kroah-Hartman
` (171 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henrik Enquist, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Enquist <henrik.enquist@gmail.com>
[ Upstream commit c3bde2beacbcb40790f0e3c3f909f9e16bbced9c ]
The "PCM Slave" format, rate, channels and access controls report the
parameters of the playback side of a cable. loopback_check_format()
updates them when a playback starts, but returns early when a capture
is open and its parameters match. The controls then keep the module
defaults, or the parameters of an earlier stream.
A playback that joins an open capture with the same parameters is the
normal case without notify, where it is constrained to the capture's
parameters, and also with notify whenever the player happens to use
them. An application that reads the controls to find the playback's
parameters, for example to reopen the capture side at the right rate
after a restart, then gets the wrong values.
Only skip the capture stop when the parameters match, and update the
controls in every case. A value event is still sent only for a control
whose value changes.
Reproducer:
arecord -D hw:Loopback,1,0 -r 44100 -f S16_LE -c 2 /dev/null &
aplay -D hw:Loopback,0,0 -t raw -r 44100 -f S16_LE -c 2 /dev/zero &
amixer -c Loopback cget "iface=PCM,name='PCM Slave Rate',device=1"
Before: the control reports 48000, the module default.
After: it reports 44100.
Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: stable@vger.kernel.org
Signed-off-by: Henrik Enquist <henrik.enquist@gmail.com>
Link: https://patch.msgid.link/20261021-aloop-slave-controls-v1-1-62297727177f@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/aloop.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index eefc41f628462..fd8d6b474e465 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -365,11 +365,14 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
runtime->channels != cruntime->channels ||
is_access_interleaved(runtime->access) !=
is_access_interleaved(cruntime->access);
- if (!check)
- return 0;
- if (stream == SNDRV_PCM_STREAM_CAPTURE)
+ /*
+ * Matching params also go on to the update below, so that
+ * the setup controls follow a playback that joins an open
+ * capture.
+ */
+ if (check && stream == SNDRV_PCM_STREAM_CAPTURE)
return -EIO;
- else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) {
+ else if (check && cruntime->state == SNDRV_PCM_STATE_RUNNING) {
/* close must not free the peer runtime below */
atomic_inc(&cable->stop_count);
stop_capture = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 706/869] sh: maple: Use the matching IRQ cookie when invoking free_irq()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (704 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 705/869] ALSA: aloop: Update the PCM Slave controls for a matching playback Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 707/869] nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store() Greg Kroah-Hartman
` (170 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Florian Fuchs,
John Paul Adrian Glaubitz, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit e3ef44e77b40e3cecfb34757ff3c15ecceea0309 ]
The Maple DMA and VBLANK handlers are registered with
&maple_unsupported_device as their dev_id. Passing NULL to free_irq()
cannot find either action, so the handlers remain registered and the
IRQ core warns.
Use the same cookie when freeing both handlers on the error paths.
Fixes: b3c69e248176 ("maple: more robust device detection.")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-By: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/sh/maple/maple.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 6dc0549f79005..3d3302c900caf 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -863,10 +863,10 @@ static int __init maple_bus_init(void)
kmem_cache_destroy(maple_queue_cache);
cleanup_bothirqs:
- free_irq(HW_EVENT_VSYNC, 0);
+ free_irq(HW_EVENT_VSYNC, &maple_unsupported_device);
cleanup_irq:
- free_irq(HW_EVENT_MAPLE_DMA, 0);
+ free_irq(HW_EVENT_MAPLE_DMA, &maple_unsupported_device);
cleanup_dma:
free_pages((unsigned long) maple_sendbuf, MAPLE_DMA_PAGES);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 707/869] nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (705 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 706/869] sh: maple: Use the matching IRQ cookie when invoking free_irq() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 708/869] net: wwan: iosm: validate msg_head before indexing msg_ring Greg Kroah-Hartman
` (169 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Yu Zhang,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Zhang <yuz08559@gmail.com>
[ Upstream commit 9f426f14051181e251590783e68ce589a63e2b1c ]
nvmet_subsys_attr_qid_max_store() sets subsys->max_qid and then walks
subsys->ctrls to force every controller to reconnect, but it holds only
nvmet_config_sem (for write). subsys->ctrls is protected by subsys->lock:
nvmet_alloc_ctrl() adds an entry under subsys->lock, and nvmet_ctrl_free()
removes it under subsys->lock with list_del() + kfree() (not kfree_rcu).
The free path takes no nvmet_config_sem, so the two locks are independent.
A controller teardown (host disconnect, keep-alive timeout or fatal error
-> nvmet_sq_destroy() -> nvmet_ctrl_put() -> nvmet_ctrl_free()) can
therefore list_del() an entry while qid_max_store() is iterating the list,
corrupting the walk.
KASAN, concurrent "echo 128 > .../subsystems/<nqn>/attr_qid_max" racing
nvme-loop controllers connecting and disconnecting, panics in seconds:
BUG: KASAN: null-ptr-deref in nvmet_subsys_attr_qid_max_store+0x10d/0x1b0
Read of size 8 at addr 0000000000000090
Call Trace:
nvmet_subsys_attr_qid_max_store+0x10d/0x1b0
configfs_write_iter+0x1a7/0x250
vfs_write+0x5df/0x940
ksys_write+0xfd/0x1e0
(also seen as a general-protection fault dereferencing a LIST_POISON
pointer at the same instruction.)
Take subsys->lock around the list_for_each_entry() loop, matching every
other subsys->ctrls accessor. ->delete_ctrl() only queues asynchronous
controller teardown, so it does not re-enter subsys->lock under the loop.
Fixes: 3e980f5995e0 ("nvmet: expose max queues to configfs")
Cc: stable@vger.kernel.org
Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Yu Zhang <yuz08559@gmail.com>
Tested-by: Yu Zhang <yuz08559@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/configfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index f6ac42eaac0e0..e2032b58191c5 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1662,8 +1662,10 @@ static ssize_t nvmet_subsys_attr_qid_max_store(struct config_item *item,
subsys->max_qid = qid_max;
/* Force reconnect */
+ mutex_lock(&subsys->lock);
list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
ctrl->ops->delete_ctrl(ctrl);
+ mutex_unlock(&subsys->lock);
up_write(&nvmet_config_sem);
return cnt;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 708/869] net: wwan: iosm: validate msg_head before indexing msg_ring
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (706 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 707/869] nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 709/869] tipc: fix broadcast sender hang on last acker departure Greg Kroah-Hartman
` (168 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fang Xieyan, Liu Chao, Loic Poulain,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Chao <liuc63@xiaopeng.com>
[ Upstream commit 46cbf85155e5451b6682ea0c17bc62ec564aec36 ]
ipc_protocol_free_msg_get() reads msg_head from shared memory and
uses it directly as an index into msg_ring[]. If the head is out
of range, the subsequent memset() writes beyond the message ring.
Validate head against IPC_MEM_MSG_ENTRIES before using it as an
index. The ring is a circular buffer, so a value outside the valid
range indicates a corrupted head pointer; report the error and fail
the allocation instead of writing out of bounds.
Fixes: 64516f633bfd ("net: iosm: protocol operations")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
index 4627847c6daab..455b3b6f09917 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
@@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index)
u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES;
union ipc_mem_msg_entry *msg;
+ if (head >= IPC_MEM_MSG_ENTRIES) {
+ dev_err(ipc_protocol->dev, "invalid message head %u", head);
+ return NULL;
+ }
+
if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) {
dev_err(ipc_protocol->dev, "message ring is full");
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 709/869] tipc: fix broadcast sender hang on last acker departure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (707 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 708/869] net: wwan: iosm: validate msg_head before indexing msg_ring Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 710/869] exportfs: Release the get_name() directory file synchronously Greg Kroah-Hartman
` (167 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henry Martin, Tung Nguyen,
Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <bsdhenrymartin@gmail.com>
[ Upstream commit f4377bf85887f57b59abb5479f7660a81ffe4449 ]
TIPC group broadcast senders are blocked while a replicast still has
outstanding member acks: tipc_group_bc_cong() returns true as long as
grp->bc_ackers is non-zero, and clears *grp->open, which is what
tipc_poll() uses to report EPOLLOUT (via tsk->group_is_open).
When the last outstanding acker departs before acking,
tipc_group_delete_member() decrements grp->bc_ackers to zero but
never restores *grp->open. As a result poll(EPOLLOUT) never fires
again. A writer blocked in sendmsg() is only released if some other
wakeup happens after the deletion: with TIPC_GROUP_MEMBER_EVTS the
leave event delivery calls sk_data_ready() and wakes it, but without
member events nothing does and it sleeps indefinitely, since the
default send timeout is MAX_SCHEDULE_TIMEOUT.
Commit 99cc2a62e07a ("tipc: reject invalid and unexpected
GRP_ACK_MSG to prevent bc_ackers underflow") already calls this out
in its changelog as a pre-existing issue.
Restore the open state exactly on the 1->0 transition in the delete
path, mirroring the GRP_ACK_MSG completion path, and invoke
sk->sk_write_space() from tipc_sk_filter_rcv() when the group just
became writable again.
Also make the ack accounting precise. The delete path used to test
less(m->bc_acked, grp->bc_snd_nxt - 1), which also matches members
that were never counted for the current replicast (JOINING/LEAVING
members keep a stale bc_acked), and the GRP_ACK_MSG handler accepted
an ack from any member whose bc_acked differed from the expected
value. Either could zero bc_ackers on behalf of a member that owes
nothing and silently void an ack still owed by a real acker. Track
whether a member owes an ack for the current replicast in a new
per-member bc_pending flag, set when the member is counted and
cleared when its ack arrives, and use it both to accept an ack and
to decide on deletion. bc_acked has no remaining user and is
removed. Suggested by Tung Quang Nguyen.
This issue was discovered by Tencent CodeBuddy Security.
Cc: stable@vger.kernel.org
Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20261019115859.3471295-1-bsdhenrymartin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/group.c | 19 ++++++++++---------
net/tipc/socket.c | 12 +++++++++++-
2 files changed, 21 insertions(+), 10 deletions(-)
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 0da7b27133949..a9ce1c7018b6c 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -74,7 +74,7 @@ struct tipc_member {
u16 window;
u16 bc_rcv_nxt;
u16 bc_syncpt;
- u16 bc_acked;
+ bool bc_pending;
};
struct tipc_group {
@@ -316,7 +316,6 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
m->node = node;
m->port = port;
m->instance = instance;
- m->bc_acked = grp->bc_snd_nxt - 1;
ret = tipc_group_add_to_tree(grp, m);
if (ret < 0) {
kfree(m);
@@ -340,9 +339,12 @@ static void tipc_group_delete_member(struct tipc_group *grp,
rb_erase(&m->tree_node, &grp->members);
grp->member_cnt--;
- /* Check if we were waiting for replicast ack from this member */
- if (grp->bc_ackers && less(m->bc_acked, grp->bc_snd_nxt - 1))
- grp->bc_ackers--;
+ /* If this member owed an ack for the current replicast and it
+ * was the last one, restore the open state so blocked broadcast
+ * senders can proceed.
+ */
+ if (grp->bc_ackers && m->bc_pending && !--grp->bc_ackers)
+ *grp->open = true;
list_del_init(&m->list);
list_del_init(&m->small_win);
@@ -394,7 +396,6 @@ void tipc_group_update_member(struct tipc_member *m, int len)
void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
{
- u16 prev = grp->bc_snd_nxt - 1;
struct tipc_member *m;
struct rb_node *n;
u16 ackers = 0;
@@ -403,8 +404,8 @@ void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
m = container_of(n, struct tipc_member, tree_node);
if (tipc_group_is_receiver(m)) {
tipc_group_update_member(m, len);
- m->bc_acked = prev;
ackers++;
+ m->bc_pending = ack;
}
}
@@ -800,9 +801,9 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
if (!m || !grp->bc_ackers)
return;
acked = msg_grp_bc_acked(hdr);
- if (acked != grp->bc_snd_nxt || m->bc_acked == acked)
+ if (acked != grp->bc_snd_nxt || !m->bc_pending)
return;
- m->bc_acked = acked;
+ m->bc_pending = false;
if (--grp->bc_ackers)
return;
list_del_init(&m->small_win);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index af14b50933f5c..4780264a8a491 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2355,8 +2355,18 @@ static void tipc_sk_filter_rcv(struct sock *sk, struct sk_buff *skb,
if (unlikely(!msg_isdata(hdr)))
tipc_sk_proto_rcv(sk, &inputq, xmitq);
- if (unlikely(grp))
+ if (unlikely(grp)) {
+ bool was_open = tsk->group_is_open;
+
tipc_group_filter_msg(grp, &inputq, xmitq);
+ /* A departing member may have held the last outstanding
+ * replicast ack, which can restore the open state inside
+ * tipc_group_filter_msg(); wake up senders blocked in
+ * poll()/write() if the group just became writable.
+ */
+ if (!was_open && tsk->group_is_open)
+ sk->sk_write_space(sk);
+ }
if (unlikely(!grp) && mtyp == TIPC_MCAST_MSG)
tipc_mcast_filter_msg(net, &tsk->mc_method.deferredq, &inputq);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 710/869] exportfs: Release the get_name() directory file synchronously
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (708 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 709/869] tipc: fix broadcast sender hang on last acker departure Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 711/869] statmount: dont copy the reserved empty string past the buffer Greg Kroah-Hartman
` (166 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danny Pidutti, Danny Pidutti,
Benjamin Coddington, Chuck Lever, Christian Brauner (Amutable),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit 49184daab01674ca400cbef58ee101dba6dbbb9d ]
get_name() opens the parent directory with dentry_open() and
releases it with fput(). From a kernel thread, fput() defers the
final __fput() to the delayed_fput work item. NFSD threads are
kernel threads, and NFSD reaches get_name() through
exportfs_decode_fh() whenever a file handle's dentry is not
connected to the root.
On a filesystem with more directories than the dcache retains,
nearly every READDIRPLUS needs a reconnect. The deferred releases
arrive faster than the work item retires them, and each pending
file pins the directory's readdir state. On ext4 that state is the
htree fname cache for the last leaf block read. A 64-thread NFSv3
server under a parallel tree walk showed unreclaimable slab growing
by about 90 MB per second, and the same workload on a 5.15 kernel
ended in a global OOM.
Commit 5ff318f645eb ("nfsd: use __fput_sync() to avoid delayed
closing of files.") stopped NFSD's own closes from feeding the
delayed_fput queue but did not cover the exportfs reconnect path.
Release the file with __fput_sync(). get_name() opened the file
itself, read-only, on a directory, so __fput() involves nothing
that could wait on the caller.
Note for LTS backports: Kernels before v6.6 need the __fput_sync()
call guarded by current->flags & PF_KTHREAD, with a plain fput()
otherwise.
Fixes: 4a9d4b024a31 ("switch fput to task_work_add")
Cc: stable@vger.kernel.org # see above, needs adjustments for < v6.2
Reported-by: Danny Pidutti <danny_pidutti@hotmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/DS4PR04MB9846BA3C16BC5ACED8B589228D952@DS4PR04MB9846.namprd04.prod.outlook.com/
Tested-by: Danny Pidutti <danny@lightningiq.io>
Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Chuck Lever <cel@kernel.org>
Link: https://patch.msgid.link/20261008140903.2784-1-cel@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exportfs/expfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index d3e55de4a2a2a..ab470783e798d 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -336,7 +336,11 @@ static int get_name(const struct path *path, char *name, struct dentry *child)
}
out_close:
- fput(file);
+ /*
+ * @file is the read-only directory opened above, so __fput()
+ * cannot block on anything the caller holds.
+ */
+ __fput_sync(file);
out:
return error;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 711/869] statmount: dont copy the reserved empty string past the buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (709 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 710/869] exportfs: Release the get_name() directory file synchronously Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 712/869] listmount: dont wrap around with a U64_MAX cursor Greg Kroah-Hartman
` (165 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, shaos, Jeff Layton,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 11eef75006819f4e71d04ca2b9a1fb1580854a55 ]
statmount_string() reserves an empty string at the start of the seq
buffer before it calls the handler for the requested string. That's
what the offsets of unset strings point to since commit e52e97f09fb6
("statmount: let unset strings be empty").
If the handler emits nothing the early return from commit 75ead69a7173
("fs: don't let statmount return empty strings") skips the size check
against the caller's buffer. Back then an empty emission meant an empty
seq buffer and there was nothing to copy. Now the reserved NUL byte is
there and copy_statmount_to_user() copies it to buf + sizeof(struct
statmount) no matter how small bufsize is.
So request a string that may turn out empty with a buffer that's
smaller than struct statmount and the kernel writes one zero byte past
the caller's buffer and reports a size that's larger than the buffer.
STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP on a mount that isn't
idmapped will do, so will STATMOUNT_FS_SUBTYPE on anything but fuse or
STATMOUNT_OPT_ARRAY on a filesystem without ->show_options(). None of
this needs privileges. The byte only lands in the caller's own address
space but that's still not ok.
prepare_kstatmount() already refuses a buffer of exactly sizeof(struct
statmount) for string requests. A smaller buffer can't hold a string
either and it can't even hold the reserved empty string. So refuse any
buffer that isn't larger than the fixed part. That's also what the uapi
header says: string requests need space after the fixed part of the
structure.
Reproducer, unprivileged, on any mount that isn't idmapped:
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>
#define STATMOUNT_FS_SUBTYPE 0x00000100U
#define STATMOUNT_MNT_UIDMAP 0x00002000U
#define STATX_MNT_ID_UNIQUE 0x00004000U
#define SM_SIZE 512 /* sizeof(struct statmount) */
struct mnt_id_req {
uint32_t size, mnt_ns_fd;
uint64_t mnt_id, param, mnt_ns_id;
};
static uint64_t root_mnt_id(void)
{
unsigned char stx[256]; /* struct statx, stx_mnt_id at offset 144 */
uint64_t id;
if (syscall(__NR_statx, AT_FDCWD, "/", 0, STATX_MNT_ID_UNIQUE, stx))
_exit(1);
memcpy(&id, stx + 144, sizeof(id));
return id;
}
static void probe(uint64_t mnt_id, uint64_t mask, int guard)
{
struct mnt_id_req req = {
.size = sizeof(req), .mnt_id = mnt_id, .param = mask,
};
long page = sysconf(_SC_PAGESIZE);
unsigned char *map, *buf;
uint32_t size;
long ret;
map = mmap(NULL, 2 * page, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
memset(map, 0xaa, 2 * page);
/* 100 byte buffer ending right at the page boundary */
buf = map + page - 100;
if (guard)
mprotect(map + page, page, PROT_NONE);
errno = 0;
ret = syscall(__NR_statmount, &req, buf, 100, 0);
printf("mask 0x%04llx%s: ret %ld errno %d", (unsigned long long)mask,
guard ? " guard page" : "", ret, errno);
if (!guard) {
memcpy(&size, buf, sizeof(size));
printf(", size 0x%x, byte[%d] 0x%02x", size, SM_SIZE,
buf[SM_SIZE]);
}
printf("\n");
munmap(map, 2 * page);
}
int main(void)
{
uint64_t id = root_mnt_id();
probe(id, STATMOUNT_MNT_UIDMAP, 0);
probe(id, STATMOUNT_FS_SUBTYPE, 0);
probe(id, STATMOUNT_MNT_UIDMAP, 1);
return 0;
}
Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM, the
same on a distro 7.1.13:
mask 0x2000: ret 0 errno 0, size 0x65, byte[512] 0x00
mask 0x0100: ret 0 errno 0, size 0x65, byte[512] 0x00
mask 0x2000 guard page: ret -1 errno 14
After:
mask 0x2000: ret -1 errno 75, size 0xaaaaaaaa, byte[512] 0xaa
mask 0x0100: ret -1 errno 75, size 0xaaaaaaaa, byte[512] 0xaa
mask 0x2000 guard page: ret -1 errno 75
Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020110747.959829-1-shawnq1@163.com
Fixes: e52e97f09fb6 ("statmount: let unset strings be empty")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-1-8917a4c1bd14@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index ab050a939cb53..fd7949d88a6c5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5817,7 +5817,8 @@ static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
ks->bufsize = bufsize;
if (ks->mask & STATMOUNT_STRING_REQ) {
- if (bufsize == sizeof(ks->sm))
+ /* Even the reserved empty string needs room past the fixed part. */
+ if (bufsize <= sizeof(ks->sm))
return -EOVERFLOW;
ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 712/869] listmount: dont wrap around with a U64_MAX cursor
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (710 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 711/869] statmount: dont copy the reserved empty string past the buffer Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 713/869] ucount: take the rlimit reference before checking the limit Greg Kroah-Hartman
` (164 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, shaos, Jeff Layton,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 95a5412022e437691f4eb1924ff249d9044f5ed1 ]
do_listmount() takes the last mount id the caller saw and looks up the
first mount after it by searching for last_mnt_id + 1. With U64_MAX
that wraps around to zero and the search finds the first mount in the
namespace. So a cursor at the largest possible id restarts the listing
from the beginning instead of ending it. A cursor of U64_MAX - 1
correctly returns nothing.
No mount will ever have that id. Mount ids come from a counter that
starts at MNT_UNIQUE_ID_OFFSET + 1 and a caller that only feeds back
ids it got from us can't hit this. It's still wrong. Nothing can come
after the largest possible id so return no entries for it, just like
for any other cursor past the last mount.
The reverse direction isn't affected. A cursor of zero is special-cased
and anything else is larger than MNT_UNIQUE_ID_OFFSET so last_mnt_id - 1
can't underflow.
Reproducer, unprivileged:
#define _GNU_SOURCE
#include <errno.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/syscall.h>
#include <unistd.h>
#define LSMT_ROOT 0xffffffffffffffffULL
struct mnt_id_req {
uint32_t size, mnt_ns_fd;
uint64_t mnt_id, param, mnt_ns_id;
};
static void list(uint64_t cursor)
{
struct mnt_id_req req = {
.size = sizeof(req), .mnt_id = LSMT_ROOT, .param = cursor,
};
uint64_t ids[8];
long ret;
errno = 0;
ret = syscall(__NR_listmount, &req, ids, 8, 0);
printf("cursor %llu: ret %ld errno %d", (unsigned long long)cursor,
ret, errno);
for (long i = 0; i < ret && i < 1; i++)
printf("%s%llu", i ? "," : " ids ", (unsigned long long)ids[i]);
printf("%s\n", ret > 1 ? ",..." : "");
}
int main(void)
{
list(0);
list(UINT64_MAX - 1);
list(UINT64_MAX);
return 0;
}
Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM:
cursor 0: ret 5 errno 0 ids 2147483651,...
cursor 18446744073709551614: ret 0 errno 0
cursor 18446744073709551615: ret 5 errno 0 ids 2147483651,...
After:
cursor 0: ret 5 errno 0 ids 2147483651,...
cursor 18446744073709551614: ret 0 errno 0
cursor 18446744073709551615: ret 0 errno 0
Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020110732.959552-1-shawnq1@163.com
Fixes: b4c2bea8ceaa ("add listmount(2) syscall")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-3-8917a4c1bd14@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/namespace.c b/fs/namespace.c
index fd7949d88a6c5..bb73b317f9e72 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5998,6 +5998,8 @@ static ssize_t do_listmount(struct klistmount *kls, bool reverse)
} else {
if (reverse)
first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
+ else if (last_mnt_id == U64_MAX)
+ first = NULL; /* nothing comes after the largest id */
else
first = mnt_find_id_at(ns, last_mnt_id + 1);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 713/869] ucount: take the rlimit reference before checking the limit
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (711 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 712/869] listmount: dont wrap around with a U64_MAX cursor Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 714/869] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup Greg Kroah-Hartman
` (163 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Alexey Gladkov,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
[ Upstream commit b14fcabd34e02c40f72d3cd1e9bd4fd18df40ff1 ]
inc_rlimit_get_ucounts() takes the reference that pins a ucounts level
while its rlimit count is non-zero only in the walk whose increment is
the 0 -> 1 transition, and only after that walk passed the limit check.
A walk that raises the count from zero and then fails the limit backs
out without the reference, while a concurrent walk that raised it past
one keeps its increment and never takes one either:
CPU0 (obeys the limit) CPU1 (overrides it)
new = add_return(1) -> 1
new = add_return(1) -> 2
new != 1, no get_ucounts()
new > max -> dec_unwind
sub_return(1) -> 1 (no put)
The count is 1 with no reference held. When CPU1 drops its charge,
dec_rlimit_put_ucounts() takes the count to 0 and puts a reference
nobody took, which frees the live struct ucounts, and the user_namespace
it pins, with kfree_rcu(). The mirror interleaving leaks the reference
instead.
An unprivileged user reaches this on a kernel with CONFIG_USER_NS=y: in
a user namespace with RLIMIT_SIGPENDING 0, one process taking
synchronous SIGSEGVs (forced, so override_rlimit is set) races a second
process in the same namespace and uid that queues real-time signals,
which obey the limit. The two hold different sighand->siglock but charge
the same per-namespace SIGPENDING ucounts. Unpatched, with rcuref
debugging:
rcuref - imbalanced put()
WARNING: lib/rcuref.c:266 at rcuref_put_slowpath+0xf4/0x120
put_ucounts+0x5a/0x180
do_dec_rlimit_put_ucounts+0x70/0x90
__sigqueue_free+0x33/0xc0
get_signal+0x56f/0xd20
arch_do_signal_or_restart+0x87/0x380
irqentry_exit+0x243/0x650
asm_exc_page_fault+0x26/0x30
Take the reference on the 0 -> 1 transition before the limit is checked,
so the walk that raises the count from zero owns that level's reference
even when its request is rejected, and unwind a rejected level through
do_dec_rlimit_put_ucounts(), which releases the reference when the count
returns to 0. The get_ucounts() failure path is unchanged. With the
patch the same interleaving, forced some 80000 times in a KASAN build,
produces no warning and no KASAN report.
Fixes: 15bc01effefe ("ucounts: Fix signal ucount refcounting")
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Link: https://patch.msgid.link/20261019185913.805378-1-nickolai@csail.mit.edu
Acked-by: Alexey Gladkov <legion@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/ucount.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/kernel/ucount.c b/kernel/ucount.c
index fc4a8f2d30965..5cbf1553658ea 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -302,23 +302,26 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
for (iter = ucounts; iter; iter = iter->ns->ucounts) {
long new = atomic_long_add_return(1, &iter->rlimit[type]);
- if (new < 0 || new > max)
+ /*
+ * Take the extra reference on the 0 -> 1 transition before the
+ * limit check: a rejected walk must not leave a concurrent one
+ * holding the surviving increment with no reference.
+ */
+ if (new == 1 && !get_ucounts(iter))
goto dec_unwind;
+ if (new < 0 || new > max) {
+ /* undo iter too, releasing the reference taken above */
+ do_dec_rlimit_put_ucounts(ucounts, iter->ns->ucounts, type);
+ return 0;
+ }
if (iter == ucounts)
ret = new;
if (!override_rlimit)
max = get_userns_rlimit_max(iter->ns, type);
- /*
- * Grab an extra ucount reference for the caller when
- * the rlimit count was previously 0.
- */
- if (new != 1)
- continue;
- if (!get_ucounts(iter))
- goto dec_unwind;
}
return ret;
dec_unwind:
+ /* get_ucounts() failed for iter: undo iter without a put */
dec = atomic_long_sub_return(1, &iter->rlimit[type]);
WARN_ON_ONCE(dec < 0);
do_dec_rlimit_put_ucounts(ucounts, iter, type);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 714/869] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (712 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 713/869] ucount: take the rlimit reference before checking the limit Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 715/869] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() Greg Kroah-Hartman
` (162 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Rafael J. Wysocki,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 0ffc7534a210105ba973167a5b86d5ab39d4031f ]
intel_pstate_driver_cleanup() frees per-CPU data without cancelling the
pending HWP notify delayed work. If hwp_notify_work is still scheduled
or running when the struct is freed, the work function accesses freed
memory via container_of().
Call intel_pstate_disable_hwp_interrupt() before kfree() to disable
the interrupt source and cancel the pending work, matching the pattern
used in intel_pstate_suspend() and intel_pstate_hwp_offline().
Fixes: d845cd901b28 ("cpufreq: intel_pstate: Support highest performance change interrupt")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
[ rjw: Fixed the Fixes: tag ]
Link: https://patch.msgid.link/20261019222635.1741146-1-tristmd@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/intel_pstate.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 1de12358c0b98..a498d66883b52 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -3458,6 +3458,8 @@ static void intel_pstate_driver_cleanup(void)
if (intel_pstate_driver == &intel_pstate)
intel_pstate_clear_update_util_hook(cpu);
+ intel_pstate_disable_hwp_interrupt(all_cpu_data[cpu]);
+
kfree(all_cpu_data[cpu]);
WRITE_ONCE(all_cpu_data[cpu], NULL);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 715/869] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (713 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 714/869] cpufreq: intel_pstate: cancel HWP notify work in driver cleanup Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 716/869] i2c: designware: queue only one read command for block reads Greg Kroah-Hartman
` (161 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Andi Shyti, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit a65917d0a22f9b10694853b725f9cd399fc3ef4d ]
i2c_acpi_new_device_by_fwnode() obtains an i2c_adapter through
i2c_acpi_find_adapter_by_handle(). That helper uses bus_find_device()
internally, so it returns the adapter with a reference held:
adapter = i2c_verify_adapter(dev);
if (!adapter)
put_device(dev);
return adapter;
The reference is only put on the failure path inside that helper. The
caller owns it otherwise. i2c_acpi_new_device_by_fwnode() never drops
it, neither on the -EPROBE_DEFER path nor after
i2c_new_client_device(), so every call leaks one reference on the
adapter and the adapter can never be released.
i2c_new_client_device() does not consume that reference. It registers
the new client with the adapter as its parent, and device_add() takes
its own reference on the parent, which device_del() releases when the
client goes away. The reference obtained by the lookup is a separate
one and has to be dropped here.
i2c_acpi_notify() in the same file already does exactly this. It takes
the adapter from the same helper, registers the client through
i2c_acpi_register_device(), which calls i2c_new_client_device(), and
then puts the reference.
i2c_new_client_device() gives the client its own reference on the
adapter, so ours can be dropped unconditionally.
Found by code review.
Fixes: 605f8fc22442 ("i2c: core: Add new i2c_acpi_new_device helper function")
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261012013421.3597430-1-make_ruc2021@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/i2c-core-acpi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 98ebbc973f212..8805fc454a4ef 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -545,6 +545,7 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
{
struct i2c_acpi_lookup lookup;
struct i2c_adapter *adapter;
+ struct i2c_client *client;
struct acpi_device *adev;
LIST_HEAD(resource_list);
int ret;
@@ -572,7 +573,10 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
if (!adapter)
return ERR_PTR(-EPROBE_DEFER);
- return i2c_new_client_device(adapter, info);
+ client = i2c_new_client_device(adapter, info);
+ put_device(&adapter->dev);
+
+ return client;
}
EXPORT_SYMBOL_GPL(i2c_acpi_new_device_by_fwnode);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 716/869] i2c: designware: queue only one read command for block reads
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (714 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 715/869] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 717/869] tpm: tpm_nsc: fix NULL pointer dereference on init failure Greg Kroah-Hartman
` (160 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Navon John Lukose, Mika Westerberg,
Andi Shyti, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navon John Lukose <navonjohnlukose@gmail.com>
[ Upstream commit 73dae605cad7921800677d982bfaeb81cc930dec ]
i2c_dw_xfer_msg() pre-queues up to rx_fifo_depth read commands based
on the initial msg.len. For I2C_M_RECV_LEN transfers the real length
is unknown until the first byte arrives and i2c_dw_recv_len() runs.
When a large initial length is passed, the surplus pre-queued reads
leave rx_outstanding non-zero after i2c_dw_recv_len() adjusts
msg.len, so the completion condition is never met and the transfer
times out. In a loop, this repeatedly times out the controller and
disrupts unrelated driver-bound devices on the same adapter.
Queue only one read command while I2C_M_RECV_LEN is pending.
i2c_dw_recv_len() re-enables TX_EMPTY, and the rest are queued once
the device-reported length is known.
Fixes: c3ae106050b9 ("i2c: designware: Implement support for SMBus block read and write")
Signed-off-by: Navon John Lukose <navonjohnlukose@gmail.com>
Cc: <stable@vger.kernel.org> # v4.10+
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-designware-master.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index c4bab532eed1e..593ddec3c40ee 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -515,6 +515,14 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
if (dev->rx_outstanding >= dev->rx_fifo_depth)
break;
+ /*
+ * For block reads, queue only the length
+ * byte until i2c_dw_recv_len() runs.
+ */
+ if ((flags & I2C_M_RECV_LEN) &&
+ buf_len < msgs[dev->msg_write_idx].len)
+ break;
+
regmap_write(dev->map, DW_IC_DATA_CMD,
cmd | 0x100);
rx_limit--;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 717/869] tpm: tpm_nsc: fix NULL pointer dereference on init failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (715 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 716/869] i2c: designware: queue only one read command for block reads Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 718/869] tpm: tpm_nsc: stop using the cleanup callback as dev.release Greg Kroah-Hartman
` (159 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Jarkko Sakkinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit 1900449684cf71427a51e0bb1d7914c0c8b39152 ]
tpm_nsc_remove() is used as the release callback of the hand-created
platform device and dereferences the chip drvdata unconditionally.
If init fails before tpmm_chip_alloc() (e.g. request_region() cannot
claim the ports), the error path drops the last device reference and
the release callback runs with chip == NULL, crashing module init.
Return early when the chip has not been created yet.
Cc: stable@vger.kernel.org
Fixes: afb5abc262e9 ("tpm: two-phase chip management functions")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/d5f0b38d6d6c17c01519c879d26448dbae388b0e.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm_nsc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 879ac88f5783c..46a52dc99b148 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -259,7 +259,12 @@ static struct platform_device *pdev = NULL;
static void tpm_nsc_remove(struct device *dev)
{
struct tpm_chip *chip = dev_get_drvdata(dev);
- struct tpm_nsc_priv *priv = dev_get_drvdata(&chip->dev);
+ struct tpm_nsc_priv *priv;
+
+ if (!chip)
+ return;
+
+ priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
release_region(priv->base, 2);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 718/869] tpm: tpm_nsc: stop using the cleanup callback as dev.release
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (716 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 717/869] tpm: tpm_nsc: fix NULL pointer dereference on init failure Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 719/869] tpm: fix zero-length read discarding the pending response Greg Kroah-Hartman
` (158 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Jarkko Sakkinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit df0ef271087623439a1e900f323ed2a57204706d ]
tpm_nsc_remove() is called explicitly from cleanup_nsc() and also
runs as the platform device release callback on the final
platform_device_put(), so the cleanup executes twice on module
exit; the second invocation operates on a chip that has already
been freed by the devm cleanup, and the I/O region is released
twice.
Overwriting the release callback installed by
platform_device_alloc() also keeps platform_device_release() from
running, leaking the platform object allocation.
Leave the default release callback in place; the explicit call in
cleanup_nsc() remains the single cleanup point.
Cc: stable@vger.kernel.org
Fixes: 570302a31149 ("[PATCH] tpm: move nsc driver off pci_dev")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/a6155310e6772f708b47291cc959e02c05b90eb7.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm_nsc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 46a52dc99b148..bcfa2a1a208a9 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -327,7 +327,6 @@ static int __init init_nsc(void)
pdev->num_resources = 0;
pdev->dev.driver = &nsc_drv.driver;
- pdev->dev.release = tpm_nsc_remove;
if ((rc = platform_device_add(pdev)) < 0)
goto err_put_dev;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 719/869] tpm: fix zero-length read discarding the pending response
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (717 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 718/869] tpm: tpm_nsc: stop using the cleanup callback as dev.release Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 720/869] gpiolib: dont report -ENOMEM for a requested line without a label Greg Kroah-Hartman
` (157 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Jarkko Sakkinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit 6fc1b05077b8ac7c3193616f0bc419f6185988c6 ]
POSIX requires that a read() with a count of zero returns zero and
has no other effects. tpm_common_read() treats such a call as a
consumed response: it marks the pending response as read and drops
it, so the response can never be retrieved; subsequent reads return
zero and the next write() is allowed to overwrite the response
buffer, silently breaking the command/response pairing of the TPM
character devices.
Return early when the caller passes a zero count, leaving any
pending response untouched for the next read. A zero-length read
will not report a deferred asynchronous error; POSIX permits read()
to skip error detection for a zero count.
Cc: stable@vger.kernel.org
Fixes: 9488585b21be ("tpm: add support for partial reads")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/3f15140ab3c26e98b49d6aceaaa826585d56960b.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm-dev-common.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index f2a5e09257ddd..a856b4ddbdc2c 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -134,6 +134,9 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
ssize_t ret_size = 0;
int rc;
+ if (!size)
+ return 0;
+
mutex_lock(&priv->buffer_mutex);
if (priv->response_length) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 720/869] gpiolib: dont report -ENOMEM for a requested line without a label
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (718 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 719/869] tpm: fix zero-length read discarding the pending response Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 721/869] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer Greg Kroah-Hartman
` (156 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Adrian Ambrozewicz,
Bartosz Golaszewski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
[ Upstream commit dae739137441667d67fbfcc4d303a0ecc6618662 ]
gpiod_request_commit() sets GPIOD_FLAG_REQUESTED, calls ->request() and
only then sets the label. A line in between has no label, so
gpiochip_dup_line_label() passes NULL to kstrdup() and returns
ERR_PTR(-ENOMEM), which for_each_hwgpio() then passes to kfree():
BUG: unable to handle page fault for address: ffcc73074355ffc8
Call Trace:
gpio_sim_dbg_show
gpiolib_seq_show
seq_read_iter
Return NULL for such a line, as for an unrequested one.
Reproduced with gpio-sim: reading /sys/kernel/debug/gpio in a loop while
lines are requested and released oopses within seconds; with this
change, 100000 cycles pass.
Fixes: 35b545332b80 ("gpio: remove gpio_lock")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261020-gpiolib-chip-removal-v3-0-aambrozewicz@nvidia.com?part=2
Assisted-by: LLM
Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Link: https://patch.msgid.link/20261022083343.3905973-3-aambrozewicz@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 635b77c0eab53..c23ba5e94cd6f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2556,6 +2556,7 @@ void gpiod_free(struct gpio_desc *desc)
char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset)
{
struct gpio_desc *desc;
+ const char *name;
char *label;
desc = gpiochip_get_desc(gc, offset);
@@ -2567,7 +2568,11 @@ char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset)
guard(srcu)(&desc->gdev->desc_srcu);
- label = kstrdup(gpiod_get_label(desc), GFP_KERNEL);
+ name = gpiod_get_label(desc);
+ if (!name)
+ return NULL;
+
+ label = kstrdup(name, GFP_KERNEL);
if (!label)
return ERR_PTR(-ENOMEM);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 721/869] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (719 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 720/869] gpiolib: dont report -ENOMEM for a requested line without a label Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 722/869] ASoC: tlv320aic32x4: Prevent division by zero in divider callbacks Greg Kroah-Hartman
` (155 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jean Delu, Helge Deller, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delu <jeandelu@tutamail.com>
[ Upstream commit c0a3e153804f0c14f4159ddbd2b73483c9cb3577 ]
eisa_enumerator() trusts the contents of the EISA EEPROM. The number
of slots is read from the EEPROM header and used to access the slot
records at HPEE_SLOT_INFO(i) = 20 + 48*i within the fixed-size
eeprom_buf (HPEE_MAX_LENGTH, 8192 bytes) without any bound check. As
struct eeprom_eisa_slot_info is 48 bytes, only 170 records fit into the
buffer, but num_slots is a u8 and may be up to 255, so a corrupted
EEPROM makes the code read up to about 4 kB past the end of the buffer
(e.g. record 254 is accessed at offset 20 + 48*254 = 12212).
parse_slot_config() has the same kind of problem: it clamps
config_data_length against HPEE_MAX_LENGTH but does not take
config_data_offset into account, so the parser can walk past the end of
the buffer even when the offset itself is valid.
Clamp the number of slots so that all slot records fit into the buffer,
and hand the number of bytes actually available to parse_slot_config()
and bound the parse by it.
Signed-off-by: Jean Delu <jeandelu@tutamail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/parisc/eisa_enumerator.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/parisc/eisa_enumerator.c b/drivers/parisc/eisa_enumerator.c
index f0cb31198a8f0..aa41d3abc6c22 100644
--- a/drivers/parisc/eisa_enumerator.c
+++ b/drivers/parisc/eisa_enumerator.c
@@ -311,6 +311,7 @@ static int configure_function(const unsigned char *buf, int *more)
static int parse_slot_config(int slot,
const unsigned char *buf,
+ unsigned int buflen,
struct eeprom_eisa_slot_info *es,
struct resource *io_parent,
struct resource *mem_parent)
@@ -333,8 +334,8 @@ static int parse_slot_config(int slot,
printk(KERN_INFO "EISA slot %d: %s %s ",
slot, board, es->flags&HPEE_FLAG_BOARD_IS_ISA ? "ISA" : "EISA");
- maxlen = es->config_data_length < HPEE_MAX_LENGTH ?
- es->config_data_length : HPEE_MAX_LENGTH;
+ /* never parse beyond the data that is actually in the buffer */
+ maxlen = min_t(unsigned int, es->config_data_length, buflen);
while ((pos < maxlen) && (num_func <= es->num_functions)) {
pos+=configure_function(buf+pos, &function_len);
@@ -491,6 +492,13 @@ int eisa_enumerator(unsigned long eeprom_addr,
printk(KERN_INFO "Enumerating EISA bus\n");
eh = (struct eeprom_header*)(eeprom_buf);
+ /*
+ * The EEPROM contents are not to be trusted: clamp the number of
+ * slots so that all slot records fit into eeprom_buf.
+ */
+ eh->num_slots = min_t(u8, eh->num_slots,
+ (HPEE_MAX_LENGTH - sizeof(*eh)) /
+ sizeof(struct eeprom_eisa_slot_info));
for (i=0;i<eh->num_slots;i++) {
struct eeprom_eisa_slot_info *es;
@@ -503,7 +511,8 @@ int eisa_enumerator(unsigned long eeprom_addr,
if (es->config_data_offset < HPEE_MAX_LENGTH) {
if (parse_slot_config(i+1, &eeprom_buf[es->config_data_offset],
- es, io_parent, mem_parent)) {
+ HPEE_MAX_LENGTH - es->config_data_offset,
+ es, io_parent, mem_parent)) {
return -1;
}
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 722/869] ASoC: tlv320aic32x4: Prevent division by zero in divider callbacks
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (720 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 721/869] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 723/869] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len Greg Kroah-Hartman
` (154 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Kazinsky, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Kazinsky <a.kazinsky@ideco.ru>
[ Upstream commit 8cf9607d2d855629260fc78e6b54ea7a98525708 ]
A zero rate requested through clk_set_rate() or clk_round_rate() reaches
clk_aic32x4_div_determine_rate() when the minimum rate is zero. Clamping
the requested rate to the allowed range leaves it unchanged, causing
division by zero when calculating the divisor.
A zero parent rate can also cause division by zero in determine_rate().
For example, if reading a parent divider's register fails,
clk_aic32x4_div_recalc_rate() returns zero, which the clock framework
caches as the parent's rate. A subsequent rate request for a child
divider receives this value in best_parent_rate. With a nonzero requested
rate, the calculated divisor is zero. It passes the existing upper-bound
check and causes division by zero in the resulting rate calculation.
The set_rate callback can receive a zero rate when an ancestor's rate
changes. clk_calc_subtree() calculates descendant rates through
recalc_rate() without calling their determine_rate callbacks. If reading
a descendant divider's register fails, clk_aic32x4_div_recalc_rate()
returns zero. This becomes the descendant's new_rate, which
clk_change_rate() passes to clk_aic32x4_div_set_rate(), causing division
by zero.
Reject zero rates in both callbacks and reject a zero divisor in
clk_aic32x4_div_determine_rate().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: a51b50062091 ("ASoC: tlv320aic32x4: Model DAC/ADC dividers in CCF")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>
Link: https://patch.msgid.link/20261023130854.93639-1-a.kazinsky@ideco.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tlv320aic32x4-clk.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
index 5c0a76a4a106b..1a815de909097 100644
--- a/sound/soc/codecs/tlv320aic32x4-clk.c
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -320,6 +320,9 @@ static int clk_aic32x4_div_set_rate(struct clk_hw *hw, unsigned long rate,
struct clk_aic32x4 *div = to_clk_aic32x4(hw);
u8 divisor;
+ if (!rate)
+ return -EINVAL;
+
divisor = DIV_ROUND_UP(parent_rate, rate);
if (divisor > AIC32X4_DIV_MAX)
return -EINVAL;
@@ -333,8 +336,11 @@ static int clk_aic32x4_div_determine_rate(struct clk_hw *hw,
{
unsigned long divisor;
+ if (!req->rate)
+ return -EINVAL;
+
divisor = DIV_ROUND_UP(req->best_parent_rate, req->rate);
- if (divisor > AIC32X4_DIV_MAX)
+ if (!divisor || divisor > AIC32X4_DIV_MAX)
return -EINVAL;
req->rate = DIV_ROUND_UP(req->best_parent_rate, divisor);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 723/869] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (721 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 722/869] ASoC: tlv320aic32x4: Prevent division by zero in divider callbacks Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 724/869] spi: zynq-qspi: fix address buffer corruption and support 4-byte address Greg Kroah-Hartman
` (153 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Andi Shyti,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
[ Upstream commit b7fd977fec0d3f2bdd4f13bb59949c817a365652 ]
When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
stack data is copied and written to REG_SM0D1_REG. Equally on the read
part, an unnecessary read is done.
Guard these extra copy/write and read for the page_len to fix leaking
uninitialized stack memory.
Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261022193853.670625-1-ansuelsmth@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-mt7621.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c
index 0a288c998419b..9ea5e3f9a7632 100644
--- a/drivers/i2c/busses/i2c-mt7621.c
+++ b/drivers/i2c/busses/i2c-mt7621.c
@@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
u16 addr;
int i, j, ret, len, page_len;
u32 cmd;
- u32 data[2];
i2c = i2c_get_adapdata(adap);
@@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
/* transfer data */
for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) {
+ u32 data[2] = { };
+
page_len = (len >= 8) ? 8 : len;
if (pmsg->flags & I2C_M_RD) {
@@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
} else {
memcpy(data, &pmsg->buf[j], page_len);
iowrite32(data[0], i2c->base + REG_SM0D0_REG);
- iowrite32(data[1], i2c->base + REG_SM0D1_REG);
+ if (page_len > 4)
+ iowrite32(data[1], i2c->base + REG_SM0D1_REG);
cmd = SM0CTL1_WRITE;
}
@@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
if (pmsg->flags & I2C_M_RD) {
data[0] = ioread32(i2c->base + REG_SM0D0_REG);
- data[1] = ioread32(i2c->base + REG_SM0D1_REG);
+ if (page_len > 4)
+ data[1] = ioread32(i2c->base + REG_SM0D1_REG);
memcpy(&pmsg->buf[j], data, page_len);
} else {
if (!(pmsg->flags & I2C_M_IGNORE_NAK)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 724/869] spi: zynq-qspi: fix address buffer corruption and support 4-byte address
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (722 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 723/869] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 725/869] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path Greg Kroah-Hartman
` (152 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pufan Jin, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pufan Jin <cyan2254650260@gmail.com>
[ Upstream commit dc5ca34f5e8dc10c566ef39aa3b1a201a17ca734 ]
In zynq_qspi_exec_mem_op(), when transmitting address bytes, the driver
iterates over op->addr.nbytes and populates xqspi->txbuf[i]. However,
xqspi->txbuf is never re-assigned before populating the address, meaning
it still points to (u8 *)&op->cmd.opcode from the command phase.
This causes two severe issues:
1. Memory corruption: Writing into xqspi->txbuf writes past the opcode
buffer on the stack (which was passed as const struct spi_mem_op *).
If opcode is zero, xqspi->txbuf is uninitialized.
2. In zynq_qspi_supports_op(), operations with op->addr.nbytes > 3 are
rejected. When paired with SPI NOR flashes larger than 16MB (such as
Winbond W25Q256), spi_nor_spimem_check_read_pp_op() tests 4-byte address
support, which fails and causes spi_nor_select_read() to drop all read
capabilities, failing probe with -EINVAL (-22).
The Zynq-7000 QSPI controller hardware in manual I/O mode natively supports
transmitting 1 to 4 address bytes via its TXD FIFO registers
(ZYNQ_QSPI_TXD_00_00_OFFSET).
Fix this by introducing a local opaddr[4] buffer in zynq_qspi_exec_mem_op()
and explicitly setting xqspi->txbuf = opaddr before populating address
bytes. Also allow up to 4 address bytes in zynq_qspi_supports_op().
Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
Cc: stable@vger.kernel.org
Signed-off-by: Pufan Jin <cyan2254650260@gmail.com>
Link: https://patch.msgid.link/20261016130812.282624-1-cyan2254650260@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-zynq-qspi.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
index 406fd9d5337ee..c9588fd1d1237 100644
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -229,11 +229,10 @@ static bool zynq_qspi_supports_op(struct spi_mem *mem,
return false;
/*
- * The number of address bytes should be equal to or less than 3 bytes.
+ * The number of address bytes should be equal to or less than 4 bytes.
*/
- if (op->addr.nbytes > 3)
+ if (op->addr.nbytes > 4)
return false;
-
return true;
}
@@ -526,6 +525,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
const struct spi_mem_op *op)
{
struct zynq_qspi *xqspi = spi_controller_get_devdata(mem->spi->controller);
+ u8 opaddr[4] __aligned(4);
int err = 0, i;
u8 *tmpbuf;
@@ -547,12 +547,13 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
}
if (op->addr.nbytes) {
- for (i = 0; i < op->addr.nbytes; i++) {
- xqspi->txbuf[i] = op->addr.val >>
+ for (i = 0; i < op->addr.nbytes; i++)
+ opaddr[i] = op->addr.val >>
(8 * (op->addr.nbytes - i - 1));
- }
reinit_completion(&xqspi->data_completion);
+ xqspi->txbuf = opaddr;
+
xqspi->rxbuf = NULL;
xqspi->tx_bytes = op->addr.nbytes;
xqspi->rx_bytes = op->addr.nbytes;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 725/869] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (723 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 724/869] spi: zynq-qspi: fix address buffer corruption and support 4-byte address Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 726/869] timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now() Greg Kroah-Hartman
` (151 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AutonomousCodeSecurity,
Cen Zhang (Microsoft), Thomas Gleixner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
[ Upstream commit 8ccd731b63a0183ca2b0e18f3ca15864b3f37eda ]
do_cpu_nanosleep() sleeps on a temporary k_itimer whose reference on the
target's struct pid is taken by posix_cpu_timer_create() and dropped by
posix_cpu_timer_del(). When a signal ends the sleep, the timer is
disarmed with posix_cpu_timer_set(), but posix_cpu_timer_del() is only
called for a result of 0 or TIMER_RETRY. If the target thread or process
has exited in the meantime, timer_lock_sighand() finds no task,
posix_cpu_timer_set() returns -ESRCH and the pid reference is leaked.
An unprivileged user can trigger this: sleep on the CPU clock of a
thread, let that thread exit, then signal the sleeper. Each round leaks
one struct pid. Repeating it exhausts unreclaimable slab memory
within minutes:
Out of memory: Killed process 150 (poc) total-vm:789292kB, anon-rss:484kB
Kernel panic - not syncing: System is deadlocked on memory
Fix this by also calling posix_cpu_timer_del() on -ESRCH. With the
target gone, the deletion is safe. It finds no task either and only
drops the pid reference.
Fixes: e26d70d271ee ("posix-timers: Cleanup reaped target handling")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261012235149.66531-1-cenzhang@linux.microsoft.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/posix-cpu-timers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index b3d4bae9ee3e0..fcb98cbb1219b 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1597,8 +1597,8 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
*/
expires = cpu_timer_getexpires(&timer.it.cpu);
error = posix_cpu_timer_set(&timer, 0, &zero_it, &it);
- if (!error) {
- /* Timer is now unarmed, deletion can not fail. */
+ if (error != TIMER_RETRY) {
+ /* Unarmed or target gone (-ESRCH), deletion can not fail. */
posix_cpu_timer_del(&timer);
} else {
while (error == TIMER_RETRY) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 726/869] timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (724 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 725/869] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 727/869] cgroup: dont kill migrated processes through their exiting threads Greg Kroah-Hartman
` (150 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh ,
Thomas Gleixner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
[ Upstream commit 6541fbc942f3b63bb8bd44e34eee6223e0abe719 ]
The sequence counter of the cwsseq target is modified during the
sequence counter loop. If the loop retries, cwsseq will now match
but the offsets contain the values from the previous loop iteration.
These are not guaranteed to be consistent in themselves or with the
current loops "now.
Save the target's original sequence counter value so that the update
also happens on loop retries.
