* [PATCH 6.18 000/686] 6.18.64-rc1 review
@ 2026-11-13 15:42 Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 001/686] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
` (46 more replies)
0 siblings, 47 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.18.64 release.
There are 686 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 15 Nov 2026 15:36:17 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.64-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.18.64-rc1
José Miguel Castellanos Valladolid <josstamy@gmail.com>
ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx
Jaeho Cho <jaeho2025@gmail.com>
ALSA: hda/realtek: Enable mute LEDs on HP OmniBook 7 17-dc0xxx
Gianluca Balboni <gianluca.balboni06@gmail.com>
ASoC: amd: yc: Add DMI quirk for HP OmniBook 3 Laptop 16-by0xxx
Armaan Sandhu <armaan.sandhu0504@gmail.com>
lib/cmdline: fix get_options() count and overflow with large ranges
Shuvam Pandey <shuvampandey1@gmail.com>
lib/tests: extend cmdline KUnit with next_arg() tests
Wang Yan <wangyan01@kylinos.cn>
selftests/landlock: Fix snprintf truncation checks in test files
Arnaldo Carvalho de Melo <acme@redhat.com>
perf python: Free the parse error entries when parsing fails
Karl Mehltretter <kmehltretter@gmail.com>
fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes
Chintan Patel <chintanlike@gmail.com>
fbdev: sh_mobile_lcdc: Make FB_DEVICE dependency optional
Chintan Patel <chintanlike@gmail.com>
fb: Add dev_of_fbinfo() helper for optional sysfs support
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmf: Add AMDI0112 ACPI ID
Myeonghun Pak <mhun512@gmail.com>
fbdev: nvidia: Release write-combining handle on probe failure
Shixiong Ou <oushixiong@kylinos.cn>
fbdev: nvidia: Convert to managed PCI and ioremap API
Wentao Liang <vulab@iscas.ac.cn>
power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe()
Au Dang <au.dang.jx@renesas.com>
irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
Guangshuo Li <lgs201920130244@gmail.com>
crypto: omap-sham - fix crypto engine cleanup
Thorsten Blum <thorsten.blum@linux.dev>
crypto: omap - add omap_sham_unregister_algs helper
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
hwmon: (coretemp) Return -ENODATA for invalid temperature readings
Andrea Parri <parri.andrea@gmail.com>
iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/vma: avoid broken uffd merge on mremap
David Carlier <devnexen@gmail.com>
media: ipu6: Fix firmware config leak on stream start
Antti Laakso <antti.laakso@linux.intel.com>
media: ipu6: Rename pointer to firmware context
Daeho Jeong <daehojeong@google.com>
f2fs: release a removed xattr node in roll-forward recovery
Miquel Raynal <miquel.raynal@bootlin.com>
clk: nuvoton: ma35d1: Add missing WDT/WWDT parent clocks
Miquel Raynal <miquel.raynal@bootlin.com>
dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks
Miquel Raynal <miquel.raynal@bootlin.com>
dt-bindings: clock: ma35d1: Drop CLK_MAX_IDX define
Miquel Raynal <miquel.raynal@bootlin.com>
clk: nuvoton: ma35d1: Keep the clock count in the driver
Sumit Kumar <sumit.kumar@oss.qualcomm.com>
PCI: dwc: Set DMA_BYPASS bit in outbound IATU CTRL2 register
David Hildenbrand (Arm) <david@kernel.org>
mm/huge_memory: split huge PUDs when adjusting VMA boundaries
Rudi Heitbaum <rudi@heitbaum.com>
PCI: imx6: Avoid dereferencing a NULL clock name
Hung-Jui Lin <alex.lin.programmer@gmail.com>
posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers
Thomas Gleixner <tglx@kernel.org>
posix-timers: Handle the timer_[re]arm() return value
Evgeny Akhtimirov <evgeny@devduty.com>
ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH
Bradley Morgan <brads@mainlining.org>
panic: restore variable arguments to nmi_panic()
Steve Wahl <steve.wahl@hpe.com>
watchdog/hpwdt: Refine hpwdt message for UV platform
Yingjie Wang <1075151112@qq.com>
nvme-tcp: validate the TLS handshake timeout
Yingjie Wang <1075151112@qq.com>
nvmet-tcp: validate the TLS handshake timeout
Borislav Petkov (AMD) <bp@alien8.de>
Documentation/kernel-parameters: Move the kernel build options
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Don't init & online empty nodes
Chao Yu <chao@kernel.org>
f2fs: fix to invalidate curseg if change_curseg() fails
David Carlier <devnexen@gmail.com>
mm/shmem: don't release a swapin-error marker as a swap entry
Christian Brauner <brauner@kernel.org>
iomap: don't mark unwritten parts of a folio uptodate
Linmao Li <lilinmao@kylinos.cn>
PCI: cadence: Store the core controller in platform drvdata
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
arm64/gcs: release GCS on failed fork
Giorgi Kobakhia <gkobakhi@asu.edu>
ocfs2: fix array out of bound access in __ocfs2_find_path()
Edward Adam Davis <eadavis@qq.com>
ocfs2: fix oob in __ocfs2_find_path
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Fix one-shot limitation for perf hardware breakpoints
Nikolaos Karaolidis <nick@karaolidis.com>
fs: don't lose inodes that another LRU walker is isolating
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: hdac_hda: Restore the codec device type on unbind
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: hdac_hda: Allocate the private data at codec driver bind
Hongfu Li <lihongfu@kylinos.cn>
mm/memfd: fix hugetlb reservation accounting in error paths
Jinmeng Zhou <jinmengzhou22@gmail.com>
mm/hugetlb: charge folios to the target mm's memcg
Josef Bacik <josef@toxicpanda.com>
mm/vma: don't leak the commit charge on mmap failure
Hongfu Li <lihongfu@kylinos.cn>
mm/memcg: migrate per-node hugetlb lruvec stat together with hugetlb folio
Ye Liu <ye.liu@linux.dev>
mm: use enum migrate_reason instead of int for migration reason parameters
Qi Zheng <zhengqi.arch@bytedance.com>
mm: memcontrol: refactor mod_memcg_state() and mod_memcg_lruvec_state()
Nikolaos Karaolidis <nick@karaolidis.com>
fs: rotate inodes whose page cache could not be dropped
Jan Kara <jack@suse.cz>
fs: Ignore inode metadata buffers in inode_lru_isolate()
Mateusz Guzik <mjguzik@gmail.com>
fs: provide accessors for ->i_state
Mateusz Guzik <mjguzik@gmail.com>
fs: spell out fenced ->i_state accesses with explicit smp_wmb/smp_rmb
Mateusz Guzik <mjguzik@gmail.com>
fs: add missing fences to I_NEW handling
Mateusz Guzik <mjguzik@gmail.com>
fs: assert on ->i_count in iput_final()
Alexander Sverdlin <alexander.sverdlin@gmail.com>
tpm: tpm2_probe: propagate transport errors
Alexey Charkov <alchark@flipper.net>
nvmem: rockchip-otp: Serialize reads
Rosen Penev <rosenp@gmail.com>
nvmem: rockchip-otp: alloc clks with main struct
Ming Lei <tom.leiming@gmail.com>
ublk: mark the io command cancelable before publishing it
Gregory Price <gourry@gourry.net>
mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd()
Wentao Liang <vulab@iscas.ac.cn>
xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released()
Ackerley Tng <ackerleytng@google.com>
mm: hugetlb: drop refcount before freeing on memcg charge failure