Fixes: 868a3e915f7f ("hrtimer: Make offset update smarter")
Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261023-timekeeping-clock_was_set_seq-v1-1-61c4c53d031c@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timekeeping.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 377e29ca5a521..32f59de2ba4ce 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -2569,6 +2569,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
ktime_t *offs_boot, ktime_t *offs_tai)
{
struct timekeeper *tk = &tk_core.timekeeper;
+ u32 cwsseq_orig = *cwsseq;
unsigned int seq;
ktime_t base;
u64 nsecs;
@@ -2580,7 +2581,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
nsecs = timekeeping_get_ns(&tk->tkr_mono);
base = ktime_add_ns(base, nsecs);
- if (*cwsseq != tk->clock_was_set_seq) {
+ if (cwsseq_orig != tk->clock_was_set_seq) {
*cwsseq = tk->clock_was_set_seq;
*offs_real = tk->offs_real;
*offs_boot = tk->offs_boot;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 727/869] cgroup: dont kill migrated processes through their exiting threads
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (725 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 726/869] timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 728/869] gve: fix out-of-bounds read in gve_get_flow_rule_entry() Greg Kroah-Hartman
` (149 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin, Tejun Heo
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5f4a3f743acc96987ae5c2e966947942c34ba56c ]
Since commit da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread
group leader"), __cgroup_kill() visits every thread in the cgroup and
sends SIGKILL with PIDTYPE_TGID, so each visited thread takes down its
whole thread group.
A thread that has started exiting can stay in a cgroup after its process
has been moved out of it. cgroup_migrate_add_task() skips PF_EXITING
tasks, and the thread is only unlinked by cgroup_task_dead() after its
final context switch. mm_release() clears the thread's clear_child_tid
word and wakes the joiner well before that, so pthread_join() can return
while the thread is still in the old cgroup.
If cgroup.kill is written in that window, __cgroup_kill() finds the
exiting thread and complete_signal() passes the group-wide SIGKILL on to
a live thread, killing a process that already left the cgroup. The cgroup
selftest test_stress.sh runs into this: test_cgcore_proc_migration()
joins its threads, moves itself back to the root cgroup, and cg_destroy()
falls back to cgroup.kill on the old cgroup when rmdir() fails with
EBUSY, so test_core kills itself. KernelCI has been reporting
"with_stress.sh: line 94: ... Killed" on several arm64 boards since the
commit reached linux-next.
Keep visiting every thread, but go back to sending SIGKILL to the thread
that was found. A SIGKILL sent to a live thread still kills its whole
thread group, so both cases fixed by that commit stay fixed, and
task_can_queue_signal() drops one sent to a thread that is already
exiting.
Fixes: da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread group leader")
Cc: stable@vger.kernel.org # v5.14+
Link: https://lore.kernel.org/all/179272264722.329188.4773475583351189022@6e52bff8000c/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 28db81da10b81..aa629b7d76e53 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4229,7 +4229,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
if (__fatal_signal_pending(task))
continue;
- do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID);
+ send_sig(SIGKILL, task, 0);
}
css_task_iter_end(&it);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 728/869] gve: fix out-of-bounds read in gve_get_flow_rule_entry()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (726 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 727/869] cgroup: dont kill migrated processes through their exiting threads Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 729/869] genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path Greg Kroah-Hartman
` (148 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Eugene Lee,
Harshitha Ramamurthy, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit 45e0a63f9c86a558afc70d79b6df38f8ec7f502a ]
gve_get_flow_rule_entry() checks the requested location against the
first and last cached rules, but rules_cache_num can be 0 while
rules_cache_synced is true: GVE_FLOW_RULE_QUERY_RULES returns the rules
from the requested location onwards, so a request past the last
installed rule - or any request when no rules are installed - returns
zero rules, which the driver accepts and marks as synced.
The next query evaluates rules_cache[*cache_num - 1] with
*cache_num == 0. The zero-initialised cache does not trip the earlier
comparison, *cache_num - 1 wraps to 0xFFFFFFFF in u32, and the read
faults about 352 GiB past the cache. ETHTOOL_GRXCLSRULE needs no
capability, so an unprivileged user can trigger it:
BUG: unable to handle page fault for address: ff240996c4c64fa8
#PF: supervisor read access in kernel mode
RIP: gve_get_flow_rule_entry+0xd4/0x110 [gve]
Treat an empty cache as a cache miss and re-query.
Fixes: 6f3bc487565d ("gve: Add flow steering ethtool support")
Cc: stable@vger.kernel.org
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Eugene Lee <eugenehlee@google.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/AS8P251MB0001135AF3233180DC42DCD1C8672@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/google/gve/gve_flow_rule.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/google/gve/gve_flow_rule.c b/drivers/net/ethernet/google/gve/gve_flow_rule.c
index 0bb8cd1876a3f..426a264af8b26 100644
--- a/drivers/net/ethernet/google/gve/gve_flow_rule.c
+++ b/drivers/net/ethernet/google/gve/gve_flow_rule.c
@@ -206,6 +206,7 @@ int gve_get_flow_rule_entry(struct gve_priv *priv, struct ethtool_rxnfc *cmd)
return -EOPNOTSUPP;
if (!priv->flow_rules_cache.rules_cache_synced ||
+ !*cache_num ||
fsp->location < be32_to_cpu(rules_cache[0].location) ||
fsp->location > be32_to_cpu(rules_cache[*cache_num - 1].location)) {
err = gve_adminq_query_flow_rules(priv, GVE_FLOW_RULE_QUERY_RULES, fsp->location);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 729/869] genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (727 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 728/869] gve: fix out-of-bounds read in gve_get_flow_rule_entry() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 730/869] veth: fix stale peer max_mtu on XDP program replacement Greg Kroah-Hartman
` (147 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Igor Velkov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Velkov <iav@iav.lv>
[ Upstream commit 717862eac6eff0eea8ac30a0c0de0bed84922aab ]
machine_kexec_mask_interrupts() calls irq_set_irqchip_state() for every
started interrupt. That function takes the bus lock of the chip and
desc->lock, and syncs the chip when it drops them. On the crash path
interrupts are off and the other CPUs are stopped, so a chip whose bus
transfer is completed by an interrupt never returns from the sync.
On RK3399 boards with an RK808 PMIC the RTC alarm interrupt belongs to
the regmap-irq chip of the RK808, which sits on I2C. rk808_irq_chip sets
init_ack_masked, so regmap_irq_sync_unlock() writes the ack register on
every unlock, and the I2C controller needs its own interrupt to finish
the transfer. A panic with a crash kernel loaded prints
SMP: stopping secondary CPUs
and then nothing until the watchdog resets the board.
machine_kexec_mask_interrupts() takes neither lock for the other
operations on the descriptor. Move the search for the chip that
implements irq_set_irqchip_state() into __irq_set_irqchip_state(), which
takes no locks, and call it from machine_kexec_mask_interrupts().
Fixes: 78fd584cdec0 ("arm64: kdump: implement machine_crash_shutdown()")
Suggested-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Igor Velkov <iav@iav.lv>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015-kexec-irq-bus-lock-v2-1-2af15f0757b6@iav.lv
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/internals.h | 1 +
kernel/irq/kexec.c | 2 +-
kernel/irq/manage.c | 43 +++++++++++++++++++++++-------------------
3 files changed, 26 insertions(+), 20 deletions(-)
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index d197854a93c8f..97e50ade3bb98 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -78,6 +78,7 @@ enum {
#include "settings.h"
extern int __irq_set_trigger(struct irq_desc *desc, unsigned long flags);
+extern int __irq_set_irqchip_state(struct irq_desc *desc, enum irqchip_irq_state which, bool val);
extern void __disable_irq(struct irq_desc *desc);
extern void __enable_irq(struct irq_desc *desc);
diff --git a/kernel/irq/kexec.c b/kernel/irq/kexec.c
index 1a3deffe6b5b6..f245b98764225 100644
--- a/kernel/irq/kexec.c
+++ b/kernel/irq/kexec.c
@@ -25,7 +25,7 @@ void machine_kexec_mask_interrupts(void)
* First try to remove the active state from an interrupt which is forwarded
* to a VM. If the interrupt is not forwarded, try to EOI the interrupt.
*/
- check_eoi = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false);
+ check_eoi = __irq_set_irqchip_state(desc, IRQCHIP_STATE_ACTIVE, false);
}
if (check_eoi && chip->irq_eoi && irqd_irq_inprogress(&desc->irq_data))
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index a0b79bcc0e08b..19eda7aa9febd 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -2702,6 +2702,28 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which, bool *
}
EXPORT_SYMBOL_GPL(irq_get_irqchip_state);
+int __irq_set_irqchip_state(struct irq_desc *desc, enum irqchip_irq_state which, bool val)
+{
+ struct irq_data *data = irq_desc_get_irq_data(desc);
+ struct irq_chip *chip;
+
+ do {
+ chip = irq_data_get_irq_chip(data);
+
+ if (WARN_ON_ONCE(!chip))
+ return -ENODEV;
+
+ if (chip->irq_set_irqchip_state)
+ break;
+
+ data = irqd_get_parent_data(data);
+ } while (data);
+
+ if (data)
+ return chip->irq_set_irqchip_state(data, which, val);
+ return -EINVAL;
+}
+
/**
* irq_set_irqchip_state - set the state of a forwarded interrupt.
* @irq: Interrupt line that is forwarded to a VM
@@ -2716,25 +2738,8 @@ EXPORT_SYMBOL_GPL(irq_get_irqchip_state);
*/
int irq_set_irqchip_state(unsigned int irq, enum irqchip_irq_state which, bool val)
{
- scoped_irqdesc_get_and_buslock(irq, 0) {
- struct irq_data *data = irq_desc_get_irq_data(scoped_irqdesc);
- struct irq_chip *chip;
-
- do {
- chip = irq_data_get_irq_chip(data);
-
- if (WARN_ON_ONCE(!chip))
- return -ENODEV;
-
- if (chip->irq_set_irqchip_state)
- break;
-
- data = irqd_get_parent_data(data);
- } while (data);
-
- if (data)
- return chip->irq_set_irqchip_state(data, which, val);
- }
+ scoped_irqdesc_get_and_buslock(irq, 0)
+ return __irq_set_irqchip_state(scoped_irqdesc, which, val);
return -EINVAL;
}
EXPORT_SYMBOL_GPL(irq_set_irqchip_state);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 730/869] veth: fix stale peer max_mtu on XDP program replacement
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (728 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 729/869] genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 731/869] scsi: ufs: bsg: Complete the job on error Greg Kroah-Hartman
` (146 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, yanxia, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: yanxia <yanxia@cmss.chinamobile.com>
[ Upstream commit c955325db639e9503941227e14e1f1ccc99442a1 ]
veth_xdp_set() calculates the peer MTU limit from the incoming program's
XDP fragment capability, but only stores it when no program was attached.
Replacing a program with one having a different fragment capability
therefore leaves the peer's max_mtu stale.
Replacing a regular program with an xdp.frags program keeps rejecting
otherwise valid jumbo MTUs. The opposite replacement leaves a larger
limit in place and permits MTUs which a fresh attachment of the regular
program would reject.
Update peer->max_mtu after every successful attachment or replacement.
Keep the GSO feature update conditional on the first attachment.
Found during review of the XDP replacement path and confirmed with
native XDP on an isolated veth pair. Before the fix, direct replacement
rejects MTU 9000 after switching to xdp.frags, and accepts it after
switching back to a regular program. Detaching and attaching instead
produces the expected results in both directions.
UML tests on net reproduce the problem before this change and match the
detach/attach controls afterwards, with both devices up or down and
with either endpoint receiving XDP. Failed replacements preserve the
previous state; same-type replacements and detach also behave as
expected. Small-frame traffic passes in the devices-up cases.
Fixes: 7cda76d858a4 ("veth: Allow jumbo frames in xdp mode")
Cc: stable@vger.kernel.org
Signed-off-by: yanxia <yanxia@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261020020147.790274-1-yanxia@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/veth.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 148114ab85ac3..25cdbba5dfa9b 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1621,10 +1621,9 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog,
}
}
- if (!old_prog) {
+ if (!old_prog)
peer->hw_features &= ~NETIF_F_GSO_SOFTWARE;
- peer->max_mtu = max_mtu;
- }
+ peer->max_mtu = max_mtu;
xdp_features_set_redirect_target(peer, true);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 731/869] scsi: ufs: bsg: Complete the job on error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (729 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 730/869] veth: fix stale peer max_mtu on XDP program replacement Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 732/869] scsi: ufs: bsg: Clear the reply buffer before use Greg Kroah-Hartman
` (145 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Jhu, Bean Huo, Peter Wang,
Bart Van Assche, Martin K. Petersen (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Jhu <stanleyjhu@google.com>
[ Upstream commit cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8 ]
When ufs_bsg_request() fails, it returns a non-zero status without calling
bsg_job_done(). bsg_queue_rq() then ends the request with BLK_STS_IOERR
without running bsg_complete(), leaking the job's device reference and
mapped scatterlists.
Always complete the job via bsg_job_done() and return 0, matching other BSG
transports. Requests failing with a negative errno now return it from SG_IO
with the 4-byte result in the reply, while positive status codes still
return 0 from SG_IO with the reply header.
Fixes: b13a3539eb2a ("scsi: ufs-bsg: complete ufs-bsg job only if no error")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-2-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs_bsg.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index bb6ff8ca5c7a8..237ade1f0cd83 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -194,14 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job)
ufshcd_rpm_put_sync(hba);
kfree(buff);
bsg_reply->result = ret;
- /* complete the job here only if no error */
- if (ret == 0) {
+ if (ret == 0)
job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) :
sizeof(struct ufs_bsg_reply);
- bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
- }
+ bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
- return ret;
+ return 0;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 732/869] scsi: ufs: bsg: Clear the reply buffer before use
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (730 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 731/869] scsi: ufs: bsg: Complete the job on error Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 733/869] scsi: ufs: core: Clear stale UIC result byte before peer DME retries Greg Kroah-Hartman
` (144 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Jhu, Bean Huo, Peter Wang,
Bart Van Assche, Martin K. Petersen (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Jhu <stanleyjhu@google.com>
[ Upstream commit 2e63ac76cc08ea376ba61fef52f7b7849e35024d ]
The reply buffer is allocated once per tag and reused. Requests that
complete with a positive status do not fill all of it, so user space
receives bytes from an earlier request on the same tag.
Clear the whole reply buffer on entry to ufs_bsg_request().
Fixes: 95e34bf930ea ("scsi: ufs-bsg: Add support for raw upiu in ufs_bsg_request()")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-3-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs_bsg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 237ade1f0cd83..0e0b08a3821c4 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -142,7 +142,7 @@ static int ufs_bsg_request(struct bsg_job *job)
int ret;
bool rpmb = false;
- bsg_reply->reply_payload_rcv_len = 0;
+ memset(job->reply, 0, job->reply_len);
ufshcd_rpm_get_sync(hba);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 733/869] scsi: ufs: core: Clear stale UIC result byte before peer DME retries
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (731 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 732/869] scsi: ufs: bsg: Clear the reply buffer before use Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 734/869] scsi: libiscsi_tcp: Prevent R2T range check overflow Greg Kroah-Hartman
` (143 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bean Huo, Stanley Jhu, Peter Wang,
Bart Van Assche, Martin K. Petersen (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Jhu <stanleyjhu@google.com>
[ Upstream commit e4a9b7640914b248eb7537d4507aa42db080586a ]
Peer DME get and set retry a failed attempt with the same struct
uic_command. UIC completion ORs the ConfigResultCode into argument2[7:0],
and nothing clears it before the next attempt. Once an attempt fails, every
retry keeps reporting that error code, even when the device returns
success, so a transient failure becomes a hard failure after three
retries. Each such retry also triggers the WARN_ON_ONCE() in
ufshcd_dispatch_uic_cmd(). In ufshcd_dme_set_attr(), ufshcd_uic_cmd_compl()
also overwrites argument3 with the register readback before the next
attempt.
Clear the result byte and restore argument3 in ufshcd_dme_set_attr() when
an attempt fails.
Fixes: 64238fbd15ea ("scsi: ufs: add retries to dme_peer get and set attribute")
Cc: stable@vger.kernel.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-6-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 52df1df6333aa..d225ad90cc392 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -4219,9 +4219,12 @@ int ufshcd_dme_set_attr(struct ufs_hba *hba, u32 attr_sel,
do {
/* for peer attributes we retry upon failure */
ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
- if (ret)
+ if (ret) {
dev_dbg(hba->dev, "%s: attr-id 0x%x val 0x%x error code %d\n",
set, UIC_GET_ATTR_ID(attr_sel), mib_val, ret);
+ uic_cmd.argument2 &= ~MASK_UIC_COMMAND_RESULT;
+ uic_cmd.argument3 = mib_val;
+ }
} while (ret && peer && --retries);
if (ret)
@@ -4285,9 +4288,11 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel,
do {
/* for peer attributes we retry upon failure */
ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
- if (ret)
+ if (ret) {
dev_dbg(hba->dev, "%s: attr-id 0x%x error code %d\n",
get, UIC_GET_ATTR_ID(attr_sel), ret);
+ uic_cmd.argument2 &= ~MASK_UIC_COMMAND_RESULT;
+ }
} while (ret && peer && --retries);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 734/869] scsi: libiscsi_tcp: Prevent R2T range check overflow
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (732 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 733/869] scsi: ufs: core: Clear stale UIC result byte before peer DME retries Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 735/869] scsi: ufs: core: Remove an always-false WARN_ONCE() Greg Kroah-Hartman
` (142 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Chris Leech,
Martin K. Petersen (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
[ Upstream commit eb7aa7fd673fdc1582223cd133bcc5f54e7af19f ]
An iSCSI target controls the R2T data offset and length as 32-bit
values. Adding them before comparing the result with the SCSI data buffer
length can wrap. An R2T with offset 1 and length U32_MAX then passes the
check for a 4096-byte write.
The transmit path treats the wrapped range as valid, exhausts the command
scatterlist, and dereferences the NULL next entry in
iscsi_tcp_segment_done().
Check the offset first, then compare the length with the remaining bytes in
the data buffer.
Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Acked-by: Chris Leech <cleech@redhat.com>
Link: https://patch.msgid.link/DB5PR08MB100629CD3750FBF71475B5224FD982@DB5PR08MB10062.eurprd08.prod.outlook.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/libiscsi_tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index d35f93451ee9b..3c9e736d45e7e 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -601,7 +601,8 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
data_length, session->max_burst);
data_offset = be32_to_cpu(rhdr->data_offset);
- if (data_offset + data_length > task->sc->sdb.length) {
+ if (data_offset > task->sc->sdb.length ||
+ data_length > task->sc->sdb.length - data_offset) {
iscsi_conn_printk(KERN_ERR, conn,
"invalid R2T with data len %u at offset %u "
"and total length %d\n", data_length,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 735/869] scsi: ufs: core: Remove an always-false WARN_ONCE()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (733 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 734/869] scsi: libiscsi_tcp: Prevent R2T range check overflow Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 736/869] scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort() Greg Kroah-Hartman
` (141 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bean Huo, Peter Wang,
Bart Van Assche, Stanley Jhu, Martin K. Petersen (Oracle),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Jhu <stanleyjhu@google.com>
[ Upstream commit cd37a69c367b6a5f685db0ac7d01f08545081a30 ]
The WARN_ONCE() in ufshcd_poll() can never fire. completed_reqs is set to
~tr_doorbell & hba->outstanding_reqs on the line above, and
hba->outstanding_reqs cannot change in between because ufshcd_poll() holds
hba->outstanding_lock. So completed_reqs & ~hba->outstanding_reqs is always
zero. Remove it. No functional change.
Cc: stable@vger.kernel.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Link: https://patch.msgid.link/20261022034443.3034432-2-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index d225ad90cc392..b3dbfd3552dc4 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -5714,9 +5714,6 @@ static int ufshcd_poll(struct Scsi_Host *shost, unsigned int queue_num)
spin_lock_irqsave(&hba->outstanding_lock, flags);
tr_doorbell = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
completed_reqs = ~tr_doorbell & hba->outstanding_reqs;
- WARN_ONCE(completed_reqs & ~hba->outstanding_reqs,
- "completed: %#lx; outstanding: %#lx\n", completed_reqs,
- hba->outstanding_reqs);
if (queue_num == UFSHCD_POLL_FROM_INTERRUPT_CONTEXT) {
/* Do not complete polled requests from interrupt context. */
ufshcd_clear_polled(hba, &completed_reqs);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 736/869] scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (734 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 735/869] scsi: ufs: core: Remove an always-false WARN_ONCE() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:56 ` [PATCH 6.18 737/869] compat: avoid double rounding in times() Greg Kroah-Hartman
` (140 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Jhu, Peter Wang, Bean Huo,
Bart Van Assche, Martin K. Petersen (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Jhu <stanleyjhu@google.com>
[ Upstream commit 7cfdfdd6557906fd09cf0a9a564a07012e7fb0c1 ]
In SDB mode, a command that times out right as the controller finishes it
can be completed twice:
1. The command times out and scsi_timeout() schedules ufshcd_abort().
2. The controller finishes the command and clears its doorbell bit in
REG_UTP_TRANSFER_REQ_DOOR_BELL, while the completion handler has not
yet cleared BIT(tag) in hba->outstanding_reqs.
3. ufshcd_abort() sees the doorbell bit clear and calls
__ufshcd_transfer_req_compl() without clearing BIT(tag) in
hba->outstanding_reqs.
4. The normal completion handler or the logical unit reset that follows
sees BIT(tag) still set in hba->outstanding_reqs and completes the same
command a second time.
This branch only exists for a rare corner case, a completion interrupt that
is lost or arrives late. Remove it to simplify the abort path and leave
such a command to the SCSI error handler, like any other command that
cannot be aborted. The cost is a slower recovery in this corner case, which
is acceptable since it only happens after a timeout.
Fixes: 169f5eb28869 ("scsi: ufs: Optimize SCSI command processing")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/fdb5c391-01ef-4a23-94c2-4f3853909348@acm.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261022034443.3034432-6-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index b3dbfd3552dc4..97f86b6905b56 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -7777,15 +7777,6 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
}
hba->req_abort_count++;
- if (!hba->mcq_enabled && !(reg & (1 << tag))) {
- /* only execute this code in single doorbell mode */
- dev_err(hba->dev,
- "%s: cmd was completed, but without a notifying intr, tag = %d",
- __func__, tag);
- __ufshcd_transfer_req_compl(hba, 1UL << tag);
- goto release;
- }
-
/*
* Task abort to the device W-LUN is illegal. When this command
* will fail, due to spec violation, scsi err handling next step
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 737/869] compat: avoid double rounding in times()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (735 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 736/869] scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort() Greg Kroah-Hartman
@ 2026-11-07 13:56 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 738/869] stackdepot: stop preallocating after the final pool Greg Kroah-Hartman
` (139 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hungyu Lin, Andrew Morton,
Arnd Bergmann, Thomas Gleixner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hungyu Lin <dennylin0707@gmail.com>
[ Upstream commit 6b30c39a5e333cfb1475acf0f73de6ef954eea8a ]
do_sys_times() already converts CPU time to USER_HZ ticks. The compat
path converts each value back to jiffies before converting it to
COMPAT_USER_HZ. This round trip can lose precision even when the two
userspace rates match.
With HZ=250 and USER_HZ=COMPAT_USER_HZ=100, one user tick becomes two
jiffies and then zero compat ticks. Every odd tick count loses one tick,
so any of the four tms fields can underreport CPU time by an additional 10
ms.
Return the value directly when the native and compat units match. Keep
the existing conversion for differing rates.
Link: https://lore.kernel.org/20261020210157.52057-1-dennylin0707@gmail.com
Fixes: f06febc96ba8 ("timers: fix itimer/many thread hang")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sys.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/sys.c b/kernel/sys.c
index c8376d7a0741b..bc89bd1331119 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1077,6 +1077,9 @@ SYSCALL_DEFINE1(times, struct tms __user *, tbuf)
#ifdef CONFIG_COMPAT
static compat_clock_t clock_t_to_compat_clock_t(clock_t x)
{
+ if (USER_HZ == COMPAT_USER_HZ)
+ return x;
+
return compat_jiffies_to_clock_t(clock_t_to_jiffies(x));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 738/869] stackdepot: stop preallocating after the final pool
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (736 preceding siblings ...)
2026-11-07 13:56 ` [PATCH 6.18 737/869] compat: avoid double rounding in times() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 739/869] ocfs2: snapshot the dentry name while tracing file release Greg Kroah-Hartman
` (138 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Caleb Kan, Matt Fleming,
Andrew Morton, Marco Elver, Andrey Konovalov, Mikhail Gavrilov,
Caleb Kan, Alexander Potapenko, Dmitry Vyukov, Vlastimil Babka,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Kan <ckan@cloudflare.com>
[ Upstream commit 8f56ea8e0706d92774603260779c7032f03ef3ac ]
depot_init_pool() decides whether another pool is needed before it
increments pools_num. When it registers the last allowed pool, pools_num
is still one below stack_max_pools, so the existing comparison clears
new_pool.
With new_pool cleared, stack_depot_save_flags() can allocate another
order-2 pool after a lookup miss. depot_keep_new_pool() retains its pointer
in the global new_pool, so the allocation is not lost. However, pools_num
has already reached stack_max_pools, and depot_init_pool() rejects every
attempt to register the pool. It remains allocated and unusable until
reboot. The non-NULL pointer prevents later saves from allocating more
spare pools.
Account for the pool being registered in the limit check so registering
the final pool installs STACK_DEPOT_POISON and prevents the extra
allocation.
Link: https://lore.kernel.org/20261022083330.3159793-1-matt@readmodwrite.com
Fixes: 31639fd6cebd ("stackdepot: use variable size records for non-evictable entries")
Signed-off-by: Caleb Kan <ckan@cloudflare.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc: Caleb Kan <calebkan1106@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/stackdepot.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index de0b0025af2b9..b20f4db5c83f6 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -322,7 +322,7 @@ static bool depot_init_pool(void **prealloc)
* NULL; do not reset to NULL if we have reached the maximum number of
* pools.
*/
- if (pools_num < stack_max_pools)
+ if (pools_num + 1 < stack_max_pools)
WRITE_ONCE(new_pool, NULL);
else
WRITE_ONCE(new_pool, STACK_DEPOT_POISON);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 739/869] ocfs2: snapshot the dentry name while tracing file release
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (737 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 738/869] stackdepot: stop preallocating after the final pool Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 740/869] ocfs2/cluster: remove zero-address nodes from IP tree on teardown Greg Kroah-Hartman
` (137 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Jia-Ju Bai, jjzuming,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 5898987d4a92b70ae73fd8355cc3a388b4dfa4e6 ]
ocfs2_file_release() passes the live dentry name and length to a trace
event while holding oi->ip_lock. This lock protects the open count and
delays RCU reclamation of external names, but it does not serialize name
changes during rename. The dentry can switch between inline and external
names, and a separately loaded length can describe a different name.
The ocfs2__file_ops event sizes and copies its __string separately.
A concurrently rewritten inline name need not remain consistent between
those operations. External names can also be selected at this call site;
the existing spinlock critical section protects their allocation lifetime,
while a snapshot additionally pairs a stable name with its length.
Take a name snapshot before acquiring oi->ip_lock and release it after
dropping the lock. Keep the trace call and open-count argument inside
the original critical section. Cache the event-enabled check so the
snapshot stays paired even if tracing is toggled meanwhile.
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-2@gmail.com
Fixes: 468eedde23d6 ("ocfs2: Remove mlog(0) from fs/ocfs2/file.c")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/file.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index a0df92a23498a..f4c36ce1678d0 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -140,18 +140,26 @@ static int ocfs2_file_open(struct inode *inode, struct file *file)
static int ocfs2_file_release(struct inode *inode, struct file *file)
{
struct ocfs2_inode_info *oi = OCFS2_I(inode);
+ struct dentry *dentry = file->f_path.dentry;
+ struct name_snapshot name;
+ bool trace_enabled = trace_ocfs2_file_release_enabled();
+
+ if (trace_enabled)
+ take_dentry_name_snapshot(&name, dentry);
spin_lock(&oi->ip_lock);
if (!--oi->ip_open_count)
oi->ip_flags &= ~OCFS2_INODE_OPEN_DIRECT;
- trace_ocfs2_file_release(inode, file, file->f_path.dentry,
- oi->ip_blkno,
- file->f_path.dentry->d_name.len,
- file->f_path.dentry->d_name.name,
- oi->ip_open_count);
+ if (trace_enabled)
+ trace_ocfs2_file_release(inode, file, dentry,
+ oi->ip_blkno, name.name.len,
+ name.name.name, oi->ip_open_count);
spin_unlock(&oi->ip_lock);
+ if (trace_enabled)
+ release_dentry_name_snapshot(&name);
+
ocfs2_free_file_private(inode, file);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 740/869] ocfs2/cluster: remove zero-address nodes from IP tree on teardown
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (738 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 739/869] ocfs2: snapshot the dentry name while tracing file release Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 741/869] mm/hugetlb: dont clear the resv_map of a VMA whose lock is held Greg Kroah-Hartman
` (136 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Andrew Morton, Joseph Qi,
Mark Fasheh, Joel Becker, Heming Zhao, Jia-Ju Bai, jjzuming,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 5dd57e77eff4ba3e85b3df126a55417c88245708 ]
o2nm_node_ipv4_address_store() accepts 0.0.0.0. It sets
O2NM_NODE_ATTR_ADDRESS and links nd_ip_node into cl_node_ip_tree under
cl_nodes_lock, but o2nm_node_group_drop_item() uses nd_ipv4_address as a
membership test. A zero address therefore leaves the rbtree node linked
when config_item_put() releases and frees struct o2nm_node. A later
address store or IP lookup can then walk the stale node and dereference
freed memory.
During teardown, drop_item takes cl_nodes_lock, skips rb_erase()
for the zero key, and then calls config_item_put(). A later
o2nm_node_ipv4_address_store() duplicate check or o2nm_get_node_by_ip()
lookup takes the same lock and walks the stale cl_node_ip_tree entry. Use
O2NM_NODE_ATTR_ADDRESS for teardown so every published nd_ip_node is
erased before configfs can release the node, without rejecting 0.0.0.0
or changing lookup semantics.
Link: https://lore.kernel.org/pm-ocfs2-node-ip-rbtree-zero-address-uaf-v5-e7f64be16b7c3b0988d1@gmail.com
Fixes: 0c83ed8eeb28 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/nodemanager.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index 87aeb1a7a90ae..bfc7c0fb2be05 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -626,8 +626,11 @@ static void o2nm_node_group_drop_item(struct config_group *group,
write_lock(&cluster->cl_nodes_lock);
- /* XXX sloppy */
- if (node->nd_ipv4_address)
+ /*
+ * 0.0.0.0 is a valid configured address, so nd_ipv4_address does
+ * not tell us whether nd_ip_node was published in the IP tree.
+ */
+ if (test_bit(O2NM_NODE_ATTR_ADDRESS, &node->nd_set_attributes))
rb_erase(&node->nd_ip_node, &cluster->cl_node_ip_tree);
/* nd_num might be 0 if the node number hasn't been set.. */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 741/869] mm/hugetlb: dont clear the resv_map of a VMA whose lock is held
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (739 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 740/869] ocfs2/cluster: remove zero-address nodes from IP tree on teardown Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 742/869] mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA Greg Kroah-Hartman
` (135 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, David Hildenbrand (Arm),
Andrew Morton, Chris Mason, Lorenzo Stoakes (ARM), Muchun Song,
Lance Yang, Liam R. Howlett, Vlastimil Babka, Jann Horn,
Pedro Falcato, Oscar Salvador, Miaohe Lin, Naoya Horiguchi,
Adam Litke, Mel Gorman, Rik van Riel, Peter Xu, Kiryl Shutsemau,
Mike Rapoport, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit d42032c0fe3ca007986c1229128775af0340fbec ]
Since commit bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private
VMAs") the lock of a private hugetlb VMA that owns a reservation is the
rw_sema of its resv_map. The hugetlb_vma_*lock*() helpers find it through
vma->vm_private_data, anew for every lock and every unlock.
At the end of mremap() the old VMA has to let go of the resv_map, which
now belongs to the new VMA: clear_vma_resv_huge_pages() stores NULL into
vm_private_data. mremap() holds mmap_lock for writing and has write
locked the VMA, which keeps away everybody who comes through the mm. It
does not keep away those who find the VMA through the file. For hole
punch and truncation hugetlb_vmdelete_list() does
hugetlb_vma_trylock_write(vma); locks resv_map->rw_sema
unmap_hugepage_range(vma, ...);
vm_private_data = NULL
hugetlb_vma_unlock_write(vma); no resv_map: does nothing
and the rw_sema stays write locked for ever:
WARNING: lock held when returning to user space!
mremap_punch/116 is leaving the kernel with locks still held!
locks held by mremap_punch/116: 1, last CPU#1:
#0: (&resv_map->rw_sema){+.+.}-{4:4}, at:
hugetlb_vmdelete_list+0x46/0x160
The next fault in the new VMA sleeps in hugetlb_vma_lock_read(),
uninterruptibly, and it holds its entry of hugetlb_fault_mutex_table[].
That table is global, so a fault of any other process on a page that
hashes to the same entry sleeps uninterruptibly as well.
All those who take the lock of a private VMA without taking the mmap/vma
lock are affected: rmap walks. So hold i_mmap_rwsem around the clearing
of the resv_map.
No change of behaviour, other than that mremap() of a hugetlb VMA takes
i_mmap_rwsem once more.
Original fix generated by an LLM and sent in private by Josef.
[david: avoid local variable, move and refine comment, description cleanups+simplifications]
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-5-42796911043b@kernel.org
Fixes: bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chris Mason <mason@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 8832923dfbcd8..ed4fb48cb35b8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -8054,6 +8054,15 @@ void hugetlb_unshare_all_pmds(struct vm_area_struct *vma)
*/
void fixup_hugetlb_reservations(struct vm_area_struct *vma)
{
- if (is_vm_hugetlb_page(vma))
- clear_vma_resv_huge_pages(vma);
+ if (!is_vm_hugetlb_page(vma))
+ return;
+
+ /*
+ * Rmap walks might still find this VMA and take the lock
+ * inside the reservation map for __vma_private_lock(). Don't clear
+ * the reservation map while that is possible.
+ */
+ i_mmap_lock_write(vma->vm_file->f_mapping);
+ clear_vma_resv_huge_pages(vma);
+ i_mmap_unlock_write(vma->vm_file->f_mapping);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 742/869] mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (740 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 741/869] mm/hugetlb: dont clear the resv_map of a VMA whose lock is held Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 743/869] mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat Greg Kroah-Hartman
` (134 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Andrew Morton, Lorenzo Stoakes (ARM), Muchun Song, Lance Yang,
Liam R. Howlett, Vlastimil Babka, Jann Horn, Pedro Falcato,
Oscar Salvador, Miaohe Lin, Naoya Horiguchi, Adam Litke,
Mel Gorman, Rik van Riel, Peter Xu, Kiryl Shutsemau,
Mike Rapoport, Josef Bacik, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Arm) <david@kernel.org>
[ Upstream commit cc078ca0b5b79b4a9e514b7f1b489f2afc83b195 ]
In case we fail to move the page tables, for example, because we fail
to allocate a page table, we actually keep the old VMA.
Calling fixup_hugetlb_reservations() on the old VMA is wrong. Fix it
by just calling it on the VMA that will be removed.
The user-visible impact is that the VMA loses its reservations, meaning
that the existing reservations get stranded (leaked) and new hugetlb folios
that are getting allocated in the VMA cannot make use of the
reservations, failing these allocations.
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-10-42796911043b@kernel.org
Fixes: b714ccb02a76 ("mm/mremap: complete refactor of move_vma()")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mremap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/mremap.c b/mm/mremap.c
index f0e63d3b3c148..f023b05dfb3d9 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1245,7 +1245,7 @@ static int copy_vma_and_data(struct vma_remap_struct *vrm,
mremap_userfaultfd_prep(new_vma, vrm->uf);
}
- fixup_hugetlb_reservations(vma);
+ fixup_hugetlb_reservations(vrm->vma);
*new_vma_ptr = new_vma;
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 743/869] mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (741 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 742/869] mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 744/869] mm: disallow ioremaping ordinary RAM in generic_access_phys() Greg Kroah-Hartman
` (133 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongfu Li, Andrew Morton,
Joshua Hahn, Muchun Song, Oscar Salvador, David Hildenbrand,
Shakeel Butt, Michal Hocko, Johannes Weiner, Nhat Pham,
Michal Hocko, Roman Gushchin, Chris Down, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongfu Li <lihongfu@kylinos.cn>
[ Upstream commit 92635a3ffe8bb48304f50625dd591a27d7505698 ]
Patch series "mm: fix hugetlb NR_HUGETLB accounting on folio migration", v2.
The hugeTLB counters added by 05d4532b60e3 ("memcg/hugetlb: add hugeTLB
counters to memcg") are maintained in two per-node places:
- the per-node vmstat counter NR_HUGETLB, exposed as nr_hugetlb in
/proc/vmstat;
- the per-node memcg lruvec stat, exposed via memory.numa_stat.
Both are accounted against the folio's node, and both drift when a hugetlb
folio is migrated, though in different ways.
A migration target folio is allocated by alloc_hugetlb_folio_nodemask()
and inherits the old folio's state without ever being accounted, while the
old folio is freed right after and its free is accounted. That alone
loses vmstat accounting: the target node has no matching increment for the
decrement on the old node, so /proc/vmstat's nr_hugetlb shrinks by
nr_pages per migration. Patch 1 accounts the folio where it is obtained,
so the increment pairs with the free in free_huge_folio() on the
successful as well as the failed migration path. The memfd page cache
preallocation helper has the same asymmetry and is fixed in the same
patch.
The per-node lruvec stat breaks differently. mem_cgroup_migrate() moves
the charge to the new folio and drops the old folio's memcg data, so the
old folio's free right after migration skips the memcg per-node decrement;
the count stays attributed to the old node for the rest of the charge's
life, and the target folio never gets an increment on its new node. Patch
2 moves that per-node accounting along with the charge, in
move_hugetlb_state().
This patch (of 2):
The NR_HUGETLB vmstat counter is maintained per folio's node: incremented
when a huge page is handed to a user via hugetlb_alloc_folio() and
decremented when it is returned to the pool via free_huge_folio().
A folio obtained by alloc_hugetlb_folio_nodemask() never goes through
hugetlb_alloc_folio(), so it is never accounted, while its free always is.
For a migration target this means the target node gets no matching
increment for the decrement on the old node, so the global nr_hugetlb in
/proc/vmstat drops by nr_pages for each migration. The same asymmetry
affects the failed migration path, which frees the target again right
away, and the temporary folio hugetlb_mfill_atomic_pte() takes from the
same helper.
alloc_hugetlb_folio_reserve(), used to preallocate the memfd page cache
folios, has the same asymmetry: the folio is handed to a user without
being accounted, while its free is accounted through free_huge_folio().
Account the folio where it is obtained, in alloc_hugetlb_folio_nodemask()
and alloc_hugetlb_folio_reserve(), so that the increment pairs with the
decrement in free_huge_folio(): a successful migration hands the folio to
a user, a failed one frees it again.
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-0-e8a36245bfab@kylinos.cn
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-1-e8a36245bfab@kylinos.cn
Fixes: 05d4532b60e3 ("memcg/hugetlb: add hugeTLB counters to memcg")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 35 +++++++++++++++++++++++------------
1 file changed, 23 insertions(+), 12 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ed4fb48cb35b8..42aace6e3ca17 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2353,6 +2353,11 @@ struct folio *alloc_hugetlb_folio_reserve(struct hstate *h, int preferred_nid,
h->resv_huge_pages--;
spin_unlock_irq(&hugetlb_lock);
+
+ if (folio)
+ lruvec_stat_mod_folio(folio, NR_HUGETLB,
+ folio_nr_pages(folio));
+
return folio;
}
@@ -2360,24 +2365,30 @@ struct folio *alloc_hugetlb_folio_reserve(struct hstate *h, int preferred_nid,
struct folio *alloc_hugetlb_folio_nodemask(struct hstate *h, int preferred_nid,
nodemask_t *nmask, gfp_t gfp_mask, bool allow_alloc_fallback)
{
- spin_lock_irq(&hugetlb_lock);
- if (available_huge_pages(h)) {
- struct folio *folio;
+ struct folio *folio = NULL;
+ spin_lock_irq(&hugetlb_lock);
+ if (available_huge_pages(h))
folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask,
preferred_nid, nmask);
- if (folio) {
- spin_unlock_irq(&hugetlb_lock);
- return folio;
- }
- }
spin_unlock_irq(&hugetlb_lock);
- /* We cannot fallback to other nodes, as we could break the per-node pool. */
- if (!allow_alloc_fallback)
- gfp_mask |= __GFP_THISNODE;
+ if (!folio) {
+ /*
+ * We cannot fallback to other nodes, as we could break the
+ * per-node pool.
+ */
+ if (!allow_alloc_fallback)
+ gfp_mask |= __GFP_THISNODE;
- return alloc_migrate_hugetlb_folio(h, gfp_mask, preferred_nid, nmask);
+ folio = alloc_migrate_hugetlb_folio(h, gfp_mask, preferred_nid,
+ nmask);
+ }
+
+ if (folio)
+ lruvec_stat_mod_folio(folio, NR_HUGETLB, folio_nr_pages(folio));
+
+ return folio;
}
static nodemask_t *policy_mbind_nodemask(gfp_t gfp)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 744/869] mm: disallow ioremaping ordinary RAM in generic_access_phys()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (742 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 743/869] mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 745/869] mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range() Greg Kroah-Hartman
` (132 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Andrew Morton, syzbot+49b1021becba70c1f3f6, Nguyen Ngoc Thang,
Lorenzo Stoakes (ARM), Mike Rapoport (Microsoft), Lance Yang,
Liam R. Howlett, Vlastimil Babka, Suren Baghdasaryan,
Michal Hocko, Benjamin Herrenschmidt, Peter Zijlstra,
Rik van Riel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Arm) <david@kernel.org>
[ Upstream commit 4590752e20aa393cc0d4fe538c0747d14a98c97a ]
generic_access_phys() can end up getting called on CoW PFNMAP mappings,
resulting in it trying to ioremap anonymous folios, which especially
the x86 code doesn't enjoy, and which is in general just odd/wrong.
E.g., with a CoW mapping of a PCI BAR:
ioremap on RAM at 0x0000000045623000 - 0x0000000045623fff
WARNING: arch/x86/mm/ioremap.c:216 at __ioremap_caller.isra.0+0x4c2/0x5f0
Call Trace:
generic_access_phys+0x130/0x4d0 mm/memory.c:7178
kernfs_vma_access+0x1ce/0x280 fs/kernfs/file.c:437
__access_remote_vm+0x58f/0x890 mm/memory.c:7256
mem_rw+0x2a1/0x670 fs/proc/base.c:912
But more generically, we should disallow access to anything that looks
like ordinary RAM in the system: including allocating memory (e.g.,
alloc_pages) and mapping them in a VM_PFNMAP.
For pages with an online memmap, allow only pages marked as reserved
(PageReserved). This also includes memblock allocations, however,
distinguishing them from other MMIO is tricky, and nobody should really
be mapping them in a PFNMAP (except someone abusing /dev/mem, which we
do not care about).
So only allow access if there is no online memmap, or if the pages are
marked reserved. Reject other pages with -EINVAL.
Note that, just like other pfn_to_online_page() users, we won't care about
concurrent memory offlining; mapping memory that can concurrently get
offlined is highly dubious.
Link: https://lore.kernel.org/20261013-generic_access_phys-v1-1-b3963ef76e37@kernel.org
Fixes: 28b2ee20c7cb ("access_process_vm device memory infrastructure")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <syzbot+49b1021becba70c1f3f6@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=49b1021becba70c1f3f6
Reported-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Closes: https://lore.kernel.org/r/20261001152524.171115-1-ngocthang2710.1999@gmail.com/
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Rik van Riel <riel@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memory.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/mm/memory.c b/mm/memory.c
index d755b5c1f1287..01d14ca0e74d2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6808,6 +6808,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
resource_size_t phys_addr;
pgprot_t prot = __pgprot(0);
void __iomem *maddr;
+ struct page *page;
int offset = offset_in_page(addr);
int ret = -EINVAL;
bool writable;
@@ -6822,6 +6823,19 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
retry:
if (follow_pfnmap_start(&args))
return -EINVAL;
+
+ /*
+ * Reject anything that looks like ordinary RAM, including anonymous
+ * folios in CoW mappings or allocated kernel memory. Note that we
+ * cannot distinguish memblock allocations from non-RAM reliably, so
+ * we cannot easily reject them here.
+ */
+ page = pfn_to_online_page(args.pfn);
+ if (page && !PageReserved(page)) {
+ follow_pfnmap_end(&args);
+ return -EINVAL;
+ }
+
prot = args.pgprot;
phys_addr = (resource_size_t)args.pfn << PAGE_SHIFT;
writable = args.writable;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 745/869] mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (743 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 744/869] mm: disallow ioremaping ordinary RAM in generic_access_phys() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 746/869] mm/mlock: use a long for the page count in mlock_fixup() Greg Kroah-Hartman
` (131 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Andrew Morton,
Gregory Price (Meta), David Hildenbrand (Arm),
Lorenzo Stoakes (ARM), Liam R. Howlett, Vlastimil Babka,
Jann Horn, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <albinwyang@tencent.com>
[ Upstream commit f5cfc8e3b20ad71949a1e5623ff45882c063a71b ]
During stress testing with stress-ng on a 256-CPU system, a softlockup was
observed when madvise(MADV_COLD) was called on a 31GB memory region backed
by transparent hugepages. The region contains 15935 THP PMD entries, and
the softlockup was triggered after 14485 of them had been processed.
The THP branch of madvise_cold_or_pageout_pte_range() has no scheduling
point. walk_pmd_range() invokes it once per 2MB PMD entry with no
cond_resched() anywhere in the loop. Each iteration calls
pmdp_invalidate() which issues a synchronous TLB shootdown (dsb ish)
waiting for all CPUs to acknowledge. This operation can be time-consuming
under heavy system load, causing the accumulated time across all PMD
entries to exceed the softlockup threshold (20s) and panic when
softlockup_panic=1. On a CONFIG_PREEMPT_NONE=y kernel, there is no other
opportunity to reschedule during this entire traversal.
The regular PTE path already has an unconditional cond_resched() at the
function tail (introduced by commit 9c276cc65a58 ("mm: introduce
MADV_COLD") and commit 1a4e58cce84e ("mm: introduce MADV_PAGEOUT") when
MADV_COLD and MADV_PAGEOUT were first introduced) and a conditional one
inside the loop (commit b2f557a21bc8 ("mm/madvise: add cond_resched() in
madvise_cold_or_pageout_pte_range()")). The THP branch never received
equivalent treatment.
Fix by adding cond_resched() at the huge_unlock exit path after
spin_unlock(ptl) and reclaim_pages(), which is the single exit point for
all goto paths in the THP branch.
Crash log:
watchdog: BUG: soft lockup - CPU#63 stuck for 23s! [stress-ng-vm:1665914]
...
Call trace:
pmdp_invalidate+0x48/0x68
madvise_cold_or_pageout_pte_range+0x84c/0xb00
walk_pmd_range.isra.0+0x1ac/0x3b0
walk_pud_range+0x120/0x190
walk_pgd_range+0x170/0x1b8
__walk_page_range+0x184/0x198
walk_page_range_vma+0x94/0x128
madvise_cold+0xd8/0x198
madvise_vma_behavior+0x234/0x638
madvise_walk_vmas.constprop.0+0xdc/0x210
madvise_do_behavior+0xa8/0x328
do_madvise+0xd8/0x140
__arm64_sys_madvise+0x2c/0xe0
Link: https://lore.kernel.org/20261010024042.4070048-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/madvise.c b/mm/madvise.c
index 505a580cd9c4c..bb02220e1959b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -452,6 +452,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
spin_unlock(ptl);
if (pageout)
reclaim_pages(&folio_list);
+ cond_resched();
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 746/869] mm/mlock: use a long for the page count in mlock_fixup()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (744 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 745/869] mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 747/869] userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references Greg Kroah-Hartman
` (130 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Andrew Morton,
Pedro Falcato, Liam R. Howlett, Lorenzo Stoakes, Vlastimil Babka,
Jann Horn, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
[ Upstream commit 3ae91e3079b1504ef162b2884454d5f1421f4eb9 ]
mlock_fixup() adjusts mm->locked_vm, an unsigned long, by the number of
pages whose VM_LOCKED state it changes, but computes that number in an
int:
int nr_pages;
...
nr_pages = (end - start) >> PAGE_SHIFT;
...
mm->locked_vm += nr_pages;
When a single VMA range of 2^31 pages (8 TiB with 4 KiB pages) or more
is locked or unlocked, the count is truncated to 32 bits and then
sign-extended, so locked_vm is changed by the wrong amount, while
munmap(), mremap() and the other paths that maintain locked_vm use the
full unsigned long page count.
Such a range is reachable on 64-bit architectures with a 47-bit or
larger user address space (x86_64, arm64 with 48-bit VA, riscv64 Sv48)
by a task with CAP_IPC_LOCK or a raised RLIMIT_MEMLOCK, which do_mlock()
checks against the full untruncated length. It costs nothing with
MAP_NORESERVE and MLOCK_ONFAULT/MCL_ONFAULT, since then no page is
populated. On x86_64, after
p = mmap(NULL, 8UL << 40, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
mlock2(p, 8UL << 40, MLOCK_ONFAULT);
VmLck in /proc/self/status reads 18446744065119617024 kB instead of
8589934592 kB; munmap() of the region then subtracts the true size and
leaves VmLck at 18446744056529682432 kB instead of 0. With 16 TiB,
locked_vm is not changed at all, VmLck stays 0 kB, and after the task
drops CAP_IPC_LOCK or lowers RLIMIT_MEMLOCK, mlock(), mmap(MAP_LOCKED)
and the other mlock_future_ok() and account_locked_vm() users enforce
RLIMIT_MEMLOCK against that count, so they let the task lock memory
beyond its limit (or, in the 8 TiB case, refuse every further lock).
The error persists for the life of the mm; unlocking the range in pieces
skews it further. The wrong count is per-mm accounting only: it does
not change which pages are locked.
The int has been there since before git history (the variable was named
"pages" until it was renamed in 2.6.28); every other updater of
locked_vm uses an unsigned long or long count. Make nr_pages a long,
which holds the page count of any user range and its negation, so the
existing sign handling is unchanged.
Found by formal verification of mm/mlock.c against the kernel binary.
Link: https://lore.kernel.org/20261014131358.780240-1-nickolai@csail.mit.edu
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Assisted-by: LLM
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mlock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/mlock.c b/mm/mlock.c
index 31045f17766a7..20061dd281502 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -468,7 +468,7 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
unsigned long end, vm_flags_t newflags)
{
struct mm_struct *mm = vma->vm_mm;
- int nr_pages;
+ long nr_pages;
int ret = 0;
vm_flags_t oldflags = vma->vm_flags;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 747/869] userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (745 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 746/869] mm/mlock: use a long for the page count in mlock_fixup() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 748/869] mm/percpu: account full object size for percpu memory allocations Greg Kroah-Hartman
` (129 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang (Microsoft), Andrew Morton,
AutonomousCodeSecurity, David Hildenbrand (Arm), Mike Rapoport,
Peter Xu, Suren Baghdasaryan, Andrea Arcangeli, tgopinath,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
[ Upstream commit 454143aeb4c6c85ca7d50df36d1a66a64d88283e ]
To move one page out of a large folio, move_pages_ptes() first has to
split the folio. __folio_split() refuses if the folio has any reference
beyond its page table mappings and the caller's own, and it reports the
refusal as -EAGAIN. move_pages() treats returned -EAGAIN as a transient
race and keeps retrying the same address, holding the VMA read locks the
whole time. This is incorrect since in some cases userspace can hold such
a reference indefinitely, such as by registering the page as an io_uring
buffer.
An unprivileged user can trigger this with three threads: first holds such
a reference on a page of a THP, second calls UFFDIO_MOVE on another page
of the same THP and spins in the kernel forever holding the VMA read
locks, and third calls fork() or mprotect(), which takes mmap_lock for
writing and then waits forever for those read locks. From then on every
mmap_lock user of that mm hangs, including other processes inspecting it
through /proc/<pid>/, until the process is SIGKILLed. The hung task
detector reports the blocked tasks (third one), and with
kernel.hung_task_panic=1 the machine panics:
INFO: task wedge:95 blocked for more than 122 seconds.
task:wedge state:D stack:12528 pid:95 tgid:95 ppid:94
Call Trace:
__schedule+0x596/0x1110
schedule+0x36/0xf0
__vma_start_exclude_readers+0x100/0x170
__vma_start_write+0x51/0xd0
__split_vma+0x208/0x3d0
vma_modify+0x6a8/0x840
vma_modify_flags+0xce/0x110
mprotect_fixup+0xbe/0x480
do_mprotect_pkey+0x2d9/0x580
__x64_sys_mprotect+0x1a/0x30
Fix by returning -EBUSY instead of -EAGAIN in move_pages_ptes(), the
caller of split_folio(), when the split fails. Thus, move_pages() does
not retry -EBUSY and the ioctl drops its locks and returns to userspace
instead of spinning.
Link: https://lore.kernel.org/20261012201514.97015-1-cenzhang@linux.microsoft.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <AutonomousCodeSecurity@microsoft.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <tgopinath@linux.microsoft.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/userfaultfd.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 34798ce783e6c..579445bddf561 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1414,8 +1414,12 @@ static long move_pages_ptes(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd
pte_unmap(dst_pte);
src_pte = dst_pte = NULL;
ret = split_folio(src_folio);
- if (ret)
+ if (ret) {
+ /* do not retry, extra refs may be held forever */
+ if (ret == -EAGAIN)
+ ret = -EBUSY;
goto out;
+ }
/* have to reacquire the folio after it got split */
folio_unlock(src_folio);
folio_put(src_folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 748/869] mm/percpu: account full object size for percpu memory allocations
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (746 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 747/869] userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 749/869] mm/madvise: atomically clear the young bit on THP MADV_COLD Greg Kroah-Hartman
` (128 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Yoo (Meta), Andrew Morton,
Joshua Hahn, Dennis Zhou, Tejun Heo, Christoph Lameter,
Suren Baghdasaryan, Hao Ge, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo (Meta) <harry@kernel.org>
[ Upstream commit c7a467fbcbbc31e57a5077bfc9456d9f29cb1571 ]
When memory allocation profiling is enabled, the pages backing percpu
memory chunks are attributed to func:pcpu_alloc_pages. However, the
accounting of individual percpu memory allocations via alloc_percpu()
and friends record only the size of a single object rather than its
full size across all CPUs.
As a result, it is often not straightforward to identify which kernel code
is actually responsible for percpu memory, because the size is
under-accounted by a factor of num_possible_cpus().
Account full object size with pcpu_obj_full_size(size) instead, which
multiplies the object size by num_possible_cpus() and adds the objcg
pointer overhead. This is consistent with what memcg already does for
charging percpu allocations.
Verified with 64-CPU VM by spawning 400 processes in a memory cgroup and
measuring mm_init()'s rss_stat counters.
Delta of kernel/fork.c:1142 func:mm_init in /proc/allocinfo:
bytes calls per allocation
unpatched 6320 395 16
patched 418176 396 1056
'percpu' field in memory.stat: 422400 (1056 bytes per process)
Memory allocation profiling now accounts the same amount of memory as
what memcg charges.
Link: https://lore.kernel.org/20261013-fix-alloc-percpu-accounting-v1-1-03e788a1e41f@kernel.org
Fixes: 60fa4a9e2323 ("mm: percpu: add codetag reference into pcpuobj_ext")
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Assisted-by: LLM # Verification
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Hao Ge <hao.ge@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/percpu.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/mm/percpu.c b/mm/percpu.c
index 81462ce5866e1..32519523845b3 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1692,14 +1692,15 @@ static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
{
if (mem_alloc_profiling_enabled() && likely(chunk->obj_exts)) {
alloc_tag_add(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag,
- current->alloc_tag, size);
+ current->alloc_tag, pcpu_obj_full_size(size));
}
}
static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
{
if (mem_alloc_profiling_enabled() && likely(chunk->obj_exts))
- alloc_tag_sub(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag, size);
+ alloc_tag_sub(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag,
+ pcpu_obj_full_size(size));
}
#else
static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 749/869] mm/madvise: atomically clear the young bit on THP MADV_COLD
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (747 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 748/869] mm/percpu: account full object size for percpu memory allocations Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 750/869] ipc/shm: fix RSS accounting for hugetlb shared memory Greg Kroah-Hartman
` (127 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Falcato, Andrew Morton,
Samarth Narang, Gregory Price (Meta), Zi Yan,
Lorenzo Stoakes (ARM), David Hildenbrand (Arm), SJ Park,
Liam R. Howlett, Vlastimil Babka, Jann Horn, Minchan Kim,
Michal Hocko, Johannes Weiner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <pfalcato@suse.de>
[ Upstream commit 246c8cc33438a71c28f9b86baa492d9a0a130316 ]
As-is, madvise_cold_or_pageout_pte_range() discards the hardware young bit
by invalidating the PMD, doing pmd_mkold() and subsequently writing to the
pmd again. However, it does so in a racy manner, looking at a
possibly-stale snapshot. It's entirely possible that a write elsewhere
set the hardware D bit, which this logic now loses.
Fix it by using pmdp_test_and_clear_young(). This is an atomic
modification of the PMD entry, and thus safe against any possible racing
writes. As a (nice) side-effect, this elides one non-required TLB flush
in pmdp_invalidate().
This bug can interact with the swapping system in complicated ways,
leading to data loss. For instance, if a folio is marked lazyfree, but
was later read from, and then MADV_COLD'd while racing a write to that
same THP, dropping the dirty bit may lead to data loss as
reclaim/MADV_PAGEOUT drops the "clean" anon folio:
T0 T1
================================================================
MADV_FREE(thp) |
folio marked lazyfree |
read(thp) |
PMD marked young by hardware |
| MADV_COLD(thp)
write(thp) | if (pmd_young(pmd)) {
PMD marked dirty by hardware | set(pmdp, pmd_mkold(pmd));
MADV_PAGEOUT/reclaim |
dirty bit may or may not be |
set |
reclaim/pageout may drop |
the folio |
Link: https://lore.kernel.org/20261013191719.95502-1-pfalcato@suse.de
Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Samarth Narang <samarth.colleges@gmail.com>
Closes: https://lore.kernel.org/linux-mm/20261011132227.413217-1-samarth.colleges@gmail.com/
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index bb02220e1959b..729d8f2f07fd8 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -428,10 +428,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
}
if (!pageout && pmd_young(orig_pmd)) {
- pmdp_invalidate(vma, addr, pmd);
- orig_pmd = pmd_mkold(orig_pmd);
-
- set_pmd_at(mm, addr, pmd, orig_pmd);
+ pmdp_test_and_clear_young(vma, addr, pmd);
tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 750/869] ipc/shm: fix RSS accounting for hugetlb shared memory
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (748 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 749/869] mm/madvise: atomically clear the young bit on THP MADV_COLD Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 751/869] mm: vmscan: dont count per-node proactive reclaim as memory pressure Greg Kroah-Hartman
` (126 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weilin Tong, Andrew Morton,
Muchun Song, Oscar Salvador, David Hildenbrand, Sidhartha Kumar,
Lorenzo Stoakes, Dan Carpenter, Baolin Wang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weilin Tong <tongweilin@linux.alibaba.com>
[ Upstream commit e387ebe5cd31720b1e0281fd045be4eef36fadb3 ]
Commit a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in
filemap.c") changed mapping->nrpages to count base pages for hugetlb
folios. However, shm_add_rss_swap() still multiplies it by
pages_per_huge_page(), overcounting RSS in both SHM_INFO and
/proc/sysvipc/shm.
Use mapping->nrpages for RSS accounting across all backing types, and
account swap only for non-hugetlb shmem. Use READ_ONCE() for both
counters instead of info->lock, which does not protect nrpages and cannot
provide a consistent snapshot.
Link: https://lore.kernel.org/20261014082218.2236088-1-tongweilin@linux.alibaba.com
Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
Signed-off-by: Weilin Tong <tongweilin@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
ipc/shm.c | 23 ++++-------------------
1 file changed, 4 insertions(+), 19 deletions(-)
diff --git a/ipc/shm.c b/ipc/shm.c
index c77a6c8683ce9..2f5cee0c78c7d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -936,26 +936,11 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
static void shm_add_rss_swap(struct shmid_kernel *shp,
unsigned long *rss_add, unsigned long *swp_add)
{
- struct inode *inode;
+ struct inode *inode = file_inode(shp->shm_file);
- inode = file_inode(shp->shm_file);
-
- if (is_file_hugepages(shp->shm_file)) {
- struct address_space *mapping = inode->i_mapping;
- struct hstate *h = hstate_file(shp->shm_file);
- *rss_add += pages_per_huge_page(h) * mapping->nrpages;
- } else {
-#ifdef CONFIG_SHMEM
- struct shmem_inode_info *info = SHMEM_I(inode);
-
- spin_lock_irq(&info->lock);
- *rss_add += inode->i_mapping->nrpages;
- *swp_add += info->swapped;
- spin_unlock_irq(&info->lock);
-#else
- *rss_add += inode->i_mapping->nrpages;
-#endif
- }
+ *rss_add += READ_ONCE(inode->i_mapping->nrpages);
+ if (IS_ENABLED(CONFIG_SHMEM) && !is_file_hugepages(shp->shm_file))
+ *swp_add += READ_ONCE(SHMEM_I(inode)->swapped);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 751/869] mm: vmscan: dont count per-node proactive reclaim as memory pressure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (749 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 750/869] ipc/shm: fix RSS accounting for hugetlb shared memory Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 752/869] mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache Greg Kroah-Hartman
` (125 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vernon Yang, Andrew Morton,
Baolin Wang, Barry Song, Ridong Chen, Davidlohr Bueso,
David Hildenbrand, Kairui Song, Qi Zheng, Shakeel Butt,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Baoquan He, Johannes Weiner,
Michal Hocko, Lorenzo Stoakes, Roman Gushchin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vernon Yang <yanglincheng@kylinos.cn>
[ Upstream commit 2ca8b38962f239b17f7881a4710c11328ce38ac9 ]
When the cgroup has no memory pressure at all, writing to
/sys/devices/system/nodeX/reclaim triggers proactive reclaim on
NUMA node, causing increase in the writer cgroup's memory PSI.
Due to this reclaim is performed in the context of the write(),
accounted as memory pressure on the writer, like
commit e22c6ed90aa9 ("mm: memcontrol: don't count limit-setting reclaim
as memory pressure"). This is unexpected, the similar scenarios (e.g.
senpai) will continue to occur, only this time it is for the
/sys/devices/system/nodeX/reclaim knob.
The Documentation/ABI/stable/sysfs-devices-node documentation also
notes that "This interface is equivalent to the memcg variant."
This patch unifies the semantics of the memcg and node interfaces:
per-node proactive reclaim is no longer counted as memory pressure,
and the per-node proactive reclaim interface no longer produces
phantom pressure.
I ran demo[1] that performs per-node proactive reclaim 10000 times
in qemu, writer cgroup memory.pressure as follows:
without patch:
some avg10=31.53 avg60=13.42 avg300=3.31 total=10602985
full avg10=31.53 avg60=13.42 avg300=3.31 total=10602985
with patch:
some avg10=9.59 avg60=3.41 avg300=0.81 total=2686221
full avg10=9.59 avg60=3.41 avg300=0.81 total=2686221
Link: https://lore.kernel.org/20261012022917.1102467-1-vernon2gm@gmail.com
Link: https://github.com/vernon2gh/app_and_module/tree/main/reclaim_node_psi [1]
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmscan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c983815bde5bf..6d53f83e9dbcf 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -7642,7 +7642,8 @@ static unsigned long __node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask,
sc->gfp_mask);
cond_resched();
- psi_memstall_enter(&pflags);
+ if (!sc->proactive)
+ psi_memstall_enter(&pflags);
delayacct_freepages_start();
fs_reclaim_acquire(sc->gfp_mask);
/*
@@ -7666,7 +7667,8 @@ static unsigned long __node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask,
memalloc_noreclaim_restore(noreclaim_flag);
fs_reclaim_release(sc->gfp_mask);
delayacct_freepages_end();
- psi_memstall_leave(&pflags);
+ if (!sc->proactive)
+ psi_memstall_leave(&pflags);
trace_mm_vmscan_node_reclaim_end(sc->nr_reclaimed);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 752/869] mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (750 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 751/869] mm: vmscan: dont count per-node proactive reclaim as memory pressure Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 753/869] mm/page_alloc: count guard pages as free again when their buddy merges Greg Kroah-Hartman
` (124 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Andrew Morton,
Kairui Song, Chris Li, Kemeng Shi, Nhat Pham, Baoquan He,
Barry Song, Youngjun Park, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 60f34fedf3a4c91ed631ed2f80713ab993cde5ee ]
swap_cache_get_folio() reads the folio from the swap table and takes a
reference with folio_try_get(), without any lock. If the folio is removed
from the swap cache and freed in between, and its memory gets reused,
folio_try_get() still succeeds and we return a page that has nothing to do
with the swap entry:
CPU 0 CPU 1
do_swap_page()
swap_cache_get_folio()
swp_tb = swap_table_get()
folio = swp_tb_to_folio(swp_tb)
madvise(MADV_DONTNEED)
zap_nonpresent_ptes()
swap_put_entries_direct()
swap_put_entries_cluster()
__try_to_reclaim_swap()
swap_cache_del_folio()
folio_put() <- freed
page reused, e.g. as an anon
folio of another task
folio_try_get(folio) <- succeeds
return folio
swap_update_readahead() <- may clear PG_readahead on it
folio_lock_or_retry() <- locks it
folio_matches_swap_entry() fails, unlock and put
filemap_get_entry() does the same lockless lookup for the page cache, and
after folio_try_get() it rechecks the xarray, because the folio may have
been freed and reused in between. swap_cache_get_folio() lost that
recheck when the swap cache moved to the swap table.
So CPU 0 writes to a folio it doesn't own: it may clear PG_readahead and
takes the folio lock of someone else's page, before
folio_matches_swap_entry() finds out the folio is not ours.
When the race occurs, a swap fault can acquire a reference to a
physical page that has been freed and reused for an unrelated purpose,
potentially by another process. The fault handler may then clear that
page's PG_readahead/PG_reclaim flag, wait on or acquire its folio lock,
and potentially attempt to remove it from an unrelated swap cache.
These operations can interfere with unrelated workloads and may cause
unexpected stalls and impaired reclaim. The subsequent swap-entry
validation normally prevents the wrong folio from being mapped into the
faulting process.
It's documented that caller always double checks the folio so this part
is harmless from the aspect of data corruption or crash.
Recheck the slot after folio_try_get() and retry if it no longer holds
this folio.
[akpm@linux-foundation.org: add LLM-generated description of userspace impact]
Link: https://lore.kernel.org/20261015060528.302634-1-jiayuan.chen@linux.dev
Fixes: 8578e0c00dcf ("mm, swap: use the swap table for the swap cache and switch API")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Kairui Song <kasong@tencent.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/swap_state.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/mm/swap_state.c b/mm/swap_state.c
index b8d7744b4436a..57cae6f6eac1e 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -86,17 +86,27 @@ void show_swap_cache_info(void)
*/
struct folio *swap_cache_get_folio(swp_entry_t entry)
{
+ struct swap_cluster_info *ci = __swap_entry_to_cluster(entry);
+ unsigned int ci_off = swp_cluster_offset(entry);
unsigned long swp_tb;
struct folio *folio;
for (;;) {
- swp_tb = swap_table_get(__swap_entry_to_cluster(entry),
- swp_cluster_offset(entry));
+ swp_tb = swap_table_get(ci, ci_off);
if (!swp_tb_is_folio(swp_tb))
return NULL;
folio = swp_tb_to_folio(swp_tb);
- if (likely(folio_try_get(folio)))
+ if (!folio_try_get(folio))
+ continue;
+ /*
+ * The folio may have been freed and its memory reused before
+ * we got the reference. Make sure it is still in the slot.
+ */
+ swp_tb = swap_table_get(ci, ci_off);
+ if (likely(swp_tb_is_folio(swp_tb) &&
+ swp_tb_to_folio(swp_tb) == folio))
return folio;
+ folio_put(folio);
}
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 753/869] mm/page_alloc: count guard pages as free again when their buddy merges
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (751 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 752/869] mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 754/869] mm/truncate: fix the zeroing end of pagecache_isize_extended() Greg Kroah-Hartman
` (123 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rik van Riel, Andrew Morton, Zi Yan,
Johannes Weiner, Dev Jain, Vlastimil Babka (SUSE),
Suren Baghdasaryan, Michal Hocko, Brendan Jackman, Kairui Song,
Qi Zheng, Shakeel Butt, Baoquan He, David Hildenbrand,
Lorenzo Stoakes, Frank van der Linden, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <riel@surriel.com>
[ Upstream commit 1503710b3b0cec02b531978129c6c1eb70a7c490 ]
With debug_guardpage_minorder set, expand() turns the unused halves of a
split into guard pages, which page_del_and_expand() leaves out of the free
counts. Freeing the allocated half credits only that half, and
__free_one_page() then merges the guard buddy with clear_page_guard(),
which no longer touches the counters.
The merged block goes on a free list with the guard pages never counted,
so NR_FREE_PAGES falls behind the free lists by every guard that merges.
Before commit e0932b6c1f94 ("mm: page_alloc: consolidate free page
accounting"), __set_page_guard() and __clear_page_guard() adjusted the
counts themselves; that commit dropped both adjustments but kept the
subtraction implicit in expand().
Count the guard pages under the merged block's migratetype when the buddy
is cleared. account_freepages() skips an isolated block as it does for
every other free page, and moving the block off the isolated list counts
it then.
Booting a 16GB VM with debug_pagealloc=on debug_guardpage_minorder=1,
check the difference in free pages reported between /proc/vmstat and
/proc/buddyinfo.
At three points (idle, after a read and file-creation load, after a second
load), check the difference between nr_free_pages and the buddyinfo
numbers in the normal zone, as a number of pages:
idle after load after second load
unpatched -130 79205 99121
patched -16 45 0
The small remaining difference seems to be due to the numbers not being
read at exactly the same time, and is also seen without guard pages.
Link: https://lore.kernel.org/20261016122304.5b1eba8e@fangorn
Fixes: e0932b6c1f94 ("mm: page_alloc: consolidate free page accounting")
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Assisted-by: LLM
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Frank van der Linden <fvdl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index b866357339c56..8bdc35efad26b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1027,10 +1027,12 @@ static inline void __free_one_page(struct page *page,
* Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page,
* merge with it and move up one order.
*/
- if (page_is_guard(buddy))
+ if (page_is_guard(buddy)) {
clear_page_guard(zone, buddy, order);
- else
+ account_freepages(zone, 1 << order, migratetype);
+ } else {
__del_page_from_free_list(buddy, zone, order, buddy_mt);
+ }
if (unlikely(buddy_mt != migratetype)) {
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 754/869] mm/truncate: fix the zeroing end of pagecache_isize_extended()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (752 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 753/869] mm/page_alloc: count guard pages as free again when their buddy merges Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 755/869] mm/mremap: populate calculated fields in vrm state correctly Greg Kroah-Hartman
` (122 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Andrew Morton,
Jan Kara, Baokun Li, Matthew Wilcox (Oracle), Brian Foster,
Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
[ Upstream commit 8f9039840588dd618c72a726c192126bb7b98228 ]
A process that extends a file by 4 GiB or more past a dirty folio, on a
file system whose block size is smaller than the page size (ext4 with 1k
blocks), reads back the bytes it wrote through a shared mapping beyond the
old end of file instead of zeroes, and a later write into that block
carries them to the disk. With the example of commit 52aecaee1c26 ("mm:
zero range of eof folio exposed by inode size extension") and the truncate
taken 4 GiB further (pwrite 2k at 0, mmap the first page and write 'X'
over [2k, 4k), truncate(2) to 4 GiB + 2k), the read of [2k, 4k) returns
the 2048 'X' bytes, and a pwrite of 16 bytes at 3k followed by fsync() and
a remount leaves 1008 'X' bytes on the disk in [3k+16, 4k). No privilege
is needed, and every size extension of 4 GiB or more reaches it:
truncate(2)/ftruncate(2) through truncate_setsize(), writes beyond the end
of file through generic_write_end(), ext4, iomap, btrfs, exfat, ntfs, afs
and orangefs. Affected since v6.13.
pagecache_isize_extended() zeroes the part of the dirty folio straddling
the old end of file that the size extension exposes, from the old size to
the new size or the end of the folio, whichever comes first:
end = min_t(unsigned int, to - folio_pos(folio), folio_size(folio));
min_t() converts both operands to unsigned int before comparing, so the
loff_t difference to - folio_pos(folio) is reduced modulo 2^32 first.
When the file grows by 4 GiB or more past the folio, end is that residue
instead of folio_size(folio): below offset nothing is zeroed, above it
only [offset, end) is. The bytes beyond the old end of file stay in the
dirty folio and, now inside i_size, are file data.
Compare in loff_t; the result is at most folio_size(folio) and fits end.
Found while formally verifying pagecache_isize_extended() against the
kernel binary.
Link: https://lore.kernel.org/20261016222721.791785-1-nickolai@csail.mit.edu
Fixes: 52aecaee1c26 ("mm: zero range of eof folio exposed by inode size extension")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Assisted-by: LLM
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Brian Foster <bfoster@redhat.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/truncate.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/truncate.c b/mm/truncate.c
index 9b1baa688a104..3534bc320a9c5 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -880,8 +880,7 @@ void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to)
unsigned int offset, end;
offset = from - folio_pos(folio);
- end = min_t(unsigned int, to - folio_pos(folio),
- folio_size(folio));
+ end = min_t(loff_t, to - folio_pos(folio), folio_size(folio));
folio_zero_segment(folio, offset, end);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 755/869] mm/mremap: populate calculated fields in vrm state correctly
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (753 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 754/869] mm/truncate: fix the zeroing end of pagecache_isize_extended() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 756/869] mm/mremap: correctly uncharge accountable VMAs in error path Greg Kroah-Hartman
` (121 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Andrew Morton,
Nickolai Zeldovich, Xueyuan Chen, Pedro Falcato, Liam R. Howlett,
Vlastimil Babka, Jann Horn, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 34e753f8d927069785f6b675f5769da5da4ef78e ]
Commit d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
introduced the vma_remap_struct helper to pass state sanely through
mremap() logic.
Part of this state is vrm->delta - equal to the absolute difference between
vrm->old_len and vrm->new_len (the old and new lengths of the VMA,
respectively).
This value is used to correctly charge accounted VMAs.
When shrinking a VMA, mremap_to() sets vrm->old_len equal to vrm->new_len
having performed the shrink of the VMA first, prior to any potential move
(e.g. MREMAP_FIXED | MREMAP_MAYMOVE specified).
However it does not recalculate vrm->delta, which results in incorrectly
overcharging the VMA when both moving and shrinking a VMA.
The charge leaks to Committed_AS globally, meaning a mischievous user can
cause allocations to fail across the system in strict overcommit mode.
Resolve the issue by abstracting the update of vrm->delta to
vrm_populate_calculated() and invoking this from mremap_to() when
vrm->old_len is changed.
Additionally, update vrm->remap_type whose value depends on vrm->delta.
The field is not read again after the shrink, but it is the logically
correct thing to do and protects against future changes which break this.
Link: https://lore.kernel.org/20261019-mremap-fix-shrink-charge-v1-1-a3ce209e5360@kernel.org
Fixes: d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Closes: https://lore.kernel.org/all/20261017233527.797191-1-nickolai@csail.mit.edu/
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mremap.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/mm/mremap.c b/mm/mremap.c
index f023b05dfb3d9..593e6f94eba3d 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -874,12 +874,6 @@ unsigned long move_page_tables(struct pagetable_move_control *pmc)
return pmc_progress(pmc);
}
-/* Set vrm->delta to the difference in VMA size specified by user. */
-static void vrm_set_delta(struct vma_remap_struct *vrm)
-{
- vrm->delta = abs_diff(vrm->old_len, vrm->new_len);
-}
-
/* Determine what kind of remap this is - shrink, expand or no resize at all. */
static enum mremap_type vrm_remap_type(struct vma_remap_struct *vrm)
{
@@ -892,6 +886,13 @@ static enum mremap_type vrm_remap_type(struct vma_remap_struct *vrm)
return MREMAP_EXPAND;
}
+/* Populate calculated fields. */
+static void vrm_populate_calculated(struct vma_remap_struct *vrm)
+{
+ vrm->delta = abs_diff(vrm->old_len, vrm->new_len);
+ vrm->remap_type = vrm_remap_type(vrm);
+}
+
/*
* When moving a VMA to vrm->new_adr, does this result in the new and old VMAs
* overlapping?
@@ -1422,6 +1423,7 @@ static unsigned long mremap_to(struct vma_remap_struct *vrm)
/* Set up for the move now shrink has been executed. */
vrm->old_len = vrm->new_len;
+ vrm_populate_calculated(vrm);
}
/* MREMAP_DONTUNMAP expands by old_len since old_len == new_len */
@@ -1694,8 +1696,7 @@ static int check_prep_vma(struct vma_remap_struct *vrm)
if (is_vm_hugetlb_page(vma) && !align_hugetlb(vrm))
return -EINVAL;
- vrm_set_delta(vrm);
- vrm->remap_type = vrm_remap_type(vrm);
+ vrm_populate_calculated(vrm);
/* For convenience, we set new_addr even if VMA won't move. */
if (!vrm_implies_new_addr(vrm))
vrm->new_addr = addr;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 756/869] mm/mremap: correctly uncharge accountable VMAs in error path
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (754 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 755/869] mm/mremap: populate calculated fields in vrm state correctly Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 757/869] mm/vmscan: reclaim every zone in per-node proactive reclaim Greg Kroah-Hartman
` (120 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Andrew Morton,
Liam R. Howlett, Vlastimil Babka, Jann Horn, Pedro Falcato,
Brian Geffon, Dmitry Safonov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 65e722a74df992719676ead85a9e93fb2b5a0983 ]
The mremap error path is a fragile and unwieldy beast - it reverses the
page table move then updates vma_remap_struct state to swap VMA, length and
address between old and new VMAs in copy_vma_and_data().
If the mremap() operation didn't specify MREMAP_DONTUNMAP then its caller,
move_vma(), invokes unmap_source_vma(), which unmaps the new VMA rather
than the old one.
For accountable VMAs when MREMAP_DONTUNMAP is not specified,
unmap_source_vma() unsets VMA_ACCOUNT_BIT during this unmap in order that
only the delta of a VMA expansion is charged (performed by
vrm_calc_charge() earlier).
Therefore nothing uncharges the expanded VMA size, and there is a permanent
leak in global Committed_AS.
Resolve the issue by uncharging when MREMAP_DONTUNMAP is not specified.
Link: https://lore.kernel.org/20261019-other-mremap-charge-leak-v1-1-d94477fe6545@kernel.org
Fixes: fdbef6149135 ("mm/mremap: don't account pages in vma_to_resize()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mremap.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/mm/mremap.c b/mm/mremap.c
index 593e6f94eba3d..8ed7c50e499b8 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1239,6 +1239,20 @@ static int copy_vma_and_data(struct vma_remap_struct *vrm,
pmc_revert.need_rmap_locks = true;
move_page_tables(&pmc_revert);
+ /*
+ * When copy_vma_and_data() returns, the new VMA will be
+ * unmapped rather than the old one.
+ *
+ * When an accountable move is being performed, this unmapping
+ * will not uncharge any expansion, so do that now.
+ *
+ * A move is accountable if the VMA is accountable and
+ * MREMAP_DONTUNMAP is not specified, so only do so if the
+ * latter is true.
+ */
+ if (!(vrm->flags & MREMAP_DONTUNMAP))
+ vrm_uncharge(vrm);
+
vrm->vma = new_vma;
vrm->old_len = vrm->new_len;
vrm->addr = vrm->new_addr;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 757/869] mm/vmscan: reclaim every zone in per-node proactive reclaim
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (755 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 756/869] mm/mremap: correctly uncharge accountable VMAs in error path Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 758/869] mm/mempolicy: apply bind policies against the scoped allocation zone Greg Kroah-Hartman
` (119 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
Barry Song, Johannes Weiner, Harry Yoo (Meta), Shakeel Butt,
Yosry Ahmed, SJ Park, Balbir Singh, Davidlohr Bueso, Michal Hocko,
Xueyuan Chen, Lorenzo Stoakes (ARM), Vishal Moola (Fractile),
Kairui Song, Qi Zheng, Axel Rasmussen, Yuanchu Xie, Wei Xu,
Baoquan He, Baolin Wang, David Hildenbrand, Michal Hocko,
Roman Gushchin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price (Meta) <gourry@gourry.net>
[ Upstream commit d0a12d80d2f7e9f4ed2030b6f04c8a897956bf84 ]
user_proactive_reclaim() limits per-node reclaim to
gfp_zone(GFP_KERNEL), which is ZONE_NORMAL. Proactive reclaim serves no
allocation, but that limit makes shrink_node() skip every ZONE_MOVABLE
folio, so writing to /sys/devices/system/node/nodeN/reclaim never
reclaims a node's movable memory. A movable-only node, such as dax/kmem
or hotplugged memory onlined movable, reclaims nothing and fails with
-EAGAIN.
To reproduce, fill a movable-only node with clean page cache and write
200M to its nodeN/reclaim: the write fails with -EAGAIN and the page
cache stays. The same write to a ZONE_NORMAL node frees 200MB.
Scan every zone, as memory.reclaim does.
Link: https://lore.kernel.org/20261019185002.3428594-1-gourry@gourry.net
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 6d53f83e9dbcf..8fb0d79a00b9e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -7825,7 +7825,7 @@ int user_proactive_reclaim(char *buf,
} else {
struct scan_control sc = {
.gfp_mask = current_gfp_context(gfp_mask),
- .reclaim_idx = gfp_zone(gfp_mask),
+ .reclaim_idx = MAX_NR_ZONES - 1,
.proactive_swappiness = swappiness == -1 ? NULL : &swappiness,
.priority = DEF_PRIORITY,
.may_writepage = !laptop_mode,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 758/869] mm/mempolicy: apply bind policies against the scoped allocation zone
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (756 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 757/869] mm/vmscan: reclaim every zone in per-node proactive reclaim Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 759/869] riscv: mm: exclude invalid THP PMDs from page table check Greg Kroah-Hartman
` (118 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
Joshua Hahn, David Hildenbrand, Zi Yan, Rakie Kim, Ying Huang,
Pasha Tatashin, Michal Hocko, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price (Meta) <gourry@gourry.net>
[ Upstream commit d4ea410ce4b8aa46a316476ea2624a357bf31fa9 ]
QEMU fails to start a guest with a VFIO device when guest RAM comes
from a memory backend bound to a movable-only node:
vfio_container_dma_map(0x55b1b1317800, 0x0, 0x10000000,
0x7f39a2200000)
= -12 (Cannot allocate memory)
VFIO pins guest RAM when the device is realized, and the pin faults
the pages in. io_uring fixed buffers fail the same way. Faulting the
range in before pinning lets the same pin succeed, since resident
pages are migrated off the node instead.
A long-term pin faults under memalloc_pin_save(). PF_MEMALLOC_PIN makes
current_gfp_context() clear __GFP_MOVABLE, but policy_nodemask() tests
apply_policy_zone() against the caller's gfp.
The bind keeps its movable-only nodemask, and the allocation finds no
usable zone:
page allocation failure:
order:0,
mode:0x140dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_COMP),
nodemask=1,cpuset=/,mems_allowed=0-1
Call Trace:
warn_alloc+0x136/0x150
__alloc_frozen_pages_noprof+0xed8/0x1720
alloc_pages_mpol+0xaa/0x170
vma_alloc_folio_noprof+0x65/0xd0
__handle_mm_fault+0x137b/0x1ac0
handle_mm_fault+0xa0/0x270
__get_user_pages+0x250/0xfd0
__gup_longterm_locked+0x116/0x870
gup_fast_fallback+0xcfc/0xdf0
pin_user_pages_fast+0x47/0x60
io_pin_pages+0x9a/0x110
Base page faults fail with -ENOMEM.
hugetlb faults fail with -EFAULT.
Check the policy zone against current_gfp_context(gfp), so a pin-scoped
fault falls back off the movable-only nodemask, like any other
non-movable allocation under the same bind.
Tested in qemu with a dax/kmem movable-only node 1. io_uring and VFIO
pins of unfaulted base pages and 2MB hugetlb pages now succeed and land
on node 0 (correct). QEMU now starts with the same backend binding.
Link: https://lore.kernel.org/20261018023349.1697434-1-gourry@gourry.net
Fixes: 8e3560d963d2 ("mm: honor PF_MEMALLOC_PIN for all movable pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mempolicy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 197a5ea0d76d9..919a505cabaee 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2206,7 +2206,7 @@ static nodemask_t *policy_nodemask(gfp_t gfp, struct mempolicy *pol,
break;
case MPOL_BIND:
/* Restrict to nodemask (but not on lower zones) */
- if (apply_policy_zone(pol, gfp_zone(gfp)) &&
+ if (apply_policy_zone(pol, gfp_zone(current_gfp_context(gfp))) &&
cpuset_nodemask_valid_mems_allowed(&pol->nodes))
nodemask = &pol->nodes;
if (pol->home_node != NUMA_NO_NODE)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 759/869] riscv: mm: exclude invalid THP PMDs from page table check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (757 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 758/869] mm/mempolicy: apply bind policies against the scoped allocation zone Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 760/869] mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline Greg Kroah-Hartman
` (117 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunhui Cui, Andrew Morton, Albert Ou,
Palmer Dabbelt, Pasha Tatashin, Paul Walmsley, tongtiangen,
Alexandre Ghiti, David Hildenbrand (Arm), Vivian Wang, Yaxing Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunhui Cui <cuiyunhui@bytedance.com>
[ Upstream commit bdda2887cbf3937c2d0f56589c2124c4167324e1 ]
RISC-V THP splitting uses a temporary invalid PMD state where
pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
in-progress entry.
That temporary state no longer describes a user-accessible mapping, but
page_table_check currently treats it as one because the RISC-V PMD
user-accessibility test only checks whether the PMD is a leaf and has user
permissions.
As a result, when a PMD-sized anonymous THP is split during a COW fault,
page_table_check can account the invalid intermediate PMD as a live PMD
mapping, and then account the replacement PTE mappings again when the
split installs the PTE table. This leaves stale PMD accounting behind and
later triggers page_table_check failures such as a non-zero anon_map_count
when the folio is freed.
Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
accounting only considers leaf PMDs that still carry either _PAGE_PRESENT
or _PAGE_PROT_NONE. This preserves the THP split semantics required by
the MM code while preventing page_table_check from treating invalid split
PMDs as live user mappings.
With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
tools/testing/selftests/mm/cow completes successfully on RISC-V after this
change.
Link: https://lore.kernel.org/20260523042052.35476-1-cuiyunhui@bytedance.com
Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: tongtiangen <tongtiangen@huawei.com>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Vivian Wang <wangruikang@iscas.ac.cn>
Cc: Yaxing Guo <guoyaxing@bosc.ac.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/include/asm/pgtable.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 9b2e967c9fe08..420d402336d0b 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -833,7 +833,14 @@ static inline bool pte_user_accessible_page(pte_t pte)
static inline bool pmd_user_accessible_page(pmd_t pmd)
{
- return pmd_leaf(pmd) && pmd_user(pmd);
+ /*
+ * page_table_check() must ignore THP split invalidation entries created by
+ * pmd_mkinvalid(). These retain _PAGE_LEAF so pmd_present()/pmd_leaf() stay
+ * true during the split, but they no longer describe a user-accessible
+ * mapping once both _PAGE_PRESENT and _PAGE_PROT_NONE are cleared.
+ */
+ return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)) &&
+ (pmd_val(pmd) & _PAGE_LEAF) && pmd_user(pmd);
}
static inline bool pud_user_accessible_page(pud_t pud)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 760/869] mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (758 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 759/869] riscv: mm: exclude invalid THP PMDs from page table check Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 761/869] fscrypt: Fix missing barrier in fscrypt_find_mode_key() Greg Kroah-Hartman
` (116 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Chintamaneni, Hardik Garg,
Andrew Morton, Barry Song, Baolin Wang, Johannes Weiner,
David Hildenbrand, Michal Hocko, Qi Zheng, Shakeel Butt,
Lorenzo Stoakes, Kairui Song, Axel Rasmussen, Yuanchu Xie, Wei Xu,
Baoquan He, Yu Zhao, apais, rlmenge, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
[ Upstream commit 183895979c441e52dbd651b388553b09eaa35cfa ]
When CONFIG_MEMCG=y, lruvec_pgdat() returns lruvec->pgdat, which for the
per-node pgdat->__lruvec is left NULL by lruvec_init() and only filled in
lazily by mem_cgroup_lruvec(). Normally that happens early, e.g. on the
first folio_add_lru().
With cgroup_disable=memory, lru_gen_shrink_node() passes &pgdat->__lruvec
directly to shrink_one(). If direct reclaim runs before anything has
called mem_cgroup_lruvec() for the node, which can happen during early
boot under memory pressure (e.g. a kdump kernel), get_swappiness() ends
up dereferencing a NULL pgdat:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
pc : get_swappiness+0x68/0xb0
lr : try_to_shrink_lruvec+0x54/0x2c0
Call trace:
get_swappiness+0x68/0xb0 (P)
try_to_shrink_lruvec+0x54/0x2c0
shrink_one+0x8c/0x240
shrink_node+0xc6c/0xe08
do_try_to_free_pages+0xdc/0x570
try_to_free_pages+0x124/0x278
__alloc_frozen_pages_noprof+0x6e8/0xf78
alloc_pages_mpol+0xc4/0x1c0
alloc_frozen_pages_noprof+0x54/0xe8
alloc_pages_noprof+0x1c/0x40
atomic_pool_expand+0x98/0x300
__dma_atomic_pool_init+0x58/0xd8
dma_atomic_pool_init+0x154/0x170
do_one_initcall+0x64/0x350
kernel_init_freeable+0x214/0x430
kernel_init+0x2c/0x208
ret_from_fork+0x10/0x20
The classic LRU path and MGLRU before per-node lru_gen_folio lists
obtained the lruvec through mem_cgroup_lruvec(), which sets
lruvec->pgdat.
The above was hit on an arm64 kdump kernel (6.18-based) booted with
cgroup_disable=memory nr_cpus=4. It also reproduces on mainline on an
arm64 VM with CONFIG_ARM64_64K_PAGES=y, CONFIG_MEMCG=y,
CONFIG_LRU_GEN_ENABLED=y and:
mem=160M nr_cpus=4 coherent_pool=512M cgroup_disable=memory
These options only serve to force direct reclaim early in boot; with
160M the boot eventually ends in OOM regardless. On mainline the first
LRU reclaim happens while unpacking the initramfs, and faults the same
way:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
pc : get_swappiness+0xd4/0x150
Call trace:
get_swappiness+0xd4/0x150 (P)
try_to_shrink_lruvec+0x44/0x2b8
shrink_one+0x80/0x1a0
shrink_node+0xd98/0xea8
do_try_to_free_pages+0xf4/0x4b0
try_to_free_pages+0x110/0x360
__alloc_frozen_pages_noprof+0x8b0/0x1718
...
__filemap_get_folio_mpol+0x2ac/0x548
simple_write_begin+0x44/0xf8
page_symlink+0x178/0x198
...
do_populate_rootfs+0x13c/0x200
Link: https://lore.kernel.org/20261017050928.128582-1-sidchintamaneni@gmail.com
Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <apais@microsoft.com>
Cc: <rlmenge@gmail.com>
Cc: <stable@vger.kernel.org> # 6.3+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8fb0d79a00b9e..e72d50bab730a 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -5082,7 +5082,7 @@ static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *
sc->nr_reclaimed = 0;
if (mem_cgroup_disabled())
- shrink_one(&pgdat->__lruvec, sc);
+ shrink_one(mem_cgroup_lruvec(NULL, pgdat), sc);
else
shrink_many(pgdat, sc);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 761/869] fscrypt: Fix missing barrier in fscrypt_find_mode_key()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (759 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 760/869] mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 762/869] fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe Greg Kroah-Hartman
` (115 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Baokun Li, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
[ Upstream commit cf66375465b9ca531f5c294f468db1df293c178c ]
fscrypt_find_mode_key() walks an RCU list and hands out a per-mode
key without an acquire:
setup task
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
setup_per_mode_enc_key()
├─ fscrypt_prepare_key()
│ └─ fscrypt_prepare_inline_crypt_key()
│ └─ blk_crypto_start_using_key()
│ └─ blk_crypto_fallback_start_using_mode()
│ ├─ init profile, keyslots, tfms[]
│ └─ smp_store_release(tfms_inited[mode]) # init order
└─ list_add_tail_rcu(&new_node->link, ...) # release -> finder
finding task (later submits the I/O itself)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fscrypt_find_mode_key()
├─ list_for_each_entry_rcu(node, ...)
└─ return &node->key # no acquire, chain breaks
...
blk_crypto_fallback_bio_prep() # WRITE path
├─ tfms_inited[mode] # addr-dep, reads true
├─ blk_crypto_fallback_profile # no dependency
├─ blk_crypto_keyslots # no dependency
└─ slotp->tfms[mode] # no dependency
RCU publishes the node and the key reachable from it, so
tfms_inited[mode] reads true through the address dependency. The
independent fallback globals are not covered by it and can be read as
uninitialized.
On a weakly ordered machine, a WRITE bio can crash in
blk_crypto_get_keyslot() or crypto_sync_skcipher_setkey().
Other tasks reach the key through fscrypt_inode_info's
cmpxchg_release()/smp_load_acquire(), which is already ordered after
the list walk; only the finding task's own later I/O was not.
Fix this by upgrading the control dependency to an acquire with
smp_acquire__after_ctrl_dep() once a matching entry has been found.
Fixes: dd015b566d50 ("fscrypt: Fix key setup in edge case with multiple data unit sizes")
Cc: stable@vger.kernel.org
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Link: https://lore.kernel.org/r/20261014161153.GC322435@quark
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20261024104350.2257313-1-libaokun@linux.alibaba.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/crypto/keysetup.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
index f27997ef9a08c..707552228ed62 100644
--- a/fs/crypto/keysetup.c
+++ b/fs/crypto/keysetup.c
@@ -207,8 +207,14 @@ fscrypt_find_mode_key(struct fscrypt_master_key *mk, u8 hkdf_context,
if (node->hkdf_context == hkdf_context &&
node->mode_num == mode_num &&
node->data_unit_bits == ci->ci_data_unit_bits &&
- fscrypt_is_key_prepared(&node->key, ci))
+ fscrypt_is_key_prepared(&node->key, ci)) {
+ /*
+ * Upgrade the RCU dereference to a full ACQUIRE, so
+ * that blk-crypto global state is seen as initialized.
+ */
+ smp_acquire__after_ctrl_dep();
return &node->key;
+ }
}
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 762/869] fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (760 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 761/869] fscrypt: Fix missing barrier in fscrypt_find_mode_key() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 763/869] timers/itimer: Keep a nonzero value at CPU timer expiry Greg Kroah-Hartman
` (114 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Haoran, Li Ximo, Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Haoran <haoranwangsec@gmail.com>
[ Upstream commit 01d1204582f16e8b7bfce29648e5cf77a585d962 ]
list_first_entry() does not return NULL on an empty list; it returns a
bogus pointer computed by container_of() from the list head.
atmel_lcdfb_probe() initializes info->modelist with INIT_LIST_HEAD()
and later takes its first entry with list_first_entry(), assuming
atmel_lcdfb_of_init() populated it. However, atmel_lcdfb_of_init()
drops the return value of fb_add_videomode() — unlike every other
fallible call in the same function — so if fb_add_videomode() fails
(its internal kmalloc can return -ENOMEM under memory pressure or
fault injection), the list stays empty while of_init() reports
success. The probe path then dereferences the bogus pointer in
fb_videomode_to_var(&info->var, &modelist->mode). Because the bogus
pointer lands inside the contiguous fb_info allocation, this may not
fault immediately; instead it silently reads adjacent memory as a
struct fb_videomode and programs garbage timing parameters into the
LCD controller. This was found by code audit; we do not have Atmel
hardware to reproduce it.
Fix this on two levels: check the return value of fb_add_videomode()
in atmel_lcdfb_of_init() so the failure is propagated (root cause),
and use list_first_entry_or_null() in atmel_lcdfb_probe() with a NULL
check that fails probe gracefully with -EINVAL (defense in depth),
consistent with the surrounding error handling which bails out to
stop_clk.
Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/atmel_lcdfb.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 35862e83f7afa..2b602ad004dd9 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1009,7 +1009,9 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
if (ret < 0)
goto put_display_node;
- fb_add_videomode(&fb_vm, &info->modelist);
+ ret = fb_add_videomode(&fb_vm, &info->modelist);
+ if (ret < 0)
+ goto put_display_node;
put_display_node:
of_node_put(display_np);
@@ -1077,8 +1079,13 @@ static int atmel_lcdfb_probe(struct platform_device *pdev)
}
atmel_lcdfb_start_clock(sinfo);
- modelist = list_first_entry(&info->modelist,
- struct fb_modelist, list);
+ modelist = list_first_entry_or_null(&info->modelist,
+ struct fb_modelist, list);
+ if (!modelist) {
+ dev_err(dev, "no video mode available\n");
+ ret = -EINVAL;
+ goto stop_clk;
+ }
fb_videomode_to_var(&info->var, &modelist->mode);
atmel_lcdfb_check_var(&info->var, info);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 763/869] timers/itimer: Keep a nonzero value at CPU timer expiry
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (761 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 762/869] fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 764/869] time/namespace: Fix overflow when converting absolute deadlines Greg Kroah-Hartman
` (113 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hungyu Lin, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hungyu Lin <dennylin0707@gmail.com>
[ Upstream commit ef60f61208a30eb5b941b707debdf04517271b4f ]
get_cpu_itimer() returns a zero remaining time when the sampled CPU time
is exactly equal to the nonzero expiry. This makes an armed ITIMER_VIRTUAL
or ITIMER_PROF timer appear disarmed.
The cputime cleanup replaced cputime_le(), which implements <=, with <.
Restore the inclusive comparison so the equality case returns TICK_NSEC,
like the overdue case and set_process_cpu_timer().
Fixes: 648616343cdb ("[S390] cputime: add sparse checking and cleanup")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020223957.87842-1-dennylin0707@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/itimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/itimer.c b/kernel/time/itimer.c
index 03a32dffc56cc..f7de39769095f 100644
--- a/kernel/time/itimer.c
+++ b/kernel/time/itimer.c
@@ -60,7 +60,7 @@ static void get_cpu_itimer(struct task_struct *tsk, unsigned int clock_id,
thread_group_sample_cputime(tsk, samples);
t = samples[clock_id];
- if (val < t)
+ if (val <= t)
/* about to fire */
val = TICK_NSEC;
else
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 764/869] time/namespace: Fix overflow when converting absolute deadlines
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (762 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 763/869] timers/itimer: Keep a nonzero value at CPU timer expiry Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 765/869] KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests Greg Kroah-Hartman
` (112 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hungyu Lin, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hungyu Lin <dennylin0707@gmail.com>
[ Upstream commit d69cfd33b5a8d176124c564513b9ceb933595d93 ]
do_timens_ktime_to_host() subtracts the namespace offset from an absolute
deadline and clamps the result to [0, KTIME_MAX]. A negative offset can
make a large deadline overflow to a negative value. Since ktime_t is
signed and KTIME_MAX is its maximum value, the subsequent comparison
against KTIME_MAX can never detect this overflow.
For example, with a -1 second boottime offset, an absolute CLOCK_BOOTTIME
timerfd deadline of KTIME_MAX can expire immediately. An absolute
clock_nanosleep() using the same clock and deadline can also return
immediately instead of waiting.
The earlier tim < offset check already handles the lower bound. A
negative subtraction result in the remaining branch therefore indicates
overflow. Detect that result and clamp it to KTIME_MAX.
Fixes: 89dd8eecfe961 ("time: Add do_timens_ktime_to_host() helper")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020233433.20997-1-dennylin0707@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c
index 99dcdb3315db7..632f331572847 100644
--- a/kernel/time/namespace.c
+++ b/kernel/time/namespace.c
@@ -51,7 +51,7 @@ ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
tim = 0;
} else {
tim = ktime_sub(tim, offset);
- if (unlikely(tim > KTIME_MAX))
+ if (unlikely(tim < 0))
tim = KTIME_MAX;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 765/869] KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (763 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 764/869] time/namespace: Fix overflow when converting absolute deadlines Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 766/869] ceph: avoid pending truncate during nonblocking cap acquire Greg Kroah-Hartman
` (111 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit 00e73757518020273ccf6308a51f214e58c21ad5 ]
KVM sets HCR_EL2.BSU to Inner Shareable for guests, so that a guest's
barriers cover the TLB and I-cache invalidations that HCR_EL2.FB
broadcasts. However, since HCR_BSU_IS became an alias of the generated
HCR_EL2_BSU_IS, it is the unshifted field value 0b01, which sets bit
0 (VM, already set) and leaves BSU at 0b00. A guest's DSB NSH is then
not required to wait for a broadcast TLBI to complete on other CPUs.
Build the field with SYS_FIELD_PREP_ENUM().
Fixes: d0f39259eff4 ("arm64: sysreg: Add layout for HCR_EL2")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261016081558.805411-1-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_arm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 1da290aeedce7..641276868a653 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -98,7 +98,7 @@
* TID1: Trap REVIDR_EL1, AIDR_EL1, and SMIDR_EL1
*/
#define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \
- HCR_BSU_IS | HCR_FB | HCR_TACR | \
+ SYS_FIELD_PREP_ENUM(HCR_EL2, BSU, IS) | HCR_EL2_FB | HCR_EL2_TACR | \
HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \
HCR_FMO | HCR_IMO | HCR_PTW | HCR_TID3 | HCR_TID1)
#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK | HCR_ATA)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 766/869] ceph: avoid pending truncate during nonblocking cap acquire
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (764 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 765/869] KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 767/869] ceph: fix out-of-bounds read in ceph_netfs_issue_op_inline() Greg Kroah-Hartman
` (110 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Xiubo Li,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
[ Upstream commit 979b7ed4457a04c5a41c36f86052ecc6b76c67d9 ]
Readahead acquires caps while the folios are locked. This can
deadlock when processing a pending truncate; truncate_pagecache() can
then attempt to a folio that is already locked.
Return -EAGAIN instead when `NON_BLOCKING` is set, causing the
readahead to be abandoned.
Cc: stable@vger.kernel.org
Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/caps.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 91cb305815cbd..7ce1af5b61c88 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2878,6 +2878,10 @@ static int try_get_cap_refs(struct inode *inode, int need, int want,
}
/* finish pending truncate */
+ if (ci->i_truncate_pending && (flags & NON_BLOCKING)) {
+ ret = -EAGAIN;
+ goto out_unlock;
+ }
while (ci->i_truncate_pending) {
spin_unlock(&ci->i_ceph_lock);
if (snap_rwsem_locked) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 767/869] ceph: fix out-of-bounds read in ceph_netfs_issue_op_inline()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (765 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 766/869] ceph: avoid pending truncate during nonblocking cap acquire Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 768/869] ceph: reject mdsmaps that claim more than CEPH_MAX_MDS ranks Greg Kroah-Hartman
` (109 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanglei Zhu <zhugl3@xiaopeng.com>
[ Upstream commit cdbb60f00f87297a9db2652847dfc0eaaf3c45aa ]
The read offset is validated against i_size but never against
inline_len, and the two fields come from the MDS independently. When
a read starts past the end of the inline data, the subtraction
len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len);
underflows and min_t() ends up with subreq->len, so copy_to_iter()
reads past the end of the inline buffer straight into the user
buffer. A malicious or buggy MDS reporting a short inline payload
together with an inflated i_size can thus leak kernel heap memory to
userspace.
Bail out with -ENODATA when the offset is not within the inline
data.
Cc: stable@vger.kernel.org
Fixes: 5b19f1eba459 ("ceph: make ceph_netfs_issue_op() handle inlined data")
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index cfbd88412f047..f58eba5456e36 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -314,6 +314,12 @@ static bool ceph_netfs_issue_op_inline(struct netfs_io_subrequest *subreq)
return false;
}
+ if (subreq->start >= iinfo->inline_len) {
+ ceph_mdsc_put_request(req);
+ err = -ENODATA;
+ goto out;
+ }
+
len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len);
err = copy_to_iter(iinfo->inline_data + subreq->start, len, &subreq->io_iter);
if (err == 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 768/869] ceph: reject mdsmaps that claim more than CEPH_MAX_MDS ranks
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (766 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 767/869] ceph: fix out-of-bounds read in ceph_netfs_issue_op_inline() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 769/869] ceph: require the dentry lease record to cover struct ceph_mds_reply_lease Greg Kroah-Hartman
` (108 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+f8e3e01d8dda8689, Xiang Mei,
Alex Markuze, Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit c1742590d2b2fc5fb217e1a9b520108f1fe282e5 ]
check_new_map() sizes its export-target bitmap from CEPH_MAX_MDS but walks
it with newmap->possible_max_rank, which comes straight off the wire:
ceph_mdsmap_decode() sets it to max(m_num_active_mds, m_max_mds), then
overwrites it with the size of the "in" set. Neither is bounded by
CEPH_MAX_MDS, only by m_info allocating, so a monitor announcing more ranks
than the bitmap holds makes test_bit() read past the end of targets[]. The
clear_bit() loop above indexes the same bitmap, though it is additionally
bounded by mdsc->max_sessions. The map arrives on the monitor connection,
which is unauthenticated in legacy msgr mode.
CEPH_MAX_MDS is a protocol constant from src/mds/mdstypes.h, and the
reserved inode ranges in super.h are laid out one rank apart over that
span, so a map claiming more ranks is corrupt. Reject it where the rank
space is established rather than letting the count reach check_new_map().
BUG: KASAN: stack-out-of-bounds in check_new_map (fs/ceph/mds_client.c:5968)
Read of size 8 at addr ffffc90000ac7798 by task kworker/1:2/127
Workqueue: ceph-msgr ceph_con_workfn
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
check_new_map (fs/ceph/mds_client.c:5968)
ceph_mdsc_handle_mdsmap (fs/ceph/mds_client.c:7060)
extra_mon_dispatch (fs/ceph/super.c:802)
mon_dispatch (net/ceph/mon_client.c:1483)
ceph_con_process_message (net/ceph/messenger.c:1424)
ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
ceph_con_workfn (net/ceph/messenger.c:1576)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>
The buggy address belongs to stack of task kworker/1:2/127
and is located at offset 288 in frame:
check_new_map (fs/ceph/mds_client.c:5846)
This frame has 1 object:
[32, 288) 'targets'
Cc: stable@vger.kernel.org
Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps")
Reported-by: co+f8e3e01d8dda8689@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mdsmap.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index c91c0e2e118ba..0fd578f0b2cd2 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -170,6 +170,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
* and the mds rank >= m_num_active_mds.