Ackerley Tng <ackerleytng@google.com>
mm: hugetlb: return -ENOSPC on memcg charge failure
Yao Yiqi <yaoyiqi3@huawei.com>
fbcon: Retry rotated font allocation after failure
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: adc: ad4080: enable address ascension for chip identification
Rong Zhang <i@rong.moe>
platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error
Rong Zhang <i@rong.moe>
platform/x86: Rename lenovo-wmi-capdata01 to lenovo-wmi-capdata
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic: Stop the target vcpu when disabling LPIs
Arnaldo Carvalho de Melo <acme@redhat.com>
perf evsel: Close the fds opened so far when disabling missing features
Hui Su <sh_def@163.com>
perf evsel: Restrict incremental open error unwind
Art O Cathain <art.home@gmail.com>
ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265
Sehat Mahde <hskmahde@gmail.com>
ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
Jackie Dong <xy-jackie@139.com>
ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11
Jasper Smet <josbeir@gmail.com>
ASoC: amd: acp: Add DMI quirk for ASUS Zenbook S16 UM5606GA
Hasun Park <hasunpark@gmail.com>
ASoC: amd: acp: add DMI override for ACP70 flag
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: move the channel survey when the channel changes
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt7921: assert sniffer on chanctx change
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs
Chao Yu <chao@kernel.org>
f2fs: fix to use bio_in_atomic() in f2fs_read_end_io()
Tal Zussman <tz2294@columbia.edu>
block: introduce bio_in_atomic()
Kaixuan Li <kaixuanli0131@gmail.com>
f2fs: bound the SIT/NAT bitmaps by the checkpoint pack
Chi Zhiling <chizhiling@kylinos.cn>
exfat: advance valid_size to EOF for append writes
Andrea Parri <parri.andrea@gmail.com>
iomap: don't lose a failed direct I/O bio's error when zeroing the tail
Pankaj Raghav <p.raghav@samsung.com>
iomap: use largest_zero_folio() in iomap_dio_zero()
Vladyslav Tymoshchuk <tvlad744@gmail.com>
ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix power-off ordering to disable power domain after clocks
Martin Fuzzey <martin.fuzzey@flowbird.group>
serial: sc16is7xx: fix data corruption due to unexpected xon/xoff
Sinan Turunc <enscrpt@pm.me>
ALSA: ua101: Bound packet copies by the PCM buffer size
Ruide Cao <caoruide123@gmail.com>
mptcp: fix MP_CAPABLE token migration when cloning reqsk
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
Sung Byeongchan <tjdqudcks0424@naver.com>
virtiofs: validate fixed-output response length
Yuto Ohnuki <ytohnuki@amazon.com>
virtiofs: add FUSE protocol validation
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: declare MCR and IER as volatile registers
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: add comments for lock requirements
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: declare SPR/TLR/XOFF2 register as volatile
Tobias Schumacher <ts@linux.ibm.com>
s390/pci: Add error cleanup in zpci_directed_irq_init()
Darrick J. Wong <djwong@kernel.org>
xfarray: don't crash when sorting if array element crosses a folio
Matthew Wilcox (Oracle) <willy@infradead.org>
xfs: Use folio_next_pos()
Matthew Wilcox (Oracle) <willy@infradead.org>
filemap: Add folio_next_pos()
Fan Wu <fanwu01@zju.edu.cn>
media: rockchip: rga: quiesce IRQ before releasing m2m state
Sven Püschel <s.pueschel@pengutronix.de>
media: rockchip: rga: use clk_bulk api
Marc Zyngier <maz@kernel.org>
KVM: arm64: nv: Move L2->L1 switch on interrupt early
Marco Scardovi <scardracs@disroot.org>
platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex
Ma Ke <make_ruc2021@163.com>
ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure
Takashi Iwai <tiwai@suse.de>
ALSA: hda: cs35l41: Use auto-cleanup for put_device()
Myeonghun Pak <mhun512@gmail.com>
mfd: twl-core: Unregister the auxiliary platform device on unbind
Thorsten Blum <thorsten.blum@linux.dev>
mfd: twl-core: Use i2c_check_functionality as boolean value
Kenneth Feng <kenneth.feng@amd.com>
drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2
Daeho Jeong <daehojeong@google.com>
f2fs: return -EIO for a lost inode block after cp_error
Ridong Chen <chenridong@xiaomi.com>
mm/mglru: fix ineffective memory protection for non-kswapd reclaim
Tejun Heo <tj@kernel.org>
cgroup: Expose some cgroup helpers
Chao Yu <chao@kernel.org>
f2fs: zone: fix to avoid bio split on sequential zone
Ethan Nelson-Moore <enelsonmoore@gmail.com>
ata: sata_inic162x: remove dangerous broken driver
Bart Van Assche <bvanassche@acm.org>
ata: libata: Add an argument to ata_eh_reset()
Li RongQing <lirongqing@baidu.com>
vfio/pci: Restore 8-byte ioeventfd support
Karl Mehltretter <kmehltretter@gmail.com>
spi: atmel-quadspi: balance runtime PM and pclk across system sleep
Robert Marko <robert.marko@sartura.hr>
spi: atmel-quadspi: use init callback for gclk variants
Robert Marko <robert.marko@sartura.hr>
spi: atmel-quadspi: add controller init callback
Matej Sochan <matej.sochan@gmail.com>
ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05
Nicholas Bonello <hadobedo@gmail.com>
ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding
Rámon van Raaij <ramon@vanraaij.eu>
ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9
Jiale Yao <yaojiale02@163.com>
iio: dac: mcp4821: reject devices without match data
Myeonghun Pak <mhun512@gmail.com>
ASoC: stm: stm32_i2s: request IRQ after regmap initialization
bui duc phuc <phucduc.bui@gmail.com>
ASoC: stm: stm32_i2s: Drop redundant error messages
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
dmaengine: qcom: bam_dma: free interrupt before the clock in error path
Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
dmaengine: qcom: bam_dma: Defer IRQ trigger type to device tree
Tom Verdonck <tom.verdonck@inspiral.be>
hwmon: (tmp108) Fix jiffies wraparound in conversion-ready check
Yunpeng Tian <shionthanatos@gmail.com>
udf: validate the device specification EA before using it
Chris Mason <mason@kernel.org>
ovl: fail the mount if the casefold flag has changed
Mehmet Fide <mehmet.fide@screeningeagle.com>
wifi: rtw88: widen the ATIM window while an AP interface is up
Mehmet Fide <mehmet.fide@screeningeagle.com>
wifi: rtw88: usb: only let the frames a dozing station needs use the after-DTIM queue
Mehmet Fide <mehmet.fide@screeningeagle.com>
wifi: rtw88: usb: bound what the driver feeds the after-DTIM queue
Mehmet Fide <mehmet.fide@screeningeagle.com>
wifi: rtw88: usb: route bmc frames via the high queue only for DTIM delivery
Martin Belanger <martin.belanger@dell.com>
nvme-tcp: skip TLS control records while waiting for the ICResp
Zhiling Zou <zhilinz@nebusec.ai>
ipmr: only copy pktinfo to cache reports
Eric Dumazet <edumazet@google.com>
ipmr: prevent info-leak in pmr_cache_report()
Baolin Wang <baolin.wang@linux.alibaba.com>
mm: memory: fix truncation removing mapped folios
Weibin Liu <liuwb@xiaopeng.com>
spi: cadence-xspi: reject SDMA transfers larger than the requested length
Jisheng Zhang <jszhang@kernel.org>
spi: cadence-xspi: group marvell support code together
Hans Zhang <18255117159@163.com>
spi: cadence-xspi: Use FIELD_MODIFY()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
spi: cadence-xspi: Replace ACPI specifics by agnostic APIs
Chris Mason <mason@kernel.org>
mm/shmem: honour F_SEAL_EXEC when an ACL is set
Kyle Zeng <kylebot@openai.com>
mm/page_vma_mapped: continue past nonmatching huge PMDs
Jiangshan Yi <yijiangshan@kylinos.cn>
ceph: fix longname buffer overflow in ceph_fname_to_usr()
David Hildenbrand (Arm) <david@kernel.org>
mm/userfaultfd: only allocate anon_vma in CoW mappings
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: unmap the page where the other VMA maps it
Yuejie Shi <syjcnss@gmail.com>
fs/ntfs3: validate the EA value length in ntfs_read_ea()
Vaibhav Nagare <vnagare@redhat.com>
bnxt_en: don't leave an XDP program installed when the open fails
Michael Chan <michael.chan@broadcom.com>
bnxt_en: Refactor some basic ring setup and adjustment logic
Jun Yang <junvyyang@tencent.com>
sctp: re-point retained control chunks on association migration
David Lee <david.lee@trailofbits.com>
sctp: hold shkey across socket migration
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM
Dave Jiang <dave.jiang@intel.com>
cxl/port: Clear cached dport pointers when a dport is removed
Dan Williams <dan.j.williams@intel.com>
cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition
Yifei Gao <gyf161023@gmail.com>
misc: fastrpc: fix double-free in fastrpc_map_attach() error path
Kumari Pallavi <kumari.pallavi@oss.qualcomm.com>
misc: fastrpc: Rename phys to dma_addr for clarity
Ming Lei <tom.leiming@gmail.com>
ublk: keep a canceled FETCH round canceling until the server is gone
Sean Christopherson <seanjc@google.com>
KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: ov5647: fix power cleanup on remove
Sean Young <sean@mess.org>
media: redrat3: Error path leaves device in transmitting state
Esben Haabendal <esben@geanix.com>
iio: light: ltr501: Power down chip if request irq fails
Pan Chuang <panchuang@vivo.com>
iio: light: Remove redundant dev_err()/dev_err_probe()
Chao Yu <chao@kernel.org>
f2fs: fix to check continuousness in f2fs_sync_meta_pages() correctly
Gaurav Batra <gbatra@linux.ibm.com>
powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped
Christopher Lusk <clusk@northecho.dev>
m68k: Fix seccomp filtering on ColdFire and 68000
Daniel Palmer <daniel@0x0f.com>
m68k: Fix task info flags handling for 68000
Chao Yu <chao@kernel.org>
f2fs: fix to avoid folio->mapping dereference in is_{meta, node}_folio()
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: og01a1b: power off sensor on remove
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
media: i2c: og01a1b: Switch from .s_stream to .enable_streams/.disable_streams
Jiaming Zhang <r772577952@gmail.com>
gfs2: reject invalid inode sizes
Tom Verdonck <tom.verdonck@inspiral.be>
hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: usb-audio: Protect Roland control activation
Nicholas Hobson <nicholas.hobson@outlook.com>
ALSA: usb-audio: keep MIDI input running for Roland TD-11
Danish Khateeb <danishkhateeb03@gmail.com>
ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks
bui duc phuc <phucduc.bui@gmail.com>
ALSA: core: Clean up file_operations definitions
Jiale Yao <yaojiale02@163.com>
iio: adc: ad7192: reject devices without match data
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
iio: adc: ad7192: Revert "properly check spi_get_device_match_data()"
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix iova allocation from restrict region
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: Account for rate_factor in control steps
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: Account rate_factor in setting upper exposure limit
Tarang Raval <tarang.raval@siliconsignals.io>
media: i2c: imx219: Replace exposure magic value with named constant
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: fix SBGGR10 Bayer pattern
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: fix ISC_PFG_CFG0_BPS macro name typo
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: store the unshifted PFE_CFG0 BPS value
Wei-Lin Chang <weilin.chang@arm.com>
KVM: arm64: ptdump: Check the page tables aren't freed when accessing
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: Use kvm_s2_fault_vma_info in gmem_abort()
Fabio Cesari <fabio.cesari@gmail.com>
iio: light: isl29028: fix runtime PM reference leak on error paths
Sang-Heon Jeon <ekffu200098@gmail.com>
iio: light: isl29028: remove isl29028_set_pm_runtime_busy() helper
Sean Christopherson <seanjc@google.com>
KVM: guest_memfd: Split bind() into prepare()+commit() phases
Hans de Goede <johannes.goede@oss.qualcomm.com>
platform/x86: int3472: Increase handshake GPIO delay to 200 ms
Tarang Raval <tarang.raval@siliconsignals.io>
platform: int3472: discrete: Support multiple HIDs per GPIO map entry
Koichiro Den <den@valinux.co.jp>
PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime
Abel Vesa <abel.vesa@linaro.org>
soc: qcom: pmic_glink: Fix device access from worker during suspend
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: The horizontal blanking step is 8
Tarang Raval <tarang.raval@siliconsignals.io>
media: i2c: imx219: Propagate errors from control range updates
Cheng Ming Lin <chengminglin@mxic.com.tw>
mtd: spi-nor: macronix: Restore fallback parameters for MX25L12805D
Maxi Saparov <masaparov@coreweave.com>
kho: do not reserve scratch memory in the kdump kernel
Eric Biggers <ebiggers@kernel.org>
lib/crypto: mips: Disable Octeon SHA code on little-endian kernels
Abhishek Dubey <adubey@linux.ibm.com>
powerpc/bpf: fix buffer overflow in JIT for large BPF programs
Zhao Gongyi <zhaogongyi@bytedance.com>
ata: libata-scsi: reject data-in commands with a data-out buffer
Michal Blaszczyk <michalblk@google.com>
sched_ext: Reset runnable_at when a task leaves its scheduler
Oliver Hartkopp <socketcan@hartkopp.net>
can: raw, isotp: copy socket options outside of lock_sock()
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: don't drop local events queued during TVLV update
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: only update flags for TT events
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: ignore ROAM flag of received ADD changes
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: send ROAM_ADV on each roamed back client
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: clear ROAM flag when re-adding a pending local client
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: only transmit local ROAM flag together with DEL
Sven Eckelmann <sven@narfation.org>
batman-adv: tpmeter: fix u32 truncation of reported bytes
SJ Park <sj@kernel.org>
mm/damon/core: move static variable last_nr_regions to damon_ctx
Ido Schimmel <idosch@nvidia.com>