*/
m->possible_max_rank = max(m->m_num_active_mds, m->m_max_mds);
+ if (m->possible_max_rank > CEPH_MAX_MDS) {
+ err = -EIO;
+ goto corrupt;
+ }
m->m_info = kcalloc(m->possible_max_rank, sizeof(*m->m_info), GFP_NOFS);
if (!m->m_info)
@@ -316,6 +320,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
{
int num_laggy = 0;
ceph_decode_32_safe(p, end, n, bad_ext);
+ if (n > CEPH_MAX_MDS) {
+ err = -EIO;
+ goto corrupt;
+ }
ceph_decode_need(p, end, sizeof(u32) * n, bad_ext);
for (i = 0; i < n; i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 769/869] ceph: require the dentry lease record to cover struct ceph_mds_reply_lease
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (767 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 768/869] ceph: reject mdsmaps that claim more than CEPH_MAX_MDS ranks Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 770/869] libceph: only set read_from_replica on read requests Greg Kroah-Hartman
` (107 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+f92fbe44e3c6df69, Xiang Mei,
Alex Markuze, Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 7286b2ffe04d4b39b4e9884f714792589d94f316 ]
parse_reply_info_lease() reads a 32-bit struct_len off the wire and only
checks that many bytes are present, without requiring struct_len to cover
sizeof(struct ceph_mds_reply_lease) (10 bytes). A malicious MDS can
declare a shorter record and still get the pointer published: the
following *p += sizeof(**lease) overshoot is undone by *p = lend, so
nothing downstream rejects the reply. ceph_fill_trace() ->
update_dentry_lease() then reads 10 bytes through that pointer on any
lookup on a mounted CephFS, running past the end of the message front.
Require the record to cover the structure, matching the sibling
parse_reply_info_dir(). A conforming MDS always encodes the full 10
bytes.
BUG: KASAN: slab-out-of-bounds in __update_dentry_lease.constprop.0 (fs/ceph/inode.c:1459)
Read of size 4 at addr ffff888026c63d65 by task kworker/0:3/2366
Workqueue: ceph-msgr ceph_con_workfn
Call Trace:
__update_dentry_lease.constprop.0 (fs/ceph/inode.c:1459)
ceph_fill_trace (fs/ceph/inode.c:1474 fs/ceph/inode.c:1823)
mds_dispatch (fs/ceph/mds_client.c:4229 fs/ceph/mds_client.c:7225)
ceph_con_process_message (net/ceph/messenger.c:1424)
ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
ceph_con_workfn (net/ceph/messenger.c:1576)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address is located 357 bytes inside of
allocated 360-byte region [ffff888026c63c00, ffff888026c63d68)
Cc: stable@vger.kernel.org
Fixes: 4ac4c23eaa38 ("ceph: decode alternate_name in lease info")
Reported-by: co+f92fbe44e3c6df69@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 342d8778b69cf..a5bc9f75e0f9c 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -338,6 +338,8 @@ static int parse_reply_info_lease(void **p, void *end,
lend = *p + struct_len;
ceph_decode_need(p, end, struct_len, bad);
+ if (struct_len < sizeof(**lease))
+ goto bad;
*lease = *p;
*p += sizeof(**lease);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 770/869] libceph: only set read_from_replica on read requests
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (768 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 769/869] ceph: require the dentry lease record to cover struct ceph_mds_reply_lease Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 771/869] libceph: Fix unsafe decode in ceph_redirect_decode() Greg Kroah-Hartman
` (106 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiubo Li, Alex Markuze, Ilya Dryomov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <xiubo.li@clyso.com>
[ Upstream commit d6c7a5fcd08873c45a2dcd645a0690fd1443af50 ]
ceph_osdc_alloc_request() ORs the mount option's read_from_replica
flag into r_flags for every request, writes included. The flag is
meant for reads: calc_target() skips the replica choice for any
request that has CEPH_OSD_FLAG_WRITE, and the OSDs only know
BALANCE_READS on read ops. Sending it on writes is at best ignored;
with read_from_replica=balance a buffered write that fell back to
ceph_sync_write() after losing BUFFER to a revoke failed with -EIO,
while the same run without the option works fine.
Gate the flag on CEPH_OSD_FLAG_READ.
Cc: stable@vger.kernel.org
Fixes: 22d2cfdffa5b ("libceph: move away from global osd_req_flags")
Assisted-by: Cursor
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/osd_client.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 46b2c2ae77784..92d76df2701ef 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1108,7 +1108,9 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
req->r_base_oloc.pool = layout->pool_id;
req->r_base_oloc.pool_ns = ceph_try_get_string(layout->pool_ns);
ceph_oid_printf(&req->r_base_oid, "%llx.%08llx", vino.ino, objnum);
- req->r_flags = flags | osdc->client->options->read_from_replica;
+ req->r_flags = flags;
+ if (flags & CEPH_OSD_FLAG_READ)
+ req->r_flags |= osdc->client->options->read_from_replica;
req->r_snapid = vino.snap;
if (flags & CEPH_OSD_FLAG_WRITE)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 771/869] libceph: Fix unsafe decode in ceph_redirect_decode()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (769 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 770/869] libceph: only set read_from_replica on read requests Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 772/869] libceph: Fix multiple unsafe decodes in ceph_oloc_decode() Greg Kroah-Hartman
` (105 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raphael Zimmer, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
[ Upstream commit 0405670e50f213594366ab7eddc07002bd7f84c0 ]
ceph_redirect_decode handles unchecked data received over the network
from an OSD. Currently, there is only a bounds check covering the first
three decode operations. After decoding the first len field from the
message, the only remaining check ensures there is enough buffer space
to hold len bytes. However, there is no guarantee that this value is
large enough to hold the subsequently decoded fields. The decoding of
the second len field is missing an explicit bounds check. Consequently,
a corrupted message can trigger an out-of-bounds read.
This patch fixes the issue by switching the decoding from
ceph_decode_32() to the bounds-checked version ceph_decode_32_safe().
Cc: stable@vger.kernel.org
Fixes: 205ee1187a67 ("libceph: follow redirect replies from osds")
Assisted-by: Cursor
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/osd_client.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 92d76df2701ef..47879d73029aa 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -3642,7 +3642,7 @@ static int ceph_redirect_decode(void **p, void *end,
if (ret)
goto out;
- len = ceph_decode_32(p);
+ ceph_decode_32_safe(p, end, len, e_inval);
if (len > 0) {
pr_warn("ceph_request_redirect::object_name is set\n");
goto e_inval;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 772/869] libceph: Fix multiple unsafe decodes in ceph_oloc_decode()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (770 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 771/869] libceph: Fix unsafe decode in ceph_redirect_decode() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 773/869] libceph: reject mismatched CRUSH weight-set sizes Greg Kroah-Hartman
` (104 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raphael Zimmer, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
[ Upstream commit 10655007b9b679e46a9e383202c7bb791e5d1d13 ]
ceph_oloc_decode handles unchecked data received over the network from
an OSD. Currently, there are multiple decode operations that aren't
covered by any bounds check. Decoding these fields can therefore result
in out-of-bounds reads if a corrupted message is received.
This patch fixes the issue by adding bounds checks covering all
previously uncovered decode operations.
[ idryomov: use ceph_decode_64_safe() for hash ]
Cc: stable@vger.kernel.org
Fixes: 205ee1187a67 ("libceph: follow redirect replies from osds")
Assisted-by: Cursor
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/osd_client.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 47879d73029aa..0b37fb3c62644 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -3570,6 +3570,7 @@ static int ceph_oloc_decode(void **p, void *end,
ceph_decode_need(p, end, len, e_inval);
struct_end = *p + len;
+ ceph_decode_need(p, end, 8 + 4 + 4, e_inval);
oloc->pool = ceph_decode_64(p);
*p += 4; /* skip preferred */
@@ -3582,7 +3583,7 @@ static int ceph_oloc_decode(void **p, void *end,
if (struct_v >= 5) {
bool changed = false;
- len = ceph_decode_32(p);
+ ceph_decode_32_safe(p, end, len, e_inval);
if (len > 0) {
ceph_decode_need(p, end, len, e_inval);
if (!oloc->pool_ns ||
@@ -3601,7 +3602,9 @@ static int ceph_oloc_decode(void **p, void *end,
}
if (struct_v >= 6) {
- s64 hash = ceph_decode_64(p);
+ s64 hash;
+
+ ceph_decode_64_safe(p, end, hash, e_inval);
if (hash != -1) {
pr_warn("ceph_object_locator::hash is set\n");
goto e_inval;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 773/869] libceph: reject mismatched CRUSH weight-set sizes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (771 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 772/869] libceph: Fix multiple unsafe decodes in ceph_oloc_decode() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 774/869] libceph: reject an initial monmap with no monitors Greg Kroah-Hartman
` (103 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Hoffmann, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Hoffmann <f3lix.dev@gmx.de>
[ Upstream commit d8fc89b5bfe4cb3aebe4c8a818247d11291b841c ]
A CEPH_MSG_OSD_MAP message can contain CRUSH choose args with replacement
weight vectors for straw2 buckets. decode_choose_args() validates the
optional IDs vector against the referenced bucket, but does not validate
the size of any replacement-weight vector.
The CRUSH mapper assumes that each replacement vector has exactly as many
entries as the bucket. A zero-length vector for a nonempty bucket makes
bucket_straw2_choose() dereference NULL, while a shorter nonzero vector
causes an out-of-bounds read. An authenticated monitor or OSD can deliver
such a map and crash a kernel client when it performs placement for an
ordinary request.
Reject a nonempty collection of weight sets for an absent bucket and
require every replacement-weight vector to match its bucket size.
Cc: stable@vger.kernel.org
Fixes: 5cf9c4a9959b ("libceph, crush: per-pool crush_choose_arg_map for crush_do_rule()")
Assisted-by: Codex:gpt-5
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/osdmap.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 68bd45852fc37..e812b30778d57 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -378,7 +378,9 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
ceph_decode_32_safe(p, end, num_buckets, e_inval);
while (num_buckets--) {
struct crush_choose_arg *arg;
+ struct crush_bucket *bucket;
u32 bucket_index;
+ u32 i;
ceph_decode_32_safe(p, end, bucket_index, e_inval);
if (bucket_index >= arg_map->size)
@@ -389,10 +391,18 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
if (ret)
goto fail;
+ bucket = c->buckets[bucket_index];
if (arg->ids_size &&
- (!c->buckets[bucket_index] ||
- arg->ids_size != c->buckets[bucket_index]->size))
+ (!bucket || arg->ids_size != bucket->size))
goto e_inval;
+
+ if (arg->weight_set_size && !bucket)
+ goto e_inval;
+
+ for (i = 0; i < arg->weight_set_size; i++) {
+ if (arg->weight_set[i].size != bucket->size)
+ goto e_inval;
+ }
}
if (!__insert_choose_arg_map(&c->choose_args, arg_map)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 774/869] libceph: reject an initial monmap with no monitors
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (772 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 773/869] libceph: reject mismatched CRUSH weight-set sizes Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 775/869] ceph: fix integer overflow in the snap trace bounds check Greg Kroah-Hartman
` (102 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+1dbed5969931c19d3eb5,
Yogesh Gaur, Alex Markuze, Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Gaur <yogeshgaur.83@gmail.com>
[ Upstream commit 94dbce2ae4fdb57bdb53ffa3456da777a5cfb981 ]
build_initial_monmap() takes the monitor count straight from
ceph_options::num_mon and builds a monmap with that many entries without
checking that there is at least one. ceph_parse_ips() writes *count only
after it has parsed an address successfully, so a ceph_options that went
through a failed parse still has num_mon == 0 and the resulting monmap
has no monitors in it at all.
The first thing the client does with that monmap is open a session, and
pick_new_mon() asserts the invariant that it is non-empty:
kernel BUG at net/ceph/mon_client.c:211!
RIP: 0010:pick_new_mon net/ceph/mon_client.c:211 [inline]
RIP: 0010:__open_session+0x60f/0x740 net/ceph/mon_client.c:245
Call Trace:
ceph_monc_open_session+0x46/0x60 net/ceph/mon_client.c:534
__ceph_open_session+0x135/0x590 net/ceph/ceph_common.c:798
ceph_real_mount fs/ceph/super.c:1173 [inline]
ceph_get_tree+0xd98/0x1fd0 fs/ceph/super.c:1362
vfs_get_tree+0x92/0x320 fs/super.c:1947
vfs_cmd_create+0xd7/0x2a0 fs/fsopen.c:231
__do_sys_fsconfig+0x55a/0xcb0 fs/fsopen.c:463
The reproducer gets there through the new device syntax: an fsconfig()
mon_addr= that does not resolve ("libceph: resolve '127.0.0.' (ret=-3):
failed") leaves fsopt->mon_addr set but num_mon at 0, so the "No monitor
address" check in ceph_get_tree() passes and the mount proceeds with an
empty monmap. The next patch stops that string from being kept, but the
assertion should not be reachable from a mount option in the first place.
Commit 40480eee361e ("libceph: Reject monmaps advertising zero monitors")
made the same BUG_ON() unreachable from the wire by rejecting
num_mon == 0 in ceph_monmap_decode(). Apply the same rule to the initial
monmap, which is the only other way one gets built, and fail the mount
with -EINVAL rather than assert afterwards.
Cc: stable@vger.kernel.org
Fixes: 7b19b4db5add ("ceph: new device mount syntax")
Reported-by: syzbot+1dbed5969931c19d3eb5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1dbed5969931c19d3eb5
Assisted-by: Cursor
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/mon_client.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 614d2bba9fd60..a406fff75ba0d 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -1141,6 +1141,9 @@ static int build_initial_monmap(struct ceph_mon_client *monc)
int num_mon = opt->num_mon;
int i;
+ if (num_mon < 1 || num_mon > CEPH_MAX_MON)
+ return -EINVAL;
+
/* build initial monmap */
monc->monmap = kzalloc(struct_size(monc->monmap, mon_inst, num_mon),
GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 775/869] ceph: fix integer overflow in the snap trace bounds check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (773 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 774/869] libceph: reject an initial monmap with no monitors Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 776/869] ceph: Fix xattr buffer leak in __send_cap() Greg Kroah-Hartman
` (101 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+ecaada42f806f629, Xiang Mei,
Alex Markuze, Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit b3bf89767e3ca9506f1c7167cac97c41ec254d42 ]
ceph_update_snap_trace() bounds the two encoded snapid arrays that follow a
struct ceph_mds_snap_realm with sizeof(u64) * (num_snaps +
num_prior_parent_snaps). Both counts come straight off the wire as __le32,
so the addition is evaluated in unsigned int and wraps before sizeof(u64)
promotes it to size_t: an MDS sending num_snaps = 1 and
num_prior_parent_snaps = 0xffffffff makes the sum zero and the check
degenerates to ceph_decode_need(&p, e, 0, bad), which always passes.
dup_array() then reads num_snaps * 8 bytes past the end of the message
front, which ceph_msg_new2() allocates at exactly front_len bytes. An
unsolicited CEPH_MSG_CLIENT_SNAP reaches this from a malicious or
compromised MDS with no client-side action, as do the snaptraces carried in
an MDS reply and in a cap import.
Compute the length with size_add()/size_mul() so it saturates at SIZE_MAX
instead of wrapping, in the style fs/ceph/mdsmap.c already uses for
num_export_targets.
BUG: KASAN: slab-out-of-bounds in dup_array (include/linux/unaligned.h:28 fs/ceph/snap.c:500)
Read of size 8 at addr ffff8880102a16c8 by task kworker/1:2/129
Workqueue: ceph-msgr ceph_con_workfn
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
dup_array (include/linux/unaligned.h:28 fs/ceph/snap.c:500)
ceph_update_snap_trace (fs/ceph/snap.c:836)
ceph_handle_snap (fs/ceph/snap.c:1155)
mds_dispatch (fs/ceph/mds_client.c:7234)
ceph_con_process_message (net/ceph/messenger.c:1424)
ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
ceph_con_workfn (net/ceph/messenger.c:1576)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
...
The buggy address is located 0 bytes to the right of
allocated 72-byte region [ffff8880102a1680, ffff8880102a16c8)
Cc: stable@vger.kernel.org
Fixes: 963b61eb041e ("ceph: snapshot management")
Reported-by: co+ecaada42f806f629@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/snap.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index c65f2b202b2b3..00cfcef5fbb25 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -788,6 +788,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
struct ceph_snap_realm *first_realm = NULL;
struct ceph_snap_realm *realm_to_rebuild = NULL;
struct ceph_client *client = mdsc->fsc->client;
+ size_t snaps_len;
int rebuild_snapcs;
int err = -ENOMEM;
int ret;
@@ -802,8 +803,10 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
ceph_decode_need(&p, e, sizeof(*ri), bad);
ri = p;
p += sizeof(*ri);
- ceph_decode_need(&p, e, sizeof(u64)*(le32_to_cpu(ri->num_snaps) +
- le32_to_cpu(ri->num_prior_parent_snaps)), bad);
+ snaps_len = size_mul(size_add(le32_to_cpu(ri->num_snaps),
+ le32_to_cpu(ri->num_prior_parent_snaps)),
+ sizeof(u64));
+ ceph_decode_need(&p, e, snaps_len, bad);
snaps = p;
p += sizeof(u64) * le32_to_cpu(ri->num_snaps);
prior_parent_snaps = p;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 776/869] ceph: Fix xattr buffer leak in __send_cap()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (774 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 775/869] ceph: fix integer overflow in the snap trace bounds check Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 777/869] ceph: Fix mds session leak in __open_export_target_session() Greg Kroah-Hartman
` (100 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e51cf76e7275d1bb5ad2d529bb00feade632dadc ]
__prep_cap() takes a reference on the xattr blob via ceph_buffer_get()
and also grabs a reference to the old xattr blob returned by
__ceph_build_xattrs_blob(). These references are normally dropped in
__send_cap() after the cap message has been sent, but when ceph_msg_new()
fails, __send_cap() requeues the cap and returns early without dropping
them, leaking both buffers on every allocation failure.
Release arg->old_xattr_buf and arg->xattr_buf on the ceph_msg_new()
failure path before returning.
Cc: stable@vger.kernel.org
Fixes: 16d68903f56a ("ceph: break up send_cap_msg")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/caps.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 7ce1af5b61c88..3dfd230412cc2 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1561,6 +1561,8 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci)
spin_lock(&ci->i_ceph_lock);
__cap_delay_requeue(arg->session->s_mdsc, ci);
spin_unlock(&ci->i_ceph_lock);
+ ceph_buffer_put(arg->old_xattr_buf);
+ ceph_buffer_put(arg->xattr_buf);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 777/869] ceph: Fix mds session leak in __open_export_target_session()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (775 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 776/869] ceph: Fix xattr buffer leak in __send_cap() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 778/869] ceph: fix 32-bit overflow in readdir reply count check Greg Kroah-Hartman
` (99 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 6c80207392fdb86107d7acbdbf4c86cac38da1af ]
__open_export_target_session() holds a reference on the target session,
either from __ceph_lookup_mds_session() or from register_session(),
which the caller is expected to drop. When __open_session() fails, the
helper returns ERR_PTR(ret) without dropping that reference, leaking
one session reference on every open failure.
Drop the session reference before returning the error.
Cc: stable@vger.kernel.org
Fixes: b682c6d41bc2 ("ceph: switch to WARN_ON_ONCE in encode_supported_features()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index a5bc9f75e0f9c..56d8df7f7ebdd 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1758,8 +1758,10 @@ __open_export_target_session(struct ceph_mds_client *mdsc, int target)
if (session->s_state == CEPH_MDS_SESSION_NEW ||
session->s_state == CEPH_MDS_SESSION_CLOSING) {
ret = __open_session(mdsc, session);
- if (ret)
+ if (ret) {
+ ceph_put_mds_session(session);
return ERR_PTR(ret);
+ }
}
return session;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 778/869] ceph: fix 32-bit overflow in readdir reply count check
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (776 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 777/869] ceph: Fix mds session leak in __open_export_target_session() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 779/869] libceph: fix out-of-bounds reads from repeated CRUSH bucket entries Greg Kroah-Hartman
` (98 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 52913831ba56efceaafd80b501d68fa00f79bde6 ]
parse_reply_info_readdir() checks how many entries are in a readdir
reply by computing the end pointer of the decoded array. That pointer
addition can wrap on 32-bit kernels and let an oversized count pass the
check. For example, a count of 0x40000000 with 156-byte entries wraps
to a zero offset, so the decoder can write past the preallocated buffer.
Check the count against the number of entries that fit in the allocation
before publishing dir_nr. Reject oversized replies through the existing
error path.
Cc: stable@vger.kernel.org
Fixes: 54008399dc0c ("ceph: preallocate buffer for readdir reply")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 56d8df7f7ebdd..9e1b4bc3eab7c 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -436,10 +436,8 @@ static int parse_reply_info_readdir(void **p, void *end,
goto done;
BUG_ON(!info->dir_entries);
- if ((unsigned long)(info->dir_entries + num) >
- (unsigned long)info->dir_entries + info->dir_buf_size) {
+ if (num > info->dir_buf_size / sizeof(*info->dir_entries)) {
pr_err_client(cl, "dir contents are larger than expected\n");
- WARN_ON(1);
goto bad;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 779/869] libceph: fix out-of-bounds reads from repeated CRUSH bucket entries
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (777 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 778/869] ceph: fix 32-bit overflow in readdir reply count check Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 780/869] ceph: clamp MDS reply result code to the errno range Greg Kroah-Hartman
` (97 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 569a9bb1e5615c2b88b8d76f03a4ab82e65a673e ]
decode_choose_arg() assumes that its destination is zero-initialized.
Although decode_choose_args() zeroes the argument array, it does not reject
a repeated bucket_index and can decode into an already populated entry.
Repeating a bucket with weight_set_size=0 preserves its existing weight_set
pointer but clears the count. Placement then reads weight_set[-1].weights
and dereferences the resulting pointer.
A malformed monitor OSDMap triggers this during RBD placement:
BUG: KASAN: slab-out-of-bounds in crush_bucket_choose+0xdd1/0xf90
Read of size 8 at addr ffff88800290df70 by task init/75
Reject populated arguments before decoding another entry, so the error
path can free their original allocations.
Cc: stable@vger.kernel.org
Fixes: c7ed1a4bf4b4 ("crush: assume weight_set != null imples weight_set_size > 0")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/osdmap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e812b30778d57..803514a1bc7ce 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -387,6 +387,8 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
goto e_inval;
arg = &arg_map->args[bucket_index];
+ if (arg->ids || arg->weight_set)
+ goto e_inval;
ret = decode_choose_arg(p, end, arg);
if (ret)
goto fail;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 780/869] ceph: clamp MDS reply result code to the errno range
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (778 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 779/869] libceph: fix out-of-bounds reads from repeated CRUSH bucket entries Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 781/869] ceph: dont fail write_begin with -EAGAIN after flushing old snapc Greg Kroah-Hartman
` (96 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanfu Xie, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
[ Upstream commit ec8d583469ed64b4973192a21b5a41c33219721f ]
ceph_mdsc_wait_request() returns the reply head result code of the MDS
request to its callers as a plain int errno. The value is a
server-controlled u32 and nothing checks that it actually is an errno;
several callers pass it straight to ERR_PTR(), e.g.
ceph_finish_lookup() on the atomic open path:
err = ceph_mdsc_wait_request(...) /* e.g. +0x50fc00 */
...
if (err)
dentry = ERR_PTR(err);
IS_ERR() only recognizes the [-MAX_ERRNO, -1] window, so an
out-of-range value is not caught anywhere and survives as a "struct
dentry *". On the open path the positive error travels
ceph_finish_lookup() -> ceph_atomic_open() -> ERR_PTR() in
fs/namei.c's atomic_open() wrapper -> step_into(), which dereferences
it as a dentry and oopses (mainline 7.3-rc3-135-g4982d3552a3b, the
value in R12 is the server-supplied result):
BUG: KASAN: probably user-memory-access in range
[0x000000000050fc00-0x000000000050fc07]
RIP: 0010:step_into_slowpath+0x3e3/0xe60
R12: 000000000050fc00
Call Trace:
<TASK>
? __pfx_ceph_atomic_open+0x10/0x10
path_openat+0xf41/0x2440
do_file_open+0x228/0x480
do_sys_openat2+0x103/0x1d0
__x64_sys_openat+0x141/0x200
do_syscall_64+0xe8/0x4f0
entry_SYSCALL_64_after_hwframe+0x77/0x79
</TASK>
(0xdffffc00000a1f80 in the full report is the KASAN shadow of 0x50fc00;
without KASAN the raw value is read.) Values with the top bit set fare
no better: 0xd8000000 sign-extends through the int conversion into the
kernel address range and takes a page fault instead.
Clamp the result at the single read and return -EIO for anything
outside the errno range, which is what a malformed reply means there.
net/9p does the same to server errno values with safe_errno(). This
is the path the reported crash takes; the other readers of
head->result, including the ceph_async_create_cb() and
ceph_async_unlink_cb() callbacks, are not covered by this patch.
Each of the six crashing opens was run on a build of
7.3-rc3-135-g4982d3552a3bf with only this change applied: it crashes
the unpatched kernel on the first openat() (verified on the same
tree without the patch), and with the patch the open fails cleanly
without an oops. A few hundred normal file operations on the
patched kernel also completed without a crash; valid errno values
pass through unchanged.
Cc: stable@vger.kernel.org
Fixes: 2f2dc053404febedc9c273452d9d518fb31fde72 ("ceph: MDS client")
Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 9e1b4bc3eab7c..e1a0f77acc1ad 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3814,6 +3814,14 @@ int ceph_mdsc_wait_request(struct ceph_mds_client *mdsc,
/* only abort if we didn't race with a real reply */
if (test_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags)) {
err = le32_to_cpu(req->r_reply_info.head->result);
+ if (err > 0 || err < -MAX_ERRNO) {
+ /*
+ * The result is server-controlled. Values outside
+ * the errno range are turned into bogus pointers by
+ * the ERR_PTR() users among the callers.
+ */
+ err = -EIO;
+ }
} else if (err < 0) {
doutc(cl, "aborted request %lld with %d\n", req->r_tid, err);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 781/869] ceph: dont fail write_begin with -EAGAIN after flushing old snapc
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (779 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 780/869] ceph: clamp MDS reply result code to the errno range Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 782/869] ceph: validate fscrypt auth blob length Greg Kroah-Hartman
` (95 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Venky Shankar, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venky Shankar <vshankar@redhat.com>
[ Upstream commit 6ff7920ca78f6edcabc26c63d20f681d938027c7 ]
When ceph_netfs_check_write_begin() finds the folio dirty in an older
snap context, it drops the folio, waits for that snap context to be
flushed and then returns -EAGAIN so that the write is retried.
However, since commit fac47b43c760 ("netfs: do not unlock and put the
folio twice"), netfs_write_begin() retries only when ->check_write_begin()
returns 0 with *foliop cleared -- every error, -EAGAIN included, is
returned as is. The -EAGAIN thus propagates up to write(2), which fails
with "Resource temporarily unavailable" once the dirty data has been
flushed, rather than being retried.
This is easily hit by buffered writers rewriting dirty pages while
snapshots are being taken, e.g. a kernel build linking vmlinux into a
directory under a snapshot schedule:
ld: final link failed: Resource temporarily unavailable
Return the wait_event_killable() result as is so that netfs re-gets the
folio and retries on success.
Cc: stable@vger.kernel.org
Fixes: fac47b43c760 ("netfs: do not unlock and put the folio twice")
Link: https://tracker.ceph.com/issues/57656
Signed-off-by: Venky Shankar <vshankar@redhat.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index f58eba5456e36..fe8b7b4f6e8bf 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1889,7 +1889,12 @@ static int ceph_netfs_check_write_begin(struct file *file, loff_t pos, unsigned
r = wait_event_killable(ci->i_cap_wq,
context_is_writeable_or_written(inode, snapc));
ceph_put_snap_context(snapc);
- return r == 0 ? -EAGAIN : r;
+ /*
+ * *foliop is cleared, so a return of 0 makes
+ * netfs_write_begin() grab the folio again and call us again
+ * to recheck it. Any error (fatal signal) fails the write.
+ */
+ return r;
}
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 782/869] ceph: validate fscrypt auth blob length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (780 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 781/869] ceph: dont fail write_begin with -EAGAIN after flushing old snapc Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 783/869] ceph: bound name skips in ceph_mdsmap_decode() by the message end Greg Kroah-Hartman
` (94 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sung byeongchan, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sung byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit bc418e234e5be14b97dec90e84a680e615b4134e ]
ceph_crypt_get_context() trusts cfa_blob_len after checking only that the
inode-owned fscrypt_auth allocation contains the fixed header and one byte.
An MDS can therefore place a larger inner length in a shorter outer object,
causing memcpy() to read beyond the allocation when a caller requests the
encryption nonce.
Require the complete blob to fit in the inode-owned allocation before using
the inner length.
On the tested baseline, the malformed reply produced the same KASAN
slab-out-of-bounds read twice. An ordinary UID obtained sixteen wire-absent
SLUB redzone bytes in two non-KASAN production-path runs. The input was
rejected twice after this change, while a complete context still worked.
Cc: stable@vger.kernel.org
Fixes: 2d332d5bc424 ("ceph: fscrypt_auth handling for ceph")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/crypto.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
index a236035f3a7a4..f23ba5c148780 100644
--- a/fs/ceph/crypto.c
+++ b/fs/ceph/crypto.c
@@ -83,6 +83,9 @@ static int ceph_crypt_get_context(struct inode *inode, void *ctx, size_t len)
return -ENOBUFS;
ctxlen = le32_to_cpu(cfa->cfa_blob_len);
+ if (ctxlen > ci->fscrypt_auth_len -
+ offsetof(struct ceph_fscrypt_auth, cfa_blob))
+ return -ENOBUFS;
if (len < ctxlen)
return -ERANGE;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 783/869] ceph: bound name skips in ceph_mdsmap_decode() by the message end
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (781 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 782/869] ceph: validate fscrypt auth blob length Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 784/869] ceph: validate MDS reply fragtree split array length Greg Kroah-Hartman
` (93 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sung byeongchan, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sung byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 7f702e1703c9648fcb02a217d66c880d00417150 ]
ceph_mdsmap_decode() reads two remote u32 name lengths and advances its
parser cursor without checking that either string remains in the message.
On a 32-bit client, a sufficiently large length can wrap the cursor below
`end`. The following numerical bounds check then succeeds and dereferences
the wrapped address.
Use ceph_decode_skip_n() for both names so the remaining bytes are checked
before the cursor advances.
The issue produced a page fault in ceph_mdsmap_decode twice on the tested
i386 baseline. The same frame was rejected without a fault twice after
this change, while a normal MDSMap continued to be accepted.
Cc: stable@vger.kernel.org
Fixes: 2f2dc053404f ("ceph: MDS client")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mdsmap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index 0fd578f0b2cd2..d377d13f854d5 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -209,7 +209,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
*p += sizeof(u64);
namelen = ceph_decode_32(p); /* skip mds name */
- *p += namelen;
+ ceph_decode_skip_n(p, end, namelen, bad);
ceph_decode_32_safe(p, end, mds, bad);
ceph_decode_32_safe(p, end, inc, bad);
@@ -227,7 +227,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
laggy = laggy_since.tv_sec != 0 || laggy_since.tv_nsec != 0;
*p += sizeof(u32);
ceph_decode_32_safe(p, end, namelen, bad);
- *p += namelen;
+ ceph_decode_skip_n(p, end, namelen, bad);
if (info_v >= 2) {
ceph_decode_32_safe(p, end, num_export_targets, bad);
export_targets_len = size_mul(num_export_targets,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 784/869] ceph: validate MDS reply fragtree split array length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (782 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 783/869] ceph: bound name skips in ceph_mdsmap_decode() by the message end Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 785/869] ceph: validate encoded xattr name lengths Greg Kroah-Hartman
` (92 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sung byeongchan, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sung byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 8cab7e7461f81ea1e0fd45082b50bb3c04c0bb10 ]
parse_reply_info_in() advances over the fragtree split array using an
unchecked count multiplication. On a 32-bit client, nsplits=0x20000000
wraps the byte length to zero, so the reply is accepted and
ceph_fill_fragtree() sorts far beyond the message front.
Compute the split length with size_mul() and require the complete array to
remain in the inode record before advancing the cursor.
The malformed reply faulted in frag_tree_split_cmp() twice on the tested
i386 baseline. It was rejected without a fault twice after this change,
while a normal reply and a one-split control remained functional.
Cc: stable@vger.kernel.org
Fixes: 2f2dc053404f ("ceph: MDS client")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index e1a0f77acc1ad..0220daac0fba7 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -14,6 +14,7 @@
#include <linux/ktime.h>
#include <linux/bitmap.h>
#include <linux/mnt_idmapping.h>
+#include <linux/overflow.h>
#include "super.h"
#include "mds_client.h"
@@ -104,6 +105,7 @@ static int parse_reply_info_in(void **p, void *end,
u64 features)
{
int err = 0;
+ size_t splits_len;
u8 struct_v = 0;
if (features == (u64)-1) {
@@ -122,9 +124,11 @@ static int parse_reply_info_in(void **p, void *end,
ceph_decode_need(p, end, sizeof(struct ceph_mds_reply_inode), bad);
info->in = *p;
- *p += sizeof(struct ceph_mds_reply_inode) +
- sizeof(*info->in->fragtree.splits) *
- le32_to_cpu(info->in->fragtree.nsplits);
+ splits_len = size_mul(sizeof(*info->in->fragtree.splits),
+ le32_to_cpu(info->in->fragtree.nsplits));
+ *p += sizeof(struct ceph_mds_reply_inode);
+ ceph_decode_need(p, end, splits_len, bad);
+ *p += splits_len;
ceph_decode_32_safe(p, end, info->symlink_len, bad);
ceph_decode_need(p, end, info->symlink_len, bad);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 785/869] ceph: validate encoded xattr name lengths
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (783 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 784/869] ceph: validate MDS reply fragtree split array length Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 786/869] ceph: fix uninitialized err in ceph_netfs_issue_read() Greg Kroah-Hartman
` (91 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sung byeongchan, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sung byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 166375898d29fea050a9abec855da6075050d5c9 ]
__build_xattrs() advances over an MDS-provided name length before checking
that the name remains in the encoded xattr blob. On 32-bit clients,
UINT_MAX wraps the cursor and is stored as a negative internal name
length. A later ordinary listxattr() converts it back to a UINT_MAX memcpy
size and corrupts kernel memory.
Check the name range before advancing and reject name, value, or aggregate
sizes that overflow the signed internal accounting.
The malformed blob corrupted kernel state in two baseline boots. It was
rejected cleanly twice with this change, while normal and length-only
controls remained safe.
Cc: stable@vger.kernel.org
Fixes: 355da1eb7a1f ("ceph: inode operations")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/xattr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index cc73b0874ce40..90a9e7de8fea0 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -11,6 +11,7 @@
#include <linux/security.h>
#include <linux/posix_acl_xattr.h>
#include <linux/slab.h>
+#include <linux/overflow.h>
#define XATTR_CEPH_PREFIX "ceph."
#define XATTR_CEPH_PREFIX_LEN (sizeof (XATTR_CEPH_PREFIX) - 1)
@@ -845,14 +846,23 @@ static int __build_xattrs(struct inode *inode)
}
err = -EIO;
while (numattr--) {
+ int names_size, vals_size;
+
ceph_decode_32_safe(&p, end, len, bad);
namelen = len;
name = p;
+ ceph_decode_need(&p, end, namelen, bad);
p += len;
ceph_decode_32_safe(&p, end, len, bad);
ceph_decode_need(&p, end, len, bad);
val = p;
p += len;
+ if (namelen > INT_MAX || len > INT_MAX ||
+ check_add_overflow(ci->i_xattrs.names_size,
+ (int)namelen, &names_size) ||
+ check_add_overflow(ci->i_xattrs.vals_size,
+ (int)len, &vals_size))
+ goto bad;
err = __set_xattr(ci, name, namelen, val, len,
0, 0, &xattrs[numattr]);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 786/869] ceph: fix uninitialized err in ceph_netfs_issue_read()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (784 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 785/869] ceph: validate encoded xattr name lengths Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 787/869] f2fs: fix to update superblock crc in sanity_check_area_boundary() Greg Kroah-Hartman
` (90 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Alex Markuze,
Xiubo Li, Ilya Dryomov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Markuze <amarkuze@redhat.com>
[ Upstream commit 823d21c78453fcdf58dbd8ecefbb41f4f3eb6540 ]
ceph_netfs_issue_read() declares err without an initializer. On the
unencrypted, non-sparse success path nothing assigns it, then the
out: label does if (err) netfs_read_subreq_terminated(subreq).
With CONFIG_INIT_STACK_ALL_PATTERN, err is 0xaaaaaaaa (nonzero), so
the subrequest is terminated while the OSD READ is still in flight.
netfs then frees the rolling buffer that the OSD iterator still
points at, causing a KASAN UAF / oops, and finish_netfs_read()
terminates the same subrequest a second time. CONFIG_INIT_STACK_ALL_ZERO
hides it because err happens to be 0.
Restore the err = 0 initializer so a successful submit leaves
completion to finish_netfs_read() only.
Cc: stable@vger.kernel.org
Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
Reported-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Alex Markuze <amarkuze@redhat.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index fe8b7b4f6e8bf..51aeae341f56d 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -362,7 +362,7 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq)
struct ceph_client *cl = fsc->client;
struct ceph_osd_request *req = NULL;
struct ceph_vino vino = ceph_vino(inode);
- int err;
+ int err = 0;
u64 len;
bool sparse = IS_ENCRYPTED(inode) || ceph_test_mount_opt(fsc, SPARSEREAD);
u64 off = subreq->start;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 787/869] f2fs: fix to update superblock crc in sanity_check_area_boundary()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (785 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 786/869] ceph: fix uninitialized err in ceph_netfs_issue_read() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 788/869] ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch Greg Kroah-Hartman
` (89 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit f8f956c7ec8c0285d7a80bed497d2f7adcbded15 ]
This patch fixes the bug reported by Sashiko:
We should update superblock crc along w/ raw_super->segment_count in
sanity_check_area_boundary() if sb_checksum feature is enabled.
Cc: stable@kernel.org
Fixes: d440c52d3151 ("f2fs: support superblock checksum")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 11d218b415b0d..69d36e1a301bf 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3920,6 +3920,12 @@ static inline bool sanity_check_area_boundary(struct f2fs_sb_info *sbi,
/* fix in-memory information all the time */
raw_super->segment_count = cpu_to_le32((main_end_blkaddr -
segment0_blkaddr) >> log_blocks_per_seg);
+ if (__F2FS_HAS_FEATURE(raw_super, F2FS_FEATURE_SB_CHKSUM)) {
+ __u32 crc = f2fs_crc32(raw_super,
+ offsetof(struct f2fs_super_block, crc));
+
+ raw_super->crc = cpu_to_le32(crc);
+ }
if (f2fs_readonly(sb) || f2fs_hw_is_readonly(sbi)) {
set_sbi_flag(sbi, SBI_NEED_SB_WRITE);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 788/869] ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (786 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 787/869] f2fs: fix to update superblock crc in sanity_check_area_boundary() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 789/869] ASoC: codecs: wsa884x: Accept temperatures across the full trim range Greg Kroah-Hartman
` (88 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Val Packett,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit f3c7bee984aa0ba2b48a44e16a6f3ec2c27f851e ]
The response sent by the firmware when requesting a clock vote (opcode
AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST) does not actually have
the same opcode + status payload as APR_BASIC_RSP_RESULT. Rather, it
returns one single u32 which is the client_handle that must be used in
future unvote requests for the same clock.
As a result of this type confusion, the status returned by the callback
to q6afe_vote_lpass_core_hw was actually an out-of-bounds read. It was
only interpreted as success (0) most of the time due to luck, but there
are some reports of random errors such as:
[ 20.961100] qcom-q6afe aprsvc:service:4:4: AFE failed to vote (3)
[ 20.961131] Failed to prepare clk 'core': -110
Fix by correctly interpreting the response as a single u32, and actually
store it as the client_handle to ensure unvote would work correctly.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/5976946.DvuYhMxLoT@antlia/
Fixes: 55e07531d922 ("ASoC: q6dsp: q6afe: add lpass hw voting support")
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Val Packett <val@packett.cool>
Link: https://patch.msgid.link/20261016063536.598610-1-val@packett.cool
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6afe.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
index 7b59d514b432a..d2cb0ccd34562 100644
--- a/sound/soc/qcom/qdsp6/q6afe.c
+++ b/sound/soc/qcom/qdsp6/q6afe.c
@@ -377,6 +377,7 @@ struct q6afe {
struct q6core_svc_api_info ainfo;
struct mutex lock;
struct aprv2_ibasic_rsp_result_t result;
+ uint32_t vote_result;
wait_queue_head_t wait;
struct list_head port_list;
spinlock_t port_list_lock;
@@ -966,13 +967,14 @@ static int q6afe_callback(struct apr_device *adev, struct apr_resp_pkt *data)
struct aprv2_ibasic_rsp_result_t *res;
struct apr_hdr *hdr = &data->hdr;
struct q6afe_port *port;
+ uint32_t *vote_res;
if (!data->payload_size)
return 0;
- res = data->payload;
switch (hdr->opcode) {
case APR_BASIC_RSP_RESULT: {
+ res = data->payload;
if (res->status) {
dev_err(afe->dev, "cmd = 0x%x returned error = 0x%x\n",
res->opcode, res->status);
@@ -999,8 +1001,10 @@ static int q6afe_callback(struct apr_device *adev, struct apr_resp_pkt *data)
}
break;
case AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST:
+ vote_res = data->payload;
afe->result.opcode = hdr->opcode;
- afe->result.status = res->status;
+ afe->result.status = 0;
+ afe->vote_result = *vote_res;
wake_up(&afe->wait);
break;
default:
@@ -1910,6 +1914,8 @@ int q6afe_vote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST);
if (ret)
dev_err(afe->dev, "AFE failed to vote (%d)\n", hw_block_id);
+ else
+ *client_handle = afe->vote_result;
kfree(pkt);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 789/869] ASoC: codecs: wsa884x: Accept temperatures across the full trim range
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (787 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 788/869] ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 790/869] ASoC: codecs: wsa883x: " Greg Kroah-Hartman
` (87 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 00535515e3c14fbee20de4a1aa61cfb3390f0f50 ]
wsa884x_get_temp() rejects any reading outside 5..45 degC with -EAGAIN.
A speaker that has been playing, or sits in a warm laptop, easily runs
above 45 degC, so its temperature becomes unreadable when it matters.
The check only needs to drop bogus conversions, such as the all-zero
reading before the PA is first enabled. Bound it by the -10..150 degC
two-point trim range instead.
Fixes: 6b99dc62d940 ("ASoC: codecs: wsa884x: Implement temperature reading and hwmon")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261023171316.819857-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wsa884x.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/sound/soc/codecs/wsa884x.c b/sound/soc/codecs/wsa884x.c
index 5ecd7962d77ae..d941e9826ba00 100644
--- a/sound/soc/codecs/wsa884x.c
+++ b/sound/soc/codecs/wsa884x.c
@@ -720,10 +720,11 @@
/*
* Device will report senseless data in many cases, so discard any measurements
- * outside of valid range.
+ * outside of the two-point trim range. Do not narrow this to ambient: a
+ * speaker that has been playing easily runs well above 45 degC.
*/
-#define WSA884X_LOW_TEMP_THRESHOLD 5
-#define WSA884X_HIGH_TEMP_THRESHOLD 45
+#define WSA884X_LOW_TEMP_THRESHOLD WSA884X_T1_TEMP
+#define WSA884X_HIGH_TEMP_THRESHOLD WSA884X_T2_TEMP
struct wsa884x_priv {
struct regmap *regmap;
@@ -1931,8 +1932,8 @@ static int wsa884x_get_temp(struct wsa884x_priv *wsa884x, long *temp)
dev_dbg(wsa884x->dev, "Measured temp %ld (dmeas=%d, d1=%d, d2=%d)\n",
val, dmeas, d1, d2);
- if ((val > WSA884X_LOW_TEMP_THRESHOLD) &&
- (val < WSA884X_HIGH_TEMP_THRESHOLD)) {
+ if (val >= WSA884X_LOW_TEMP_THRESHOLD &&
+ val <= WSA884X_HIGH_TEMP_THRESHOLD) {
wsa884x->temperature = val;
*temp = val * 1000;
ret = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 790/869] ASoC: codecs: wsa883x: Accept temperatures across the full trim range
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (788 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 789/869] ASoC: codecs: wsa884x: Accept temperatures across the full trim range Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 791/869] net: usb: pegasus: check rx pkt_len against the received length Greg Kroah-Hartman
` (86 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 6a55cf0d9dd2e2493a5030a4f7b0413d31165e45 ]
wsa883x_get_temp() rejects any reading outside 5..45 degC with -EAGAIN,
so a speaker that has been playing, or sits in a warm chassis, becomes
unreadable above 45 degC.
Bound the check by the -10..150 degC two-point trim range instead, and
use inclusive comparisons, as in_range() excludes the upper bound.
Fixes: a02c42d41af7 ("ASoC: codecs: wsa883x: Implement temperature reading and hwmon")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261023171316.819857-4-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wsa883x.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c
index 5f2ced650dcc8..6fb50b6e5e188 100644
--- a/sound/soc/codecs/wsa883x.c
+++ b/sound/soc/codecs/wsa883x.c
@@ -455,10 +455,11 @@
/*
* Device will report senseless data in many cases, so discard any measurements
- * outside of valid range.
+ * outside of the two-point trim range. Do not narrow this to ambient: a
+ * speaker that has been playing easily runs well above 45 degC.
*/
-#define WSA883X_LOW_TEMP_THRESHOLD 5
-#define WSA883X_HIGH_TEMP_THRESHOLD 45
+#define WSA883X_LOW_TEMP_THRESHOLD WSA883X_T1_TEMP
+#define WSA883X_HIGH_TEMP_THRESHOLD WSA883X_T2_TEMP
struct wsa883x_priv {
struct regmap *regmap;
@@ -1430,7 +1431,7 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
unsigned int dmeas_msb = 0, dmeas_lsb = 0;
int d1, d2, dmeas;
unsigned int mask;
- int ret, range;
+ int ret;
long val;
guard(mutex)(&wsa883x->sp_lock);
@@ -1493,8 +1494,8 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
}
val = WSA883X_T1_TEMP + (((dmeas - d1) * (WSA883X_T2_TEMP - WSA883X_T1_TEMP)) / (d2 - d1));
- range = WSA883X_HIGH_TEMP_THRESHOLD - WSA883X_LOW_TEMP_THRESHOLD;
- if (in_range(val, WSA883X_LOW_TEMP_THRESHOLD, range)) {
+ if (val >= WSA883X_LOW_TEMP_THRESHOLD &&
+ val <= WSA883X_HIGH_TEMP_THRESHOLD) {
wsa883x->temperature = val;
*temp = val * 1000;
ret = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 791/869] net: usb: pegasus: check rx pkt_len against the received length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (789 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 790/869] ASoC: codecs: wsa883x: " Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 792/869] bonding: fix out-of-bounds read of arp_ip_target Greg Kroah-Hartman
` (85 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Jie Law, Simon Horman,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
[ Upstream commit efee699f6de06611234ef9b0abd52db1340e5452 ]
read_bulk_callback() takes the frame length from the device, from the
receive header on the 0x8513 and from the trailing status bytes on the
other chips, and only checks it against PEGASUS_MTU before passing that
many bytes up the stack. In two cases the stack then uses bytes that the
device did not send:
- A device that sends a short transfer but claims a long frame gets the
stale or uninitialized remainder of the receive skb delivered as
packet data.
- A device that claims a frame shorter than an Ethernet header gets
past the check as well. eth_type_trans() takes pkt_type from h_dest
and the protocol from h_proto without checking skb->len. If the
transfer is also short, those come from bytes left in the skb by an
earlier transfer, or from uninitialized memory.
Drop frames shorter than ETH_HLEN, and frames whose claimed length, plus
the 0x8513 header, does not fit in the bytes actually received, and
count them as length errors. urb->actual_length never exceeds the
PEGASUS_MTU sized transfer buffer, so this also covers the existing
PEGASUS_MTU check. Valid Ethernet frames are at least 60 bytes long
without the FCS, so they are not affected.
Found by code review with LLM assistance. With an emulated USB device,
a 101-byte transfer claiming a 1500-byte frame was passed up as a
1500-byte packet before this change and is dropped after it, and
frames claiming 0, 4 and 13 bytes were passed up and are now dropped
and counted in rx_length_errors. The extra bytes happened to be zero
in the first test, so disclosure of actual kernel data was not
demonstrated.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261021020310.34045-3-law.wei.jie@gt.tech.gov.sg
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/pegasus.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index f5a26a0bc679a..69445a94ee6ff 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -523,11 +523,17 @@ static void read_bulk_callback(struct urb *urb)
}
/*
- * If the packet is unreasonably long, quietly drop it rather than
- * kernel panicing by calling skb_put.
+ * Drop frames shorter than an Ethernet header, because
+ * eth_type_trans() reads the header whatever the length, and frames
+ * longer than what was actually received. Passing either up would
+ * expose stale buffer contents, and skb_put() could panic on the
+ * latter. count is at most PEGASUS_MTU.
*/
- if (pkt_len > PEGASUS_MTU - rx_offset)
+ if (pkt_len < ETH_HLEN || pkt_len + rx_offset > count) {
+ net->stats.rx_errors++;
+ net->stats.rx_length_errors++;
goto goon;
+ }
/*
* at this point we are sure pegasus->rx_skb != NULL
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 792/869] bonding: fix out-of-bounds read of arp_ip_target
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (790 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 791/869] net: usb: pegasus: check rx pkt_len against the received length Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 793/869] ipmr: fully initialize the synthetic IP header in ipmr_get_route() Greg Kroah-Hartman
` (84 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen,
Fernando Fernandez Mancera, Nikolay Aleksandrov, Jay Vosburgh,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit a81513bf5bdf29cf00c0a11f56be515c1ec260f4 ]
arp_ip_target is a module parameter array with BOND_MAX_ARP_TARGETS
entries. In the loop parsing it in bond_check_params(), arp_ip_count is
the number of accepted targets, while i is the index into
arp_ip_target. Invalid and duplicate entries are skipped without
bumping arp_ip_count, so bounding the loop with arp_ip_count lets i run
past the end of arp_ip_target, e.g. 16 targets with one duplicate:
BUG: KASAN: global-out-of-bounds in bond_check_params.constprop.0+0x1148/0x1440
Read of size 8 at addr ffffffff96e9ee00 by task swapper/0/1
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
print_report+0xd1/0x630
kasan_report+0xf3/0x130
__asan_report_load8_noabort+0x14/0x30
bond_check_params.constprop.0+0x1148/0x1440
bonding_init+0x13/0xe0
do_one_initcall+0xe7/0x5b0
kernel_init_freeable+0xa91/0x1120
kernel_init+0x24/0x220
ret_from_fork+0x5b3/0x820
ret_from_fork_asm+0x1a/0x30
</TASK>
The buggy address belongs to the variable:
arp_ip_target+0x80/0xa0
Bound the loop with i instead. arp_ip_count never exceeds i, so it
stays within BOND_MAX_ARP_TARGETS too.
Fixes: 5a5c5fd48e3b ("bonding: arp_ip_count and arp_targets can be wrong")
Cc: stable@vger.kernel.org
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20261023104528.232427-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index baafc13603d3d..2e9e1b4d74da9 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -6270,7 +6270,7 @@ static int __init bond_check_params(struct bond_params *params)
}
for (arp_ip_count = 0, i = 0;
- (arp_ip_count < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
+ (i < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
__be32 ip;
/* not a complete check, but good enough to catch mistakes */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 793/869] ipmr: fully initialize the synthetic IP header in ipmr_get_route()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (791 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 792/869] bonding: fix out-of-bounds read of arp_ip_target Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 794/869] dt-bindings: clock: ma35d1: Document the missing crystal inputs Greg Kroah-Hartman
` (83 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Ido Schimmel, Hangbin Liu,
Eric Dumazet, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 134351edc28e083c61012b6c69e8e54dd7fa5bcc ]
For an unresolved multicast route query, ipmr_get_route() builds a
synthetic IP header in the headroom obtained from
skb_realloc_headroom(), which does not zero the memory it allocates.
Only a few fields are initialized, leaving others as stale heap
contents.
ipmr_cache_report() copies this header into the IGMPMSG_NOCACHE report
that is queued to the mroute socket, so a recvmsg() on that socket leaks
the uninitialized bytes to user space: the 'tos' field [1] and the 'id'
and 'frag_off' fields [2].
Fix by zeroing the IP header before filling in the few fields that are
used, so that the entire header is initialized, as in ip6mr_get_route().