vxlan: Stop rejecting dynamic FDB entries with a nexthop ID
Daehyeon Ko <4ncienth@gmail.com>
timekeeping: Require permission to set auxiliary clocks
Hamid Nassiby <hamid.nassiby@nokia.com>
Revert "mm/page_owner: fix memory leak in page_owner_stack_fops->release()"
Guanglei Zhu <zhugl3@xiaopeng.com>
ceph: clamp the inline data length in ceph_fill_inline_data()
Oliver Hartkopp <socketcan@hartkopp.net>
can: protect the receive lists with a per-device lock
Oliver Hartkopp <socketcan@hartkopp.net>
can: replace ARPHRD_CAN type checks with can_get_ml_priv()
Sasha Levin <sashal@kernel.org>
Revert "hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU"
Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
iommu/amd: Force device table to maximum size
Chris Mason <mason@kernel.org>
x86/mm: Fix global ASID handed out to two processes
Marco Ziliani <rylos78@gmail.com>
ata: libata-pmp: disable the SEMB port on Marvell 88SM9705
Kiryl Shutsemau (Meta) <kas@kernel.org>
arm64: sdei: Preserve the interrupted context's exception registers
Kiryl Shutsemau (Meta) <kas@kernel.org>
arm64: sdei: Run the event handler on the kernel vectors
Thorsten Blum <blum@kernel.org>
x86/boot: Fix off-by-one error in sme_clear_pgd()
Jinjie Ruan <ruanjinjie@huawei.com>
arm64: kexec_file: Fix elf_headers memory leak in retry loop
Akshay Jindal <Akshay.Jindal@amd.com>
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
Breno Leitao <leitao@debian.org>
x86/nmi: Ignore negative NMI handler durations
Danish Khateeb <danishkhateeb03@gmail.com>
perf/core: Don't send SIGTRAP after exec removed the event
Shao Mingyin <shao.mingyin@zte.com.cn>
nvmet: bound the traddr and trsvcid configfs writes
Qiliang Yuan <odys.yuan@gmail.com>
nvme: wait for SRCU readers before splicing the namespace list
Qiliang Yuan <odys.yuan@gmail.com>
srcu: Add list_splice_init_srcu()
Imre Kaloz <kaloz@kernel.org>
MIPS: sgi-ip32: Leave MACE PCI control alone in config accesses
Imre Kaloz <kaloz@kernel.org>
MIPS: sgi-ip32: Mask MACE PCI interrupts in CRIME only
Imre Kaloz <kaloz@kernel.org>
MIPS: mm: Fix the cache error vector jump for XKPHYS kernels
Matthias Goergens <matthias.goergens@gmail.com>
udf: don't use eloc after the end of the unallocated space table
Matthias Goergens <matthias.goergens@gmail.com>
udf: fix preallocation discarding before an empty allocation extent
Matthias Goergens <matthias.goergens@gmail.com>
udf: check the unallocated space table when it is loaded
Matthias Goergens <matthias.goergens@gmail.com>
udf: don't let the extent type hide an exhausted free-space table extent
Kyle Zeng <kylebot@openai.com>
mptcp: pm: kernel: use RCU to free endpoint listeners
Christian Gmeiner <cgmeiner@igalia.com>
drm/etnaviv: Flush the tile status cache through both the PE and BLT
James Clark <jjc@jclark.com>
net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
Ray Zhang <sgzhang@google.com>
net: count last skb of each sk_backlog pass in __release_sock()
Bryam Vargas <hexlabsecurity@proton.me>
net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
Hungyu Lin <dennylin0707@gmail.com>
ext2: preserve IOMAP_F_DIRTY for extending direct writes
Sinan Turunc <enscrpt@pm.me>
ALSA: usx2y: Guard the playback copy
Sinan Turunc <enscrpt@pm.me>
ALSA: usx2y: Require a buffer of two URBs
Wentao Liang <vulab@iscas.ac.cn>
ALSA: caiaq: free the EP4 URB when input setup fails
Sinan Turunc <enscrpt@pm.me>
ALSA: line6: Reject capture buffers smaller than two packets
Mohamed Yassine Jebabli <med.jebabli@gmail.com>
ALSA: hda/tas2781: Only accept CRC-less V1 data if all entries are valid
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: usx2y: Refuse a retried DSP load after a failure
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: bcd2000: Fix use-after-free of MIDI URBs on file close
Alex Kazinsky <a.kazinsky@ideco.ru>
ALSA: cs46xx: Handle SCB creation failures before dereferencing
Chris Simpson <chris@nilk.net>
ALSA: hda/realtek: Enable bass speakers on Alienware m17 R3
HyeongJun An <sammiee5311@gmail.com>
ALSA: ump: Fix dropped data bytes at UMP System message conversion
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/devinit/gf100-: try to avoid double-running vbios scripts
Finn Zeruhn <fzeruhn@icloud.com>
drm/dp: keep MOT set between messages when no_zero_sized is set
Rosen Penev <rosenp@gmail.com>
drm/nouveau/nvkm: clear use.enabled when subdev init fails
Hengyu Liang <hengyul@cs.unc.edu>
l2tp: only return sessions of the given tunnel in l2tp_session_get()
Chris Mason <mason@kernel.org>
ovl: look up the index by the decoded origin
Sasha Levin <sashal@kernel.org>
nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
Zhao Gongyi <zhaogongyi@bytedance.com>
arm64: mm: validate /dev/mem mmap ranges without overflow
Wei Wang <wvw@google.com>
arm64: suspend: Save and restore TPIDR2_EL0 across CPU suspend
Ewan D. Milne <emilne@redhat.com>
nvmet: don't return memory contents beyond valid data when reading ANA log page
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: don't drop the gang dependency fence twice
renpanpan <renpanpan@kylinos.cn>
drm/amdgpu: Only enable HDMI audio if display supports it
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: drop the dma-buf reference when a KFD import fails
Hugo Sales <hugo@hsal.es>
drm/amdgpu: Clamp the ATIF backlight curve to its 99 points
Erhan Bilgili <erhan.bilgili@gmail.com>
drm/amdgpu: Report MES ring wait timeouts.
Erhan Bilgili <erhan.bilgili@gmail.com>
drm/amdgpu: Fix duplicate dependency fence releases
Kylie C <kyliepc@proton.me>
drm/amd/display: Don't select zero V_TOTAL_MIN/MAX on seamless boot
Matthew Schwartz <matthew.schwartz@linux.dev>
drm/amd/display: Keep the nominal vtotal while VRR is inactive
Misha Nasledov <misha@nasledov.com>
drm/amd/display: Drop clock requirements on DCN32 when no displays are active
Roman Demidov <roman.demidov.nn@gmail.com>
drm/amd/display: Fix NULL deref in dcn401_update_clocks_update_dtb_dto
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu/gfx12: disallow GFXOFF while updating the SPM VMID
Alex Hung <alex.hung@amd.com>
drm/amd/display: Avoid closing unowned DDC pins
Milan Milicevic <Milan.Milicevic@amd.com>
drm/amdgpu: publish IH enabled before PSP programs IH_RB_CNTL
Milan Milicevic <Milan.Milicevic@amd.com>
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for navi10_ih
Prike Liang <Prike.Liang@amd.com>
drm/amdgpu: finish GPU recovery callbacks before restarting schedulers
Dariusz Marcinkiewicz <darekm@google.com>
drm/amdgpu: check amdgpu_vm_ready() in dma-buf move notify
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdkfd: use the queue's process info for the WPTR BO eviction fence
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: keep the CS user fence BO in GTT
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: parse CS IBs at the BO offset their VA mapping starts at
Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
drm/amdgpu: Check cs flags.
Jarkko Sakkinen <jarkko@kernel.org>
nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
Yitang Yang <yi1tang.yang@gmail.com>
ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
Yilin Zhang <yilinzhang@moonshot.ai>
mptcp: do not use Fast Open on MP_JOIN subflows
Daehyeon Ko <4ncienth@gmail.com>
vhost/vsock: size receive SKBs from declared payload
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: clamp skb->queue_mapping before indexing the tx queue
Chris Mason <mason@kernel.org>
ovl: do not let chattr change the casefold flag
Xia Yan <yanxia@cmss.chinamobile.com>
ipv6: fix device binding after failed datagram connect
Samiullah Khawaja <skhawaja@google.com>
mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
Ritesh Harjani (IBM) <ritesh.list@gmail.com>
mm/huge_memory: set the mmu_gather page size in zap_huge_pud()
David Hildenbrand (Arm) <david@kernel.org>
mm/memory-tiers: unregister empty tiers outside memory_tier_lock
Chris Mason <mason@kernel.org>
mm/vma: call ->may_split() before a partial merge
David Hildenbrand (Arm) <david@kernel.org>
mm/ksm: reset the unstable trees of all nodes
Chris Mason <mason@kernel.org>
mm: fix unkillable fault loop on MAP_DROPPABLE memory
Josef Bacik <josef@toxicpanda.com>
mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit
Chris Mason <mason@kernel.org>
mm/memory: reject remote COW faults on PFN mappings
David Hildenbrand (Arm) <david@kernel.org>
mm/madvise: fix data loss from MADV_FREE on a KSM page
Josef Bacik <josef@toxicpanda.com>
mm/mremap: fix moving PUD leaves
David Hildenbrand (Arm) <david@kernel.org>
mm/mremap: recheck PUDs under the page table lock
David Hildenbrand (Arm) <david@kernel.org>
mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs
Chris Mason <mason@kernel.org>
mm/mmu_notifier: set ->mm only after mmgrab()
Josef Bacik <josef@toxicpanda.com>
mm/mmu_notifier: finish non-blocking interval invalidation on error
Josef Bacik <josef@toxicpanda.com>
mm/mmu_gather: fix flushing ranges with 4 GiB or larger
David Hildenbrand (Arm) <david@kernel.org>
mm/gup: check for overflow when converting nr_pages to bytes in GUP-fast
Chris Mason <mason@kernel.org>
mm/gup: fix out-of-bounds write for nr_pages == 0 in GUP-fast
Chris Mason <mason@kernel.org>
mm/gup: fix clearing folios in memfd_pin_folios()
David Hildenbrand (Arm) <david@kernel.org>
mm/gup: recheck the PUD under PTL in follow_pud_mask()
Chris Mason <mason@kernel.org>
mm/khugepaged: preserve dirty bits when collapsing PTE-mapped THPs
Josef Bacik <josef@toxicpanda.com>
mm/khugepaged: fix PMD table lock leak in try_collapse_pte_mapped_thp()
Josef Bacik <josef@toxicpanda.com>
mm/khugepaged: always recheck the pmd in try_collapse_pte_mapped_thp()
Liu Changjie <liucj1228@outlook.com>
can: peak_usb: pcan_usb_fd_decode_buf(): accept short uCAN end-of-list records
ChunYuZhiQiang <chunyuzhiqiang@yinhe.ht>
can: dev: can_fill_info(): don't wake up controller if interface is down
Oliver Hartkopp <socketcan@hartkopp.net>
can: proc: skip stats calculation after reset in can_stat_update()
Runyu Xiao <runyu.xiao@seu.edu.cn>
can: proc: reset pkg_stats atomics individually
Oliver Hartkopp <socketcan@hartkopp.net>
can: isotp: check the return values of can_rx_register() in isotp_bind()
Cunhao Lu <1579567540@qq.com>
can: dev: can_put_echo_skb(): free skb on invalid echo index
Kaixuan Li <kaixuanli0131@gmail.com>
can: isotp: check the frame type, not just the length
Yingjie Wang <1075151112@qq.com>
nvmet: reject keep-alive timeouts that would overflow
Christoph Hellwig <hch@lst.de>
xfs: fix recovery of partial attr removals
Hyunwoo Kim <imv4bel@gmail.com>
net: restore refcount ordering for lockless socket access
Daejun Park <daejun7.park@samsung.com>
xfs: clamp the pNFS layout range to the maximum file size
Daejun Park <daejun7.park@samsung.com>
xfs: cap the block count of xfs_iomap_write_direct() at one extent
Daejun Park <daejun7.park@samsung.com>
xfs: clamp a pNFS LAYOUTCOMMIT extent before computing its end
Daejun Park <daejun7.park@samsung.com>
xfs: add a flag to convert unwritten extents without allocating blocks
Daejun Park <daejun7.park@samsung.com>
xfs: mark the inode preallocated for pNFS write layouts past EOF
Zhe Liu <liuzhe1@kylinos.cn>
blk-iocost: account flush sequence latency only once
Krystian Kaniewski <krystianmkaniewski@gmail.com>
blk-mq: fix out-of-bounds read in blk_mq_free_rqs
Reid Downing <skibletz@gmail.com>
xfs: fix wrong compat fields in xfs_ioctl32_bstat_copyin()
Hungyu Lin <dennylin0707@gmail.com>
block: Return the soft block size for compat BLKBSZGET
Cong Zhang <cong.zhang@oss.qualcomm.com>
virtio_blk: use synchronous quiesce in virtblk_freeze_priv()
Josef Bacik <josef@toxicpanda.com>
blk-mq: end the request if getting a keyslot fails
Hungyu Lin <dennylin0707@gmail.com>
inotify: do not coalesce rename events
chenglong.ma <longpareto@gmail.com>
vduse: fix VA/PA confusion in the coherent page fault path
Thorsten Blum <blum@kernel.org>
hwrng: virtio - prevent use-after-free after a failed restore
Esben Haabendal <esben@geanix.com>
drm/bridge: nwl-dsi: Limit LCDIF specific sync override
Esben Haabendal <esben@geanix.com>
drm/bridge: nwl-dsi: Cleanup endpoint mux control selection
Yuho Choi <oss.patchbox@gmail.com>
vdpa/snet: Don't discard the DPU error in snet_send_ctrl_msg()
Yuho Choi <oss.patchbox@gmail.com>
iommu/virtio: Reset device before deleting virtqueues on probe failure
Fang Xieyan <fangxy@xiaopeng.com>
vhost: fix used ring index wrap in vhost_add_used_n_in_order
Shubham Antil <shubham@octane.security>
vhost-scsi: zero misaligned I/O bounce pages
Kyle Zeng <kylebot@openai.com>
net/sched: sch_qfq: prevent aggregate self-replacement
Jianyun Gao <jianyungao89@gmail.com>
xfs: fix temporary cursor leak in btree shift corruption paths
Naman Jain <namjain@linux.microsoft.com>
x86/init: Initialize wall clock in get_rtc_noop()
Cen Zhang <zzzccc427@gmail.com>
ocfs2: cache the mount context for dentry lock callbacks
Cen Zhang <zzzccc427@gmail.com>
ocfs2: wait for filecheck kobject release after a failed add
Cen Zhang <zzzccc427@gmail.com>
ocfs2/cluster: unlink socket containers before releasing resources
Cen Zhang <zzzccc427@gmail.com>
ocfs2: stop recovery before shutting down local allocators
Cen Zhang <zzzccc427@gmail.com>
ocfs2/dlm: serialize migration MLE cleanup on failure
Cen Zhang <zzzccc427@gmail.com>
ocfs2: keep locking_state within the cluster connection lifetime
Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
fat: hold truncate_lock in fat_write_failed()
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: do not read the entry array of an empty xattr block
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: do not index before the entry array when dividing an empty bucket
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: do not read the entry array of an empty xattr bucket
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: find the xattr entry again after converting a block to a bucket
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: find the xattr entry again after defragmenting a bucket
Andrew Morton <akpm@linux-foundation.org>
openrisc: export __mulsi3 for modules
T.J. Mercier <tjmercier@google.com>
mm: memcontrol: fix NULL pointer deref and UAF from high_work_func() on dying memcg
Mike Rapoport (Microsoft) <rppt@kernel.org>
mm/cma: accept memory of CMA areas reserved at a fixed address
Mike Rapoport (Microsoft) <rppt@kernel.org>
mm/cma: accept memory of multi-range CMA areas
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/vma: update VMA iterator state on error in new VMA merge
Yafang Shao <laoar.shao@gmail.com>
mm/migrate: snapshot the source nid before the misplaced migration
Hungyu Lin <dennylin0707@gmail.com>
mm/migrate: untag addresses when querying page nodes
Chris Down <chris@chrisdown.name>
mm: make swapoff interruptible when unusing mms/shmem
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: hold damon_sysfs_lock in target_metric_store()
Hengyu Liang <hengyul@cs.unc.edu>
fs/proc/task_mmu: return -ENOTTY for unknown pagemap ioctls