[1]
BUG: KMSAN: kernel-infoleak in _copy_to_iter
raw_recvmsg
Uninit was stored to memory at:
ipmr_cache_report
ipmr_cache_unresolved
ipmr_get_route
Uninit was created at:
pskb_expand_head
skb_realloc_headroom
ipmr_get_route
Byte 1 of 28 is uninitialized
[2]
BUG: KMSAN: kernel-infoleak in _copy_to_iter
raw_recvmsg
Uninit was stored to memory at:
ipmr_cache_report
ipmr_cache_unresolved
ipmr_get_route
Uninit was created at:
pskb_expand_head
skb_realloc_headroom
ipmr_get_route
Bytes 4-7 of 28 are uninitialized
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/0545f0c83f5ee2f6696210f87268e811ef655715.1792476357.git.zhilinz%40nebusec.ai
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261025071729.34967-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ipmr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b1282c01a77e0..66a7f25f236b8 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2474,6 +2474,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
skb_push(skb2, sizeof(struct iphdr));
skb_reset_network_header(skb2);
iph = ip_hdr(skb2);
+ memset(iph, 0, sizeof(*iph));
iph->ihl = sizeof(struct iphdr) >> 2;
iph->saddr = saddr;
iph->daddr = daddr;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 794/869] dt-bindings: clock: ma35d1: Document the missing crystal inputs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (792 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 793/869] ipmr: fully initialize the synthetic IP header in ipmr_get_route() Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 795/869] tcp: limit tcp_tso_rtt_log to a valid shift count Greg Kroah-Hartman
` (82 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Miquel Raynal,
Jerome Brunet, Brian Masney, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit ea1f41802312e77b58113146a060fb0546b2234d ]
The MA35D1 clock controller takes two crystal oscillator inputs from
the board:
- HXT, a high-speed 24 MHz crystal for most of the system
- LXT, a low-speed 32.768 kHz crytal for the RTC and low power modes
So far the binding was expecting a single crystal. The example named it
HXT, but no real definition for it was given. LXT was not even
described. In order to remain backward compatible, we will continue to
allow either one (HXT) or two (HXT then LXT) input clocks. I propose to
give those phandles a name to clarify what these entries expect, but I'm
not listing the clock-names property in the required block, for backward
compatibility. The rates are fixed by the TRM, so even if the second
oscillator is not described, the OS can make an educated guess.
Fixes: 2f8b5eb589cb ("dt-bindings: clock: nuvoton: add binding for ma35d1 clock controller")
Cc: stable@vger.kernel.org
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260930-perso-ma35d1-upstream-clk-v6-2-48937ee6c9bb@bootlin.com
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bindings/clock/nuvoton,ma35d1-clk.yaml | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml b/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
index 8f0c43683729b..9649feda8d7a5 100644
--- a/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
+++ b/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
@@ -29,7 +29,18 @@ properties:
const: 1
clocks:
- maxItems: 1
+ minItems: 1
+ maxItems: 2
+ description:
+ The controller takes 2 crystal oscillator inputs from the board.
+ HXT is a 24 MHz crystal feeding the internal PLLs. LXT is a 32.768
+ kHz crystal, for RTC and low power operations.
+
+ clock-names:
+ minItems: 1
+ items:
+ - const: hxt
+ - const: lxt
nuvoton,pll-mode:
description:
@@ -58,6 +69,7 @@ examples:
compatible = "nuvoton,ma35d1-clk";
reg = <0x40460200 0x100>;
#clock-cells = <1>;
- clocks = <&clk_hxt>;
+ clocks = <&clk_hxt>, <&clk_lxt>;
+ clock-names = "hxt", "lxt";
};
...
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 795/869] tcp: limit tcp_tso_rtt_log to a valid shift count
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (793 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 794/869] dt-bindings: clock: ma35d1: Document the missing crystal inputs Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 796/869] xsk: restore UMEM flags after failed pool assignment Greg Kroah-Hartman
` (81 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingjie Wang, Jiayuan Chen,
Neal Cardwell, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingjie Wang <1075151112@qq.com>
[ Upstream commit 850a7225bc61cdfaf0c4b02ff341ae7cb54902f5 ]
tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
an upper bound, so it accepts values through 255. Values above 31 make
the shift undefined.
A process with CAP_NET_ADMIN in the target network namespace can set the
per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
TCP data over loopback triggers:
UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
shift exponent 32 is too large for 32-bit type 'unsigned int'
Call Trace:
__ubsan_handle_shift_out_of_bounds
tcp_tso_segs
tcp_write_xmit
__tcp_push_pending_frames
tcp_push
tcp_sendmsg_locked
Limit the sysctl to 31, the largest valid shift count for a u32, and
document the accepted range. Writes of larger values now fail with
-EINVAL.
On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
valid boundary values produced no sanitizer diagnostics.
Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/tencent_31D2FFCCE76C50A695A1270151F825E90906@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/networking/ip-sysctl.rst | 2 ++
net/ipv4/sysctl_net_ipv4.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index c2ca933f7bdbc..9b8a1980bb546 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1088,6 +1088,8 @@ tcp_tso_rtt_log - INTEGER
If you want to use the old autosizing, set this sysctl to 0.
+ Possible values are [0, 31], inclusive.
+
Default: 9 (2^9 = 512 usec)
tcp_pacing_ss_ratio - INTEGER
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 34a8a932402d8..bc3e5d6b8662c 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,7 @@ static int ip_local_port_range_max[] = { 65535, 65535 };
static int tcp_adv_win_scale_min = -31;
static int tcp_adv_win_scale_max = 31;
static int tcp_app_win_max = 31;
+static int tcp_tso_rtt_log_max = 31;
static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
static int tcp_min_snd_mss_max = 65535;
static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
@@ -1379,6 +1380,7 @@ static struct ctl_table ipv4_net_table[] = {
.maxlen = sizeof(u8),
.mode = 0644,
.proc_handler = proc_dou8vec_minmax,
+ .extra2 = &tcp_tso_rtt_log_max,
},
{
.procname = "tcp_min_rtt_wlen",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 796/869] xsk: restore UMEM flags after failed pool assignment
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (794 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 795/869] tcp: limit tcp_tso_rtt_log to a valid shift count Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:57 ` [PATCH 6.18 797/869] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl() Greg Kroah-Hartman
` (80 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Moses, Maciej Fijalkowski,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moses <p@1g4.org>
[ Upstream commit b88b826ec54a06f48a42580c609ba81293ebec8e ]
xp_assign_dev() sets XDP_UMEM_SG_FLAG before checking whether the
device supports multibuffer zero-copy. If assignment fails, xsk_bind()
destroys the pool but retains the registered UMEM. A subsequent bind
without XDP_USE_SG inherits the stale flag.
The flag also changes RX buffer sizing after DMA mapping. On igc, a
failed SG bind followed by a non-SG retry with 4096-byte chunks and
1792 bytes of headroom passes admission with 2048 bytes, but programs
a 1024-byte RX buffer. On I225-V hardware, an ordinary 1514-byte frame
is truncated to 1024 bytes or 1008 with RX timestamps enabled.
Restoring the original flags eliminates the truncation in both cases.
Save the UMEM flags before assignment and restore them on failure.
Discovered during development of AF_XDP changes for igc.
Fixes: d609f3d228a8 ("xsk: add multi-buffer support for sockets sharing umem")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20261021224705.2078753-1-p@1g4.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xdp/xsk_buff_pool.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index 5ee0edaf075c0..9dc1ff31867a1 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c
@@ -175,6 +175,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
{
u32 needed = netdev->mtu + ETH_PAD_LEN;
u32 segs = netdev->xdp_zc_max_segs;
+ u8 umem_flags = pool->umem->flags;
bool mbuf = flags & XDP_USE_SG;
bool force_zc, force_copy;
struct netdev_bpf bpf;
@@ -270,6 +271,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
if (!force_zc)
err = 0; /* fallback to copy mode */
if (err) {
+ pool->umem->flags = umem_flags;
xsk_clear_pool_at_qid(netdev, queue_id);
dev_put(netdev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 797/869] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (795 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 796/869] xsk: restore UMEM flags after failed pool assignment Greg Kroah-Hartman
@ 2026-11-07 13:57 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 798/869] ALSA: usb-audio: Bound packet copies by the PCM buffer size Greg Kroah-Hartman
` (79 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dominik Maier, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Maier <dmnk@google.com>
[ Upstream commit 87409eedc543d288cdd49c2174f7d61eca7b8db5 ]
lo_ioctl() checks for (mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN)
before allowing LOOP_SET_STATUS or LOOP_SET_STATUS64, but not
lo_compat_ioctl(), the handler used by 32-bit user space on 64-bit
kernels.
As a result, on 64-bit kernels with CONFIG_COMPAT=y, a 32-bit
unprivileged user-space process holding a read-only (O_RDONLY) file
descriptor to an active /dev/loopN device can issue a compat
LOOP_SET_STATUS ioctl to modify lo_offset, clear lo_sizelimit to 0
(exposing backing-file data past the configured limit), or alter
lo_flags.
Enforce the same (mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN) check
on LOOP_SET_STATUS in lo_compat_ioctl().
Cc: stable@vger.kernel.org
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Reviewed-by: Bart Van Assche bvanassche@acm.org
Link: https://patch.msgid.link/20261025200740.2064379-1-dmnk@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/loop.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 13ce229d450cd..57d3babbd63bf 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1686,8 +1686,10 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
switch(cmd) {
case LOOP_SET_STATUS:
- err = loop_set_status_compat(lo,
- (const struct compat_loop_info __user *)arg);
+ err = -EPERM;
+ if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
+ err = loop_set_status_compat(lo,
+ (const struct compat_loop_info __user *)arg);
break;
case LOOP_GET_STATUS:
err = loop_get_status_compat(lo,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 798/869] ALSA: usb-audio: Bound packet copies by the PCM buffer size
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (796 preceding siblings ...)
2026-11-07 13:57 ` [PATCH 6.18 797/869] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 799/869] ALSA: hda: Reject codec reset on ASoC (ext_ops) buses Greg Kroah-Hartman
` (78 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sinan Turunc, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinan Turunc <enscrpt@pm.me>
[ Upstream commit 06be918062adc1a5a76dc346803b136b20bdb5ae ]
retire_capture_urb() and prepare_playback_urb() assume that one USB
packet never carries more data than the whole ALSA ring buffer. Nothing
enforces that: the packet size comes from the device (wMaxPacketSize,
and curpacksize == maxpacksize when the class-specific endpoint
descriptor sets MaxPacketsOnly), while the PCM hardware constraints only
require 64-byte periods, two periods and a period time of one data
interval. An 8 kHz mono U8 stream on a 128-byte buffer is legal, and a
full-speed device can send 1023-byte packets into it.
On the first oversized packet hwptr_done is wrapped once and stays
beyond buffer_bytes (895 for 1023 bytes into 128). On the next packet
the wrap arithmetic in the copy path computes
bytes1 = subs->buffer_bytes - oldptr
with oldptr > buffer_bytes, so bytes1 wraps to about 4 GB and memcpy()
runs off the end of the URB buffer and of the vmalloc'd DMA buffer:
BUG: KASAN: slab-out-of-bounds in retire_capture_urb+0x251/0x870
Read of size 4294966529 at addr ffff88800c1e2800 by task vhci_rx/82
and for playback, where copy_to_urb() has the same shape:
BUG: KASAN: vmalloc-out-of-bounds in copy_to_urb.isra.0+0x188/0x430
Read of size 4294966529 at addr ffffc9000004537f by task vhci_rx/79
prepare_playback_urb+0x98a/0x1fc0
Truncate an oversized capture packet to the buffer size, and stop
filling a playback URB once it holds a whole buffer. With bytes <=
buffer_bytes the single wrap of hwptr_done and the two-part memcpy()
in both copy paths stay inside the buffer. A device whose packets do
not fit the buffer at all was never going to play correctly anyway.
Reproduced on 7.3-rc7 with a USB/IP device (dummy_hcd cannot carry
isochronous data) advertising a UAC1 endpoint with MaxPacketsOnly and
wMaxPacketSize 1023, and a PCM client using period_size 64, periods 2.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Sinan Turunc <enscrpt@pm.me>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261026223543.620-2-enscrpt@pm.me
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/pcm.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 682b6c1fe76ba..c2f7b08607ac8 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1343,6 +1343,18 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
bytes -= adj;
subs->stream_offset_adj -= adj;
}
+ /*
+ * A packet can be as large as the endpoint's maxpacksize, which
+ * the device chooses, while the ring buffer can be as small as
+ * two 64-byte periods. The hwptr_done wrap below handles one
+ * wrap only, so never take more than one buffer from a packet.
+ */
+ if (unlikely(bytes > subs->buffer_bytes)) {
+ dev_warn_ratelimited(&subs->dev->dev,
+ "%u-byte packet exceeds %u-byte buffer, truncating\n",
+ bytes, subs->buffer_bytes);
+ bytes = subs->buffer_bytes;
+ }
frames = bytes / stride;
if (!subs->txfr_quirk)
bytes = frames * stride;
@@ -1553,8 +1565,14 @@ static int prepare_playback_urb(struct snd_usb_substream *subs,
for (i = 0; i < ctx->packets; i++) {
counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail);
+ /*
+ * Bound by the ring buffer as well as by the URB:
+ * copy_to_urb() wraps hwptr_done once, so one URB must
+ * never carry more than the whole buffer.
+ */
if (counts < 0 ||
- (frames + counts) * stride > ctx->buffer_size)
+ (frames + counts) * stride > ctx->buffer_size ||
+ (frames + counts) * stride > subs->buffer_bytes)
break;
/* set up descriptor */
urb->iso_frame_desc[i].offset = frames * stride;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 799/869] ALSA: hda: Reject codec reset on ASoC (ext_ops) buses
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (797 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 798/869] ALSA: usb-audio: Bound packet copies by the PCM buffer size Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 800/869] ixgbe: reserve TX timestamp after skb preparation Greg Kroah-Hartman
` (77 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Cezary Rojewski,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit a4311e9447bbb219044db38897f95be112f46a8a ]
Writing to the reconfig or clear sysfs nodes of a codec handled by ASoC
(SOF via hdac_hda, AVS via codecs/hda) hangs the writer.
snd_hda_codec_reset() sets card->shutdown and calls
device_release_driver(). With ext_ops the driver unbind unregisters the
ASoC component, which unbinds and frees the whole ASoC card:
- snd_card_disconnect() returns early as card->shutdown is already set,
so the card's child devices are not removed and snd_card_free() waits
for the card release forever.
- Even without that, freeing the card removes the codec's hwdep device,
which owns the sysfs node the reset was issued from, deadlocking in
kernfs while waiting for the active write to finish.
The legacy HDA driver keeps the card across a driver rebind, ASoC does
not, so the reset cannot be supported there. Return -EOPNOTSUPP and skip
the misleading "codec is being used" messages in the callers.
Fixes: 6bae5ea94989 ("ASoC: hdac_hda: add asoc extension for legacy HDA codec drivers")
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222182
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20261027072835.4796-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/common/codec.c | 6 ++++++
sound/hda/common/sysfs.c | 4 ++++
2 files changed, 10 insertions(+)
diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index 7869f673894fe..e6548e03a32ce 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -1806,6 +1806,12 @@ int snd_hda_codec_reset(struct hda_codec *codec)
{
struct hda_bus *bus = codec->bus;
+ /* ASoC: driver unbind frees the card, incl. the hwdep issuing the reset */
+ if (bus->core.ext_ops) {
+ codec_err(codec, "Codec reset is not supported with ASoC\n");
+ return -EOPNOTSUPP;
+ }
+
if (snd_hda_lock_devices(bus) < 0)
return -EBUSY;
diff --git a/sound/hda/common/sysfs.c b/sound/hda/common/sysfs.c
index f8c8483fd5e5f..121a54ea3150a 100644
--- a/sound/hda/common/sysfs.c
+++ b/sound/hda/common/sysfs.c
@@ -117,6 +117,8 @@ static int clear_codec(struct hda_codec *codec)
int err;
err = snd_hda_codec_reset(codec);
+ if (err == -EOPNOTSUPP)
+ return err;
if (err < 0) {
codec_err(codec, "The codec is being used, can't free.\n");
return err;
@@ -132,6 +134,8 @@ static int reconfig_codec(struct hda_codec *codec)
CLASS(snd_hda_power, pm)(codec);
codec_info(codec, "hda-codec: reconfiguring\n");
err = snd_hda_codec_reset(codec);
+ if (err == -EOPNOTSUPP)
+ return err;
if (err < 0) {
codec_err(codec,
"The codec is being used, can't reconfigure.\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 800/869] ixgbe: reserve TX timestamp after skb preparation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (798 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 799/869] ALSA: hda: Reject codec reset on ASoC (ext_ops) buses Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 801/869] ASoC: hdac_hda: Balance the runtime PM disable in codec remove Greg Kroah-Hartman
` (76 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Maciej Fijalkowski,
Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@kernel.org>
[ Upstream commit f75062536e2d45ee182828f0e47e0124be2fdc8d ]
ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
for the pending TX timestamp before preparing the skb for transmit.
Several of the following steps may need to reallocate the skb head:
- ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
when the header is cloned (e.g. a packet tap holds a clone).
- ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
checksum offsets, which can call pskb_expand_head() through
skb_ensure_writable().
- With DCB and a software VLAN tag, skb_cow_head() is called to
rewrite the VLAN priority.
pskb_expand_head() used to BUG() on shared skbs. Since commit
c7d8bc3dd511 ("net: skbuff: don't BUG() on bad arguments to
pskb_expand_head()") it returns -EINVAL instead, so these packets
are dropped (TSO, DCB) or sent with an unfinished checksum
(skb_checksum_help() errors are ignored by ixgbe_tx_csum()).
Reserve the TX timestamp right before ixgbe_tx_map(), after all skb
preparation, as i40e and ice already do. The timestamp request
remains covered on the FCoE path, and the cleanup on ixgbe_tx_map()
failure is unchanged.
Fixes: 891dc0821d20 ("ixgbe: Add ptp work item to poll for the Tx timestamp")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20261026082035.335770-1-edumazet@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +++++++++++--------
1 file changed, 23 insertions(+), 17 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index f950570909ab2..75ba78a84c865 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9426,23 +9426,6 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
}
protocol = vlan_get_protocol(skb);
- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
- adapter->ptp_clock) {
- if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
- !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
- &adapter->state)) {
- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
- tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
-
- /* schedule check for Tx timestamp */
- adapter->ptp_tx_skb = skb_get(skb);
- adapter->ptp_tx_start = jiffies;
- schedule_work(&adapter->ptp_tx_work);
- } else {
- adapter->tx_hwtstamp_skipped++;
- }
- }
-
#ifdef CONFIG_PCI_IOV
/*
* Use the l2switch_enable flag - would be false if the DMA
@@ -9507,6 +9490,29 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
#ifdef IXGBE_FCOE
xmit_fcoe:
#endif /* IXGBE_FCOE */
+ /* Reserve the Tx timestamp only after all skb preparation:
+ * skb_get() makes the skb shared, and pskb_expand_head()
+ * (reached from skb_cow_head() or skb_checksum_help())
+ * refuses shared skbs.
+ */
+ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+ adapter->ptp_clock) {
+ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
+ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
+ &adapter->state)) {
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+ first->tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+
+ /* schedule check for Tx timestamp */
+ adapter->ptp_tx_skb = skb_get(skb);
+ adapter->ptp_tx_start = jiffies;
+ schedule_work(&adapter->ptp_tx_work);
+ } else {
+ adapter->tx_hwtstamp_skipped++;
+ }
+ }
+
if (ixgbe_tx_map(tx_ring, first, hdr_len))
goto cleanup_tx_timestamp;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 801/869] ASoC: hdac_hda: Balance the runtime PM disable in codec remove
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (799 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 800/869] ixgbe: reserve TX timestamp after skb preparation Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 802/869] LoongArch: Call cpu_final_simd() with pure_initcall() Greg Kroah-Hartman
` (75 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit f26c0d5f91d918bb66cbbc8916f41836adb38346 ]
hdac_hda_codec_remove() disables runtime PM of the codec device before
releasing the HDA link and calling the codec driver's remove callback,
so that no runtime resume can race with the teardown and access the
link or the already freed codec driver data.
snd_hda_codec_cleanup_for_unbind() then disables runtime PM again.
On the next probe snd_hda_codec_register() enables runtime PM only once,
leaving it disabled after the ASoC card or the codec driver has been
unbound and bound again: the codec stays powered and runtime_status
reads 'unsupported'.
Re-enable runtime PM at the end of hdac_hda_codec_remove() to balance
its own disable. The codec remains disabled until it is registered again.
Fixes: c3ec8ac82105 ("ASoC: hdac_hda: fix memleak on module unload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261027083840.28813-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/hdac_hda.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index b4d93b9404bb7..1a89f570fd1f4 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -557,6 +557,7 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
return;
}
+ /* prevent runtime PM callbacks while the link and the codec are torn down */
pm_runtime_disable(&hdev->dev);
snd_hdac_ext_bus_link_put(hdev->bus, hlink);
@@ -564,6 +565,9 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
driver->ops->remove(codec);
snd_hda_codec_cleanup_for_unbind(codec);
+
+ /* Balances the disable above, cleanup_for_unbind keeps runtime PM disabled */
+ pm_runtime_enable(&hdev->dev);
}
static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 802/869] LoongArch: Call cpu_final_simd() with pure_initcall()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (800 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 801/869] ASoC: hdac_hda: Balance the runtime PM disable in codec remove Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 803/869] LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code Greg Kroah-Hartman
` (74 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huacai Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 9b56c3659a7e5d930ab3c07ea74cc46af65b6d20 ]
After commit 35ebc4de105989034f12 ("xor: remove macro abuse for XOR
implementation registrations"), using "simd=128" to limit SIMD on a
platform with 256bit SIMD instructions causes a boot failure.
Because cpu_final_simd() is called with arch_initcall() now, which is
after xor_init(), LASX flavors are selected but not workable.
Call cpu_final_simd() with pure_initcall() which is before xor_init().
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/cpu-probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/kernel/cpu-probe.c b/arch/loongarch/kernel/cpu-probe.c
index 4ac9c95991670..9f0f9fdac011b 100644
--- a/arch/loongarch/kernel/cpu-probe.c
+++ b/arch/loongarch/kernel/cpu-probe.c
@@ -93,7 +93,7 @@ static int __init cpu_final_simd(void)
return 0;
}
-arch_initcall(cpu_final_simd);
+pure_initcall(cpu_final_simd);
static inline void set_elf_platform(int cpu, const char *plat)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 803/869] LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (801 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 802/869] LoongArch: Call cpu_final_simd() with pure_initcall() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 804/869] LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic() Greg Kroah-Hartman
` (73 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huacai Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 244eb26bbd152896f976db6415550993cd60b46d ]
NODE_ADDRSPACE_SHIFT is 44 now but may be changed in future, so use
pa_to_nid()/nid_to_addrbase() rather than hard-code.
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/numa.h | 2 +-
arch/loongarch/kernel/irq.c | 3 ++-
arch/loongarch/pci/pci.c | 3 ++-
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/loongarch/include/asm/numa.h b/arch/loongarch/include/asm/numa.h
index bbf9f70bd25f4..c9654ff900a3a 100644
--- a/arch/loongarch/include/asm/numa.h
+++ b/arch/loongarch/include/asm/numa.h
@@ -14,7 +14,7 @@
#define NODE_ADDRSPACE_SHIFT 44
#define pa_to_nid(addr) (((addr) & 0xf00000000000) >> NODE_ADDRSPACE_SHIFT)
-#define nid_to_addrbase(nid) (_ULCAST_(nid) << NODE_ADDRSPACE_SHIFT)
+#define nid_to_addrbase(nid) (_U64CAST_(nid) << NODE_ADDRSPACE_SHIFT)
#ifdef CONFIG_NUMA
diff --git a/arch/loongarch/kernel/irq.c b/arch/loongarch/kernel/irq.c
index 80946cafaec1b..130954ab9ee20 100644
--- a/arch/loongarch/kernel/irq.c
+++ b/arch/loongarch/kernel/irq.c
@@ -19,6 +19,7 @@
#include <asm/irq.h>
#include <asm/loongson.h>
+#include <asm/numa.h>
#include <asm/setup.h>
DEFINE_PER_CPU(unsigned long, irq_stack);
@@ -68,7 +69,7 @@ static int __init early_pci_mcfg_parse(struct acpi_table_header *header)
for (i = 0; i < n; i++, mptr++) {
msi_group[i].pci_segment = mptr->pci_segment;
- pch_group[i].node = msi_group[i].node = (mptr->address >> 44) & 0xf;
+ pch_group[i].node = msi_group[i].node = pa_to_nid(mptr->address);
}
return 0;
diff --git a/arch/loongarch/pci/pci.c b/arch/loongarch/pci/pci.c
index f33c7ea1443d9..0b99b32110a5d 100644
--- a/arch/loongarch/pci/pci.c
+++ b/arch/loongarch/pci/pci.c
@@ -12,6 +12,7 @@
#include <linux/io-64-nonatomic-lo-hi.h>
#include <asm/cacheflush.h>
#include <asm/loongson.h>
+#include <asm/numa.h>
#define PCI_DEVICE_ID_LOONGSON_HOST 0x7a00
#define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06
@@ -43,7 +44,7 @@ int raw_pci_write(unsigned int domain, unsigned int bus, unsigned int devfn,
phys_addr_t mcfg_addr_init(int node)
{
- return (((u64)node << 44) | MCFG_EXT_PCICFG_BASE);
+ return (nid_to_addrbase(node) | MCFG_EXT_PCICFG_BASE);
}
static int __init pcibios_init(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 804/869] LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (802 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 803/869] LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 805/869] LoongArch: Remove redundant call in update_bp_registers() Greg Kroah-Hartman
` (72 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Li, Xi Ruoyao, Tiezhu Yang,
Huacai Chen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 85cebdfee765e92e748e71b9b91889eef5988282 ]
When running BPF selftest "test_progs -t timer_lockup" on a LoongArch
machine, the kernel intermittently experiences soft lockups and panics
in hrtimer_cancel().
The root cause is that the bpf_timer_cancel() implementation relies on
smp_mb__after_atomic() to provide a full data barrier after a relaxed
atomic_inc() to ensure the proper store-load ordering before performing
lockless dependency checks on weakly-ordered architectures, such as on
LoongArch, but the current definition of smp_mb__after_atomic() is just
a plain compiler barrier.
This allows a subsequent read to bypass the prior write due to store-
load reordering, enabling concurrent CPUs to simultaneously bypass the
software deadlock detection, enter hrtimer_cancel(), and then trigger a
severe ABBA deadlock in the hrtimer core.
Moreover, there are hundreds of smp_mb__after_atomic() call sites across
the core kernel (kernel/, drivers/, mm/, net/, fs/) that currently lack
necessary full data barriers on LoongArch, which have potential risks.
To comply with the LKMM specification, fix this by removing the arch-
specific definition of __smp_mb__after_atomic(), so that this macro can
automatically fall back to the generic definition in asm-generic that
maps to __smp_mb() and emits the required hardware DBAR instruction.
While at it, do the same thing for __smp_mb__before_atomic().
With this patch the BPF timer_lockup selftest was stressed for millions
consecutive loops on a physical LoongArch machine, without encountering
any further lockups.
Cc: stable@vger.kernel.org # 6.7+
Fixes: affef66b65889a0e ("LoongArch: Relax memory ordering for atomic operations")
Closes: https://lore.kernel.org/loongarch/CAK3+h2xOSEZUHhou7N2cRL-aGrZCNSm45g+P7thObMe+fpgYCA@mail.gmail.com/
Reported-by: Vincent Li <vincent.mc.li@gmail.com>
Reviewed-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/barrier.h | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/loongarch/include/asm/barrier.h b/arch/loongarch/include/asm/barrier.h
index 4b663f1977061..84c6d739119d1 100644
--- a/arch/loongarch/include/asm/barrier.h
+++ b/arch/loongarch/include/asm/barrier.h
@@ -57,9 +57,6 @@
#define __WEAK_LLSC_MB " \n"
#endif
-#define __smp_mb__before_atomic() barrier()
-#define __smp_mb__after_atomic() barrier()
-
/**
* array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
* @index: array element index
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 805/869] LoongArch: Remove redundant call in update_bp_registers()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (803 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 804/869] LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 806/869] LoongArch: Fix bitmask corruption " Greg Kroah-Hartman
` (71 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 23534c6efeb718e8a4d9107fa7d6707b5b1f5859 ]
In update_bp_registers(), there is a duplicate call to write_wb_reg()
when enabling an execute breakpoint:
write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
The two lines are completely identical. Remove the redundant call to
clean up the code and eliminate unnecessary register writes.
Cc: stable@vger.kernel.org
Fixes: edffa33c7bb5 ("LoongArch: Add hardware breakpoints/watchpoints support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/hw_breakpoint.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index c35f9bf380334..deeb2f9795705 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -453,7 +453,6 @@ static void update_bp_registers(struct pt_regs *regs, int enable, int type)
if (enable) {
if ((info->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) && (type == 0)) {
write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
- write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
} else {
ctrl = read_wb_reg(CSR_CFG_CTRL, i, 1);
if (info->ctrl.type == LOONGARCH_BREAKPOINT_LOAD)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 806/869] LoongArch: Fix bitmask corruption in update_bp_registers()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (804 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 805/869] LoongArch: Remove redundant call in update_bp_registers() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 807/869] LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP Greg Kroah-Hartman
` (70 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 30c52672bf456decf675c11f3c65acd73a6bcca8 ]
In update_bp_registers(), when disabling a LOAD or STORE watchpoint,
the code attempts to clear the bit of LoadEn or StoreEn by using the
standard bit-clearing pattern.
However, due to the omission of parentheses, the bitwise NOT operator
'~' takes higher precedence than the left shift operator '<<'. Then:
(1) ~0x1 << MWPnCFG3_LoadEn evaluates to "(~0x1) << 8 = 0xFFFFFE00",
(2) ~0x1 << MWPnCFG3_StoreEn evaluates to "(~0x1) << 9 = 0xFFFFFC00",
that incorrectly clears all configuration fields in the lower 8 bits.
These fields in the lower 8 bits contain critical configurations such
as DSOnly (bit 0), PLV0-PLV3 privilege levels (bits 1-4), and LCL (bit
7). Writing back these corrupted values severely breaks configuration
isolation and ruins the hardware watchpoint states.
Add parentheses to ensure the correct evaluation order, so that only
the targeted LoadEn/StoreEn bit is cleared while preserving the other
crucial configuration bits in the lower 8 bits.
Cc: stable@vger.kernel.org
Fixes: edffa33c7bb5 ("LoongArch: Add hardware breakpoints/watchpoints support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/hw_breakpoint.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index deeb2f9795705..bd891b3808a6b 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -468,9 +468,9 @@ static void update_bp_registers(struct pt_regs *regs, int enable, int type)
} else {
ctrl = read_wb_reg(CSR_CFG_CTRL, i, 1);
if (info->ctrl.type == LOONGARCH_BREAKPOINT_LOAD)
- ctrl &= ~0x1 << MWPnCFG3_LoadEn;
+ ctrl &= ~(0x1 << MWPnCFG3_LoadEn);
if (info->ctrl.type == LOONGARCH_BREAKPOINT_STORE)
- ctrl &= ~0x1 << MWPnCFG3_StoreEn;
+ ctrl &= ~(0x1 << MWPnCFG3_StoreEn);
write_wb_reg(CSR_CFG_CTRL, i, 1, ctrl);
}
regs->csr_prmd &= ~CSR_PRMD_PWE;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 807/869] LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (805 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 806/869] LoongArch: Fix bitmask corruption " Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 808/869] LoongArch: Only send SIGTRAP signal if necessary in do_watch() Greg Kroah-Hartman
` (69 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit f322ebfdfda2bce91fb1d3fb0072c735051fed85 ]
According to the LoongArch Reference Manual, the single-step 'Skip' bit
resides in the instruction breakpoint status register (CSR.FWPS), rather
than the configuration register (CSR.FWPC).
Furthermore, the kernel code comments also explicitly document it as
"CSR.FWPS.Skip", yet the macro was erroneously defined as CSR_FWPC_SKIP
and used as such in traps.c and hw_breakpoint.c. This mismatch creates
architectural naming confusion.
Fix this by renaming the macro from CSR_FWPC_SKIP to CSR_FWPS_SKIP to
precisely match the manual and comments. Also, update all call sites to
align with the rectified definition.
Cc: stable@vger.kernel.org
Fixes: 424421a7f34c ("LoongArch: ptrace: Add hardware single step support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/loongarch.h | 4 ++--
arch/loongarch/kernel/hw_breakpoint.c | 2 +-
arch/loongarch/kernel/traps.c | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h
index 58a4a3b6b035d..642dc9adddceb 100644
--- a/arch/loongarch/include/asm/loongarch.h
+++ b/arch/loongarch/include/asm/loongarch.h
@@ -1090,8 +1090,8 @@
#define LOONGARCH_CSR_DERA 0x501 /* debug era */
#define LOONGARCH_CSR_DESAVE 0x502 /* debug save */
-#define CSR_FWPC_SKIP_SHIFT 16
-#define CSR_FWPC_SKIP (_ULCAST_(1) << CSR_FWPC_SKIP_SHIFT)
+#define CSR_FWPS_SKIP_SHIFT 16
+#define CSR_FWPS_SKIP (_ULCAST_(1) << CSR_FWPS_SKIP_SHIFT)
/*
* CSR_ECFG IM
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index bd891b3808a6b..7f69cf361a5e2 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -550,7 +550,7 @@ void hw_breakpoint_thread_switch(struct task_struct *next)
addr = read_wb_reg(CSR_CFG_ADDR, 0, 0);
mask = read_wb_reg(CSR_CFG_MASK, 0, 0);
if (!((regs->csr_era ^ addr) & ~mask))
- csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+ csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
regs->csr_prmd |= CSR_PRMD_PWE;
} else {
/* Update breakpoints */
diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c
index 8e51ce004572c..4c2e5a13f07e4 100644
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -821,7 +821,7 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
* instruction. So don't clear llbit and reset CSR.FWPS.Skip until
* the llsc execution is completed.
*/
- csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+ csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
csr_write32(CSR_LLBCTL_KLO, LOONGARCH_CSR_LLBCTL);
goto out;
}
@@ -838,7 +838,7 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
* current pc, If yes, then we should not set the CSR.FWPS.SKIP
* bit to break the original instruction stream.
*/
- csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+ csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 808/869] LoongArch: Only send SIGTRAP signal if necessary in do_watch()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (806 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 807/869] LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 809/869] LoongArch: Fix perf hardware breakpoint failure via installation Greg Kroah-Hartman
` (68 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit f087903018e35d38b8932e18b010ee2e8699d1a1 ]
In do_watch(), the kernel unconditionally forces a SIGTRAP signal at the
end of the handler via force_sig(SIGTRAP). This is essential for ptrace
operations, but it severely disrupts standard perf_event usage.
Under normal perf usage, it is not necessary to force a SIGTRAP signal
on every hit. Forcing it unnecessarily aborts the target process if no
user-space signal handler is registered, which violates performance
monitoring behaviors and injects context switch overheads.
However, a conditional check using only 'current->ptrace' would block
legitimate user-requested signals when a perf_event is configured with
'attr.sigtrap = 1' for asynchronous user-space tracking.
Fix this by refactoring breakpoint_handler() and watchpoint_handler()
to return a boolean status indicating whether any triggered breakpoint
explicitly requires a signal notification. Update do_watch() to enforce
the SIGTRAP signal only when the process is actively being debugged via
ptrace, or when the underlying perf_event infrastructure specifically
demands it via 'attr.sigtrap'.
Cc: stable@vger.kernel.org
Fixes: 424421a7f34c ("LoongArch: ptrace: Add hardware single step support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/hw_breakpoint.h | 4 ++--
arch/loongarch/kernel/hw_breakpoint.c | 18 ++++++++++++++++--
arch/loongarch/kernel/traps.c | 9 ++++++---
3 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/arch/loongarch/include/asm/hw_breakpoint.h b/arch/loongarch/include/asm/hw_breakpoint.h
index 5faa97a87a9e2..d202052df8a16 100644
--- a/arch/loongarch/include/asm/hw_breakpoint.h
+++ b/arch/loongarch/include/asm/hw_breakpoint.h
@@ -116,8 +116,8 @@ extern void arch_uninstall_hw_breakpoint(struct perf_event *bp);
extern int hw_breakpoint_slots(int type);
extern void hw_breakpoint_pmu_read(struct perf_event *bp);
-void breakpoint_handler(struct pt_regs *regs);
-void watchpoint_handler(struct pt_regs *regs);
+bool breakpoint_handler(struct pt_regs *regs);
+bool watchpoint_handler(struct pt_regs *regs);
#ifdef CONFIG_HAVE_HW_BREAKPOINT
extern void ptrace_hw_copy_thread(struct task_struct *task);
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index 7f69cf361a5e2..d009ed780cf02 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -482,9 +482,10 @@ NOKPROBE_SYMBOL(update_bp_registers);
/*
* Debug exception handlers.
*/
-void breakpoint_handler(struct pt_regs *regs)
+bool breakpoint_handler(struct pt_regs *regs)
{
int i;
+ bool need_sigtrap = false;
struct perf_event *bp, **slots;
slots = this_cpu_ptr(bp_on_reg);
@@ -494,17 +495,24 @@ void breakpoint_handler(struct pt_regs *regs)
bp = slots[i];
if (bp == NULL)
continue;
+
perf_bp_event(bp, regs);
+ if (bp->attr.sigtrap)
+ need_sigtrap = true;
+
csr_write32(0x1 << i, LOONGARCH_CSR_FWPS);
update_bp_registers(regs, 0, 0);
}
}
+
+ return need_sigtrap;
}
NOKPROBE_SYMBOL(breakpoint_handler);
-void watchpoint_handler(struct pt_regs *regs)
+bool watchpoint_handler(struct pt_regs *regs)
{
int i;
+ bool need_sigtrap = false;
struct perf_event *wp, **slots;
slots = this_cpu_ptr(wp_on_reg);
@@ -514,11 +522,17 @@ void watchpoint_handler(struct pt_regs *regs)
wp = slots[i];
if (wp == NULL)
continue;
+
perf_bp_event(wp, regs);
+ if (wp->attr.sigtrap)
+ need_sigtrap = true;
+
csr_write32(0x1 << i, LOONGARCH_CSR_MWPS);
update_bp_registers(regs, 0, 1);
}
}
+
+ return need_sigtrap;
}
NOKPROBE_SYMBOL(watchpoint_handler);
diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c
index 4c2e5a13f07e4..9ce12327d64ea 100644
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -807,6 +807,8 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
#ifndef CONFIG_HAVE_HW_BREAKPOINT
pr_warn("Hardware watch point handler not implemented!\n");
#else
+ bool need_sigtrap = !!current->ptrace;
+
if (kgdb_breakpoint_handler(regs))
goto out;
@@ -843,11 +845,12 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
}
}
} else {
- breakpoint_handler(regs);
- watchpoint_handler(regs);
+ need_sigtrap |= breakpoint_handler(regs);
+ need_sigtrap |= watchpoint_handler(regs);
}
- force_sig(SIGTRAP);
+ if (need_sigtrap)
+ force_sig(SIGTRAP);
out:
#endif
irqentry_exit(regs, state);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 809/869] LoongArch: Fix perf hardware breakpoint failure via installation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (807 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 808/869] LoongArch: Only send SIGTRAP signal if necessary in do_watch() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 810/869] cpufreq: stats: Fix potential out-of-bounds access in deferred reset Greg Kroah-Hartman
` (67 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit f5c0f8427469e703465c719c4304ce91282a32eb ]
In hw_breakpoint_control(), the logic to enable CSR_PRMD_PWE (global
watchpoint enable) incorrectly relies on TIF_LOAD_WATCH. This thread
flag is only set during ptrace operations, meaning that the standard
hardware breakpoints created via perf_event_open() will never have
this flag set.
As a result, the CSR_PRMD_PWE switch is skipped, leaving the hardware
breakpoint completely inactive in perf usage.
Fix this by decoupling the CSR_PRMD_PWE from the ptrace specific flag
TIF_LOAD_WATCH, which ensures that CSR_PRMD_PWE is enabled whenever a
hardware breakpoint is installed.
Here is a user-space reproducer to demonstrate the issue:
(1) Test program (test_perf_install.c):
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <linux/perf_event.h>
#include <linux/hw_breakpoint.h>
static int var = 0;
int main(void)
{
size_t count = 0;
struct perf_event_attr attr = {
.type = PERF_TYPE_BREAKPOINT,
.size = sizeof(attr),
.bp_type = HW_BREAKPOINT_W,
.bp_addr = (unsigned long)&var,
.bp_len = HW_BREAKPOINT_LEN_1,
.exclude_kernel = 1,
};
int fd = syscall(__NR_perf_event_open, &attr, 0, -1, -1, 0);
ioctl(fd, PERF_EVENT_IOC_ENABLE, 0);
asm volatile("st.b %1, %0" : "=m"(var) : "r"(11) : "memory");
ioctl(fd, PERF_EVENT_IOC_DISABLE, 0);
read(fd, &count, sizeof(size_t));
printf("Watchpoint counts: expected = 1, actual = %zu\n", count);
close(fd);
return 0;
}
(2) Test steps:
$ gcc test_perf_install.c -o test_perf_install
$ ./test_perf_install
(3) Test results:
Without this patch:
Watchpoint counts: expected = 1, actual = 0
With this patch:
Watchpoint counts: expected = 1, actual = 1
Cc: stable@vger.kernel.org
Fixes: 3892b11eac5a ("LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/hw_breakpoint.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index d009ed780cf02..1a05350159f7b 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -233,7 +233,7 @@ static int hw_breakpoint_control(struct perf_event *bp,
}
enable = csr_read64(LOONGARCH_CSR_CRMD);
csr_write64(CSR_CRMD_WE | enable, LOONGARCH_CSR_CRMD);
- if (bp->hw.target && test_tsk_thread_flag(bp->hw.target, TIF_LOAD_WATCH))
+ if (bp->hw.target)
regs->csr_prmd |= CSR_PRMD_PWE;
break;
case HW_BREAKPOINT_UNINSTALL:
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 810/869] cpufreq: stats: Fix potential out-of-bounds access in deferred reset
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (808 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 809/869] LoongArch: Fix perf hardware breakpoint failure via installation Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 811/869] arm64/mm: restrict transparent contpte mappings to valid PTEs Greg Kroah-Hartman
` (66 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Rafael J. Wysocki,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ Upstream commit 8a702989677216489e471a6f27599da53f753567 ]
cpufreq_stats_create_table() sets stats->last_index to -1 if policy->cur
is not in the frequency table. It then stays at -1, because
cpufreq_stats_record_transition() returns early on old_index == -1 before
it gets to update last_index.
Commit 46a310b80bc2 ("[CPUFREQ] Don't set stat->last_index to -1 if
the pol->cur has incorrect value.") added that check. However, since
commit 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to
cpufreq_stats_record_transition()"), the stats reset is deferred to the
beginning of cpufreq_stats_record_transition(), before that check, and
cpufreq_stats_reset_table() ends with an unconditional
cpufreq_stats_update(). So if the "reset" attribute is written while
last_index is -1, the next frequency transition accesses
time_in_state[-1].
Fix it by also returning early on last_index == -1 in
cpufreq_stats_reset_table().
Fixes: 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to cpufreq_stats_record_transition()")
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/20261027133332.377546-1-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq_stats.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 40a9ff18da068..d457848b3eabd 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -52,6 +52,10 @@ static void cpufreq_stats_reset_table(struct cpufreq_stats *stats)
* reset_pending accesses in cpufreq_stats_record_transition().
*/
smp_rmb();
+
+ if (stats->last_index == -1)
+ return;
+
cpufreq_stats_update(stats, READ_ONCE(stats->reset_time));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 811/869] arm64/mm: restrict transparent contpte mappings to valid PTEs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (809 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 810/869] cpufreq: stats: Fix potential out-of-bounds access in deferred reset Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 812/869] perf machine: Fix NULL deref in thread__resolve_callchain_sample() Greg Kroah-Hartman
` (65 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Wang, Lance Yang, Zhao Gongyi,
Catalin Marinas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Gongyi <zhaogongyi@bytedance.com>
[ Upstream commit 486d396b19e93f6e56e0a0ba96c14a9ccc1a5977 ]
The transparent contpte layer treats PTE_CONT as software grouping state.
When a valid PTE has PTE_CONT set, the contpte helpers may align an
operation to a CONT_PTE_SIZE block and operate on the whole block. The
current single-PTE helpers use pte_valid_cont() to identify such groups;
this is a helper contract, not an architectural restriction on using
PTE_CONT with present-invalid descriptors. Explicit users such as hugetlb
manage their contiguous encodings separately.
contpte_set_ptes() currently sets PTE_CONT from alignment alone. Batched
set_ptes() users can therefore install present-invalid PTEs with
PTE_CONT set, for example mprotect(PROT_NONE), NUMA hinting through
modify_prot_commit_ptes(), fork() copying a PROT_NONE large folio, or a
PMD split installing PAGE_NONE PTEs.
This is not a hardware programming problem: invalid descriptors are not
translated, so the hardware ignores descriptor bits such as PTE_CONT. It
is a software-state problem. Some arm64 fast paths, such as
test_and_clear_young_ptes(), test pte_cont() directly instead of
pte_valid_cont().
In the observed failure, mprotect(PROT_NONE) installed a full
CONT_PTE_SIZE range of present-invalid PTEs with PTE_CONT set.
MADV_GUARD_INSTALL then zapped one PTE. The nr == 1 clear_full_ptes()
path only unfolds pte_valid_cont() entries, so the neighbouring
present-invalid entries kept PTE_CONT while the target entry became a
guard marker.
clear_refs_pte_range() then reached the marker through:
ptep_test_and_clear_young()
test_and_clear_young_ptes()
contpte_test_and_clear_young_ptes()
contpte_align_addr_ptep()
__ptep_test_and_clear_young()
The marker changed from old_pte=0x00000000000047c0 to
new_pte=0x00000000000043c0 by clearing PTE_AF. For swap PTEs, bit 10 is
part of the swap type field, bits 6-10: 0x47c0 is SWP_PTE_MARKER with
offset 4, while 0x43c0 has type 15 and is decoded as an ordinary swap
entry. Zap later warned in swap_put_entries_direct() with a bad swap
entry.
Present-invalid PTEs could retain PTE_CONT as software grouping state,
but their single-PTE modification paths would then need to recognize
and unfold those groups consistently. Since current helpers mostly use
pte_valid_cont() for membership, avoid creating present-invalid
transparent contpte groups in contpte_set_ptes(). They bring no hardware
benefit while invalid, and eligible valid ranges can be grouped again
when they are installed.
The public set_ptes() wrapper already clears PTE_CONT before calling
contpte_set_ptes(). Return invalid PTEs through __set_ptes() directly,
and warn if a future direct caller unexpectedly passes an invalid PTE
with PTE_CONT set.
This is triggerable by a user process against its own address space. On
systems running with panic_on_warn, the warning becomes a denial of
service.
Fixes: 4602e5757bcc ("arm64/mm: wire up PTE_CONT for user mappings")
Cc: stable@vger.kernel.org
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 3 +++
arch/arm64/mm/contpte.c | 4 +++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 1765e484fb9f0..2ce69d64e60ca 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -1675,6 +1675,9 @@ extern void modify_prot_commit_ptes(struct vm_area_struct *vma, unsigned long ad
* The contpte APIs are used to transparently manage the contiguous bit in ptes
* where it is possible and makes sense to do so. The PTE_CONT bit is considered
* a private implementation detail of the public ptep API (see below).
+ * Single-PTE transparent contpte helpers use pte_valid_cont() to identify
+ * grouped PTEs; explicit contiguous-encoding users such as hugetlb manage
+ * their entries separately.
*/
extern void __contpte_try_fold(struct mm_struct *mm, unsigned long addr,
pte_t *ptep, pte_t pte);
diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c
index 29024e20e876d..c39a290c6b5a2 100644
--- a/arch/arm64/mm/contpte.c
+++ b/arch/arm64/mm/contpte.c
@@ -444,8 +444,10 @@ void contpte_set_ptes(struct mm_struct *mm, unsigned long addr,
*/
VM_WARN_ON(nr == 1);
- if (!mm_is_user(mm))
+ if (!mm_is_user(mm) || !pte_valid(pte)) {
+ VM_WARN_ON_ONCE(!pte_valid(pte) && pte_cont(pte));
return __set_ptes(mm, addr, ptep, pte, nr);
+ }
end = addr + (nr << PAGE_SHIFT);
pfn = pte_pfn(pte);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 812/869] perf machine: Fix NULL deref in thread__resolve_callchain_sample()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (810 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 811/869] arm64/mm: restrict transparent contpte mappings to valid PTEs Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 813/869] drm/amdkfd: stop restore retries on device unplug Greg Kroah-Hartman
` (64 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Shengming Hu, lvyating,
Adrian Hunter, Alexander Shishkin, Dai Hualiang, he.yilin,
Ingo Molnar, James Clark, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Qingtao Liu, Shen Lin, ye.zhihao1, zhang.cheng35,
Arnaldo Carvalho de Melo, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: lvyating <lv.yating@zte.com.cn>
[ Upstream commit 4626d370ae89b8af4d46a45372b269f926ec662d ]
When recording with -j stack, resolve_lbr_callchain_sample() can
dereference a NULL 'chain' pointer while resolving the branch
stack.
$ perf record -j stack -e branches:u uname
perf: Segmentation fault
Fix it by checking 'chain' for NULL before dereferencing it.
Fixes: 29be60c93d2d9300 ("perf build-id: Mark DSO in sample callchains")
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Shengming Hu <hu.shengming@zte.com.cn>
Signed-off-by: lvyating <lv.yating@zte.com.cn>
Tested-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Dai Hualiang <dai.hualiang@zte.com.cn>
Cc: he.yilin@zte.com.cn
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qingtao Liu <liu.qingtao2@zte.com.cn>
Cc: Shen Lin <shen.lin1@zte.com.cn>
Cc: stable@vger.kernel.org
Cc: ye.zhihao1@zte.com.cn
Cc: zhang.cheng35@zte.com.cn
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index cb138d1bdd7b9..8452d776d994a 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2743,7 +2743,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
if (chain)
chain_nr = chain->nr;
- if (evsel__has_branch_callstack(evsel)) {
+ if (chain && evsel__has_branch_callstack(evsel)) {
struct perf_env *env = evsel__env(evsel);
err = resolve_lbr_callchain_sample(thread, cursor, sample, parent,
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 813/869] drm/amdkfd: stop restore retries on device unplug
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (811 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 812/869] perf machine: Fix NULL deref in thread__resolve_callchain_sample() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 814/869] drm/amd/display: take a runtime PM reference only when a CRTC turns on Greg Kroah-Hartman
` (63 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaogang Chen, Olivier Kaloudoff,
Felix Kuehling, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
[ Upstream commit 3254ed0b15f2fe656c9cb36ccb59b92422440bf8 ]
amdgpu_amdkfd_restore_userptr_worker() and svm_range_restore_work()
reschedule themselves when validation fails with evicted objects
pending. After a surprise removal the restore paths fail with -ENODEV
permanently, so rescheduling just spins the worker uselessly until
cancel_delayed_work_sync() in fini finally stops it - which can take
a while, since process teardown itself is delayed by the dead device.
Treat -ENODEV as terminal in both workers.
Cc: Xiaogang Chen <xiaogang.chen@amd.com>
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 266fab83139600e58db7e900e930c722e619b78c)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 18 +++++++++++++-----
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +++++---
2 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 35dffb14a20aa..6de7dfa30ce50 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -2824,6 +2824,7 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
struct task_struct *usertask;
struct mm_struct *mm;
uint32_t evicted_bos;
+ int ret;
mutex_lock(&process_info->notifier_lock);
evicted_bos = process_info->evicted_bos;
@@ -2843,14 +2844,16 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
mutex_lock(&process_info->lock);
- if (update_invalid_user_pages(process_info, mm))
+ ret = update_invalid_user_pages(process_info, mm);
+ if (ret)
goto unlock_out;
/* userptr_inval_list can be empty if all evicted userptr BOs
* have been freed. In that case there is nothing to validate
* and we can just restart the queues.
*/
if (!list_empty(&process_info->userptr_inval_list)) {
- if (validate_invalid_user_pages(process_info))
+ ret = validate_invalid_user_pages(process_info);
+ if (ret)
goto unlock_out;
}
/* Final check for concurrent evicton and atomic update. If
@@ -2859,11 +2862,14 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
* reference counting inside KFD will handle this case.
*/
mutex_lock(&process_info->notifier_lock);
- if (process_info->evicted_bos != evicted_bos)
+ if (process_info->evicted_bos != evicted_bos) {
+ ret = -EAGAIN;
goto unlock_notifier_out;
+ }
if (confirm_valid_user_pages_locked(process_info)) {
WARN(1, "User pages unexpectedly invalid");
+ ret = -EINVAL;
goto unlock_notifier_out;
}
@@ -2881,8 +2887,10 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
unlock_out:
mutex_unlock(&process_info->lock);
- /* If validation failed, reschedule another attempt */
- if (evicted_bos) {
+ /* If validation failed, reschedule another attempt, unless the
+ * device is gone for good
+ */
+ if (evicted_bos && ret != -ENODEV) {
queue_delayed_work(system_freezable_wq,
&process_info->restore_userptr_work,
msecs_to_jiffies(AMDGPU_USERPTR_RESTORE_DELAY_MS));
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 1b29dee7948d8..366b31191ac1e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -1853,7 +1853,7 @@ static void svm_range_restore_work(struct work_struct *work)
struct mm_struct *mm;
int evicted_ranges;
int invalid;
- int r;
+ int r = 0;
svms = container_of(dwork, struct svm_range_list, restore_work);
evicted_ranges = atomic_read(&svms->evicted_ranges);
@@ -1927,8 +1927,10 @@ static void svm_range_restore_work(struct work_struct *work)
mmap_write_unlock(mm);
mutex_unlock(&process_info->lock);
- /* If validation failed, reschedule another attempt */
- if (evicted_ranges) {
+ /* If validation failed, reschedule another attempt, unless the
+ * device is gone for good
+ */
+ if (evicted_ranges && r != -ENODEV) {
pr_debug("reschedule to restore svm range\n");
queue_delayed_work(system_freezable_wq, &svms->restore_work,
msecs_to_jiffies(AMDGPU_SVM_RANGE_RESTORE_DELAY_MS));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 814/869] drm/amd/display: take a runtime PM reference only when a CRTC turns on
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (812 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 813/869] drm/amdkfd: stop restore retries on device unplug Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 815/869] drm/amdgpu: reject CS chunks too large for kvmalloc() Greg Kroah-Hartman
` (62 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Luigi Lauro,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luigi Lauro <luigi.lauro@gmail.com>
[ Upstream commit b456f591f925fbd6b33770d0eec1b51c2f9d41c1 ]
amdgpu_dm_commit_streams() takes a runtime PM reference for every
active CRTC that needs a modeset and has a new stream, but
amdgpu_dm_atomic_commit_tail() drops one only for each CRTC that goes
from active to inactive. A modeset of a CRTC that is already active (a
mode change, or anything else that needs a full modeset) therefore
leaks one reference. Once that has happened, the usage count no longer
returns to zero with every CRTC off, and the device cannot runtime
suspend again until reboot. The two also disagree the other way when a
CRTC turns on without a stream ("Failed to create new stream"): no
reference is taken, but one is dropped when it turns off.
Take the reference in the loop that counts the disabled CRTCs, on the
mirror condition: when the CRTC goes from inactive to active, which is
what the commit that added it intended ("every time we enable a
previously disabled CRTC"). Each active CRTC then holds exactly one
reference.
Tested on an RX 9070 XT (Navi 48) over OCuLink, with the change
backported to 7.2.9: an unplugged connector forced on, then mode A on a
CRTC, mode B on the same active CRTC, and the CRTC off, three rounds in
a row. The usage count rose by 3 with the stock module, by 0 with this
patch, and by 3 again after reloading the stock module.
Fixes: 97028037a38a ("drm/amdgpu: Grab/put runtime PM references in atomic_commit_tail()")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5951
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 59ef9a435499777b8e1c4e0eff52f813c64fb920)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index bb1fae39cd395..a77b55ff9321f 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -10550,8 +10550,6 @@ static void amdgpu_dm_commit_streams(struct drm_atomic_state *state,
if (dm_old_crtc_state->stream)
remove_stream(adev, acrtc, dm_old_crtc_state->stream);
- pm_runtime_get_noresume(dev->dev);
-
acrtc->enabled = true;
acrtc->hw_mode = new_crtc_state->mode;
crtc->hwmode = new_crtc_state->mode;
@@ -11024,8 +11022,13 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
#ifdef CONFIG_DEBUG_FS
enum amdgpu_dm_pipe_crc_source cur_crc_src;
#endif
- /* Count number of newly disabled CRTCs for dropping PM refs later. */
- if (old_crtc_state->active && !new_crtc_state->active)
+ /*
+ * One runtime PM reference per active CRTC: take it when the
+ * CRTC turns on, count it when it turns off for dropping later.
+ */
+ if (!old_crtc_state->active && new_crtc_state->active)
+ pm_runtime_get_noresume(dev->dev);
+ else if (old_crtc_state->active && !new_crtc_state->active)
crtc_disable_count++;
dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 815/869] drm/amdgpu: reject CS chunks too large for kvmalloc()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (813 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 814/869] drm/amd/display: take a runtime PM reference only when a CRTC turns on Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 816/869] drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping Greg Kroah-Hartman
` (61 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesse Zhang, Christian König,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit ba4c3c202919405f461a393e823e4b72c8518494 ]
The CS ioctl copies every chunk with vmemdup_array_user() before it
looks at it, for whatever length_dw userspace gives. kvmalloc() warns
about allocations above INT_MAX when called without __GFP_NOWARN, so any
process with the render node can trigger a warning. On navi31, a CS with
a chunk of length_dw 0x20000000 returns -ENOMEM after:
WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x5a5/0x7d0
Reject such chunks with -EINVAL before trying to copy them.
Fixes: 2098105ec65c ("drm: drop drm_[cm]alloc* helpers")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit dab5f5280406088591645f499f048dcfefab8d7d)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index f8a2c9e41ca31..efcd2322afa61 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -235,6 +235,12 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
size = p->chunks[i].length_dw;
+ if (size > INT_MAX / sizeof(uint32_t)) {
+ ret = -EINVAL;
+ i--;
+ goto free_partial_kdata;
+ }
+
p->chunks[i].kdata = vmemdup_array_user(u64_to_user_ptr(user_chunk.chunk_data),
size,
sizeof(uint32_t));
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 816/869] drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (814 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 815/869] drm/amdgpu: reject CS chunks too large for kvmalloc() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 817/869] drm/amd/display: Initialize missing TD-LUT programming inputs Greg Kroah-Hartman
` (60 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philip Yang, Jesse Zhang,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit 52957e813f2f025c86e4aa6e86cb4963ef94fd00 ]
When an SVM range is split, svm_range_split_pages() gives the new range
the number of VRAM pages counted in its part of the dma_addr arrays and
subtracts it from the old range. Pages migrated to VRAM by a prefetch
have no dma_addr entries until the range is mapped on a GPU, e.g. with
no ACCESS attribute, or with XNACK off before the delayed restore worker
mapped it, so the new range gets 0 and the old one keeps the count for
both.
Migrating the parts back to system memory then gets the accounting
wrong: the old part keeps a VRAM page count after all its pages are
gone, so its svm_bo is never freed, and the new part underflows. On
navi31, as an unprivileged process: prefetch 4 MiB to the GPU, prefetch
the upper 2 MiB and then the lower 2 MiB back to system memory:
Recorded vram pages(0x0) should not be less than migration pages(0x200).
WARNING: ../amdkfd/kfd_migrate.c:922 at svm_migrate_vram_to_ram+0xbdc/0xcd0 [amdgpu]
and /sys/class/kfd/kfd/proc/<pid>/vram_<gpu_id> stays at 4194304 until
the process exits.
Without dma_addr arrays, the split is still exact when the old range is
completely in VRAM, which is what a prefetch of the whole range leaves.
Give the new range all its pages in that case. The warning is gone and
the VRAM usage drops back to 0.
This doesn't cover a range that is only partly in VRAM without dma_addr
arrays, e.g. after a partial migration, since svm_migrate_ram_to_vram()
only counts the pages it actually migrated. That would need VRAM
residency to be tracked per page independently of dma_addr.
v2:
- Rename counted to has_dma_addr and compare against old->npages (Philip)
- Mention the XNACK off case and the partial migration limitation (Philip)
Fixes: 006ad514a50c ("drm/amdkfd: Use partial hmm page walk during buffer validation in SVM")
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7ca6f3359b557a267c7b07a2fd748b1473395e10)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 366b31191ac1e..cd2cfb9a3bae2 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -987,9 +987,12 @@ svm_range_split_pages(struct svm_range *new, struct svm_range *old,
uint64_t start, uint64_t last)
{
uint64_t npages = last - start + 1;
+ bool has_dma_addr = false;
int i, r;
for (i = 0; i < MAX_GPU_INSTANCE; i++) {
+ if (old->dma_addr[i])
+ has_dma_addr = true;
r = svm_range_split_array(&new->dma_addr[i], &old->dma_addr[i],
sizeof(*old->dma_addr[i]), old->start,
npages, new->start, new->npages,
@@ -997,8 +1000,16 @@ svm_range_split_pages(struct svm_range *new, struct svm_range *old,
if (r)
return r;
}
- if (old->actual_loc)
+ if (old->actual_loc) {
+ /*
+ * Pages migrated by prefetch have no dma_addr until they are
+ * mapped on a GPU. A fully resident range still splits exactly,
+ * old->npages isn't adjusted yet here.
+ */
+ if (!has_dma_addr && old->vram_pages == old->npages)
+ new->vram_pages = new->npages;
old->vram_pages -= new->vram_pages;
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 817/869] drm/amd/display: Initialize missing TD-LUT programming inputs
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (815 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 816/869] drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 818/869] drm/amdkfd: validate SRAT subtables before parsing Greg Kroah-Hartman
` (59 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avi Weiss, Ray Wu, Harry Wentland,
Daniel Wheeler, Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avi Weiss <thnkslprpt@gmail.com>
[ Upstream commit 167df3b94680b8670c4cacc08af232e3bfcab5ff ]
dml_core_mode_programming() memsets (clears) its scratch structure
before calculating TD-LUT settings, but does not initialize
tdlut_mpc_width_flag or is_gfx11.
Both inputs therefore remain false regardless of the plane
configuration which can result in incorrect calculations.
Initialize both fields using the same sources as the mode
support path (now both paths are aligned).
Fixes: 70839da63605 ("drm/amd/display: Add new DCN401 sources")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ad8d216e7d9fc050cdf39278e5fae17f61c36931)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
index d2a237fcf5b08..ccc7ce0db2e1a 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
@@ -10921,6 +10921,8 @@ static bool dml_core_mode_programming(struct dml2_core_calcs_mode_programming_ex
calculate_tdlut_setting_params->cursor_buffer_size = mode_lib->ip.cursor_buffer_size;
calculate_tdlut_setting_params->gpuvm_enable = display_cfg->gpuvm_enable;
calculate_tdlut_setting_params->gpuvm_page_size_kbytes = display_cfg->plane_descriptors[k].overrides.gpuvm_min_page_size_kbytes;
+ calculate_tdlut_setting_params->tdlut_mpc_width_flag = display_cfg->plane_descriptors[k].tdlut.tdlut_mpc_width_flag;
+ calculate_tdlut_setting_params->is_gfx11 = dml_get_gfx_version(display_cfg->plane_descriptors[k].surface.tiling);
// output
calculate_tdlut_setting_params->tdlut_pte_bytes_per_frame = &s->tdlut_pte_bytes_per_frame[k];
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 818/869] drm/amdkfd: validate SRAT subtables before parsing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (816 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 817/869] drm/amd/display: Initialize missing TD-LUT programming inputs Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 819/869] drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO Greg Kroah-Hartman
` (58 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Jiale Yao, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 9866cb13ba4d39aa8fed34b765d4aecabe04f02e ]
The KFD SRAT walker reads the first subtable length without checking
that a header is present and trusts subsequent lengths when accessing
CPU and generic affinity records. Invalid firmware lengths can therefore
cause out-of-bounds reads.
Validate the table header, every generic subtable range, and each
supported typed record before reading its fields.
Fixes: ddec8d3be0f8 ("drm/amdkfd: add ACPI SRAT parsing for topology")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d76b655c98e8cc9e791b31502ad274f47dee2aae)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 35 ++++++++++++++++++---------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index b0e87bdc29114..ee6c17e88976a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -2051,27 +2051,33 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
return;
}
+ if (table_header->length < sizeof(struct acpi_table_srat))
+ goto invalid_srat;
+
table_end = (unsigned long)table_header + table_header->length;
/* Parse all entries looking for a match. */
sub_header = (struct acpi_subtable_header *)
((unsigned long)table_header +
sizeof(struct acpi_table_srat));
- subtable_len = sub_header->length;
- while (((unsigned long)sub_header) + subtable_len < table_end) {
- /*
- * If length is 0, break from this loop to avoid
- * infinite loop.
- */
- if (subtable_len == 0) {
- pr_err("SRAT invalid zero length\n");
- break;
- }
+ while ((unsigned long)sub_header < table_end) {
+ unsigned long start = (unsigned long)sub_header;
+
+ if (table_end - start < sizeof(*sub_header))
+ goto invalid_srat;
+
+ subtable_len = sub_header->length;
+ if (subtable_len < sizeof(*sub_header) ||
+ subtable_len > table_end - start)
+ goto invalid_srat;
switch (sub_header->type) {
case ACPI_SRAT_TYPE_CPU_AFFINITY:
cpu = (struct acpi_srat_cpu_affinity *)sub_header;
+ if (subtable_len < sizeof(*cpu))
+ goto invalid_srat;
+
pxm = *((u32 *)cpu->proximity_domain_hi) << 8 |
cpu->proximity_domain_lo;
if (pxm > max_pxm)
@@ -2079,6 +2085,9 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
break;
case ACPI_SRAT_TYPE_GENERIC_AFFINITY:
gpu = (struct acpi_srat_generic_affinity *)sub_header;
+ if (subtable_len < sizeof(*gpu))
+ goto invalid_srat;
+
bdf = *((u16 *)(&gpu->device_handle[0])) << 16 |
*((u16 *)(&gpu->device_handle[2]));
if (bdf == pci_id) {
@@ -2095,9 +2104,13 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
sub_header = (struct acpi_subtable_header *)
((unsigned long)sub_header + subtable_len);
- subtable_len = sub_header->length;
}
+ goto out;
+
+invalid_srat:
+ pr_err("SRAT contains an invalid subtable\n");
+out:
acpi_put_table(table_header);
/* Workaround bad cpu-gpu binding case */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 819/869] drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (817 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 818/869] drm/amdkfd: validate SRAT subtables before parsing Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 820/869] net: limit priority VLAN untag depth Greg Kroah-Hartman
` (57 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, Jesse Zhang,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit 8f3ecda0ab42fb5ba7310fe848013d3eff31b416 ]
criu_process_info() evicts the queues of the process on every call, and
each kfd_process_evict_queues() increments qpd->evicted, but CRIU UNPAUSE
restores them only once. After PROCESS_INFO twice and UNPAUSE the queues
stay evicted for good. On navi31, a barrier-AND packet on an HSA queue
completes after PROCESS_INFO + UNPAUSE, but times out after
PROCESS_INFO, PROCESS_INFO, UNPAUSE.
The error path has a related problem: when kfd_process_evict_queues()
itself fails, it has already rolled back its partial eviction, and the
kfd_process_restore_queues() in the error path restores once more.
Evict only when the queues are not paused yet, and on errors only undo
an eviction done by this call. The barrier now completes after any
number of PROCESS_INFO calls followed by UNPAUSE.
Fixes: cd9f79103003 ("drm/amdkfd: CRIU Implement KFD unpause operation")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4d79c9e3c32c677fcadf5ca10ab81ee0a4b81f99)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index b90bfbd121f88..e4a6100d036ae 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -2703,6 +2703,7 @@ static int criu_process_info(struct file *filep,
struct kfd_process *p,
struct kfd_ioctl_criu_args *args)
{
+ bool paused_here = false;
int ret = 0;
mutex_lock(&p->mutex);
@@ -2713,11 +2714,15 @@ static int criu_process_info(struct file *filep,
goto err_unlock;
}
- ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_CHECKPOINT);
- if (ret)
- goto err_unlock;
+ /* UNPAUSE restores the queues once, so evict them only once */
+ if (!p->queues_paused) {
+ ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_CHECKPOINT);
+ if (ret)
+ goto err_unlock;
- p->queues_paused = true;
+ p->queues_paused = true;
+ paused_here = true;
+ }
args->pid = task_pid_nr_ns(p->lead_thread,
task_active_pid_ns(p->lead_thread));
@@ -2732,7 +2737,7 @@ static int criu_process_info(struct file *filep,
args->priv_data_size);
err_unlock:
- if (ret) {
+ if (ret && paused_here) {
kfd_process_restore_queues(p);
p->queues_paused = false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 820/869] net: limit priority VLAN untag depth
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (818 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 819/869] drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 821/869] macvlan: fix passthru promiscuity accounting while down Greg Kroah-Hartman
` (56 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Kamil Sawicki,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Sawicki <user148783812897@gmail.com>
[ Upstream commit d3ff07f5acc573e5f72bf1c581bae5d05191ba61 ]
The priority VLAN receive path can repeatedly remove VID 0 tags and retry
packet processing. Unlike the read-only VLAN protocol parser, this path has
no limit on the number of nested tags it consumes.
Each skb_vlan_untag() advances skb->data and resets header offsets. The
offsets are stored in 16-bit fields. With enough nested tags, the network
or transport offset can wrap. A later protocol handler can then derive a
large pull length from the wrapped offsets and access memory outside the
skb allocation.
Apply the existing VLAN_MAX_DEPTH limit to the exceptional VID 0 retry.
Count the tag already stored in skb VLAN metadata as the first level, then
stop before untagging a ninth level. Keep the accounting inside this
uncommon branch so the regular VLAN receive path is unaffected.
A single VID 0 priority tag before a real VLAN tag is valid. No normal
deployment was found that intentionally emits multiple consecutive VID 0
tags; permitting eight levels is therefore conservative.
The issue was found while researching the Linux network receive path for
Google kvmCTF, with OpenAI Codex (gpt-5.6-sol) assisting the analysis. The
affected path, reproducer and fix were manually reviewed and tested.
Fixes: 36b2f61a42c2 ("net: handle 802.1P vlan 0 packets properly")
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Kamil Sawicki <user148783812897@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261024004835.17862-1-user148783812897@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 0bfd5e9940df0..673223065b955 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6074,6 +6074,8 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
}
if (unlikely(skb_vlan_tag_present(skb)) && !netdev_uses_dsa(skb->dev)) {
+ unsigned int priority_tag_depth = 1;
+
check_vlan_id:
if (skb_vlan_tag_get_id(skb)) {
/* Vlan id is non 0 and vlan_do_receive() above couldn't
@@ -6085,6 +6087,12 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
* 802.1Q or 802.1AD and vlan_do_receive() above could
* not find vlan dev for vlan id 0.
*/
+ if (unlikely(priority_tag_depth >= VLAN_MAX_DEPTH)) {
+ drop_reason = SKB_DROP_REASON_RECURSION_LIMIT;
+ goto drop;
+ }
+
+ priority_tag_depth++;
__vlan_hwaccel_clear_tag(skb);
skb = skb_vlan_untag(skb);
if (unlikely(!skb))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 821/869] macvlan: fix passthru promiscuity accounting while down
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (819 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 820/869] net: limit priority VLAN untag depth Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 822/869] net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring Greg Kroah-Hartman
` (55 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xia Yan, Hangbin Liu, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xia Yan <yanxia@cmss.chinamobile.com>
[ Upstream commit b6743653d134c9ef8436e2db1be1ad4c1e0d0091 ]
macvlan_changelink() adjusts the lower device's promiscuity count when
NOPROMISC changes, even if the passthru macvlan is down. The reference
is acquired in macvlan_open() and released in macvlan_stop(), so a down
interface has no reference to change.
Clearing NOPROMISC while down leaves an extra reference after the next
open/stop cycle. Setting it while down can remove a reference held by
another user of the lower device.
Guard the count adjustment with netif_running(dev). Keep storing the
requested flags while down so the next open uses the new setting.
Comparing changelink with open/stop exposed the unmatched count changes;
the same issue was also described in earlier macvlan reviews. A netlink
test on UML reproduced both DOWN cases before the fix and verified the
expected counts afterwards. Repeated flag updates, two open/stop cycles,
deletion and bidirectional small-frame delivery were also checked.
Full x86_64 builds completed with WERROR disabled for allmodconfig, and
WERROR and KASAN disabled for allyesconfig, including the resulting
dependency changes. Neither comparison showed new diagnostics.
Fixes: df8ef8f3aaa6 ("macvlan: add FDB bridge ops and macvlan flags")
Link: https://lore.kernel.org/netdev/179170088566.434549.4699134797461783473@kernel.org/
Link: https://lore.kernel.org/netdev/20261016003009.2692872-1-kuba@kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261022090809.12019-1-yanxia@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/macvlan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 7151ae883136b..c38989009c76f 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1630,7 +1630,8 @@ static int macvlan_changelink(struct net_device *dev,
if (data && data[IFLA_MACVLAN_FLAGS]) {
__u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
- if (macvlan_passthru(vlan->port) && promisc) {
+ if (macvlan_passthru(vlan->port) && promisc &&
+ netif_running(dev)) {
int err;
if (flags & MACVLAN_FLAG_NOPROMISC)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 822/869] net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (820 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 821/869] macvlan: fix passthru promiscuity accounting while down Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 823/869] fs/ntfs3: bound CreateAttribute asize against record_size in do_action Greg Kroah-Hartman
` (54 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Yang, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <mmyangfl@gmail.com>
[ Upstream commit d54b21d824302af52d06574870817fbe14774dab ]
hisi_femac_net_close() frees the receive ring while the RX address queue
still holds every address that was pushed to IQ_ADDR.
A port that keeps receiving then DMAs arrived frames into buffers that
other slab caches have already taken back; on an EC6108V9C (hi3798mv100)
the queue still held all 52 armed addresses right after the interface
was closed, and had dropped to 43 after 15 s of broadcast traffic.
Reset the port before the buffers are released, so that the receiver no
longer holds any of their addresses.
Fixes: 542ae60af24f ("net: hisilicon: Add Fast Ethernet MAC driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20261025182022.2959333-1-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hisi_femac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c
index d244a40df4309..fba68035c9691 100644
--- a/drivers/net/ethernet/hisilicon/hisi_femac.c
+++ b/drivers/net/ethernet/hisilicon/hisi_femac.c
@@ -491,6 +491,7 @@ static int hisi_femac_net_close(struct net_device *dev)
netif_stop_queue(dev);
napi_disable(&priv->napi);
+ hisi_femac_port_reset(priv);
hisi_femac_free_skb_rings(priv);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 823/869] fs/ntfs3: bound CreateAttribute asize against record_size in do_action
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (821 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 822/869] net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 824/869] fs/ntfs3: bound DeleteAttribute asize against rec->used " Greg Kroah-Hartman
` (53 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyeontae Lee, Konstantin Komarov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyeontae Lee <wonju345@naver.com>
[ Upstream commit fb0f0ef7b5a6bc761b372ce00764d4b6e0b91a47 ]
In do_action()'s CreateAttribute case (fslog.c:3286), attr2 points into
the on-disk log record and asize = le32_to_cpu(attr2->size) is therefore
attacker-controlled on mount. The guard bounds asize only against the
log record itself,
Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)
where rec_len is the client data length, and separately bounds dlen
against the MFT record. Nothing bounds asize against record_size, but
all three writes that follow are into rec, a kmalloc(sbi->record_size)
buffer allocated by mi_init() (record.c:105):
memmove(Add2Ptr(attr, asize), attr, used - roff);
memcpy(attr, attr2, asize);
rec->used = cpu_to_le32(used + asize);
With record_size 0x400, roff 0x38, used 0x160 and asize 0x800 the memcpy
writes 2048 bytes at rec + 0x38, 0x438 bytes past the allocation, and
rec->used is left at 0x960. dlen is 0x18 here, so the existing
dlen check passes: dlen bounds nothing about the size of the copy.
The equivalent non-replay path already refuses this. mi_insert_attr()
performs the same insert and starts with (record.c:488):
if (used + asize > sbi->record_size)
return NULL;
Apply the same bound, spelled as a subtraction to match the neighbouring
clause. used <= record_size holds here because check_file_record()
validates it (fslog.c:2826) and is called on this record at fslog.c:3172;
roff <= used - 4 follows from check_if_attr() together with the ATTR_END
check at fslog.c:2844, so bounding used + asize bounds both copies.
The sibling WriteEndOfFileRecordSegment case does the equivalent check
against record_size at fslog.c:3277.
Reproduced by mounting a crafted image on v7.2-rc5 under KASAN:
BUG: KASAN: slab-out-of-bounds in do_action.isra.0+0x41f6/0x83a0
Write of size 2048 at addr ffff888005c74838 by task mount/69
CPU: 0 UID: 0 PID: 69 Comm: mount Not tainted 7.2.0-rc5-00300-g8ba098e6b6ff #2
Call Trace:
kasan_report+0xce/0x100
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x3c/0x60
do_action.isra.0+0x41f6/0x83a0
log_replay+0x920a/0xd300
ntfs_loadlog_and_replay+0x3ef/0x510
ntfs_fill_super+0x1d23/0x4550
get_tree_bdev_flags+0x2ef/0x550
vfs_get_tree+0x82/0x2f0
fc_mount+0x10/0x1b0
path_mount+0x517/0x1df0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 69:
__kasan_kmalloc+0x8f/0xa0
__kmalloc_noprof+0x1b4/0x460
mi_init+0x81/0x110
mi_get+0x6a/0x220
do_action.isra.0+0x1db4/0x83a0
log_replay+0x920a/0xd300
ntfs_loadlog_and_replay+0x3ef/0x510
ntfs_fill_super+0x1d23/0x4550
The buggy address belongs to the object at ffff888005c74800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 56 bytes inside of
allocated 1024-byte region [ffff888005c74800, ffff888005c74c00)
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hyeontae Lee <wonju345@naver.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ca3533a10d064..f9b6275643f2c 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3302,10 +3302,15 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
asize = le32_to_cpu(attr2->size);
used = le32_to_cpu(rec->used);
+ /*
+ * attr2->size is taken from the log record and is bounded only
+ * by the log record length, not by the MFT record. Refuse an
+ * attribute that does not fit, as mi_insert_attr() does.
+ */
if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
!IS_ALIGNED(asize, 8) ||
Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
- dlen > record_size - used) {
+ dlen > record_size - used || asize > record_size - used) {
goto dirty_vol;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 824/869] fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (822 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 823/869] fs/ntfs3: bound CreateAttribute asize against record_size in do_action Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 825/869] ntfs3: fix mapping pairs bounds check for alignment Greg Kroah-Hartman
` (52 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyeontae Lee, Konstantin Komarov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyeontae Lee <wonju345@naver.com>
[ Upstream commit 408216b66afd9ddadaba2dce56fd4af6793e95a2 ]
In do_action()'s DeleteAttribute case (fslog.c:3316), attr is
Add2Ptr(rec, roff) with roff taken from the on-disk lrh->record_off, and
asize = le32_to_cpu(attr->size) is read straight out of the MFT record:
asize = le32_to_cpu(attr->size);
used = le32_to_cpu(rec->used);
if (!check_if_attr(rec, lrh))
goto dirty_vol;
...
memmove(attr, Add2Ptr(attr, asize), used - asize - roff);
check_if_attr() (fslog.c:2869) walks the attribute chain from
rec->attr_off and returns o == ro. Its loop breaks on ATTR_END, so ro may
legitimately equal the offset of the ATTR_END marker; that is exactly how
CreateAttribute appends to a record. But check_file_record()'s walk
(fslog.c:2831) also stops at ATTR_END, so check_attr() never inspects the
bytes there. When roff is the ATTR_END offset, those never-validated bytes
are what gets read as attr->size, and used - asize - roff underflows.
The read itself is also unbounded: roff is a u16 and attr->size is
dereferenced at fslog.c:3317, before check_if_attr() has constrained roff
at all, so it can be up to ~64K past a record_size-sized object.
Commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file
record check") added at fslog.c:2844
if (used < PtrOffset(rec, attr) + sizeof(attr->type))
return false;
and its changelog names this very memmove. It bounds rec->used against the
ATTR_END offset; it does not bound asize. With record_size 0x400,
attr_off 0x38, a valid three-attribute chain ending in ATTR_END at 0x158
and used 0x160, a record whose four bytes at 0x15c read 0x100 gives
used - asize - roff = 0x160 - 0x100 - 0x158 = 0xffffff08
i.e. a ~4 GiB memmove whose source and destination both run off the end of
rec, a kmalloc(sbi->record_size) object (record.c:105).
The equivalent non-replay path already refuses this. mi_remove_attr()
performs the same removal and starts with (record.c:548):
if (aoff + asize > used)
return false;
Apply the same bound, spelled as a subtraction to match the neighbouring
cases, and move the attr->size read after check_if_attr() so that the
header is known to lie inside the record before it is dereferenced.
Requiring roff + SIZEOF_RESIDENT <= used rejects the ATTR_END offset
without rejecting any real attribute: for an attribute the walk validated,
roff + asize <= off(ATTR_END) <= used - 4, and any attribute a
DeleteAttribute record can legitimately name carries a full resident
header, so roff + SIZEOF_RESIDENT <= roff + asize <= used - 4.
check_attr() itself imposes no lower bound on asize, so a crafted
sub-header asize can still pass the first test; the second test then
bounds it and the memmove stays inside the record.
Reproduced by mounting a crafted image on v7.2-rc5, which already contains
0ca0485e4b2e, under KASAN. The image is an ordinary mkfs.ntfs volume with
four bytes of one MFT record changed and a crafted $LogFile:
BUG: KASAN: slab-out-of-bounds in do_action.isra.0+0x3211/0x83c0
Read of size 4294967048 at addr ffff888002423258 by task mount/66
CPU: 1 UID: 0 PID: 66 Comm: mount Not tainted 7.2.0-rc5 #3
Call Trace:
kasan_report+0xce/0x100
kasan_check_range+0x105/0x1b0
__asan_memmove+0x23/0x60
do_action.isra.0+0x3211/0x83c0
log_replay+0x920a/0xd300
ntfs_loadlog_and_replay+0x3ef/0x510
ntfs_fill_super+0x1d23/0x4550
get_tree_bdev_flags+0x2ef/0x550
vfs_get_tree+0x82/0x2f0
fc_mount+0x10/0x1b0
path_mount+0x517/0x1df0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 66:
__kasan_kmalloc+0x8f/0xa0
__kmalloc_noprof+0x1b4/0x460
mi_init+0x81/0x110
mi_get+0x6a/0x220
do_action.isra.0+0x1dbf/0x83c0
log_replay+0x920a/0xd300
ntfs_loadlog_and_replay+0x3ef/0x510
ntfs_fill_super+0x1d23/0x4550
The buggy address belongs to the object at ffff888002423000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 600 bytes inside of
allocated 1024-byte region [ffff888002423000, ffff888002423400)
KASAN reports the source side because __asan_memmove()
(mm/kasan/shadow.c:94) validates src before dest and returns without
copying. Both ends are out of bounds, and on a kernel built without
KASAN the copy is performed.
rec->used is also left at used - asize by fslog.c:3323 before the memmove,
so the record stays inconsistent even when the copy is suppressed; the same
mount goes on to report "ino=1a, mi_enum_attr" and marks the volume dirty.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hyeontae Lee <wonju345@naver.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index f9b6275643f2c..e2668c57066b4 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3340,10 +3340,21 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
break;
case DeleteAttribute:
- asize = le32_to_cpu(attr->size);
used = le32_to_cpu(rec->used);
- if (!check_if_attr(rec, lrh))
+ /*
+ * check_if_attr() accepts a record_off that points at the
+ * ATTR_END marker, which is how CreateAttribute appends. The
+ * bytes there are not an attribute and check_attr() never
+ * validated them, so refuse an offset that cannot hold a
+ * resident header before reading attr->size, and then bound it
+ * as mi_remove_attr() does.
+ */
+ if (!check_if_attr(rec, lrh) || roff + SIZEOF_RESIDENT > used)
+ goto dirty_vol;
+
+ asize = le32_to_cpu(attr->size);
+ if (asize > used - roff)
goto dirty_vol;
rec->used = cpu_to_le32(used - asize);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 825/869] ntfs3: fix mapping pairs bounds check for alignment
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (823 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 824/869] fs/ntfs3: bound DeleteAttribute asize against rec->used " Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 826/869] ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe Greg Kroah-Hartman
` (51 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Konstantin Komarov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit f517cae6333121783043d9ba5142b50f5d1cf75b ]
In the UpdateMappingPairs action, the expansion check compares the
unaligned new attribute size with the available record space. The new
size is aligned to an 8-byte boundary before the mapping pairs are
updated, so the check can underestimate the required space by up to
seven bytes.
Use the aligned size in the expansion check to ensure that the
subsequent update cannot exceed the available record space.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index e2668c57066b4..4753fcab4d81c 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3436,7 +3436,8 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
if (!check_if_attr(rec, lrh) || !attr->non_res ||
aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
- (nsize > asize && nsize - asize > record_size - used)) {
+ (nsize > asize &&
+ ALIGN(nsize, 8) - asize > record_size - used)) {
goto dirty_vol;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 826/869] ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (824 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 825/869] ntfs3: fix mapping pairs bounds check for alignment Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 827/869] ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek Greg Kroah-Hartman
` (50 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 99203e8d8968def973e82bb712ea959c6a46c16e ]
After the codec has been removed, its runtime PM status is
RPM_SUSPENDED while hdac_hda_codec_probe() powers the codec up via
snd_hda_codec_device_new(). The pm_runtime_put()/snd_hda_power_down()
calls on probe and registration then see an already suspended device,
the codec suspend callback is not called and the codec, its HDA link and
the codec_powered bit stay set, preventing the controller from runtime
suspending.
The remove has a similar problem with the codec link accounting:
hdac_hda_codec_remove() drops the link reference taken in probe without
looking at the runtime PM state of the codec. If the codec was already
runtime suspended, the link reference has been dropped by the codec
suspend callback and the remove drops it a second time.
Resume the codec in hdac_hda_codec_remove() before disabling runtime PM
so that the link reference and the codec_powered bit are always in the
same state as after the probe, and mark the device active on probe once
the codec has been powered up.
Finally mark the codec device suspended at the end of the remove. Its
runtime PM is disabled at this point and if only the ASoC card is
unbound (e.g. by unbinding the machine driver), a following system
suspend would otherwise call the runtime suspend callback on the already
cleaned up codec via pm_runtime_force_suspend().
This is a followup patch to address Sashiko reports.
Link: https://lore.kernel.org/linux-sound/20261027083840.28813-4-peter.ujfalusi@linux.intel.com/
Fixes: c3ec8ac82105 ("ASoC: hdac_hda: fix memleak on module unload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261027144655.31988-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/hdac_hda.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index 1a89f570fd1f4..ac28b3cadb69f 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -517,6 +517,9 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
snd_hdac_display_power(hdev->bus,
HDA_CODEC_IDX_CONTROLLER, false);
+ /* The codec is in D0, the status is RPM_SUSPENDED after a previous unbind */
+ pm_runtime_set_active(&hdev->dev);
+
/* match for forbid call in snd_hda_codec_device_new() */
pm_runtime_allow(&hdev->dev);
@@ -557,6 +560,12 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
return;
}
+ /*
+ * Resume the codec to have its link reference (dropped below) and
+ * codec_powered bit in the same state as after the probe.
+ */
+ pm_runtime_get_sync(&hdev->dev);
+
/* prevent runtime PM callbacks while the link and the codec are torn down */
pm_runtime_disable(&hdev->dev);
snd_hdac_ext_bus_link_put(hdev->bus, hlink);
@@ -568,6 +577,9 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
/* Balances the disable above, cleanup_for_unbind keeps runtime PM disabled */
pm_runtime_enable(&hdev->dev);
+ pm_runtime_put_noidle(&hdev->dev);
+ /* The codec is cleaned up, system suspend must skip it from now on */
+ pm_runtime_set_suspended(&hdev->dev);
}
static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 827/869] ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (825 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 826/869] ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 828/869] nvmet-rdma: reject short connection requests Greg Kroah-Hartman
` (49 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Dave Miller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 1e860f42f41c6fbf3304f6a52be38245b9394982 ]
ppp_ccp_peek() caches a pointer to skb->data in dp after the first
pskb_may_pull(), then uses dp after a second pskb_may_pull(skb, len + 2)
in the CCP_CONFACK handler. If the second pull triggers
pskb_expand_head() due to a cloned skb or frag linearization,
skb->head is freed and reallocated, leaving dp stale.
The stale dp is subsequently used in CCP_OPT_LENGTH() and passed to
decomp_init()/comp_init() which read from the freed memory.
Re-derive dp from skb->data after the second pskb_may_pull.
Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ppp/ppp_generic.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 14fa87a8e0834..61c240d846ee2 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -3204,6 +3204,7 @@ ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound)
len = CCP_LENGTH(dp);
if (!pskb_may_pull(skb, len + 2))
return; /* too short */
+ dp = skb->data + 2;
dp += CCP_HDRLEN;
len -= CCP_HDRLEN;
if (len < CCP_OPT_MINLEN || len < CCP_OPT_LENGTH(dp))
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 828/869] nvmet-rdma: reject short connection requests
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (826 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 827/869] ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 829/869] nvmet-fc: only send read data for successful commands Greg Kroah-Hartman
` (48 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+e015e82956da641b,
Christoph Hellwig, Weiming Shi, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 635e760169a87abf03874cd4636cd91b580cb427 ]
nvmet_rdma_parse_cm_connect_req() treats RDMA-CM private data as a
struct nvme_rdma_cm_req but accepts any nonzero private_data_len. The
iWARP path allocates exactly the peer-provided length, so a six-byte MPA
request reaches the parser and the hsqsize load reads two bytes past the
allocation.
Require the complete request structure before reading any of its fields.
The decoded KASAN report is:
BUG: KASAN: slab-out-of-bounds in nvmet_rdma_cm_handler
(drivers/nvme/target/rdma.c:1427 drivers/nvme/target/rdma.c:1475
drivers/nvme/target/rdma.c:1614 drivers/nvme/target/rdma.c:1814)
Read of size 2 at addr ff1100010459d366 by task kworker/u16:1/41
Workqueue: iw_cm_wq cm_work_handler
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
nvmet_rdma_cm_handler
(drivers/nvme/target/rdma.c:1427 drivers/nvme/target/rdma.c:1475
drivers/nvme/target/rdma.c:1614 drivers/nvme/target/rdma.c:1814)
cma_cm_event_handler (drivers/infiniband/core/cma.c:2181)
iw_conn_req_handler (drivers/infiniband/core/cma.c:2640)
cm_work_handler
(drivers/infiniband/core/cm.c:2502
drivers/infiniband/core/cm.c:3858)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>
Allocated by task 12:
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_node_track_caller_noprof
(mm/slub.c:5414 mm/slub.c:5545)
kmemdup_noprof (mm/util.c:138)
cm_event_handler
(drivers/infiniband/core/iwcm.c:194
drivers/infiniband/core/iwcm.c:1076)
siw_cm_upcall (drivers/infiniband/sw/siw/siw_cm.c:408)
siw_proc_mpareq (drivers/infiniband/sw/siw/siw_cm.c:750)
siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1086)
The buggy address is located 0 bytes to the right of
allocated 6-byte region [ff1100010459d360, ff1100010459d366)
Cc: stable@vger.kernel.org
Fixes: 8f000cac6e7a ("nvmet-rdma: add a NVMe over Fabrics RDMA target driver")
Reported-by: <co+e015e82956da641b@bugs.sh>
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/rdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 2b03bce27a88c..a0ba6641c7ffb 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -1410,7 +1410,7 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
struct nvme_rdma_cm_req *req;
req = (struct nvme_rdma_cm_req *)conn->private_data;
- if (!req || conn->private_data_len == 0)
+ if (!req || conn->private_data_len < sizeof(*req))
return NVME_RDMA_CM_INVALID_LEN;
if (le16_to_cpu(req->recfmt) != NVME_RDMA_CM_FMT_1_0)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 829/869] nvmet-fc: only send read data for successful commands
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (827 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 828/869] nvmet-rdma: reject short connection requests Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 830/869] nvmet: pci-epf: report transport errors in command completions Greg Kroah-Hartman
` (47 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Andrea Parri,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 94f93c61b1a5dd08d011be58172ce4392b849008 ]
When a read command completes with an error,
__nvmet_fc_fcp_nvme_cmd_done() still pushes the whole data buffer to
the host before the response. nvmet_fc_alloc_tgt_pgs() allocates that
buffer with sgl_alloc() and no __GFP_ZERO, and a command rejected by
nvmet_check_transfer_len() leaves it untouched, so the host receives
stale target memory.
The buffer is as large as the data length in the command IU, so the
amount of stale memory returned is up to the host.
The tcp and rdma targets send data only when cqe->status is zero (see
nvmet_tcp_need_data_out() and nvmet_rdma_need_data_out()), so no nvmet
command can rely on returning data with an error status. Do the same
for fc. The ERSP then reports a transferred length of fod->offset,
which is 0, matching what nvme_fc_fcpio_done() checks on the host.
Tested over nvme-fcloop: a failed read command no longer transfers
data and still completes with its error status, and successful reads
are unaffected.
Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1880fc7804326..ec08992668b99 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -2493,11 +2493,11 @@ __nvmet_fc_fcp_nvme_cmd_done(struct nvmet_fc_tgtport *tgtport,
} else {
/*
- * try to push the data even if the SQE status is non-zero.
- * There may be a status where data still was intended to
- * be moved
+ * A failed command may not have filled its read buffer, so
+ * only push data for success, as the tcp and rdma targets do.
*/
- if ((fod->io_dir == NVMET_FCP_READ) && (fod->data_sg_cnt)) {
+ if (fod->io_dir == NVMET_FCP_READ && fod->data_sg_cnt &&
+ !cqe->status) {
/* push the data over before sending rsp */
nvmet_fc_transfer_fcp_data(tgtport, fod,
NVMET_FCOP_READDATA);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 830/869] nvmet: pci-epf: report transport errors in command completions
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (828 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 829/869] nvmet-fc: only send read data for successful commands Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 831/869] nvmet: pci-epf: require SGLs to match the command data length Greg Kroah-Hartman
` (46 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Andrea Parri,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 46ed7310a60029826eedb01081a4556643ed5f3b ]
When the PCI endpoint target fails a command itself, the host receives a
successful completion. This happens for a data length above MDTS,
malformed PRPs or SGLs, a buffer allocation failure, an SQ that is not
live, and a failed DMA of the command data. A write whose data cannot be
fetched from the host is thus reported as written, though nothing was
executed.
Each of these paths sets iod->status and calls
nvmet_pci_epf_complete_iod(), which then reloads iod->status from
iod->cqe.status. The nvmet core only fills that field when it completes
the request, which these paths never do, so it is still zero and
nvmet_pci_epf_cq_work() posts a success status to the host.
Drop the reload. Every path already sets iod->status before completion:
nvmet_pci_epf_queue_response() copies it from the request's CQE, and
the transport error paths set it themselves.
Found by code inspection.
Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
Cc: stable@vger.kernel.org
Tested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/pci-epf.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c
index e3815be98ee6e..a85f21a593706 100644
--- a/drivers/nvme/target/pci-epf.c
+++ b/drivers/nvme/target/pci-epf.c
@@ -1174,7 +1174,6 @@ static void nvmet_pci_epf_complete_iod(struct nvmet_pci_epf_iod *iod)
unsigned long flags;
/* Print an error message for failed commands, except AENs. */
- iod->status = le16_to_cpu(iod->cqe.status) >> 1;
if (iod->status && iod->cmd.common.opcode != nvme_admin_async_event)
dev_err(iod->ctrl->dev,
"CQ[%d]: Command %s (0x%x) status 0x%0x\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 831/869] nvmet: pci-epf: require SGLs to match the command data length
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (829 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 830/869] nvmet: pci-epf: report transport errors in command completions Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 832/869] nvmet-auth: fix error handling on CHALLENGE failure Greg Kroah-Hartman
` (45 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Andrea Parri,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 9fb4adbc39751697b9fcf71e45bd5d5119c3f07c ]
The PCI endpoint target sends the host every byte a read command's SGL
describes, even when the SGL describes more than the command transfers.
The excess is kmalloc() memory the command never wrote, so the host
receives stale target memory. Any successful read can do this,
including Identify.
nvmet_pci_epf_alloc_iod_data_buf() allocates each segment at the length
of its SGL data descriptor, but sets req->transfer_len from
iod->data_len, the length the command implies. Once the command
completes, nvmet_pci_epf_transfer_iod_data() sends every segment in
full. Nothing compares the descriptor lengths with iod->data_len, and
the MDTS check only bounds iod->data_len.
Fail the command with Data SGL Length Invalid when the data descriptors
do not add up to iod->data_len, before any segment is allocated. The
tcp and rdma transports take the data length from the SGL itself, so
there most commands already reject a mismatch in
nvmet_check_transfer_len(). PRP lists are built from iod->data_len and
are unaffected.
Found by code inspection.
Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
Cc: stable@vger.kernel.org
Tested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/pci-epf.c | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c
index a85f21a593706..dcc6cae6f3c5e 100644
--- a/drivers/nvme/target/pci-epf.c
+++ b/drivers/nvme/target/pci-epf.c
@@ -1095,10 +1095,22 @@ static int nvmet_pci_epf_iod_parse_sgl_segments(struct nvmet_pci_epf_ctrl *ctrl,
return 0;
}
+static u64 nvmet_pci_epf_iod_data_segs_len(struct nvmet_pci_epf_iod *iod)
+{
+ u64 len = 0;
+ int i;
+
+ for (i = 0; i < iod->nr_data_segs; i++)
+ len += iod->data_segs[i].length;
+
+ return len;
+}
+
static int nvmet_pci_epf_iod_parse_sgls(struct nvmet_pci_epf_iod *iod)
{
struct nvmet_pci_epf_ctrl *ctrl = iod->ctrl;
struct nvme_sgl_desc *sgl = &iod->cmd.common.dptr.sgl;
+ int ret;
if (sgl->type == (NVME_SGL_FMT_DATA_DESC << 4)) {
/* Single data descriptor case. */
@@ -1106,10 +1118,23 @@ static int nvmet_pci_epf_iod_parse_sgls(struct nvmet_pci_epf_iod *iod)
iod->data_segs = &iod->data_seg;
iod->data_seg.pci_addr = le64_to_cpu(sgl->addr);
iod->data_seg.length = le32_to_cpu(sgl->length);
- return 0;
+ } else {
+ ret = nvmet_pci_epf_iod_parse_sgl_segments(ctrl, iod);
+ if (ret)
+ return ret;
}
- return nvmet_pci_epf_iod_parse_sgl_segments(ctrl, iod);
+ /*
+ * The command executes on data_len bytes, but each segment is
+ * allocated and transferred in full, so they must describe exactly
+ * data_len bytes.
+ */
+ if (nvmet_pci_epf_iod_data_segs_len(iod) != iod->data_len) {
+ iod->status = NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
+ return -EINVAL;
+ }
+
+ return 0;
}
static int nvmet_pci_epf_alloc_iod_data_buf(struct nvmet_pci_epf_iod *iod)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 832/869] nvmet-auth: fix error handling on CHALLENGE failure
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (830 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 831/869] nvmet: pci-epf: require SGLs to match the command data length Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 833/869] nvmet-fc: Tear down the association when the admin queue allocation fails Greg Kroah-Hartman
` (44 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shao Mingyin, Keith Busch,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shao Mingyin <shao.mingyin@zte.com.cn>
[ Upstream commit 96da408bb4a24bf87b366b13f41c2687d3c05671 ]
In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for
example when the initiator-supplied allocation length is shorter than the
DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails),
the error path sets status = NVME_SC_INTERNAL and breaks out of the
switch. The unconditional
status = nvmet_copy_to_sgl(req, 0, d, al);
after the switch then overwrites the error status (nvmet_copy_to_sgl()
returns 0 on success), so the AUTH_RECEIVE command incorrectly completes
with SUCCESS and the initiator proceeds with a truncated/empty challenge.
Fix this by freeing the buffer and jumping to the common done: label on
CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the
NVME_SC_INTERNAL status.
Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fabrics-cmd-auth.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 20a2dfcbbc57f..fc50fde2947d4 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -601,10 +601,11 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
switch (req->sq->dhchap_step) {
case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE:
if (nvmet_auth_challenge(req, d, al) < 0) {
- pr_warn("ctrl %d qid %d: challenge error (%d)\n",
- ctrl->cntlid, req->sq->qid, status);
+ pr_warn("ctrl %d qid %d: challenge error\n",
+ ctrl->cntlid, req->sq->qid);
status = NVME_SC_INTERNAL;
- break;
+ kfree(d);
+ goto done;
}
req->sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_REPLY;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 833/869] nvmet-fc: Tear down the association when the admin queue allocation fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (831 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 832/869] nvmet-auth: fix error handling on CHALLENGE failure Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 834/869] nvme-tcp: start error recovery when read_sock fails Greg Kroah-Hartman
` (43 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wagner, Guixin Liu,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 11db8ab55e1a7533e9cfe57687ab142ba67d3c84 ]
When the initial admin queue allocation fails after a new association
was created, nvmet_fc_ls_create_association() only drops the
association reference, which frees the association. By then the
association is already on the target port's assoc_list, though, and
removal from that list only happens in nvmet_fc_delete_target_assoc(),
which this error path never calls. The freed association stays on the
list, where later lookups and the port teardown can access it, and the
target port reference taken at allocation time leaks.
A remote host can trigger this reliably with a Create Association LS
requesting a queue too large to allocate.
Schedule the regular association teardown instead of dropping the
reference directly. The teardown removes the association from the
list and releases the target port reference before the final reference
drop frees it.
Fixes: 0cab4404874f ("nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association")
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index ec08992668b99..89edffeb10626 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1710,7 +1710,7 @@ nvmet_fc_ls_create_association(struct nvmet_fc_tgtport *tgtport,
be16_to_cpu(rqst->assoc_cmd.sqsize));
if (!queue) {
ret = VERR_QUEUE_ALLOC_FAIL;
- nvmet_fc_tgt_a_put(iod->assoc);
+ nvmet_fc_schedule_delete_assoc(iod->assoc);
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 834/869] nvme-tcp: start error recovery when read_sock fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (832 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 833/869] nvmet-fc: Tear down the association when the admin queue allocation fails Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 835/869] nvme-tcp: fix io_work priority inversion when send_mutex is held Greg Kroah-Hartman
` (42 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Martin Belanger, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Belanger <martin.belanger@dell.com>
[ Upstream commit 288cfa187208cc9d0809eb8e1508658151a444dd ]
nvme_tcp_recv_skb() disables the queue and starts error recovery for
errors it detects itself. An error returned by the transport reaches
nvme_tcp_try_recv() without either action.
nvme_tcp_io_work() returns on a negative result and does not requeue
itself, so the queue stops receiving and remains stalled until a command
times out.
Report the error and start error recovery when the queue is still
enabled, which indicates that the error was not handled by the actor.
Do this under the socket lock, as nvme_tcp_recv_skb() does.
Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin Belanger <martin.belanger@dell.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/tcp.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index b7e4624f1dcd8..5d7581a1dc41d 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1425,6 +1425,19 @@ static int nvme_tcp_try_recv(struct nvme_tcp_queue *queue)
lock_sock(sk);
queue->nr_cqe = 0;
consumed = sock->ops->read_sock(sk, &rd_desc, nvme_tcp_recv_skb);
+ /*
+ * nvme_tcp_recv_skb() handles its own errors, so a queue that is
+ * still enabled failed inside read_sock(). Handle it before
+ * release_sock() processes the backlog.
+ */
+ if (unlikely(consumed < 0 && consumed != -EAGAIN &&
+ queue->rd_enabled)) {
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d: receive failed: %d\n",
+ nvme_tcp_queue_id(queue), consumed);
+ queue->rd_enabled = false;
+ nvme_tcp_error_recovery(&queue->ctrl->ctrl);
+ }
release_sock(sk);
return consumed == -EAGAIN ? 0 : consumed;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 835/869] nvme-tcp: fix io_work priority inversion when send_mutex is held
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (833 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 834/869] nvme-tcp: start error recovery when read_sock fails Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 836/869] nvmet: Finish the blk plug when integrity allocation fails Greg Kroah-Hartman
` (41 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seiji Nishikawa, Keith Busch,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Nishikawa <snishika@redhat.com>
[ Upstream commit 5db358f3a7f9c33717622c1597d15c4c91997b19 ]
Commit f42d4796ee10 ("nvme-tcp: fix I/O stalls on congested sockets")
added a check in nvme_tcp_io_work() that sets pending to true when the
queue has pending requests and the socket is writeable. The check is
placed after the mutex_trylock() block, so it also runs when
mutex_trylock(&queue->send_mutex) failed and io_work did not send
anything.
When .queue_rq sends a request directly from its own context, it holds
send_mutex and can give up the CPU in lock_sock_nested() when another
task needs the CPU, for example the io_work kworker of the same queue,
which runs on the same CPU. Then io_work cannot take send_mutex, but
the requests are still on req_list and the socket is writeable, so
pending is set to true. io_work loops until the deadline and queues
itself again on io_cpu, without sleeping.
This is a priority inversion. io_work runs on the high priority
nvme_tcp_wq and cannot make progress until send_mutex is released, but
it keeps running. The task holding send_mutex runs at normal priority
and needs the CPU to release it. The scheduler keeps giving the CPU to
io_work, so the task holding send_mutex may not run again, and the
requests on the queue are not sent and time out.
This is the same problem that commit 70f437fb4395 ("nvme-tcp: fix
io_work priority inversion") fixed. That commit removed
"pending = !llist_empty(&queue->req_list)" from the path where
mutex_trylock() fails, and let the task holding send_mutex queue
io_work again in nvme_tcp_queue_request() after it releases the mutex.