Samarth Narang <samarth.colleges@gmail.com>
mm/ksm: keep soft-dirty when merging a page
Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
mm/page_alloc: mark pages freed by __free_pages_core() as not tagged
Li Zhe <lizhe.67@bytedance.com>
mm/hugetlb: fix mremap deadlock when PMD sharing is possible
Li Zhe <lizhe.67@bytedance.com>
mm/hugetlb: fix mremap move length truncation
Hungyu Lin <dennylin0707@gmail.com>
mm/page-writeback: avoid 32-bit overflow in dirty threshold shares
Kyle Zeng <kylebot@openai.com>
mm/khugepaged: flush deferred unmaps before dropping a failed folio
Babu Moger <babu.moger@amd.com>
x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot
Babu Moger <babu.moger@amd.com>
x86/resctrl: Correct ABMC counter ID field width
Mohit Sharma <mohit.sharma@oss.qualcomm.com>
ASoC: qcom: q6apm: Guard callbacks until probe data is ready
Michael McAllister <me@michaelmcallister.org>
Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
Valentin Kindschi <valentin.kindschi@fiveco.ch>
Bluetooth: hci_sync: pause advertising for the scan address update
Valentin Kindschi <valentin.kindschi@fiveco.ch>
Bluetooth: hci_sync: re-enable legacy advertising on resume
Zack Rusin <zack.rusin@broadcom.com>
x86/vmware: Fix i386 high-bandwidth hypercall arguments
Yingjie Wang <1075151112@qq.com>
ipv6: reject wrapped temporary address preferred lifetimes
Sean Christopherson <seanjc@google.com>
KVM: x86: Unconditionally reset MMU context when emulating INIT
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Cap number of parent PTEs per SP at 1000 (the arbitrary rmap limit)
Sean Christopherson <seanjc@google.com>
KVM: nVMX: Process each host MSR entry at most once when unwinding failed VM-Entry
Sean Christopherson <seanjc@google.com>
KVM: x86: Conditionally resched when restarting REP string emulation
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Conditionally resched when retrying gPTE walk on A/D update failure
Daejun Park <daejun7.park@samsung.com>
nvme: unregister when pr_register() is given a zero new key
Vas Zayarskiy <contact@vasily.cc>
hwmon: (aquacomputer_d5next) Avoid truncating scaled sensor readings
Guenter Roeck <linux@roeck-us.net>
hwmon: (sht4x) Convert update_interval to jiffies in pending data check
Guenter Roeck <linux@roeck-us.net>
hwmon: (coretemp) Check for NULL platform device in hotplug callbacks
Baek Kyu, Kim <pocj8ur4in@gmail.com>
hwmon: (gpio-fan) Update the speed cache before dropping the PM reference
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus) Fix return value check from thermal zone registration
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus) Release devres allocated memory after devm_thermal_of_zone_register error
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus) Check return value from pmbus_thermal_add_sensor()
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus/q54sj108a2) Add missing NULL pointer check
Guenter Roeck <linux@roeck-us.net>
hwmon: (peci/dimmtemp) Fix devres leak and UAF on concurrent unbind
Guenter Roeck <linux@roeck-us.net>
hwmon: (nct6683) Fix incorrect struct cast in show_pwm() and store_pwm()
Guenter Roeck <linux@roeck-us.net>
hwmon: (lm87) Fix drvdata type confusion in vrm_show() and vrm_store()
Guenter Roeck <linux@roeck-us.net>
hwmon: (hp-wmi-sensors) Fix unbounded loops in scale_numeric_sensor()
Guenter Roeck <linux@roeck-us.net>
hwmon: (hp-wmi-sensors) Avoid global struct mutation
Guenter Roeck <linux@roeck-us.net>
hwmon: (asus_wmi_sensors) Avoid global struct mutation
Guenter Roeck <linux@roeck-us.net>
hwmon: (aquacomputer_d5next) Check maxcollection when probing AQUAERO devices
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: do not discard pending alarms on disable
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: balance regulator state
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: enable IRQ processing when regulator is already enabled
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: defer probe when IRQs are unavailable
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: fix be16 handling
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: fix off-by-one in command mode retry loop
Javier Carrasco <javier.carrasco.cruz@gmail.com>
hwmon: chipcap2: fix command error diagnostics
Jiale Yao <yaojiale02@163.com>
hwmon: (aquacomputer_d5next) reject short status reports
Baek Kyu, Kim <pocj8ur4in@gmail.com>
hwmon: (corsair-cpro) Cache fan target only after a successful command
Xia Yan <yana06070@163.com>
veth: keep carrier off when resizing channels with a down peer
Fang Xieyan <fangxy@xiaopeng.com>
vringh: reject empty / undersized indirect descriptor tables
Fang Xieyan <fangxy@xiaopeng.com>
vringh: bound top-level re-entry into indirect tables
Tal Zussman <tz2294@columbia.edu>
vhost-vdpa: fix pinned page leak in vhost_vdpa_pa_map() error path
Qihang <q.h.hack.winter@gmail.com>
cipso: fix optlen corruption in cipso_v4_delopt()
Maíra Canal <mcanal@igalia.com>
drm/v3d: Widen cache_clean_lock over the whole L2TCACTL sequence
Jose Maria Casanova Crespo <jmcasanova@igalia.com>
drm/v3d: Initialize timedout_batches when running a CSD job
Daejun Park <daejun7.park@samsung.com>
xfs: don't skip free extents of the longest length in a whole-AG FITRIM
Daejun Park <daejun7.park@samsung.com>
xfs: don't skip free extents in later batches of a whole-AG FITRIM
Hungyu Lin <dennylin0707@gmail.com>
ext2: preserve completed DIO bytes when buffered fallback fails
David Hildenbrand (Arm) <david@kernel.org>
mm/filemap: finish fault cleanup before dropping the fault lock
Josef Bacik <josef@toxicpanda.com>
mm/filemap: don't lose a folio lock wakeup to a signal
Josef Bacik <josef@toxicpanda.com>
mm/memfd: make f_pos accesses atomic
Josef Bacik <josef@toxicpanda.com>
mm/mglru: don't use stack pointers when walking PUD and PMD tables
David Hildenbrand (Arm) <david@kernel.org>
mm/shmem: fix truncation of files containing only swapin-error markers
David Hildenbrand (Arm) <david@kernel.org>
mm/shmem: fix truncate loop after boundary swapin failure
David Hildenbrand (Arm) <david@kernel.org>
mm/shmem: fix truncate hang in large swap entry
David Hildenbrand (Arm) <david@kernel.org>
mm/shmem: rescan after nonuniform folio splitting
David Hildenbrand (Arm) <david@kernel.org>
mm/shmem: discard whole new large folios on fallocate rollback
Chris Mason <mason@kernel.org>
mm/shmem: preserve data in clean folios when splitting fails
Chris Mason <mason@kernel.org>
mm/shmem: stop retrying folios that cannot be split
Josef Bacik <josef@toxicpanda.com>
tmpfs: preserve explicitly disabled quota limits
Josef Bacik <josef@toxicpanda.com>
tmpfs: keep the quota soft limits of an unused id
Chris Mason <mason@kernel.org>
mm/mempolicy: charge shared policy nodes
Ian Bridges <icb@fastmail.org>
ksmbd: grant a POSIX ACL group entry only to the group's members
Federico Musto <federico@rimpianto.com>
net: atl1c: drop oversized RX frames instead of panicking
Vidya Srinivas <vidya.srinivas@intel.com>
drm/i915/display: Single scaler per pipe on WCL
Lu Yao <yaolu@kylinos.cn>
drm/i915/gem: Reset err for each fence entry
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Don't clip plane state destination rectangle
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Fix SFF and CFF CTL register bit definitions
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Disable linked plane sel fetch as well
Jouni Högander <jouni.hogander@intel.com>
drm/i915/display: Add enabled pipe planes into state for selective fetch
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Clear selective fetch area when duplicating plane state
Breno Leitao <leitao@debian.org>
x86/bugs: Select the BHI mitigation based on the attack vector properly
Miguel Ojeda <ojeda@kernel.org>
rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`
Ian Bridges <icb@fastmail.org>
ksmbd: require DELETE access for delete-on-close opens
Jamal Hadi Salim <jhs@mojatatu.com>
bpf: Fix skb_pull() BUG in __bpf_redirect_neigh()
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: hwdep: Serialize DSP load requests