The new check brings back the same behavior in a different form.
Two things make this easier to hit. nvme_tcp_queue_request() sends
directly only when it runs on io_cpu, so the task that takes send_mutex
is on the same CPU as the io_work kworker of that queue when it takes
the mutex. Also, when the tasks are in a cgroup with the cpu controller
enabled, the whole group competes with the nice -20 kworker as one
entity, so each task in the group gets even less CPU time.
We hit this on a 6 CPU VM running a database on nvme-tcp storage. In
the vmcore, 2 tasks held send_mutex of 2 queues and were runnable in
lock_sock_nested() for 103 seconds, while the kworkers for those queues
kept running io_work on their CPUs. All database tasks were in one
cgroup, which got only about 0.3% of the CPU against the nice -20
kworker. Requests timed out, and blk_mq_timeout_work() waited in
synchronize_srcu() for the tasks still in .queue_rq.
Only do the pending check if io_work could take send_mutex. If it could
not, the task holding send_mutex sends what it can in
nvme_tcp_send_all(), and queues io_work again after it releases the
mutex if requests are still pending, so no request is left behind.
Fixes: f42d4796ee10 ("nvme-tcp: fix I/O stalls on congested sockets")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/tcp.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 5d7581a1dc41d..94495b0228714 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1450,9 +1450,11 @@ static void nvme_tcp_io_work(struct work_struct *w)
do {
bool pending = false;
+ bool got_send_mutex = false;
int result;
if (mutex_trylock(&queue->send_mutex)) {
+ got_send_mutex = true;
result = nvme_tcp_try_send(queue);
mutex_unlock(&queue->send_mutex);
if (result > 0)
@@ -1467,8 +1469,13 @@ static void nvme_tcp_io_work(struct work_struct *w)
else if (unlikely(result < 0))
return;
- /* did we get some space after spending time in recv? */
- if (nvme_tcp_queue_has_pending(queue) &&
+ /*
+ * did we get some space after spending time in recv?
+ * Only check this if we could take send_mutex. Otherwise
+ * the task holding it sends the requests and queues io_work
+ * again after it releases the mutex.
+ */
+ if (got_send_mutex && nvme_tcp_queue_has_pending(queue) &&
sk_stream_is_writeable(queue->sock->sk))
pending = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 836/869] nvmet: Finish the blk plug when integrity allocation fails
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (834 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 835/869] nvme-tcp: fix io_work priority inversion when send_mutex is held Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 837/869] nvmet: Free the old negotiation state when restarting authentication Greg Kroah-Hartman
` (40 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Nilay Shroff, Guixin Liu, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 18fc5f6f1ca945630dae5404265de55d65194e22 ]
nvmet_bdev_execute_rw() starts a plug before building the bios, but
the two error exits taken when nvmet_bdev_alloc_bip() fails return
without calling blk_finish_plug(). current->plug is left pointing
at the stack frame of the returned function, so the next
blk_flush_plug() walks a stale list.
Route both failures through a common exit that finishes the plug.
Fixes: c6e3f13398123 ("nvmet: add metadata support for block devices")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/io-cmd-bdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
index 0103815542d49..160364cc8c980 100644
--- a/drivers/nvme/target/io-cmd-bdev.c
+++ b/drivers/nvme/target/io-cmd-bdev.c
@@ -305,7 +305,7 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req)
&prot_miter);
if (unlikely(rc)) {
bio_io_error(bio);
- return;
+ goto out_plug;
}
}
@@ -325,11 +325,12 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req)
rc = nvmet_bdev_alloc_bip(req, bio, &prot_miter);
if (unlikely(rc)) {
bio_io_error(bio);
- return;
+ goto out_plug;
}
}
submit_bio(bio);
+out_plug:
blk_finish_plug(&plug);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 837/869] nvmet: Free the old negotiation state when restarting authentication
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (835 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 836/869] nvmet: Finish the blk plug when integrity allocation fails Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 838/869] kgdb: Fix buffer overflow in the m packet handler Greg Kroah-Hartman
` (39 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Guixin Liu,
Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 5c279fcabb0ea7ba61881c13027b15d8054b8abd ]
Restarting a DH-HMAC-CHAP negotiation with SEND(NEGOTIATE) resets
sq->dhchap_step but does not release the previous c1/c2/skey, which
are only freed in nvmet_auth_sq_free() at teardown. The next
CHALLENGE/REPLY exchange then overwrites those pointers with fresh
allocations.
An unauthenticated host can repeat the negotiate message endlessly,
leaking a few dozen bytes per round and slowly exhausting target
memory.
Clear the old negotiation state with nvmet_auth_sq_free() before
setting up the new one. Also reset dhchap_skey_len to zero: if a DH
session key was already established, a following round with dhvlen=0
would otherwise pass a NULL skey with a stale non-zero length to the
HMAC code and dereference it.
Fixes: db1312dd95488 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/auth.c | 1 +
drivers/nvme/target/fabrics-cmd-auth.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 4c68225411be3..eb2b6c7a80838 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -249,6 +249,7 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq)
sq->dhchap_c2 = NULL;
kfree(sq->dhchap_skey);
sq->dhchap_skey = NULL;
+ sq->dhchap_skey_len = 0;
}
void nvmet_auth_sq_destroy(struct nvmet_sq *sq)
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index fc50fde2947d4..61a36fb54e877 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -326,6 +326,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
/* Restart negotiation */
pr_debug("%s: ctrl %d qid %d reset negotiation\n",
__func__, ctrl->cntlid, req->sq->qid);
+ nvmet_auth_sq_free(req->sq);
if (!req->sq->qid) {
dhchap_status = nvmet_setup_auth(ctrl, req->sq,
true);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 838/869] kgdb: Fix buffer overflow in the m packet handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (836 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 837/869] nvmet: Free the old negotiation state when restarting authentication Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 839/869] kgdb: Fix buffer overflow in the M and X packet handlers Greg Kroah-Hartman
` (38 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fang Xieyan, Douglas Anderson,
Daniel Thompson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fang Xieyan <fangxy@xiaopeng.com>
[ Upstream commit ac0159129e2cb99a70c4b80cfbf58d03e092dc7b ]
gdb_cmd_memread() passes the length of the 'm' packet straight to
kgdb_mem2hex(), which hex-encodes the reply into
remcom_out_buffer[BUFMAX] without checking that the reply fits. A
client on the KGDB I/O console can ask for a read of any size, and
the hex encoding runs off the end of the buffer. kgdb_mem2hex() takes
that length as an int count, so 2^31 truncates to a negative value
and copy_from_kernel_nofault() is handed buf + count as its
destination.
On x86 BUFMAX is 1024, so a read of 512 bytes overruns by the single
byte that terminates the hex string:
BUG: KASAN: global-out-of-bounds in kgdb_mem2hex+0x1dd/0x230
Write of size 1 at addr ffffffff87651780 by task sh/1
...
The buggy address belongs to the variable:
remcom_out_buffer+0x400/0x420
Bounds check the length before the hex encoding:
if (length > (BUFMAX - 1) / 2) {
error_packet(remcom_out_buffer, -EINVAL);
return;
}
gdbstub_msg_write() already bounds the count it hex-encodes
against BUFMAX. Reads over the limit never returned valid data,
so an error reply loses nothing.
Fixes: dc7d55270521 ("kgdb: core")
Cc: stable@vger.kernel.org
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20260914180344.15485-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/debug/gdbstub.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index 22fe969c5d2e5..75b9cf07ebbe0 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -562,6 +562,14 @@ static void gdb_cmd_memread(struct kgdb_state *ks)
if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
kgdb_hex2long(&ptr, &length) > 0) {
+ /*
+ * The hex-encoded reply needs 2 * length + 1 bytes
+ * in remcom_out_buffer[BUFMAX].
+ */
+ if (length > (BUFMAX - 1) / 2) {
+ error_packet(remcom_out_buffer, -EINVAL);
+ return;
+ }
err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
if (!err)
error_packet(remcom_out_buffer, -EINVAL);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 839/869] kgdb: Fix buffer overflow in the M and X packet handlers
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (837 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 838/869] kgdb: Fix buffer overflow in the m packet handler Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 840/869] kgdb: Fix buffer overflow in the qRcmd packet handler Greg Kroah-Hartman
` (37 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fang Xieyan, Daniel Thompson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fang Xieyan <fangxy@xiaopeng.com>
[ Upstream commit 13962ef7021ef2531a4f6650eca87c363e6c9c32 ]
write_mem_msg() passes the length claimed by an 'M' or 'X' packet directly
to kgdb_hex2mem() or kgdb_ebin2mem(). A malformed packet can claim more
data than was actually received, causing the decoders to read past
remcom_in_buffer.
Record the received payload length in get_packet() and use it to bound
the decoders. 'M' carries two hex characters per byte, while 'X' carries
one byte per output byte except that a 0x7d escape consumes an additional
input byte. Pass the packet end to kgdb_ebin2mem() so both reads are
checked against the received data.
Keep zero-length 'X' packets valid, as GDB uses them to probe binary
download support.
Fixes: dc7d55270521 ("kgdb: core")
Cc: stable@vger.kernel.org
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Link: https://lore.kernel.org/r/20260922154907.90535-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/debug/gdbstub.c | 45 +++++++++++++++++++++++++++++++++++-------
1 file changed, 38 insertions(+), 7 deletions(-)
diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index 75b9cf07ebbe0..dbe48bd53e533 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -42,6 +42,8 @@
/* Our I/O buffers. */
static char remcom_in_buffer[BUFMAX];
static char remcom_out_buffer[BUFMAX];
+/* Payload bytes get_packet() stored in remcom_in_buffer, excluding the NUL. */
+static int remcom_in_len;
static int gdbstub_use_prev_in_buf;
static int gdbstub_prev_in_buf_pos;
@@ -86,7 +88,7 @@ static int gdbstub_read_wait(void)
}
#endif
/* scan for the sequence $<data>#<checksum> */
-static void get_packet(char *buffer)
+static int get_packet(char *buffer)
{
unsigned char checksum;
unsigned char xmitcsum;
@@ -134,6 +136,8 @@ static void get_packet(char *buffer)
}
buffer[count] = 0;
} while (checksum != xmitcsum);
+
+ return count;
}
/*
@@ -320,16 +324,26 @@ int kgdb_hex2long(char **ptr, unsigned long *long_val)
* Copy the binary array pointed to by buf into mem. Fix $, #, and
* 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
* The input buf is overwritten with the result to write to mem.
+ *
+ * buf_end points one past the last byte received for this packet. Each
+ * 0x7d escape consumes a second input byte, so decoding count bytes can
+ * read up to 2 * count input bytes; stop at buf_end rather than running
+ * off the end of remcom_in_buffer.
*/
-static int kgdb_ebin2mem(char *buf, char *mem, int count)
+static int kgdb_ebin2mem(char *buf, char *mem, int count, char *buf_end)
{
int size = 0;
char *c = buf;
while (count-- > 0) {
+ if (buf >= buf_end)
+ return -EINVAL;
c[size] = *buf++;
- if (c[size] == 0x7d)
+ if (c[size] == 0x7d) {
+ if (buf >= buf_end)
+ return -EINVAL;
c[size] = *buf++ ^ 0x20;
+ }
size++;
}
@@ -366,16 +380,33 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
static int write_mem_msg(int binary)
{
char *ptr = &remcom_in_buffer[1];
+ char *buf_end = &remcom_in_buffer[remcom_in_len];
unsigned long addr;
unsigned long length;
int err;
if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
- if (binary)
- err = kgdb_ebin2mem(ptr, (char *)addr, length);
- else
+ /*
+ * Trust only the bytes actually received, not length: the
+ * client can claim more payload than it sent. 'M' decodes two
+ * hex chars per byte in place, so it needs 2 * length bytes at
+ * ptr; 'X' decodes one byte per byte, and kgdb_ebin2mem() bounds
+ * its extra 0x7d-escape reads against buf_end itself.
+ */
+ if (ptr >= buf_end)
+ return -EINVAL;
+
+ if (binary) {
+ if (length > (unsigned long)(buf_end - ptr))
+ return -EINVAL;
+ err = kgdb_ebin2mem(ptr, (char *)addr, length, buf_end);
+ } else {
+ if (length > (unsigned long)(buf_end - ptr) / 2)
+ return -EINVAL;
err = kgdb_hex2mem(ptr, (char *)addr, length);
+ }
+
if (err)
return err;
if (CACHE_FLUSH_IS_SAFE)
@@ -992,7 +1023,7 @@ int gdb_serial_stub(struct kgdb_state *ks)
/* Clear the out buffer. */
memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
- get_packet(remcom_in_buffer);
+ remcom_in_len = get_packet(remcom_in_buffer);
switch (remcom_in_buffer[0]) {
case '?': /* gdbserial status */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 840/869] kgdb: Fix buffer overflow in the qRcmd packet handler
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (838 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 839/869] kgdb: Fix buffer overflow in the M and X packet handlers Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 841/869] fsverity: Be more careful with return value of ->get_verity_descriptor() Greg Kroah-Hartman
` (36 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Fang Xieyan,
Daniel Thompson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fang Xieyan <fangxy@xiaopeng.com>
[ Upstream commit 9ca9e8c857b55a081d5a1f8039b27cbb4d646b49 ]
gdb_cmd_query() decodes the hex payload of a qRcmd packet (the GDB
"monitor" command passthrough to kdb) into remcom_out_buffer and hands
it to kdb_parse(). It sizes the decode with strlen() of the payload:
int len = strlen(remcom_in_buffer + 6);
...
kgdb_hex2mem(remcom_in_buffer + 6,
remcom_out_buffer, len);
len = len / 2;
kgdb_hex2mem() takes count as the number of bytes to produce and
decodes them in place at buf, reading and writing 2 * count bytes
there. len here is the hex character count, twice the decoded size,
so the decode runs over 2 * len bytes at remcom_in_buffer + 6, off
the end of the buffer. On x86 BUFMAX is 1024, so a 256-byte monitor
command (512 hex characters) overruns remcom_in_buffer during the
in-place decode:
BUG: KASAN: global-out-of-bounds in kgdb_hex2mem+0x131/0x160
Read of size 1 at addr ffffffff8765ef05 by task sh/1
...
kgdb_hex2mem+0x131/0x160
gdb_serial_stub+0x16d4/0x3170
kgdb_cpu_enter+0xb68/0x1520
...
The buggy address belongs to the variable:
remcom_in_buffer+0x405/0x420
Halve len before the call so kgdb_hex2mem() gets the decoded byte count.
It then reads the len hex characters already in remcom_in_buffer and
writes len / 2 bytes, all inside the buffer, and remcom_out_buffer holds
the same command as before.
Fixes: a0de055cf613 ("kgdb: gdb "monitor" -> kdb passthrough")
Cc: stable@vger.kernel.org
Suggested-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/all/CAD=FV=V1-gNZ8yTsC+D8inePWv=A+9H09hWJojQf5NRpcNvK+Q@mail.gmail.com/
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20260916151753.6722-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/debug/gdbstub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index dbe48bd53e533..1a917c5bdd1eb 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -816,9 +816,9 @@ static void gdb_cmd_query(struct kgdb_state *ks)
strscpy(remcom_out_buffer, "E01");
break;
}
+ len = len / 2;
kgdb_hex2mem(remcom_in_buffer + 6,
remcom_out_buffer, len);
- len = len / 2;
remcom_out_buffer[len++] = 0;
kdb_common_init_state(ks);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 841/869] fsverity: Be more careful with return value of ->get_verity_descriptor()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (839 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 840/869] kgdb: Fix buffer overflow in the qRcmd packet handler Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 842/869] irqchip/riscv-imsic: Report successful hardware retrigger Greg Kroah-Hartman
` (35 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit 8f8faec82aa902b1997ae578c46bcc84afbad811 ]
If fsverity_operations::get_verity_descriptor() returns that the verity
descriptor has 0 size, then a zero-size buffer is allocated to hold it,
and it's called again with bufsize=0.
But bufsize=0 is a special case that says to return the actual size. If
in the meantime the filesystem has decided that the size is some
actually valid size, it will return that size, and then
validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash.
Of course, for the filesystem to misbehave in that strange way, it
generally would require direct writes to the block device.
Regardless, fsverity_get_descriptor() might as well guard against it.
Make it do so. Specifically, validate that the first call to
->get_verity_descriptor() returns at least the minimum descriptor size,
and validate that the second call returns the same size as the first.
Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261025203831.120095-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/verity/open.c | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)
diff --git a/fs/verity/open.c b/fs/verity/open.c
index 2aa5eae5a5403..02e2c14ab3ffb 100644
--- a/fs/verity/open.c
+++ b/fs/verity/open.c
@@ -273,12 +273,6 @@ static bool validate_fsverity_descriptor(struct inode *inode,
const struct fsverity_descriptor *desc,
size_t desc_size)
{
- if (desc_size < sizeof(*desc)) {
- fsverity_err(inode, "Unrecognized descriptor size: %zu bytes",
- desc_size);
- return false;
- }
-
if (desc->version != 1) {
fsverity_err(inode, "Unrecognized descriptor version: %u",
desc->version);
@@ -317,31 +311,37 @@ static bool validate_fsverity_descriptor(struct inode *inode,
int fsverity_get_descriptor(struct inode *inode,
struct fsverity_descriptor **desc_ret)
{
- int res;
+ int size, res;
struct fsverity_descriptor *desc;
- res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
- if (res < 0) {
- fsverity_err(inode,
- "Error %d getting verity descriptor size", res);
- return res;
+ size = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
+ if (size < 0) {
+ fsverity_err(inode, "Error %d getting verity descriptor size",
+ size);
+ return size;
}
- if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
- fsverity_err(inode, "Verity descriptor is too large (%d bytes)",
- res);
+ if (size < sizeof(*desc) || size > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
+ fsverity_err(inode,
+ "Verity descriptor has invalid size (%d bytes)",
+ size);
return -EMSGSIZE;
}
- desc = kmalloc(res, GFP_KERNEL);
+ desc = kmalloc(size, GFP_KERNEL);
if (!desc)
return -ENOMEM;
- res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res);
+ res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, size);
if (res < 0) {
fsverity_err(inode, "Error %d reading verity descriptor", res);
kfree(desc);
return res;
}
-
- if (!validate_fsverity_descriptor(inode, desc, res)) {
+ if (res != size) {
+ fsverity_err(inode, "Verity descriptor size changed (%d => %d)",
+ size, res);
+ kfree(desc);
+ return -EINVAL;
+ }
+ if (!validate_fsverity_descriptor(inode, desc, size)) {
kfree(desc);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 842/869] irqchip/riscv-imsic: Report successful hardware retrigger
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (840 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 841/869] fsverity: Be more careful with return value of ->get_verity_descriptor() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 843/869] irqchip/irq-msi-lib: Free wired MSI descriptors Greg Kroah-Hartman
` (34 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avi Weiss, Thomas Gleixner,
Björn Töpel, Anup Patel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avi Weiss <thnkslprpt@gmail.com>
[ Upstream commit a2f482407d33ebe7f12e30d6cf383ffb1c7d709d ]
imsic_irq_retrigger() writes to the IMSIC MSI register to retrigger
an interrupt, but returns 0. The IRQ core treats zero as failure and
may schedule a software resend despite the hardware retrigger.
Return 1 after the MSI write to report successful hardware
retriggering and prevent the unnecessary software resend.
Fixes: 027e125acdba ("irqchip/riscv-imsic: Add device MSI domain support for platform devices")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261026122641.3292904-2-thnkslprpt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-riscv-imsic-platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-riscv-imsic-platform.c b/drivers/irqchip/irq-riscv-imsic-platform.c
index 643c8e4596117..52673ff9edf4a 100644
--- a/drivers/irqchip/irq-riscv-imsic-platform.c
+++ b/drivers/irqchip/irq-riscv-imsic-platform.c
@@ -61,7 +61,7 @@ static int imsic_irq_retrigger(struct irq_data *d)
local = per_cpu_ptr(imsic->global.local, vec->cpu);
writel_relaxed(vec->local_id, local->msi_va);
- return 0;
+ return 1;
}
static void imsic_irq_ack(struct irq_data *d)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 843/869] irqchip/irq-msi-lib: Free wired MSI descriptors
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (841 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 842/869] irqchip/riscv-imsic: Report successful hardware retrigger Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 844/869] Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU" Greg Kroah-Hartman
` (33 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Avi Weiss, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avi Weiss <thnkslprpt@gmail.com>
[ Upstream commit 1c16bc2b1122f78f9d51c5785f7a78b36d44972b ]
msi_device_domain_alloc_wired() allocates a descriptor for each
interrupt, but wired MSI domains do not set MSI_FLAG_FREE_MSI_DESCS.
msi_device_domain_free_wired() releases the IRQ without freeing its
descriptor, eventually exhausting the domain. Failed allocations also
leave descriptors behind.
Set MSI_FLAG_FREE_MSI_DESCS for wired MSI domains so both paths
release the descriptors.
Fixes: 64a855324311 ("irqchip/irq-msi-lib: Prepare for DOMAIN_BUS_WIRED_TO_MSI")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261025122058.2180685-1-thnkslprpt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-msi-lib.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-msi-lib.c b/drivers/irqchip/irq-msi-lib.c
index d5eefc3d72155..8b8a64f63a717 100644
--- a/drivers/irqchip/irq-msi-lib.c
+++ b/drivers/irqchip/irq-msi-lib.c
@@ -72,6 +72,7 @@ bool msi_lib_init_dev_msi_info(struct device *dev, struct irq_domain *domain,
info->flags = MSI_FLAG_ALLOC_SIMPLE_MSI_DESCS | MSI_FLAG_FREE_MSI_DESCS;
fallthrough;
case DOMAIN_BUS_WIRED_TO_MSI:
+ info->flags |= MSI_FLAG_FREE_MSI_DESCS;
/* Remove PCI specific flags */
required_flags &= ~MSI_FLAG_PCI_MSI_MASK_PARENT;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 844/869] Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU"
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (842 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 843/869] irqchip/irq-msi-lib: Free wired MSI descriptors Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 845/869] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates Greg Kroah-Hartman
` (32 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongjian Wang, Eric Dumazet,
Jiayuan Chen, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Wang <echoowall@gmail.com>
[ Upstream commit 564313447e545eea13038f74ada9272ab129b3cb ]
This reverts commit 2640e6419594 ("net: advertise TCP MSS from the
configured MTU, not the learned PMTU").
That commit stopped the learned PMTU from lowering the MSS we advertise
in SYN and SYN-ACK. For symmetric paths it argued that "the peer runs
its own PMTU discovery and usually already knows the real path MTU".
That only holds if ICMP "fragmentation needed" can reach the peer. When
the peer sits behind a firewall that drops inbound ICMP, its PMTU
discovery is a black hole (RFC 2923, section 2.1), and the smaller MSS
we advertised was the only thing keeping its full-size segments off the
narrow hop.
Inbound ICMP filtering is very common in enterprise and carrier
networks, and it is pervasive in mainland China. We hit this in
production after the commit was backported to 6.12.111: TCP connections
that reach a server through a relay with a smaller-MTU hop complete the
handshake, then stall as soon as the client sends full-size segments.
Clients on networks that let ICMP through, and connections that bypass
the relay, are unaffected, which made it hard to trace back to the
kernel.
Reproducer, network namespaces on a single host:
cli --(1500)-- r1 --(1456)-- r2 --(1500)-- srv
r1 drops ICMP frag-needed towards cli. srv has already learned PMTU
1456 towards cli, then cli uploads 1 MB to srv:
kernel SYN-ACK MSS 1 MB upload
6.12.107 1416 OK
6.12.111 1460 stalls, times out
7.3-rc7 1460 stalls, times out
7.3-rc7 + this revert 1416 OK
The asymmetric case the commit was written for does not need a new
default: the advertised MSS can already be set per route with the
advmss metric, which takes precedence over default_advmss(). With this
revert applied, on an asymmetric path where srv learned PMTU 1456
towards cli while cli->srv is 1500 end to end:
srv route to cli SYN-ACK MSS largest cli->srv segment
default 1416 1404
advmss 1460 1460 1448
So DSR-style setups can opt in with "ip route ... advmss <mss>", while
hosts whose peers cannot complete PMTU discovery keep working by
default.
Fixes: 2640e6419594 ("net: advertise TCP MSS from the configured MTU, not the learned PMTU")
Closes: https://lore.kernel.org/regressions/4F0FAEB6-A13B-47F3-BFF1-C706686C6F64@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Wang <echoowall@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20261026-advmss-revert-v1-2-272fa4b7ecb6@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip.h | 25 -------------------------
include/net/ip6_route.h | 37 -------------------------------------
net/ipv4/route.c | 4 ++--
net/ipv6/route.c | 2 +-
4 files changed, 3 insertions(+), 65 deletions(-)
diff --git a/include/net/ip.h b/include/net/ip.h
index 5041202ccce2a..86e555fb6897b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -513,31 +513,6 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
return res;
}
-/* Configured/administrative MTU of a route, for advertising the TCP MSS.
- *
- * Unlike ip_dst_mtu_maybe_forward(), this deliberately ignores the
- * ICMP-learned path MTU (rt->rt_pmtu). The advertised MSS bounds what the
- * peer may send to us and must reflect our receive capability (the device or
- * route-configured MTU), not a path MTU learned on the reverse (send)
- * direction, which may not apply to the peer->us path and outlives the fnhe
- * for the whole connection. See RFC 2923 section 2.3 and the comment above
- * tcp_advertise_mss().
- */
-static inline unsigned int ip_dst_mtu_configured(const struct dst_entry *dst)
-{
- unsigned int mtu, res;
-
- rcu_read_lock();
- mtu = dst_metric_raw(dst, RTAX_MTU);
- if (!mtu)
- mtu = READ_ONCE(dst_dev_rcu(dst)->mtu);
- mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
- res = mtu - lwtunnel_headroom(dst->lwtstate, mtu);
- rcu_read_unlock();
-
- return res;
-}
-
static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
const struct sk_buff *skb)
{
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 4137bdf05baae..956ebbebd53cf 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -354,43 +354,6 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst
return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
}
-/* Configured/administrative MTU of a route, for advertising the TCP MSS.
- *
- * Unlike ip6_dst_mtu_maybe_forward(), this ignores any ICMPv6-learned path
- * MTU (which is kept on the RTF_CACHE exception route) and returns the MTU of
- * the underlying route (fib6_pmtu) or the egress device. The advertised MSS
- * bounds what the peer may send to us and must reflect our receive
- * capability, not a path MTU learned on the reverse (send) direction. See
- * RFC 2923 section 2.3 and the comment above tcp_advertise_mss().
- */
-static inline unsigned int ip6_dst_mtu_configured(const struct dst_entry *dst)
-{
- const struct rt6_info *rt = dst_rt6_info(dst);
- const struct fib6_info *from;
- struct inet6_dev *idev;
- unsigned int mtu = 0;
-
- rcu_read_lock();
- /* IPv6 keeps the learned PMTU and the configured MTU in the same
- * RTAX_MTU slot: the learned value sits on this (possibly RTF_CACHE)
- * dst, the configured one on the underlying route. Reach the latter
- * via ->from (fib6_pmtu), populated by ip6_route_info_create().
- */
- from = rcu_dereference(rt->from);
- if (from)
- mtu = from->fib6_pmtu;
- if (!mtu) {
- mtu = IPV6_MIN_MTU;
- idev = __in6_dev_get(dst_dev_rcu(dst));
- if (idev)
- mtu = max_t(unsigned int, mtu, READ_ONCE(idev->cnf.mtu6));
- }
- rcu_read_unlock();
-
- mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
- return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
-}
-
u32 ip6_mtu_from_fib6(const struct fib6_result *res,
const struct in6_addr *daddr,
const struct in6_addr *saddr);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6e51d8f5365dc..e6276896f3ad4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1362,8 +1362,8 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
rcu_read_lock();
net = dst_dev_net_rcu(dst);
- advmss = max_t(unsigned int, ip_dst_mtu_configured(dst) - header_size,
- net->ipv4.ip_rt_min_advmss);
+ advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+ net->ipv4.ip_rt_min_advmss);
rcu_read_unlock();
return min(advmss, IPV4_MAX_PMTU - header_size);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ce60fe53b822b..c3a837bdd0cb6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3264,7 +3264,7 @@ EXPORT_SYMBOL_GPL(ip6_sk_redirect);
static unsigned int ip6_default_advmss(const struct dst_entry *dst)
{
- unsigned int mtu = ip6_dst_mtu_configured(dst);
+ unsigned int mtu = dst6_mtu(dst);
struct net *net;
mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 845/869] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (843 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 844/869] Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU" Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 846/869] apparmor: dont revalidate inherited files under files->file_lock Greg Kroah-Hartman
` (31 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien Jarno,
Fabian Grünbichler, Georgia Garcia, Maxime Bélair,
John Johansen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Bélair <maxime.belair@canonical.com>
[ Upstream commit 4de32fd05ce9e63b492899215ea929e7d306cdab ]
aa_unix_file_perm lazily refreshes the AppArmor context cached on a unix
socket. Two of the helpers it uses assume ctx->peer has already been set:
update_peer_ctx -> l = aa_label_merge(old, label, GFP_ATOMIC);
update_sk_ctx -> } else if (aa_label_is_subset(plabel, old)) {
where @old is ctx->peer. Neither aa_label_merge nor aa_label_is_subset
allows NULL. So both fault on the aa_label->size load.
BUG: kernel NULL pointer dereference, address: 000000000000004c
RIP: 0010:__aa_label_next_not_in_set+0xb/0xd0
Call Trace:
aa_label_is_subset+0x3f/0x70
aa_unix_file_perm+0x5e8/0x9d0
aa_file_perm+0x45a/0x550
apparmor_file_permission+0x44/0xb0
security_file_permission+0x40/0x100
rw_verify_area+0x56/0x180
vfs_write+0x7c/0x480
ksys_write+0xbf/0xf0
ctx->peer is only recorded for stream connections and socket pairs.
unix_dgram_connect sets unix_peer(sk) without going through that path,
so a connected AF_UNIX datagram socket has unix_peer(sk) set while
ctx->peer is still NULL, and the first write that needs revalidation
reaches the helpers above.
Both derefs date back to the Fixes: commit, but the update_sk_ctx() one
was dormant until commit 4483efe4f215 ("apparmor: fix shadowing of plabel
that prevents cache from being updated") stopped @plabel being shadowed,
which is why bisecting the oops lands there.
A NULL @old just means no peer label has been recorded yet, so install
the label directly instead of merging or comparing against it.
Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
Cc: stable@vger.kernel.org
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Closes: https://bugs.debian.org/1145111
Tested-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/af_unix.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index 834a3b1c2f0af..aa2b31d5598cd 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -676,7 +676,7 @@ static void update_sk_ctx(struct sock *sk, struct aa_label *label,
if (old == plabel) {
rcu_assign_pointer(ctx->peer_lastupdate,
aa_get_label(plabel));
- } else if (aa_label_is_subset(plabel, old)) {
+ } else if (!old || aa_label_is_subset(plabel, old)) {
rcu_assign_pointer(ctx->peer_lastupdate,
aa_get_label(plabel));
rcu_assign_pointer(ctx->peer, aa_get_label(plabel));
@@ -694,13 +694,17 @@ static void update_peer_ctx(struct sock *sk, struct aa_sk_ctx *ctx,
spin_lock(&unix_sk(sk)->lock);
old = rcu_dereference_protected(ctx->peer,
lockdep_is_held(&unix_sk(sk)->lock));
- l = aa_label_merge(old, label, GFP_ATOMIC);
- if (l) {
- if (l != old) {
- rcu_assign_pointer(ctx->peer, l);
- aa_put_label(old);
- } else
- aa_put_label(l);
+ if (!old) {
+ rcu_assign_pointer(ctx->peer, aa_get_label(label));
+ } else {
+ l = aa_label_merge(old, label, GFP_ATOMIC);
+ if (l) {
+ if (l != old) {
+ rcu_assign_pointer(ctx->peer, l);
+ aa_put_label(old);
+ } else
+ aa_put_label(l);
+ }
}
spin_unlock(&unix_sk(sk)->lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 846/869] apparmor: dont revalidate inherited files under files->file_lock
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (844 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 845/869] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 847/869] r8152: Use BMSR to detect the link state Greg Kroah-Hartman
` (30 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgia Garcia <georgia.garcia@canonical.com>
[ Upstream commit a913281f600157aa036b7c02afbb18a0ac115187 ]
aa_inherit_files() revalidates inherited files on exec using
iterate_fd(), which calls the callback with files->file_lock held,
so the revalidation is done with IN_ATOMIC. However the unix socket
mediation path can sleep: aa_unix_file_perm() drops a ref on the
peer's path with path_put(), and unix_fs_perm() -> aa_path_perm()
allocates a buffer with aa_get_buffer(false), resulting in
BUG: sleeping function called from invalid context at fs/dcache.c:1039
...
dput.part.0+0x24/0x180
path_put+0x2c/0x60
aa_unix_file_perm+0x42a/0x17b0
aa_file_perm+0xcd3/0x1060
match_file+0x10b/0x190
iterate_fd+0xe6/0x280
aa_inherit_files+0x250/0x4f0
Only grab a ref on each file under iterate_fd(), and revalidate it
after the lock is dropped, so revalidation is done with no locks held
and does not need to be atomic. Denied fds are still replaced with
/dev/null, or closed if it can not be opened.
Fixes: b1aea2c19607 ("apparmor: fix race in unix socket mediation when peer_path is used")
Cc: stable@vger.kernel.org
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/file.c | 61 ++++++++++++++++++++--------------------
1 file changed, 31 insertions(+), 30 deletions(-)
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 534a93520c569..3176e5623d3d4 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -691,49 +691,50 @@ static void revalidate_tty(const struct cred *subj_cred, struct aa_label *label)
no_tty();
}
-struct cred_label {
- const struct cred *cred;
- struct aa_label *label;
-};
-
-static int match_file(const void *p, struct file *file, unsigned int fd)
+/*
+ * iterate_fd() callback, called with files->file_lock held: grab a ref
+ * on the next file so it can be revalidated without the lock held.
+ */
+static int get_next_file(const void *p, struct file *file, unsigned int fd)
{
- struct cred_label *cl = (struct cred_label *)p;
+ *(struct file **)p = get_file(file);
- if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,
- aa_map_file_to_perms(file), IN_ATOMIC))
- return fd + 1;
- return 0;
+ return fd + 1;
}
-
/* based on selinux's flush_unauthorized_files */
void aa_inherit_files(const struct cred *cred, struct files_struct *files)
{
struct aa_label *label = aa_get_newest_cred_label(cred);
- struct cred_label cl = {
- .cred = cred,
- .label = label,
- };
- struct file *devnull = NULL;
- unsigned int n;
+ struct file *devnull = NULL, *file;
+ bool devnull_tried = false;
+ unsigned int n = 0;
revalidate_tty(cred, label);
- /* Revalidate access to inherited open files. */
- n = iterate_fd(files, 0, match_file, &cl);
- if (!n) /* none found? */
- goto out;
-
- devnull = dentry_open(&aa_null, O_RDWR, cred);
- if (IS_ERR(devnull))
- devnull = NULL;
- /* replace all the matching ones with this */
- do {
+ /*
+ * Revalidate access to inherited open files. Each file is
+ * revalidated holding only a reference to it, with no locks
+ * held, as revalidation may sleep (e.g. unix socket mediation
+ * dropping path refs, or allocating path buffers).
+ */
+ while ((n = iterate_fd(files, n, get_next_file, &file)) != 0) {
+ int error = aa_file_perm(OP_INHERIT, cred, label, file,
+ aa_map_file_to_perms(file), false);
+
+ fput(file);
+ if (!error)
+ continue;
+ if (!devnull_tried) {
+ devnull_tried = true;
+ devnull = dentry_open(&aa_null, O_RDWR, cred);
+ if (IS_ERR(devnull))
+ devnull = NULL;
+ }
+ /* replace the denied fd (n - 1) with devnull, or close it */
replace_fd(n - 1, devnull, 0);
- } while ((n = iterate_fd(files, n, match_file, &cl)) != 0);
+ }
if (devnull)
fput(devnull);
-out:
aa_put_label(label);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 847/869] r8152: Use BMSR to detect the link state
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (845 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 846/869] apparmor: dont revalidate inherited files under files->file_lock Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 848/869] mount: refuse setns() with a shared fs_struct again Greg Kroah-Hartman
` (29 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hayes Wang, Linmao Li, Paolo Abeni,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 85b4bc79dde77aadda0929a22f3532b208a3e1f8 ]
r8152 detects carrier from PLA_PHYSTATUS without reading BMSR, so
BMSR_LSTATUS can remain latched low after link up. Since
commit f6f2e946aa4d ("net: mii: Fix the Speed display when the network
cable is not connected"), the first speed query can then report
SPEED_UNKNOWN, which applications such as NetworkManager may cache
until the next carrier change.
Use BMSR_LSTATUS in set_carrier() so a latched link down can turn
carrier off after the link has recovered. If BMSR reports down but
PLA_PHYSTATUS reports up, reschedule the link work to read the current
state without waiting for another notification.
Tested on an RTL8153B: NetworkManager reported 1000 Mb/s after 3 of 3
rebinds, instead of an unknown speed.
Fixes: f6f2e946aa4d ("net: mii: Fix the Speed display when the network cable is not connected")
Cc: stable@vger.kernel.org
Suggested-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Hayes Wang <hayeswang@realtek.com>
Link: https://patch.msgid.link/20261026012345.1902285-1-lilinmao@kylinos.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/r8152.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 8cf4e81f8f882..7b9923b6480e6 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -6785,11 +6785,8 @@ static void set_carrier(struct r8152 *tp)
{
struct net_device *netdev = tp->netdev;
struct napi_struct *napi = &tp->napi;
- u16 speed;
-
- speed = rtl8152_get_speed(tp);
- if (speed & LINK_STATUS) {
+ if (r8152_mdio_read(tp, MII_BMSR) & BMSR_LSTATUS) {
if (!netif_carrier_ok(netdev)) {
tp->rtl_ops.enable(tp);
netif_stop_queue(netdev);
@@ -6815,6 +6812,11 @@ static void set_carrier(struct r8152 *tp)
tasklet_enable(&tp->tx_tl);
netif_info(tp, link, netdev, "carrier off\n");
}
+
+ if (rtl8152_get_speed(tp) & LINK_STATUS) {
+ set_bit(RTL8152_LINK_CHG, &tp->flags);
+ schedule_delayed_work(&tp->schedule, 0);
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 848/869] mount: refuse setns() with a shared fs_struct again
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (846 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 847/869] r8152: Use BMSR to detect the link state Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 849/869] userns: dont drop the exec securebits Greg Kroah-Hartman
` (28 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 948e604aca8af30490accf7d46d44814ffa26f80 ]
mntns_install() refuses to switch the mount namespace of a task that
shares its fs_struct, since root and cwd of the others would move to a
namespace they are not in. It looks at nsset->fs for that. If more
than the mount namespace is asked for, that is a private copy made by
prepare_nsset(), which has one user by definition; commit_nsset() then
writes root and cwd of the copy to the fs_struct of the task.
A thread of a process with two threads, pidfd of a task in another
mount namespace:
setns(pidfd, CLONE_NEWNS) -EINVAL
setns(pidfd, CLONE_NEWNS | CLONE_NEWUTS) 0
and after the second call the other thread, still in the old mount
namespace, has lost its cwd (/tmp became /) and sees the mounts of the
other namespace under /.
Look at the fs_struct that is going to be changed. The second call then
fails with -EINVAL like the first one.
Fixes: 303cc571d107 ("nsproxy: attach to namespaces via pidfds")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index bb73b317f9e72..34e0d14c454ba 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -6376,7 +6376,7 @@ static int mntns_install(struct nsset *nsset, struct ns_common *ns)
if (is_anon_ns(mnt_ns))
return -EINVAL;
- if (fs->users != 1)
+ if (current->fs->users != 1)
return -EINVAL;
get_mnt_ns(mnt_ns);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 849/869] userns: dont drop the exec securebits
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (847 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 848/869] mount: refuse setns() with a shared fs_struct again Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 850/869] blk-iocost: abort weight transfer on invalid donation weights Greg Kroah-Hartman
` (27 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mickaël Salaün,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit bf5ba73c9bdd5e872eb35e801e429a3b526f8f04 ]
SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE tell script
interpreters to only run what AT_EXECVE_CHECK allows and to refuse
interactive input. A service manager sets them together with their lock
bits so that nothing below it can turn them off again.
But set_cred_user_ns() resets all securebits to SECUREBITS_DEFAULT. So
any task that can create a user namespace sheds the locked exec bits
with a single unshare(CLONE_NEWUSER) and joining one with setns() does
the same. The lock is pointless if anyone who may create a user
namespace can drop it, and that is pretty much everyone.
Resetting the other bits is fine. They are about how capabilities are
computed and a new user namespace starts out with a full set of
capabilities anyway. The exec bits grant nothing though. They are
restrictions a task placed on itself, just like no_new_privs which a
user namespace doesn't touch either. So keep them and their locks.
Reproducer:
// SPDX-License-Identifier: GPL-2.0
/* Lock the exec securebits, then create a user namespace and look at them again. */
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <sys/prctl.h>
#define SECBIT_EXEC_RESTRICT_FILE (1 << 8)
#define SECBIT_EXEC_RESTRICT_FILE_LOCKED (1 << 9)
#define SECBIT_EXEC_DENY_INTERACTIVE (1 << 10)
#define SECBIT_EXEC_DENY_INTERACTIVE_LOCKED (1 << 11)
int main(void)
{
int bits = SECBIT_EXEC_RESTRICT_FILE | SECBIT_EXEC_RESTRICT_FILE_LOCKED |
SECBIT_EXEC_DENY_INTERACTIVE | SECBIT_EXEC_DENY_INTERACTIVE_LOCKED;
if (prctl(PR_SET_SECUREBITS, bits, 0, 0, 0)) {
perror("PR_SET_SECUREBITS");
return 1;
}
printf("before: 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
printf("clear locked bits: %s\n", prctl(PR_SET_SECUREBITS, 0, 0, 0, 0) ? "refused" : "ALLOWED");
if (unshare(CLONE_NEWUSER)) {
perror("unshare(CLONE_NEWUSER)");
return 1;
}
printf("after unshare(CLONE_NEWUSER): 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
return 0;
}
On v7.1 this prints "before: 0xf00", "clear locked bits: refused" and
"after unshare(CLONE_NEWUSER): 0x0". With this patch the last line
reads 0xf00 as well.
Fixes: a0623b2a1d59 ("security: Add EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits")
Cc: stable@vger.kernel.org # v6.14+
Link: https://patch.msgid.link/20261026-work-securebits-userns-v1-1-b35473fa1a34@kernel.org
Reviewed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/userspace-api/check_exec.rst | 4 ++++
kernel/user_namespace.c | 5 ++++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/Documentation/userspace-api/check_exec.rst b/Documentation/userspace-api/check_exec.rst
index 05dfe3b56f711..0904810e1d8d9 100644
--- a/Documentation/userspace-api/check_exec.rst
+++ b/Documentation/userspace-api/check_exec.rst
@@ -99,6 +99,10 @@ This secure bit may be set by user session managers, service managers,
container runtimes, sandboxer tools... Except for test environments, the
related ``SECBIT_EXEC_DENY_INTERACTIVE_LOCKED`` bit should also be set.
+Both secure bits and their locks are inherited across :manpage:`fork(2)` and
+:manpage:`execve(2)`, and they are kept when a task creates or joins a user
+namespace.
+
Here is the expected behavior for a script interpreter according to combination
of any exec securebits:
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 03cb63883d041..702f934e69a97 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -45,8 +45,11 @@ static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
{
/* Start with the same capabilities as init but useless for doing
* anything as the capabilities are bound to the new user namespace.
+ * The exec securebits grant nothing, they are restrictions the task
+ * placed on itself. Keep them and their locks.
*/
- cred->securebits = SECUREBITS_DEFAULT;
+ cred->securebits = SECUREBITS_DEFAULT |
+ (cred->securebits & (SECURE_ALL_UNPRIVILEGED | SECURE_ALL_UNPRIVILEGED << 1));
cred->cap_inheritable = CAP_EMPTY_SET;
cred->cap_permitted = CAP_FULL_SET;
cred->cap_effective = CAP_FULL_SET;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 850/869] blk-iocost: abort weight transfer on invalid donation weights
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (848 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 849/869] userns: dont drop the exec securebits Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 851/869] proc: dont let an entry below /proc/<pid>/net be a mountpoint Greg Kroah-Hartman
` (26 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunhai Dai, Tao Cui, Tejun Heo,
Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunhai Dai <daikunhai@didiglobal.com>
[ Upstream commit c810ee88cdab27f443c32270dc7c0eaad2cca3f8 ]
transfer_surpluses() warns and then keeps going when the donation
calculation produced invalid weights. The following propagation can then
divide by a zero hweight_inuse, so the warning is immediately followed by a
divide error.
When the check trips, abandon this period's donation transfer and release
the walk lists. This trades one period without donation for not crashing;
the invalid state is not expected on the normal path.
Developed with assistance from Claude Code (Anthropic): the assistant
analysed the failure path, drafted the change and ran the checks listed
below. The author reviewed the result and remains responsible for it.
Fixes: e08d02aa5fc9 ("blk-iocost: implement Andy's method for donation weight updates")
Cc: stable@vger.kernel.org
Signed-off-by: Kunhai Dai <daikunhai@didiglobal.com>
Tested-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20261019125412.3123895-2-daikunhai@didiglobal.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-iocost.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index d0b13580c6b62..5c7cdb493768c 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -1965,6 +1965,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now)
pr_cont(": active=%u donating=%u after=%u\n",
iocg->hweight_active, iocg->hweight_donating,
iocg->hweight_after_donation);
+ goto out;
}
}
@@ -2063,6 +2064,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now)
__propagate_weights(iocg, iocg->active, inuse, true, now);
}
+out:
/* walk list should be dissolved after use */
list_for_each_entry_safe(iocg, tiocg, &inner_walk, walk_list)
list_del_init(&iocg->walk_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 851/869] proc: dont let an entry below /proc/<pid>/net be a mountpoint
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (849 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 850/869] blk-iocost: abort weight transfer on invalid donation weights Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 852/869] tcp: check congestion control restriction first Greg Kroah-Hartman
` (25 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Aleksa Sarai,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit eeecea75ece2ba894bee4d3c53ed2e40abda8f0e ]
proc_net_d_revalidate() always returns 0 so that a dentry below
/proc/<pid>/net is never reused after setns(). So lookup_fast() will end
up calling d_invalidate(), which unhashes the dentry and detaches every
mount on it, in every mount namespace; including locked mounts.
Then lookup_slow() creates a new dentry for the same entry. So a mount
on /proc/<pid>/net/dev succeeds and goes away with the first lookup of
the name by anybody with search permission on the directory. Given it's
0555 that's everyone's grandma. A mask on such a name hides nothing as
the repro below shows.
Treat those entries like I did fd/, fdinfo/ and map_files/ and refuse to
mount on them in the first place. It's nonsensical theater otherwise:
procnet net/dev stat
// SPDX-License-Identifier: GPL-2.0
/*
* procnet: cover an entry of /proc/<pid>/ with a bind mount, lock the mount,
* then look the name up.
*
* The first task stays alive, <pid> is its pid. The "container" task has its
* own mount namespace. There it binds a mask on /proc/<pid>/<name>. It drops to
* uid 1000 and enters a new user namespace with a new mount namespace, so that
* the mask is locked. Then one task looks the name up:
*
* stat the container calls stat() on the name
* umount the container calls umount2(MNT_DETACH) on the name
* nobody a task with uid 65534 in the first namespaces calls stat()
*
* The container lists its mounts before and after (that does not look the
* name up) and then reads the name. MASK is fine. Anything else means that
* the lookup uncovered the entry.
*
* usage: procnet <name> stat|umount|nobody
* name "status" is the control, "net/dev" is a file below net, "net/stat" is
* a directory below net
*/
#define _GNU_SOURCE
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/wait.h>
#define WORK "/run/pn"
static char target[128];
static void die(const char *what)
{
fprintf(stderr, "FATAL %s: %s\n", what, strerror(errno));
exit(2);
}
static void write_str(const char *path, const char *s, int flags)
{
int fd = open(path, O_WRONLY | flags, 0644);
if (fd < 0 || write(fd, s, strlen(s)) < 0)
die(path);
close(fd);
}
/* list the mounts below /proc without a lookup of the target */
static void mounts(const char *when)
{
char line[512];
FILE *f = fopen("/proc/self/mountinfo", "r");
int n = 0;
if (!f)
die("mountinfo");
while (fgets(line, sizeof(line), f)) {
if (!strstr(line, " /proc/"))
continue;
printf("container: %s: mount: %s", when, line);
n++;
}
fclose(f);
if (!n)
printf("container: %s: nothing is mounted below /proc\n", when);
}
static void show(const char *when, int isdir)
{
char buf[48] = "";
int fd;
if (isdir) {
struct dirent *de;
DIR *d = opendir(target);
int hit = 0;
if (!d) {
printf("container: %s: opendir(%s) = %s\n", when, target, strerror(errno));
return;
}
printf("container: %s: readdir(%s) =", when, target);
while ((de = readdir(d))) {
if (de->d_name[0] == '.')
continue;
printf(" %s", de->d_name);
hit |= strcmp(de->d_name, "MASK");
}
closedir(d);
printf("%s\n", hit ? " <-- HIT" : "");
return;
}
fd = open(target, O_RDONLY);
if (fd < 0) {
printf("container: %s: open(%s) = %s\n", when, target, strerror(errno));
return;
}
if (read(fd, buf, sizeof(buf) - 1) < 0)
die("read");
close(fd);
if (strchr(buf, '\n'))
*strchr(buf, '\n') = 0;
printf("container: %s: read(%s) = \"%s\"%s\n", when, target, buf,
strncmp(buf, "MASK", 4) ? " <-- HIT" : "");
}
int main(int argc, char **argv)
{
const char *name = argc > 1 ? argv[1] : "net/dev";
const char *op = argc > 2 ? argv[2] : "stat";
int isdir = !strcmp(name, "net/stat");
int to_host[2], to_cont[2];
struct stat st;
pid_t pid;
char c;
setvbuf(stdout, NULL, _IOLBF, 0);
snprintf(target, sizeof(target), "/proc/%d/%s", getpid(), name);
if (unshare(CLONE_NEWNS) || mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL))
die("unshare");
mkdir(WORK, 0755);
if (mount("W", WORK, "tmpfs", 0, NULL))
die("mount W");
write_str(WORK "/mask", "MASK", O_CREAT);
mkdir(WORK "/maskdir", 0755);
write_str(WORK "/maskdir/MASK", "MASK", O_CREAT);
if (pipe(to_host) || pipe(to_cont))
die("pipe");
pid = fork();
if (pid < 0)
die("fork");
if (!pid) {
if (unshare(CLONE_NEWNS))
die("container unshare");
if (mount(isdir ? WORK "/maskdir" : WORK "/mask", target, NULL, MS_BIND, NULL)) {
printf("container: bind the mask on %s: %s\n", target, strerror(errno));
exit(0);
}
printf("container: bind the mask on %s: ok\n", target);
if (setgid(1000) || setuid(1000) || prctl(PR_SET_DUMPABLE, 1))
die("setuid");
/* lock the mount: a new user namespace with a copy of the tree */
if (unshare(CLONE_NEWUSER | CLONE_NEWNS))
die("container userns");
write_str("/proc/self/setgroups", "deny", 0);
write_str("/proc/self/uid_map", "0 1000 1", 0);
write_str("/proc/self/gid_map", "0 1000 1", 0);
mounts("before");
errno = 0;
if (!strcmp(op, "stat")) {
stat(target, &st);
printf("container: stat(%s): %s\n", target, strerror(errno));
} else if (!strcmp(op, "umount")) {
umount2(target, MNT_DETACH);
printf("container: umount2(%s, MNT_DETACH): %s\n", target, strerror(errno));
} else if (write(to_host[1], "g", 1) != 1 || read(to_cont[0], &c, 1) != 1) {
die("sync");
}
mounts("after");
show("after", isdir);
exit(0);
}
close(to_host[1]);
if (read(to_host[0], &c, 1) == 1) {
pid_t p2 = fork();
if (!p2) {
if (setgid(65534) || setuid(65534))
die("setuid");
errno = 0;
stat(target, &st);
printf("nobody: uid %u: stat(%s): %s\n", getuid(), target, strerror(errno));
exit(0);
}
waitpid(p2, NULL, 0);
if (write(to_cont[1], "g", 1) != 1)
die("sync");
}
waitpid(pid, NULL, 0);
return 0;
}
Fixes: 1fde6f21d90f ("proc: fix /proc/net/* after setns(2)")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261024-work-procfs-fixes-v1-1-46b03c3a8fac@kernel.org
Acked-by: Jan Kara <jack@suse.cz>
Reviewed-by: Aleksa Sarai <aleksa@amutable.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/proc/generic.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 12b817f4ffcfd..b63f612d5ebf2 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -256,9 +256,10 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
inode = proc_get_inode(dir->i_sb, de);
if (!inode)
return ERR_PTR(-ENOMEM);
+ /* never reused and so never a mountpoint for long */
if (de->flags & PROC_ENTRY_FORCE_LOOKUP)
- return d_splice_alias_ops(inode, dentry,
- &proc_net_dentry_ops);
+ return proc_splice_unmountable(inode, dentry,
+ &proc_net_dentry_ops);
return d_splice_alias_ops(inode, dentry,
&proc_misc_dentry_ops);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 852/869] tcp: check congestion control restriction first
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (850 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 851/869] proc: dont let an entry below /proc/<pid>/net be a mountpoint Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 853/869] apparmor: fix refcount leak in aa_get_newest_profile() Greg Kroah-Hartman
` (24 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Eric Dumazet, Zhiling Zou,
Kuniyuki Iwashima, Jiayuan Chen, Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
[ Upstream commit dda51b73721684637ab8e9bd97c78228b99c4bd2 ]
tcp_set_default_congestion_control() takes a reference to an algorithm
before checking whether a non-init network namespace may select it. A
rejected request returns -EPERM without dropping the reference.
This affects module-backed algorithms too; BPF is not required. For
example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
non-init network namespace can repeatedly request it as the default
although it is not in tcp_allowed_congestion_control. Each rejected
write leaks a module reference. Since module->refcnt is an atomic_t,
2^31 such writes can make it negative; later module_put() calls warn,
and rmmod can hit the BUG_ON() in try_release_module_ref().
Check the namespace restriction before acquiring the reference, as
tcp_set_congestion_control() already does.
Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/71c142b2d45af6a2fe7fc6cd4a5ca52c53afbe23.1793075984.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_cong.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 8e83ef81fc187..e3f462f161dd6 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
ca = tcp_ca_find_autoload(name);
if (!ca) {
ret = -ENOENT;
- } else if (!bpf_try_module_get(ca, ca->owner)) {
- ret = -EBUSY;
} else if (!net_eq(net, &init_net) &&
!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
/* Only init netns can set default to a restricted algorithm */
ret = -EPERM;
+ } else if (!bpf_try_module_get(ca, ca->owner)) {
+ ret = -EBUSY;
} else {
prev = xchg(&net->ipv4.tcp_congestion_control, ca);
if (prev)
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 853/869] apparmor: fix refcount leak in aa_get_newest_profile()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (851 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 852/869] tcp: check congestion control restriction first Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 854/869] apparmor: avoid potential double free when remapping DFA tables Greg Kroah-Hartman
` (23 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit 33ed50716251d5b2875706c40d0c8082d46be0b1 ]
The labels_profile() macro is evaluating its argument twice
#define labels_profile(X) ((X)->vec[(X)->size - 1])
unfortunately aa_get_newest_profile() passes
aa_get_newest_label(&p->label)
so every call to aa_get_newest_profile results in 2 refcounts
being taken with one being leaked.
There is no need for labels_profile() to be a macro. Convert it to
an inline fn, which ensures all uses are passing the correct struct
and removes the double evaluation.
Fixes: 637f688dc3dc ("apparmor: switch from profiles to using labels on contexts")
Cc: stable@vger.kernel.org
Reported-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/include/label.h | 6 +++++-
security/apparmor/label.c | 1 -
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 574be681f83e9..75c49e713a749 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -162,7 +162,11 @@ do { \
#define labels_ns(X) (vec_ns(&((X)->vec[0]), (X)->size))
#define labels_set(X) (&labels_ns(X)->labels)
#define labels_view(X) labels_ns(X)
-#define labels_profile(X) ((X)->vec[(X)->size - 1])
+
+static inline struct aa_profile *labels_profile(const struct aa_label *label)
+{
+ return label->vec[label->size - 1];
+}
int aa_label_next_confined(struct aa_label *l, int i);
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 5c42cd01ea473..667f20363ebf1 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -386,7 +386,6 @@ void aa_label_kref(struct kref *kref)
label_free_switch(label);
return;
}
- /* TODO: update labels_profile macro so it works here */
AA_BUG(label_isprofile(label) &&
on_list_rcu(&label->vec[0]->base.profiles));
AA_BUG(label_isprofile(label) &&
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 854/869] apparmor: avoid potential double free when remapping DFA tables
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (852 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 853/869] apparmor: fix refcount leak in aa_get_newest_profile() Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 855/869] apparmor: check accept index + 1 is in bounds Greg Kroah-Hartman
` (22 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li RongQing, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 7ccd884a5e5386f4c7d98625113f4924f70286b4 ]
When unpacking a DFA, aa_dfa_unpack() stores a table in dfa->tables
before attempting to remap a 16-bit table to 32-bit.
However, remap_data16_to_data32() frees the original table when
allocation of the new table fails. This leaves the corresponding
dfa->tables entry pointing to freed memory. If the unpacking then
fails, dfa_free() attempts to free the same table again.
Only publish the table to dfa->tables after any required remapping
has completed successfully, so that dfa->tables never contains a
pointer to a table that has already been freed.
Fixes: 9208c05f9fdf ("apparmor: add support for 2^24 states to the dfa state machine.")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/match.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index b2a4bee4e3939..e4ef1057e2c06 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -397,7 +397,6 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
/* check for duplicate table entry */
if (dfa->tables[table->td_id])
goto fail;
- dfa->tables[table->td_id] = table;
data += table_size(table->td_lolen, table->td_flags);
size -= table_size(table->td_lolen, table->td_flags);
@@ -414,9 +413,9 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
if (!table)
goto fail;
}
- dfa->tables[table->td_id] = table;
break;
}
+ dfa->tables[table->td_id] = table;
table = NULL;
}
error = verify_table_headers(dfa->tables, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 855/869] apparmor: check accept index + 1 is in bounds
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (853 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 854/869] apparmor: avoid potential double free when remapping DFA tables Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 856/869] net/packet: check TX_RING fragments before memory accounting Greg Kroah-Hartman
` (21 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanglei Zhu <zhugl3@xiaopeng.com>
[ Upstream commit afe5d5a747393cb3d00795db31d7fce5108a766a ]
aa_lookup_condperms() returns perms[index + 1] when an accept entry has
ACCEPT_FLAG_OWNER set and the subject uid does not match the file uid,
so such an entry consumes two slots in the perms table. But
verify_dfa_accept_index() only checks that index is within the perms
table, so a policy that sets the owner flag on the last entry is
accepted, and the runtime lookup then reads perms[index + 1] one entry
past the end of the table.
The perms table is allocated by unpack_perms_table() with a u16 size
read from the policy blob, so a crafted policy can place the owner flag
at index size - 1 to reach the out-of-bounds read.
Check that index + 1 is also in bounds when the owner flag is set.
Fixes: 6f442d42c0d89 ("apparmor: fix profile verification and enable it")
Cc: stable@vger.kernel.org
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy_unpack.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 1e1792d3ff5a4..391665c27ede1 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1244,6 +1244,15 @@ static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
if (ACCEPT_TABLE(dfa)[i] >= table_size)
return false;
+ /*
+ * Accept indexes for owner-conditional permissions come in
+ * pairs, so the non-owner entry at index + 1 must also be
+ * in bounds.
+ */
+ if (dfa->tables[YYTD_ID_ACCEPT2] &&
+ (ACCEPT_TABLE2(dfa)[i] & ACCEPT_FLAG_OWNER) &&
+ ACCEPT_TABLE(dfa)[i] + 1 >= table_size)
+ return false;
}
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 856/869] net/packet: check TX_RING fragments before memory accounting
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (854 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 855/869] apparmor: check accept index + 1 is in bounds Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:58 ` [PATCH 6.18 857/869] tcp: fix reordering addition overflow in MTU probing Greg Kroah-Hartman
` (20 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Kyle Zeng,
Eric Dumazet, Willem de Bruijn, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit dc4dd12f80e499dc034710cd8195489abcf0b059 ]
tpacket_fill_skb() adds the full non-linear payload length to
skb->truesize and sk_wmem_alloc before checking MAX_SKB_FRAGS. With
PACKET_VNET_HDR, userspace can submit a ring-sized frame even when it
greatly exceeds the device MTU.
A near-INT_MAX frame can saturate sk_wmem_alloc before the fragment
loop rejects it. A subsequent refcount_add(0x40000001) can temporarily
turn REFCOUNT_SATURATED into 1. A concurrent TX completion can then
drop that apparent last reference and free the still-live packet
socket before refcount_warn_saturate() restores the counter.
Check that the remaining payload fits in MAX_SKB_FRAGS pages before
accounting it. Include the initial page offset in the calculation,
and move the existing -EFAULT handling out of the fragment loop.
This preserves the accepted packet sizes and error code while
preventing an invalid frame from injecting an oversized byte charge.
Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
Cc: stable@vger.kernel.org
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
[edumazet: use net_warn_ratelimited() instead of pr_err(), add a Fixes: tag]
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261028181450.2221013-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/packet/af_packet.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4516e54525223..7b8ba1690d543 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2646,6 +2646,12 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
}
offset = offset_in_page(data);
+ if (unlikely(to_write > MAX_SKB_FRAGS * PAGE_SIZE - offset)) {
+ net_warn_ratelimited("Packet exceed the number of skb frags(%u)\n",
+ (unsigned int)MAX_SKB_FRAGS);
+ return -EFAULT;
+ }
+
len_max = PAGE_SIZE - offset;
len = ((to_write > len_max) ? len_max : to_write);
@@ -2657,12 +2663,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
while (likely(to_write)) {
nr_frags = skb_shinfo(skb)->nr_frags;
- if (unlikely(nr_frags >= MAX_SKB_FRAGS)) {
- pr_err("Packet exceed the number of skb frags(%u)\n",
- (unsigned int)MAX_SKB_FRAGS);
- return -EFAULT;
- }
-
page = pgv_to_page(data);
data += len;
flush_dcache_page(page);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 857/869] tcp: fix reordering addition overflow in MTU probing
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (855 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 856/869] net/packet: check TX_RING fragments before memory accounting Greg Kroah-Hartman
@ 2026-11-07 13:58 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 858/869] apparmor: remove fs entries created by a failed policy load Greg Kroah-Hartman
` (19 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wyatt Feng, Ren Wei, Kyle Zeng,
Eric Dumazet, Neal Cardwell, Kuniyuki Iwashima, Jiayuan Chen,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit c1df9c0c0536393de43310f84ca4f8b217271a00 ]
Commit efb8763d7bbb ("net: ipv4: bound TCP reordering sysctl writes and
MTU probe sizes") widened size_needed and the MSS multiplication, but
tp->reordering + 1 is still evaluated as u32. RTAX_REORDERING accepts
an unrestricted u32, and tcp_init_metrics() can install U32_MAX.
In that case the extra-data requirement becomes zero. A write queue
with probe_size - 1 data bytes and a FIN satisfies the sequence-space
check. The coalescing walk can pass the queue head to
tcp_skb_can_collapse(), and tcp_clone_payload() can produce an skb
whose advertised payload exceeds the data in its fragments. Local
delivery followed by TCP_ZEROCOPY_RECEIVE can then walk beyond the
fragment array. KASAN reports a slab-out-of-bounds read in
can_map_frag().
Cast reordering before incrementing it so the arithmetic handles the
entire u32 metric range. For U32_MAX, the required size exceeds the
32-bit queue and window limits, so the existing checks skip the probe.
The calculation is unchanged for all other reordering values.
Fixes: efb8763d7bbb ("net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes")
Cc: stable@vger.kernel.org
Cc: Wyatt Feng <bronzed_45_vested@icloud.com>
Cc: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20261028160226.2170244-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f6210d4a3408f..b39ab081e3a66 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2631,7 +2631,7 @@ static int tcp_mtu_probe(struct sock *sk)
mss_now = tcp_current_mss(sk);
probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
icsk->icsk_mtup.search_low) >> 1);
- size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache;
+ size_needed = probe_size + ((u64)tp->reordering + 1) * tp->mss_cache;
interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
/* When misfortune happens, we are reprobing actively,
* and then reprobe timer has expired. We stick with current
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 858/869] apparmor: remove fs entries created by a failed policy load
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (856 preceding siblings ...)
2026-11-07 13:58 ` [PATCH 6.18 857/869] tcp: fix reordering addition overflow in MTU probing Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 859/869] aio: fix NULL deref when a fault races ring truncation Greg Kroah-Hartman
` (18 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgia Garcia <georgia.garcia@canonical.com>
[ Upstream commit 6ec46f8f1977d218bf2494ce276152b2d01424af ]
aa_replace_profiles() creates the raw_data/<rev> directory for the
loaddata and the profile directories for new profiles before the last
checks that can fail. When one of those checks fails, the fail path
releases the ns lock without removing what this load created.
The raw_data directory is named after the current ns revision, and the
revision is only bumped by a successful load. The stale directory is
only removed once the loaddata's last profile reference is dropped, from
a workqueue. Until then, every load fails to create raw_data/<rev> with
-EEXIST. If the new profiles are never freed, which is the case when
their dents are left behind pinning the proxy, that never happens and no
policy can be loaded until reboot.
While still holding the ns lock in the fail path, remove the profile
directories of the new profiles and, if this load created it, the
raw_data directory.
Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 70d6315a059af..14c91fc94b22e 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1163,6 +1163,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
struct aa_loaddata *rawdata_ent;
const char *op;
ssize_t count, error;
+ bool rawdata_created = false;
LIST_HEAD(lh);
op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
@@ -1302,6 +1303,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
ent = NULL;
goto fail_lock;
}
+ rawdata_created = true;
}
list_for_each_entry(ent, &lh, list) {
if (!ent->old) {
@@ -1397,6 +1399,18 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
return udata_sz;
fail_lock:
+ /*
+ * Remove fs entries created by this load. Nothing else references
+ * them yet, and leaving them behind would leak the new profiles
+ * (their dents pin the proxy) and make the next load at the same,
+ * unbumped ns revision fail with -EEXIST on its raw_data dir.
+ */
+ list_for_each_entry(tmp, &lh, list) {
+ if (!tmp->old)
+ __aafs_profile_rmdir(tmp->new);
+ }
+ if (rawdata_created)
+ __aa_fs_remove_rawdata(udata);
mutex_unlock(&ns->lock);
/* audit cause of failure */
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 859/869] aio: fix NULL deref when a fault races ring truncation
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (857 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 858/869] apparmor: remove fs entries created by a failed policy load Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 860/869] backing-file: enforce append-only and immutable backing inodes Greg Kroah-Hartman
` (17 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
[ Upstream commit d53b5aa5cfae27e4d236fc0ab9581085d27f7d33 ]
The aio ring lives in a file on the aio pseudo filesystem and the ring
VMA uses filemap_fault(). aio_ctx_aops doesn't have a ->read_folio
because aio_setup_ring() puts all folios of the ring into the page
cache. So a fault on the ring only works as long as it finds its folio
in the page cache. If it doesn't, filemap_fault() calls ->read_folio
without checking and we jump to NULL.
We already fixed this twice this year. A forked child could inherit the
ring mapping, fixed by commit c03ce4173c7b ("fs: aio: set
VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error"). And a
partial mremap() could leave part of the ring mapped, fixed by
commit 3adf7ae18bf4 ("fs: aio: reject partial mremap to avoid
Null-pointer-dereference error"). Both times a VMA outlived the ring and
the ring file was truncated under it.
There's a third way to get there. kill_ioctx() and the error path of
ioctx_alloc() unmap the ring with vm_munmap() and ignore the return
value. If vm_munmap() has to wait for mmap_lock and a fatal signal is
pending it returns -EINTR and the VMA stays. free_ioctx() then calls
put_aio_ring_file() which truncates the ring file to zero. A fault that
passed the i_size check in filemap_fault() before that doesn't find its
folio anymore, allocates a new one and calls ->read_folio:
fault on the ring io_destroy() with SIGKILL pending
================= =================================
vm_munmap() returns -EINTR
filemap_fault()
i_size check passes
free_ioctx()
put_aio_ring_file()
truncate_setsize(inode, 0)
no folio, allocate a new one
filemap_read_folio()
->read_folio == NULL
All that's needed is a second process that shares the mm. If a CLONE_VM
child calls io_destroy() and gets SIGKILLed while it waits for mmap_lock
the ring stays mapped for the threads of the parent. Any user can do
that.
Instead of plugging the routes one by one give the ring a ->read_folio
that unlocks the folio and returns -EIO. All folios of a live ring are
in the page cache so a fault can only end up there if the ring was
truncated. The fault now gets SIGBUS. Nothing else reads the ring file
and the aio filesystem uses noop_backing_dev_info so there's no
readahead either.
Making vm_munmap() unkillable in those two places would only close this
one route and bring back what commit ae7987835643 ("mm: make vm_munmap
killable") fixed.
Fixes: 36bc08cc0170 ("fs/aio: Add support to aio ring pages migration")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-1-88f22792f6f7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/aio.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/aio.c b/fs/aio.c
index bd92bd3e13408..e06fa57b05ca9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -474,7 +474,18 @@ static int aio_migrate_folio(struct address_space *mapping, struct folio *dst,
#define aio_migrate_folio NULL
#endif
+/*
+ * filemap_fault() reads a folio that it did not find in the page cache. All
+ * folios of a live ring are there, so the ring was truncated under the fault.
+ */
+static int aio_read_folio(struct file *file, struct folio *folio)
+{
+ folio_unlock(folio);
+ return -EIO;
+}
+
static const struct address_space_operations aio_ctx_aops = {
+ .read_folio = aio_read_folio,
.dirty_folio = noop_dirty_folio,
.migrate_folio = aio_migrate_folio,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 860/869] backing-file: enforce append-only and immutable backing inodes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (858 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 859/869] aio: fix NULL deref when a fault races ring truncation Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 861/869] iov_iter: fix NULL deref in iov_iter_alignment() Greg Kroah-Hartman
` (16 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 19b18e01d0361ce495be153ecce80b581086ab3f ]
FUSE passthrough opens the backing file anew whenever the FUSE file is
opened. fuse_passthrough_open() passes the flags of that open to
backing_file_open() which opens the backing file with vfs_open() and the
credentials of the server. But vfs_open() doesn't go through may_open().
So the backing inode is never checked for S_APPEND and S_IMMUTABLE. The
checks that did run were done on the FUSE inode and that one never has
either flag.
So anyone who may open the FUSE file for writing can overwrite an
append-only backing file anywhere or write to an immutable one. The
server only has to register the file and a read-only or even an O_PATH
file descriptor is enough for that. Registering requires CAP_SYS_ADMIN
but the writer can be any user that the server lets open the file.
The FUSE inode is checked instead of the backing inode in a few more
places:
- do_mmap() refuses a shared mapping of an append-only file that was
opened for writing. A FUSE file opened with O_RDWR | O_APPEND passes
the open check and can then be mapped shared and written to at any
offset.
- fcntl(F_SETFL) and RWF_NOAPPEND refuse to take append mode away from a
file on an append-only inode. On the FUSE file both succeed. A
synchronous write still appends because the backing file was opened
with O_APPEND. But an asynchronous write is submitted with the flags
of the user's kiocb and lands at the given offset.
Do the checks on the backing inode. backing_file_open() refuses to open
an immutable inode for writing and an append-only inode for writing
without O_APPEND, just like may_open(). backing_file_mmap() refuses a
shared mapping of an append-only inode, just like do_mmap(). And writes
and splices to a backing file in append mode fail if append mode was
taken away from the user file.
A FUSE file that was opened before the backing file became append-only
can still write anywhere. That's what happens on the native filesystem
as well and the backing file of such a file isn't in append mode. Two
differences remain. F_SETFL succeeds and the next write fails. And FUSE
reports EIO for a refused open because it turns every error from opening
the backing file into EIO.
overlayfs uses the same helpers but it mirrors S_APPEND and S_IMMUTABLE
in its own inode and a chattr through the overlay never sets them on the
upper inode. So for overlayfs this only changes something if the upper
inode is changed behind the overlay's back.
Fixes: 4a90451bbc7f ("fuse: implement open in passthrough mode")
Reported-by: Chris Mason <mason@kernel.org>
Cc: stable@vger.kernel.org # v6.9+
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-2-88f22792f6f7@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/backing-file.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/fs/backing-file.c b/fs/backing-file.c
index 6f16e23f70461..5cca636207d1a 100644
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -35,9 +35,21 @@ struct file *backing_file_open(const struct file *user_file, int flags,
const struct cred *cred)
{
const struct path *user_path = file_user_path(user_file);
+ struct inode *real_inode = d_inode(real_path->dentry);
struct file *f;
int error;
+ /*
+ * may_open() checked the inode of the user file, which need not carry
+ * S_APPEND and S_IMMUTABLE of the backing inode.
+ */
+ if ((flags & O_ACCMODE) != O_RDONLY) {
+ if (IS_IMMUTABLE(real_inode))
+ return ERR_PTR(-EPERM);
+ if (IS_APPEND(real_inode) && !(flags & O_APPEND))
+ return ERR_PTR(-EPERM);
+ }
+
f = alloc_empty_backing_file(flags, cred, user_file);
if (IS_ERR(f))
return f;
@@ -222,6 +234,14 @@ ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter,
if (!iov_iter_count(iter))
return 0;
+ /*
+ * F_SETFL and RWF_NOAPPEND can take append mode away from the user
+ * file. They checked its inode, not the backing one.
+ */
+ if ((file->f_flags & O_APPEND) && !(flags & IOCB_APPEND) &&
+ IS_APPEND(file_inode(file)))
+ return -EPERM;
+
ret = file_remove_privs(iocb->ki_filp);
if (ret)
return ret;
@@ -309,6 +329,10 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe,
if (!out->f_op->splice_write)
return -EINVAL;
+ /* splice refuses a user file in append mode, so F_SETFL cleared it */
+ if ((out->f_flags & O_APPEND) && IS_APPEND(file_inode(out)))
+ return -EPERM;
+
ret = file_remove_privs(iocb->ki_filp);
if (ret)
return ret;
@@ -339,6 +363,10 @@ int backing_file_mmap(struct file *file, struct vm_area_struct *vma,
if (!can_mmap_file(file))
return -ENODEV;
+ /* do_mmap() checked the inode of the user file */
+ if ((vma->vm_flags & VM_SHARED) && IS_APPEND(file_inode(file)))
+ return -EACCES;
+
vma_set_file(vma, file);
old_cred = override_creds(ctx->cred);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 861/869] iov_iter: fix NULL deref in iov_iter_alignment()
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (859 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 860/869] backing-file: enforce append-only and immutable backing inodes Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 862/869] splice: avoid stale f_pos writeback on error Greg Kroah-Hartman
` (15 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
[ Upstream commit a290a9e5cf5fbba05d6c59b94b36d00f4fc15ef2 ]
Since commit 111a12b422a8 ("io_uring/rsrc: reject zero-length fixed
buffer import") io_import_fixed() hands out an empty ITER_BVEC for a
zero-length request. Its count is 0 and its bvec array is NULL.
iov_iter_alignment() only checks the count for ITER_UBUF. For ITER_BVEC
it calls iov_iter_alignment_bvec() and the do-while loop in there reads
bvec->bv_len before it looks at the count. So it dereferences NULL.
btrfs checks the alignment of a direct read with iov_iter_alignment()
before it looks at the count and f2fs does the same. So any user that
can open a file on btrfs can oops the kernel with a single zero-length
IORING_OP_READ_FIXED on an O_DIRECT file descriptor. With IOSQE_ASYNC
the oops happens in an io-wq worker. The dead worker stays on the worker
list and when the task that submitted the request exits io-wq writes to
the freed task_struct of the worker. That's just fallout from the oops
though.
Empty iterators with a NULL array aren't unusual. afs, tls and tipc
create them as well. So leave io_uring alone and make
iov_iter_alignment() return 0 for an empty iterator of any type.
Fixes: 111a12b422a8 ("io_uring/rsrc: reject zero-length fixed buffer import")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-3-88f22792f6f7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/iov_iter.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 4bc7c19337558..b2eb629497a92 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -836,6 +836,10 @@ unsigned long iov_iter_alignment(const struct iov_iter *i)
return 0;
}
+ /* An empty iterator may have no segment array at all. */
+ if (!i->count)
+ return 0;
+
/* iovec and kvec have identical layouts */
if (likely(iter_is_iovec(i) || iov_iter_is_kvec(i)))
return iov_iter_alignment_iovec(i);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 862/869] splice: avoid stale f_pos writeback on error
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (860 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 861/869] iov_iter: fix NULL deref in iov_iter_alignment() Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 863/869] fs: let backing files inherit FMODE_NONOTIFY from the user file Greg Kroah-Hartman
` (14 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 79b496ebe382866e3a05090b7dc9ae95e85e65b2 ]
do_splice() snapshots an implicit file position before calling the splice
helper. Since splice does not take f_pos_lock, another operation on the
same open file description can update f_pos while the helper is blocked.
If the helper then fails, the unconditional writeback restores the stale
snapshot.
For a directory without ->splice_read, a file-to-pipe splice fails with
-EINVAL. A concurrent directory mutation and getdents() call can advance
f_pos and refresh the filesystem's revalidation cookie before that failure
restores only the old position. The next ext2 readdir can then trust an
offset inside a directory entry and copy data from the adjacent page to
userspace.
Only update an implicit file position when splice returns a non-negative
result, matching read and write. Keep explicit offset updates unchanged.
Fixes: 7995bd287134 ("splice: don't pass the address of ->f_pos to methods")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20261018051708.2422394-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/splice.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/splice.c b/fs/splice.c
index f5094b6d00a09..8ac45441e2193 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1351,10 +1351,10 @@ ssize_t do_splice(struct file *in, loff_t *off_in, struct file *out,
ret = do_splice_from(ipipe, out, &offset, len, flags);
file_end_write(out);
- if (!off_out)
- out->f_pos = offset;
- else
+ if (off_out)
*off_out = offset;
+ else if (ret >= 0)
+ out->f_pos = offset;
} else if (opipe) {
if (off_out)
return -ESPIPE;
@@ -1375,10 +1375,10 @@ ssize_t do_splice(struct file *in, loff_t *off_in, struct file *out,
ret = splice_file_to_pipe(in, opipe, &offset, len, flags);
- if (!off_in)
- in->f_pos = offset;
- else
+ if (off_in)
*off_in = offset;
+ else if (ret >= 0)
+ in->f_pos = offset;
} else {
ret = -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 863/869] fs: let backing files inherit FMODE_NONOTIFY from the user file
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (861 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 862/869] splice: avoid stale f_pos writeback on error Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 864/869] fs: skip copy_file_range write limits when there is no data Greg Kroah-Hartman
` (13 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Goldstein, Edvard Conrad,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edvard Conrad <edvard@tuta.io>
[ Upstream commit c3d355f427cea70fbe31b49e21f1915dbf37f2e6 ]
When fanotify reports a permission event, copy_event_to_user() creates
the event fd with dentry_open_nonotify(), so that the listener's use of
that fd does not generate further events. If the event's path is on a
stacked filesystem, the stacked filesystem's ->open() opens the real
file with backing_file_open(). Since commit ebe559609d78 ("fs: get rid
of __FMODE_NONOTIFY kludge"), FMODE_NONOTIFY lives in f_mode only and
the backing file does not inherit it: it is allocated with the default
fsnotify mode, and fsnotify_open_perm_and_set_mode() raises FS_OPEN_PERM
on the real path if the backing filesystem has permission event
watchers.
Before that commit __FMODE_NONOTIFY travelled in f_flags, and overlayfs
copies the user file's f_flags into the backing open
(ovl_open_realfile()), so the backing file was exempt implicitly. Commit
bc2473c90fca ("ovl: enable fsnotify events on underlying real files")
relied on that when it dropped FMODE_NONOTIFY from OVL_OPEN_FLAGS.
The nested event is queued to the same group, from inside the
listener's read(2), and can only be answered by another reader thread
of that group. A listener holding filesystem marks on both the stacked
and the backing filesystem therefore deadlocks as soon as all of its
reader threads are inside such a read(2) at the same time, and every
other task that touches a marked filesystem queues up behind it.
Observed with a commercial anti-malware agent (16 reader threads) on an
ostree/composefs host: / is an overlayfs whose data layer is the ostree
object store on the same btrfs that holds /etc and /home, and a
systemd-sysext overlay sits on /usr. Every on-demand scan of /usr wedged
the whole machine until the group was killed. Stack of a blocked reader
thread on 7.2.7:
fanotify_get_response
fanotify_handle_event
send_to_group
fsnotify
__fsnotify_parent
do_dentry_open
vfs_open
backing_file_open
ovl_open_realfile [overlay]
ovl_open [overlay]
do_dentry_open
vfs_open
backing_file_open
ovl_open_realfile [overlay]
ovl_open [overlay]
do_dentry_open
vfs_open
dentry_open_nonotify
copy_event_to_user
fanotify_read
vfs_read
ksys_read
Userspace cannot avoid this: the backing open happens while the kernel
builds the fd, before the event is reported, and fid reporting is not
available for permission event classes.
Make a backing file inherit FMODE_NONOTIFY when the user file it is
opened for must not generate events. This restores the pre-6.14
behaviour for the fds that fanotify creates (and for any other
FMODE_NONOTIFY file), while ordinary opens through a stacked filesystem
keep generating events on the real path, as intended by bc2473c90fca.
Verified with a self-contained reproducer (private tmpfs lower layers, an
overlayfs over them, FAN_OPEN_PERM filesystem marks on the overlay and on
one lower layer, a child opening a file through the overlay) in a qemu
VM on this tree built with defconfig plus OVERLAY_FS, FANOTIFY and
FANOTIFY_ACCESS_PERMISSIONS: without this patch the listener's read(2)
never returns and the child's open is released only by the listener's
death; with it read(2) returns, the event is answered and the open
completes.
backing_tmpfile_open() is left alone: its only caller is
ovl_create_tmpfile(), whose user file is a regular overlayfs file.
Fixes: ebe559609d78 ("fs: get rid of __FMODE_NONOTIFY kludge")
Cc: stable@vger.kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Edvard Conrad <edvard@tuta.io>
Link: https://patch.msgid.link/P58Wrer--F-9@tuta.io
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/backing-file.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/backing-file.c b/fs/backing-file.c
index 5cca636207d1a..bf526fa2e29df 100644
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -54,6 +54,17 @@ struct file *backing_file_open(const struct file *user_file, int flags,
if (IS_ERR(f))
return f;
+ /*
+ * A user file that must not generate fsnotify events (e.g. the fd
+ * that fanotify creates for a permission event with
+ * dentry_open_nonotify()) must not generate them through its backing
+ * file either. Otherwise a listener watching the backing filesystem
+ * gets a nested permission event from its own read(2), which only
+ * another reader of the same group can answer.
+ */
+ if (FMODE_FSNOTIFY_NONE(user_file->f_mode))
+ file_set_fsnotify_mode(f, FMODE_NONOTIFY);
+
path_get(user_path);
backing_file_set_user_path(f, user_path);
error = vfs_open(real_path, f);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 864/869] fs: skip copy_file_range write limits when there is no data
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (862 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 863/869] fs: let backing files inherit FMODE_NONOTIFY from the user file Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 865/869] fs: dont fail __d_obtain_alias() for unlinked inodes Greg Kroah-Hartman
` (12 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hungyu Lin, Amir Goldstein,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hungyu Lin <dennylin0707@gmail.com>
[ Upstream commit 81dfa035891f0502674332ee97db348a16486de0 ]
generic_copy_file_checks() reduces count to zero for a source offset at
or beyond EOF, but still checks the destination write limits. If pos_out
is at RLIMIT_FSIZE, this sends SIGXFSZ and returns -EFBIG even though
there is no data to write.
For example, GNU cat copying a 1024-byte regular file to another regular
file with RLIMIT_FSIZE=1024 copies all bytes and is then killed by its
next copy_file_range() call at EOF. A zero-length request can fail in
the same way.
Check write limits only when count is nonzero, as the ordinary write
checks already do. Keep the other copy validation in place.
Fixes: 96e6e8f4a68d ("vfs: add missing checks to copy_file_range")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20261026015738.46230-1-dennylin0707@gmail.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/read_write.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/read_write.c b/fs/read_write.c
index 833bae068770a..011fe55c94cdb 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1530,9 +1530,11 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
else
count = min(count, size_in - (uint64_t)pos_in);
- ret = generic_write_check_limits(file_out, pos_out, &count);
- if (ret)
- return ret;
+ if (count) {
+ ret = generic_write_check_limits(file_out, pos_out, &count);
+ if (ret)
+ return ret;
+ }
/* Don't allow overlapped copying within the same file. */
if (inode_in == inode_out &&
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 865/869] fs: dont fail __d_obtain_alias() for unlinked inodes
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (863 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 864/869] fs: skip copy_file_range write limits when there is no data Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 866/869] init/bootconfig: pass init arguments in documented order Greg Kroah-Hartman
` (11 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko, Amir Goldstein,
Jan Kara, Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
[ Upstream commit a522dd871024a0f065bfa7638afdb929607f58fc ]
Commit 669bb5af15d4 ("fs: make sure to call fsnotify_inoderemove() only
once when inode is dead") did two things. It made dentry_unlink_inode()
call fsnotify_inoderemove() only once the inode has neither links nor
aliases left. And it made __d_obtain_alias() fail with -ESTALE for an
inode in that state so that open_by_handle_at() can't create a new alias
after FS_DELETE_SELF has been reported and the inode marks are gone.
The second part is wrong for network filesystems. __d_obtain_alias()
backs d_obtain_alias() and d_obtain_root(). Those are what the
->fh_to_dentry() and ->get_parent() methods use to turn the inode they
looked up into a dentry for exportfs_decode_fh_raw(), i.e., for
open_by_handle_at() and for nfsd file handle decoding.
For a local filesystem an in-core inode without links and aliases is an
orphan that goes away on the final iput(). For a network filesystem
that's not true. i_nlink is just the link count the server last
reported and whether the object is still reachable through its file
handle is up to the server. If a file is unlinked while it is still
open elsewhere, e.g., by another NFSv4 client or by a process on the
server, the server keeps the object alive and its file handle stays
valid. nfs_fh_to_dentry() fetches the attributes for such a handle,
nfs_fhget() sets i_nlink to 0 from them, the new inode has no aliases
yet and so __d_obtain_alias() now fails with -ESTALE. The same applies
to fuse_get_dentry() which takes i_nlink from the fuse server.
Filesystems that care about unlinked inodes already make that decision
themselves in ->fh_to_dentry(), e.g., ceph's __fh_to_dentry() fetches
the link count with CEPH_CAP_LINK_SHARED and only refuses an unlinked
inode if it isn't open.
Note that on a network filesystem i_nlink drops to zero through
attribute updates when another client unlinks the file. So the inode
might never have gone through dentry_unlink_inode() with i_nlink == 0,
i.e., fsnotify_inoderemove() might never have been called for it and
there's nothing for the -ESTALE to protect.
So drop the two checks from __d_obtain_alias() again and go back to the
unconditional alias lookup. While at it, update the comment above
inode_notify_dead() since it no longer blocks new aliases.
Amir sent this as v3 to replace 669bb5af15d4 but that commit was already
in mainline by then. So do it as a fix on top. The resulting code is
identical to v3.
This means open_by_handle_at() can again create a new alias for an
unlinked inode after FS_DELETE_SELF has been reported. Closing that file
reports a second FS_DELETE_SELF and the file has none of the inode marks
that were torn down. That's what Daehyeon's open_by_handle_at() LTP test
checks so it is expected to fail again. This needs to be handled
separately. A mark that is added through such a file while
fsnotify_destroy_marks() is still running is rejected with -ENOENT since
36ebddca56b9 ("fsnotify: prevent mark additions during connector
teardown") so it can't end up on a detached connector.
Christian Brauner <brauner@kernel.org> says:
Amir's v3 replaced 669bb5af15d4 as a whole. I turned it into an
incremental fix on top of mainline and wrote a new commit message.
Jan's Reviewed-by was given on v3 and the resulting code is identical.
Fixes: 669bb5af15d4 ("fs: make sure to call fsnotify_inoderemove() only once when inode is dead")
Cc: stable@vger.kernel.org
Reported-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/CAOQ4uxg7Qt436SiKhKEJKOjtCjeB_XyTjazYF7HMyQAGGcgx2A@mail.gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261030-work-dcache-obtain_alias-v1-1-a1f7e44536d2@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dcache.c | 19 +++++--------------
1 file changed, 5 insertions(+), 14 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 04adb623e584e..3ad74a3abf9ad 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -443,10 +443,9 @@ static void dentry_free(struct dentry *dentry)
}
/*
- * If inode is unlinked and doesn't have any aliases (i.e., all fds pointing to
- * it are closed), it is pretty much dead. Except that file handle lookup could
- * still revive it which causes issues to fsnotify. So once inode reaches this
- * state we make sure to block creating any new aliases.
+ * When inode is unlinked and doesn't have any aliases (i.e., all fds pointing
+ * to it are closed) we report FS_DELETE_SELF to fsnotify and cleanup all inode
+ * marks.
*/
static bool inode_notify_dead(struct inode *inode)
{
@@ -2035,12 +2034,7 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
sb = inode->i_sb;
- spin_lock(&inode->i_lock);
- if (!inode_notify_dead(inode))
- res = __d_find_any_alias(inode); /* existing alias? */
- else
- res = ERR_PTR(-ESTALE);
- spin_unlock(&inode->i_lock);
+ res = d_find_any_alias(inode); /* existing alias? */
if (res)
goto out;
@@ -2052,10 +2046,7 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
security_d_instantiate(new, inode);
spin_lock(&inode->i_lock);
- if (!inode_notify_dead(inode))
- res = __d_find_any_alias(inode); /* recheck under lock */
- else
- res = ERR_PTR(-ESTALE);
+ res = __d_find_any_alias(inode); /* recheck under lock */
if (likely(!res)) { /* still no alias, attach a disconnected dentry */
unsigned add_flags = d_flags_for_inode(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 866/869] init/bootconfig: pass init arguments in documented order
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (864 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 865/869] fs: dont fail __d_obtain_alias() for unlinked inodes Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 867/869] ocfs2: read the xattr entry hash before defragmenting the bucket Greg Kroah-Hartman
` (10 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avi Weiss, Masami Hiramatsu (Google),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avi Weiss <thnkslprpt@gmail.com>
[ Upstream commit 278b2abf660a3e0991eb9f16f11bd9e9514a286d ]
start_kernel() appends command-line init arguments before
bootconfig init arguments, while setup_command_line()
places them in the opposite order. As a result, the
arguments passed to init do not match the saved command
line, reversing the intended precedence of options.
Parse extra_init_args before after_dashes so command-line
init arguments are passed last.
Link: https://lore.kernel.org/all/20261027073719.4010659-2-thnkslprpt@gmail.com/
Fixes: b66fbbe8d482 ("init/bootconfig: Reorder init parameter from bootconfig and cmdline")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
init/main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/init/main.c b/init/main.c
index 269b30038b9fa..2097f4bbc0d87 100644
--- a/init/main.c
+++ b/init/main.c
@@ -910,12 +910,12 @@ void start_kernel(void)
__stop___param - __start___param,
-1, -1, NULL, &unknown_bootoption);
print_unknown_bootoptions();
- if (!IS_ERR_OR_NULL(after_dashes))
- parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
- NULL, set_init_arg);
if (extra_init_args)
parse_args("Setting extra init args", extra_init_args,
NULL, 0, -1, -1, NULL, set_init_arg);
+ if (!IS_ERR_OR_NULL(after_dashes))
+ parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
+ NULL, set_init_arg);
/* Architectural and non-timekeeping rng init, before allocator init */
random_init_early(command_line);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 867/869] ocfs2: read the xattr entry hash before defragmenting the bucket
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (865 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 866/869] init/bootconfig: pass init arguments in documented order Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 868/869] apparmor: fix uninitialized variable warning in aa_inherit_files Greg Kroah-Hartman
` (9 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit f48151da595e74efdc23d83d8d6d142207b8c731 ]
Patch series "ocfs2: fix stale xattr entry pointers and empty header
reads", v1.
Five defects in the ocfs2 extended attribute code, plus one robustness
measure that belongs with them, all on the paths that move entries
between a block, a bucket and an index tree. They fall into two groups.
Stale entry pointers (patches 1 to 3)
ocfs2_xa_set() writes through a pointer into xh_entries[] that two of
its callers invalidate first. Defragmenting a bucket ends in a sort()
on xe_name_hash, and lib/sort.c is an unstable heapsort, so entries that
share a hash can trade slots. Copying a block into a bucket changes the
order outright, since a block holds its entries in insertion order while
a bucket holds them by hash, yet ocfs2_xattr_update_xattr_search()
relocates the search by the index the entry had in the block. Neither
path compares the entry's name with the one being set, so setxattr() can
replace a neighbouring attribute's value and still report success, or
trip ocfs2_xa_reuse_entry()'s BUG_ON. Patch 1 takes the hash before the
sort; patches 2 and 3 look the entry up again afterwards.
Reads of an empty entry array (patches 4 to 6)
A block and a bucket may both hold no entries: ocfs2_xa_remove_entry()
keeps the last slot when it removes the only one, so an empty bucket
still carries the hash it is keyed by. Three sites index xh_entries[]
without checking xh_count and so read xh_entries[-1], which lands on the
header and comes back as xh_count | xh_free_start << 16. Nothing
faults, but the value is acted on: the collision check reports no
collision for an empty bucket, the divide commits a sentinel hash that
hides part of the key space from ocfs2_xattr_bucket_find(), and the
block to bucket copy claims storage the bucket does not hold. Patches 4
to 6 guard each site and keep the one read of xh_entries[0] that
ocfs2_xa_remove_entry() documents as intentional.
This patch (of 6):
ocfs2_xattr_set_entry_index_block() takes the hash a bucket split has to
work with out of xs->here, but only after ocfs2_xattr_set_entry_bucket()
has tried and failed to fit the entry. That call defragments the bucket
when it runs out of room, and ocfs2_defrag_xattr_bucket() finishes by
sorting the entry array by name hash. lib/sort.c is not stable, so two
entries sharing a hash may trade slots and xs->here is left naming an
entry other than the one the search found.
The hash value itself survives the permutation -- the array is already
sorted, so a slot can only exchange with an equal-hash neighbour -- but
there is no reason to depend on that. Pick the hash up before the set,
where xs->here is unambiguously the entry the search landed on.
No functional change intended.
Link: https://lore.kernel.org/20261024151012.1059683-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261024151012.1059683-2-joseph.qi@linux.alibaba.com
Fixes: e39baff18b85 ("ocfs2: use the stored hash when checking xattr bucket collision")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 8013451927a83..734801de8e89e 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -5683,6 +5683,22 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
trace_ocfs2_xattr_set_entry_index_block(xi->xi_name);
+ /*
+ * An existing entry keeps the hash it was stored under, and that is
+ * the hash a split has to work with. A new entry is stored under the
+ * unsigned one, which is what ocfs2_xa_add_entry() will write.
+ *
+ * Read it before the set below. Filling the bucket may defragment it,
+ * and ocfs2_defrag_xattr_bucket() re-sorts the entry array, so
+ * afterwards xs->here only denotes whichever entry the sort left in
+ * that slot.
+ */
+ if (xs->not_found)
+ name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
+ xi->xi_name_len);
+ else
+ name_hash = le32_to_cpu(xs->here->xe_name_hash);
+
ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
if (!ret)
goto out;
@@ -5698,17 +5714,7 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
* the maximum number of collisions we will allow for then is
* one bucket's worth, so check it here whether we need to
* add a new bucket for the insert.
- *
- * An existing entry keeps the hash it was stored under, and that is
- * the hash a split has to work with. A new entry is stored under the
- * unsigned one, which is what ocfs2_xa_add_entry() will write.
*/
- if (xs->not_found)
- name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
- xi->xi_name_len);
- else
- name_hash = le32_to_cpu(xs->here->xe_name_hash);
-
ret = ocfs2_check_xattr_bucket_collision(xs->bucket, name_hash);
if (ret) {
mlog_errno(ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 868/869] apparmor: fix uninitialized variable warning in aa_inherit_files
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (866 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 867/869] ocfs2: read the xattr entry hash before defragmenting the bucket Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 13:59 ` [PATCH 6.18 869/869] apparmor: on failed load ensure profile files are removed before parent Greg Kroah-Hartman
` (8 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, John Johansen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit ed35bbe7d06e6505401eff3f3c7a36bd1f167a17 ]
Fix the following warning
All warnings (new ones prefixed by >>):
>> security/apparmor/file.c:737:53: warning: variable 'file' is uninitialized when used here [-Wuninitialized]
737 | int error = aa_file_perm(OP_INHERIT, cred, label, file,
| ^~~~
security/apparmor/file.c:724:36: note: initialize the variable 'file' to silence this warning
724 | struct file *devnull = NULL, *file;
| ^
| = NULL
1 warning generated.
vim +/file +737 security/apparmor/file.c
719
720 /* based on selinux's flush_unauthorized_files */
721 void aa_inherit_files(const struct cred *cred, struct files_struct *files)
722 {
723 struct aa_label *label = aa_get_newest_cred_label(cred);
724 struct file *devnull = NULL, *file;
725 bool devnull_tried = false;
726 unsigned int n = 0;
727
728 revalidate_tty(cred, label);
729
730 /*
731 * Revalidate access to inherited open files. Each file is
732 * revalidated holding only a reference to it, with no locks
733 * held, as revalidation may sleep (e.g. unix socket mediation
734 * dropping path refs, or allocating path buffers).
735 */
736 while ((n = iterate_fd(files, n, get_next_file, &file)) != 0) {
> 737 int error = aa_file_perm(OP_INHERIT, cred, label, file,
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610292346.ehqNujiE-lkp@intel.com/
Fixes: a913281f60015 ("apparmor: don't revalidate inherited files under files->file_lock")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 3176e5623d3d4..f8f9320e266a4 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -706,7 +706,7 @@ static int get_next_file(const void *p, struct file *file, unsigned int fd)
void aa_inherit_files(const struct cred *cred, struct files_struct *files)
{
struct aa_label *label = aa_get_newest_cred_label(cred);
- struct file *devnull = NULL, *file;
+ struct file *devnull = NULL, *file = NULL;
bool devnull_tried = false;
unsigned int n = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* [PATCH 6.18 869/869] apparmor: on failed load ensure profile files are removed before parent
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (867 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 868/869] apparmor: fix uninitialized variable warning in aa_inherit_files Greg Kroah-Hartman
@ 2026-11-07 13:59 ` Greg Kroah-Hartman
2026-11-07 14:30 ` [PATCH 6.18 000/869] 6.18.63-rc1 review Brett A C Sheffield
` (7 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Johansen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit 97ba44a2aa4c7ab011a93ce94cb595200fe4ea4f ]
The load interface does not guarantee the order profiles are loaded.
When a parent is loaded after its child, and the load fails, the
current code will issue a warning, and leak a dentry.
For the loaded set of profiles, ensure that on failure list is ordered
is traversed in reverse so any children processed after their parent
is freed first. We do not need to deal with the cases where the
children are processed before their parent, because either a parent
outside the list already exists or a dummy parent outside of the list
is created, and the list walk will not put those parents before their
children.
Fixes: 6ec46f8f1977d ("apparmor: remove fs entries created by a failed policy load")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 14c91fc94b22e..230d8428b4d31 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1404,8 +1404,10 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
* them yet, and leaving them behind would leak the new profiles
* (their dents pin the proxy) and make the next load at the same,
* unbumped ns revision fail with -EEXIST on its raw_data dir.
+ * ensure children (which are at the end of the list are removed
+ * before their parent
*/
- list_for_each_entry(tmp, &lh, list) {
+ list_for_each_entry_reverse(tmp, &lh, list) {
if (!tmp->old)
__aafs_profile_rmdir(tmp->new);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (868 preceding siblings ...)
2026-11-07 13:59 ` [PATCH 6.18 869/869] apparmor: on failed load ensure profile files are removed before parent Greg Kroah-Hartman
@ 2026-11-07 14:30 ` Brett A C Sheffield
2026-11-07 16:57 ` Peter Schneider
` (6 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Brett A C Sheffield @ 2026-11-07 14:30 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
044/044 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.18.63-rc1-gb7660db717ae #1 SMP PREEMPT_DYNAMIC Sat Nov 7 14:24:28 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (869 preceding siblings ...)
2026-11-07 14:30 ` [PATCH 6.18 000/869] 6.18.63-rc1 review Brett A C Sheffield
@ 2026-11-07 16:57 ` Peter Schneider
2026-11-08 15:54 ` Miguel Ojeda
` (5 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Peter Schneider @ 2026-11-07 16:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 07.11.2026 um 14:44 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (870 preceding siblings ...)
2026-11-07 16:57 ` Peter Schneider
@ 2026-11-08 15:54 ` Miguel Ojeda
2026-11-08 16:44 ` Sasha Levin
2026-11-09 9:34 ` Ron Economos
` (4 subsequent siblings)
876 siblings, 1 reply; 880+ messages in thread
From: Miguel Ojeda @ 2026-11-08 15:54 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda, Carlos Maiolino, linux-xfs, Darrick J. Wong,
Christoph Hellwig, Huacai Chen, WANG Xuerui, loongarch,
Richard Weinberger, Anton Ivanov, Johannes Berg, linux-um
On Sat, 07 Nov 2026 08:44:42 -0500 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64 and arm32:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
In loongarch64, I am seeing again the XFS issue:
https://lore.kernel.org/stable/20261106071743.90363-1-ojeda@kernel.org/
Cc: Carlos Maiolino <cem@kernel.org>
Cc: linux-xfs@vger.kernel.org
Cc: Darrick J. Wong <djwong@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: loongarch@lists.linux.dev
For completeness, for UML I have been seeing (I will skip reporting these):
arch/um/drivers/ubd_kern.c:780:13: warning: stack frame size (1480) exceeds limit (1024) in 'ubd_device_release' [-Wframe-larger-than]
lib/kunit/test.c:684:5: warning: stack frame size (1208) exceeds limit (1024) in 'kunit_run_tests' [-Wframe-larger-than]
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-um@lists.infradead.org
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-08 15:54 ` Miguel Ojeda
@ 2026-11-08 16:44 ` Sasha Levin
0 siblings, 0 replies; 880+ messages in thread
From: Sasha Levin @ 2026-11-08 16:44 UTC (permalink / raw)
To: Miguel Ojeda
Cc: Sasha Levin, gregkh, achill, akpm, broonie, conor, f.fainelli,
hargar, jonathanh, linux-kernel, linux, lkft-triage, patches,
patches, pavel, rwarsow, shuah, sr, stable, sudipm.mukherjee,
torvalds, Carlos Maiolino, linux-xfs, Darrick J. Wong,
Christoph Hellwig, Huacai Chen, WANG Xuerui, loongarch,
Richard Weinberger, Anton Ivanov, Johannes Berg, linux-um
> In loongarch64, I am seeing again the XFS issue:
Thanks for the report. The xfs patch ("xfs: cross-reference the primary
superblock") is dropped again from 7.3, 6.18 and 6.12.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 880+ messages in thread
* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (871 preceding siblings ...)
2026-11-08 15:54 ` Miguel Ojeda
@ 2026-11-09 9:34 ` Ron Economos
2026-11-09 9:40 ` Barry K. Nathan
` (3 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Ron Economos @ 2026-11-09 9:34 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 11/7/26 05:44, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.63-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (872 preceding siblings ...)
2026-11-09 9:34 ` Ron Economos
@ 2026-11-09 9:40 ` Barry K. Nathan
2026-11-09 9:50 ` Pavel Machek
` (2 subsequent siblings)
876 siblings, 0 replies; 880+ messages in thread
From: Barry K. Nathan @ 2026-11-09 9:40 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 11/7/26 5:44 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.63-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
I took 6.18.62 and applied the stable-queue as of commit
85f15de479e79a3a7515d926437bde0a0f16306a ("Fixes for all trees").
This drops the build-breaking XFS patch and is the current
stable-queue as of this writing.
Tested on my Lenovo ThinkPad T14 Gen 1 and an arm64 virtual machine.
Working well, no regressions observed.
Tested-by: Barry K. Nathan <barryn@pobox.com>
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (873 preceding siblings ...)
2026-11-09 9:40 ` Barry K. Nathan
@ 2026-11-09 9:50 ` Pavel Machek
2026-11-09 19:57 ` Florian Fainelli
2026-11-09 20:04 ` Shuah Khan
876 siblings, 0 replies; 880+ messages in thread
From: Pavel Machek @ 2026-11-09 9:50 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 504 bytes --]
Hi!
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.18.y
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Best regards,
Pavel
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (874 preceding siblings ...)
2026-11-09 9:50 ` Pavel Machek
@ 2026-11-09 19:57 ` Florian Fainelli
2026-11-09 20:04 ` Shuah Khan
876 siblings, 0 replies; 880+ messages in thread
From: Florian Fainelli @ 2026-11-09 19:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 11/7/26 05:44, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.63-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested with
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 880+ messages in thread* Re: [PATCH 6.18 000/869] 6.18.63-rc1 review
2026-11-07 13:44 [PATCH 6.18 000/869] 6.18.63-rc1 review Greg Kroah-Hartman
` (875 preceding siblings ...)
2026-11-09 19:57 ` Florian Fainelli
@ 2026-11-09 20:04 ` Shuah Khan
876 siblings, 0 replies; 880+ messages in thread
From: Shuah Khan @ 2026-11-09 20:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr, Shuah Khan
On 11/7/26 06:44, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.63 release.
> There are 869 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.63-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 880+ messages in thread