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: usx2y: Initialize idle URBs before submitting streams
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: us122l: Fix NULL dereference at hwdep open and release
YuanZhe Liu <25031212351@stu.xidian.edu.cn>
ALSA: us122l: Add missing NULL check in usb_stream_hwdep_mmap()
Evanshenf <archwse@gmail.com>
drm/loongson: Handle buffer mapping failures when clearing a BO
Evanshenf <archwse@gmail.com>
drm/loongson: Fix double free on BO initialization failure
Evanshenf <archwse@gmail.com>
drm/loongson: Fix framebuffer selection in async cursor updates
Shao Mingyin <shao.mingyin@zte.com.cn>
scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store
Yuanhe Shu <xiangzao@linux.alibaba.com>
scsi: target: Verify the iSCSI ISID is null-terminated
Yingjie Wang <x-professor@outlook.com>
scsi: bsg: Report synchronous data copyback failures
Yu Zhang <yuz08559@gmail.com>
ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked
guolingxing <guolingxing@tju.edu.cn>
btrfs: sysfs: restore NOFS context on early return in btrfs_sysfs_add_block_group_type()
Masafumi Suzuki <shengshilingmu97@gmail.com>
sctp: account for chunk padding in sctp_init_cause()
Lucas Tanure <lucas.tanure@neat.no>
drm/vc4: hdmi: enable scrambling before the TMDS clock starts
Lucas Tanure <lucas.tanure@neat.no>
drm/vc4: hdmi: always cancel the scrambling work synchronously
Dom Cobley <popcornmix@gmail.com>
drm/vc4: hdmi: power down the BCM2712 PHY when the output is disabled
Zhou Qiuyue <n0ps1edzz@gmail.com>
ipv6: raw: fix use-after-free in rawv6_send_hdrinc()
Franck Baur <franck.baur.67@gmail.com>
net: jme: keep RX MAC clock enabled for WoL
Sven Eckelmann <sven@narfation.org>
batman-adv: stop originator purge worker before freeing TT
Sven Eckelmann <sven@narfation.org>
batman-adv: fix skb leak when hard_iface is being released
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: initialize orig_node of unfilled candidate slots
Kyle Zeng <kylebot@openai.com>
batman-adv: mcast: validate tracker padding before forwarding
Chengfeng Ye <nicoyip.dev@gmail.com>
batman-adv: Close OGM aggregation before transmission
Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
9p: don't decrement a server-owned zero nlink
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
9p/xen: validate the response size from the backend
Yu Zhang <yuz08559@gmail.com>
scsi: target: Fix demo-mode dynamic ACL dev-entry UAF vs LUN teardown
Andrew Luebke <andrew.luebke@gmail.com>
scsi: aic79xx: Fix NULL pointer dereference in device reset
Imre Kaloz <kaloz@kernel.org>
scsi: aic7xxx: Use default settings on the SGI O2 onboard controllers
Fourie Zhang <fouriezhang@tencent.com>
xfrm4: use a full socket for local errors
Toke Høiland-Jørgensen <toke@toke.dk>
wifi: mac80211: reinstate IEEE80211_TX_CTL_AMPDU flag in ieee80211_tx_prep_agg()
Maíra Canal <mcanal@igalia.com>
drm/vc4: Drop the BO reservations outside of job_lock
Maíra Canal <mcanal@igalia.com>
drm/vc4: Publish the output fence outside of job_lock
Zijing Yin <yzjaurora@gmail.com>
wifi: cfg80211: fix out-of-bounds read in valid_rule()
Alex Kazinsky <a.kazinsky@ideco.ru>
wifi: rsi: Skip TX aggregation setup for non-QoS frames
Jason Perlow <jperlow@gmail.com>
wifi: brcmfmac: map msgbuf RX packet IDs bidirectional
Weigang He <geoffreyhe2@gmail.com>
wifi: mac80211: reload TDLS header pointer after skb_linearize()
André Draszik <andre.draszik@linaro.org>
drm/drm_crtc: ensure dma_fence_ops remain valid during device unbind
Devin Wittmayer <lucid_duck@justthetip.ca>
drm/panic: Fix kmsg screen hang on a long log line
Sabrina Dubroca <sd@queasysnail.net>
xfrm: espintcp: reorder operations within espintcp_init_sk
Qihang <q.h.hack.winter@gmail.com>
xfrm: interface: validate the IP header on xmit
Hyungjung Joo <jhj140711@gmail.com>
net/9p/usbg: clear stale client pointer on close
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: remove bogus context initialization in alloc_requests
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: fix out_req buffer leak in disable_usb9pfs
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: call disable_usb9pfs() from usb9pfs_disable()
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: always reset completion when disconnecting
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: set client to Disconnected on usb9pfs_disable
Michael Grzeschik <mgr@kernel.org>
net/9p/usbg: also disable endpoints on p9_usbg_close
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/9p/usbg: Fix use-after-free in disable_usb9pfs()
Zhao Zhang <zzhan461@ucr.edu>
9p: fix caches_show() out-of-bounds write
Yifei Gao <gyf161023@gmail.com>
9p/xen: fix refcount leak in p9_xen_response() on wrong tag
Michael Bommarito <michael.bommarito@gmail.com>
9p/trans_virtio: reject mount tags longer than NAME_MAX at probe
Chengfeng Ye <nicoyip.dev@gmail.com>
net/9p/usbg: clear stale request context after abort
Chengfeng Ye <nicoyip.dev@gmail.com>
xfrm: retry inexact policy lookup after node reinsertion
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/9p/usbg: fix prefix matching in device lookup
Christian Brauner <brauner@kernel.org>
ns: don't add init_ipc_ns and init_net without namespace support
Noam D. Eliyahu <noam.d.eliyahu@gmail.com>
tg3: Invert restart quirk logic to restrict SNP power-down bypass
Zhiling Zou <zhilinz@nebusec.ai>
ipmr: drop packets with unknown ingress VIF
Ido Schimmel <idosch@nvidia.com>
ipmr, ip6mr: validate packets injected into the register vif on xmit
Peng Wang <peng_wang@linux.alibaba.com>
tick/nohz: Reevaluate the tick for kicks flushed outside hardirq
Hungyu Lin <dennylin0707@gmail.com>
posix-timers: Accept NULL clock_getres() output in stubs
Yingjie Wang <x-professor@outlook.com>
scsi: handle out-of-range SG_SET_TIMEOUT values
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Validate request_len before accessing request
Daeho Jeong <daehojeong@google.com>
f2fs: don't use truncate_inode_pages_final() on live inodes
Sahaj Chaudhari <sahaj123.sc@gmail.com>
gpio: pca953x: Preserve wakeup accounting on parent IRQ failure
Henry Martin <bsdhenrymartin@gmail.com>
rds: fix out-of-bounds conn_path walks via handshake exthdrs
Yun Zhou <yun.zhou@windriver.com>
net: erspan: set lltx to avoid sch_direct_xmit deadlock
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Add the bucket size to expr_field_str()
Guixin Liu <kanie@linux.alibaba.com>
cxl/events: Test CME counter expiry with equality, not bitwise AND
Bui Viet Dung <dungvn2345@gmail.com>
Bluetooth: selftest: Pin module for selftest debugfs file operations
Guangshuo Li <lgs201920130244@gmail.com>
mfd: ab8500: Fix child device leaks on probe failure
Andrey Misiurov <andrey.misyrov@gmail.com>
fbdev: core: Initialize modelist in framebuffer_alloc()
Breno Leitao <leitao@debian.org>
ACPI: APEI: accumulate the queued flag across error sections
Ridong Chen <chenridong@xiaomi.com>
mm/page_counter: avoid integer overflow in effective_protection()
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: timers: Compute an offset-applied CVAL from the current count
Jiayuan Chen <jiayuan.chen@linux.dev>
mm/memcontrol: fix data-race on reading jiffies_64
Priyank Rathod <rathodpriyank@google.com>
PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing
Kazuki Hanai <hnkz.64@gmail.com>
media: mediatek: jpeg: Avoid context access after job finish
Rupesh Majhi <zoone.rupert@gmail.com>
iio: pressure: dps310: fix CFG_REG bit definitions
Ridham Khurana <khurana.ridham222@gmail.com>
hwmon: (lm70) Fix rounding of negative temperatures
Ruoyu Wang <ruoyuw560@gmail.com>
media: adv748x: Fix endpoint reference leaks on probe failure
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: require two-byte Cypress type 04 records
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: fix WB offset and gain register field masking
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: read sysfs_filter->sz_range only once
Eric Sandeen <sandeen@redhat.com>
devtmpfs: restore mount option reconfiguration on get_tree
Ben Dooks <ben.dooks@codethink.co.uk>
devtmpfs: make 'devtmpfs_context_ops' static
Kiryl Shutsemau (Meta) <kas@kernel.org>
mm: page_alloc: make defrag_mode retries follow the promoted order
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: give the sysctl timer limits in milliseconds
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: swap the AX.25 connection of a neighbour under a lock
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: drop the neighbour reference once when a cleared socket is closed
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: report a timed out call to connect()
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: hold the socket a received frame is delivered to
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: hold the listener while a Call Request is queued on it
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: only update the BPQ extension flag on circuit set-up frames
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: disconnect sockets under their lock when a device goes down
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: don't send part of a message that cannot be fragmented whole
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: check the window size given by the peer
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: drop a frame received with a TTL of 0
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: keep the selected route when a route of a node is removed
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: return the peer node in the address given by recvmsg()
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: don't give the same circuit ID to two sockets
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: give a frame back intact when it cannot be delivered
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: use the more flag of each frame taken from the resequencing queue
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: don't leak frames in nr_route_frame()
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: don't convert the maximum number of tries to jiffies
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't let connect() find its own socket when calling the same station
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: let a socket connect again after a failed or ended connection
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: keep the window below 8 when a socket goes back to modulo 8
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: make 16 the smallest maximum_packet_length of a port
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't leave half a message on a connection when fragmenting fails
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: free the copy of an IP packet that ax25_send_frame() turned down
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't test the socket flags of a connection that has no socket
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: put an incoming connection on the listener's queue once it is set up
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: free the old digipeater path of a listed socket under ax25_list_lock
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't copy an uninitialised address to recvmsg()'s caller
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't take a reference on a gone device in ax25_accept()
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't build a frame header from an uninitialised digipeater list
Bernard Pidoux <bernard.f6bvp@gmail.com>
6pack: restart the transmit queue when the interface is opened
Bernard Pidoux <bernard.f6bvp@gmail.com>
mkiss: restart the transmit queue when the interface is opened
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: free a closed socket when its device goes down
Bernard Pidoux <bernard.f6bvp@gmail.com>
ax25: don't create a second connection for a link on an incoming SABM
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: don't give the same LCI to two calls placed at the same time
Bernard Pidoux <bernard.f6bvp@gmail.com>
netrom: ignore a BPQ transport timeout below the sysctl minimum
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: arm the neighbour timers with mod_timer()
Bernard Pidoux <bernard.f6bvp@gmail.com>
bpqether: fix truncated /proc/net/bpqether on partial reads
Bernard Pidoux <bernard.f6bvp@gmail.com>
bpqether: leave the Ethernet device's queue and counters alone
Bernard Pidoux <bernard.f6bvp@gmail.com>
mkiss: don't use a tty write error as a byte count
Bernard Pidoux <bernard.f6bvp@gmail.com>
mkiss: size the frame buffers for worst-case KISS escaping
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Force UVC version for Avermedia GC515
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Add autosuspend quirk for AVerMedia Live Gamer HD 2
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: mac80211: queue frames while off-channel
Denis Pauk <pauk.denis@gmail.com>
hwmon: (nct6775) Add ASUS X870/W480 to WMI monitoring list
Maximilian Luz <luzmaximilian@gmail.com>
hwmon: (nct6775) Add ASUS ROG STRIX X870E-H GAMING WIFI7
Yi Cong <yicong@kylinos.cn>
wifi: mt76: mt792x: fix negative errno truncation in offload capability
Marek Vasut <marek.vasut+renesas@mailbox.org>
PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes
Christian Borntraeger <borntraeger@linux.ibm.com>
s390/vmcp: Initialize full session info to zero
Jeff Layton <jlayton@kernel.org>
nfsd: shorten extack string returned with dodgy listener
Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@linux.microsoft.com>
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
Rosen Penev <rosenp@gmail.com>
net: bgmac: enable interrupts only after NAPI is ready
Rosen Penev <rosenp@gmail.com>
mtd: rawnand: ndfc: use devm_platform_ioremap_resource()
Rosen Penev <rosenp@gmail.com>
mtd: rawnand: ndfc: fix gcc uninitialized var
Arnd Bergmann <arnd@arndb.de>
mtd: rawnand: ndfc: add CONFIG_OF dependency
Rosen Penev <rosenp@gmail.com>
mtd: rawnand: ndfc: use ioread32be/iowrite32be and allow COMPILE_TEST
Eric Biggers <ebiggers@kernel.org>
raid6: add missing vzeroupper to AVX2 code
Diego Oliva <diego@bynar.io>
smb: client: reject FIND data areas that run past the received response
Paulo Alcantara <pc@manguebit.org>
smb: client: reclaim credits for decrypted reads with no matching mid
Darrick J. Wong <djwong@kernel.org>
xfs: forcibly reset quota timers when upgrading to bigtime during repair
Darrick J. Wong <djwong@kernel.org>
xfs: reinitialize dquot block if non-first dquot can't load
Qingfang Deng <qingfang.deng@linux.dev>
pppoe: delete session hash entries by pointer match
Liz Fong-Jones <lizf@honeycomb.io>
writeback: keep cleanup_offline_cgwb()'s scan out of syncs
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Accept requests to retain immutable autonomous selection
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Propagate errors from cross-CPU FFH calls
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Validate FFH register fields before hardware access
Ping-Ke Shih <pkshih@realtek.com>
wifi: rtw88: TX report with long timeout for non-PCIE devices
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
FUJITA Tomonori <fujita.tomonori@gmail.com>
rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
SJ Park <sj@kernel.org>
mm/damon/core: filter out damos address filter-split failed region
SJ Park <sj@kernel.org>
mm/damon/core: remove unreachable damos charge_{target,addr}_from
SJ Park <sj@kernel.org>
mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total
SJ Park <sj@kernel.org>
mm/damon/core: skip applying scheme if region split for quota fails
Eric Biggers <ebiggers@kernel.org>
raid6: add missing vzeroupper to AVX-512 code
Eric Biggers <ebiggers@kernel.org>
xor: add missing vzeroupper to AVX code
Eric Biggers <ebiggers@kernel.org>
fsverity: Explicitly require FMODE_READ to retrieve hashes
Yuansheng Yang <0xbeac@gmail.com>
io_uring/rsrc: hold uring_lock across index-alloc put_user
Jens Axboe <axboe@kernel.dk>
io_uring/poll: don't poll a writer for urgent data
Jens Axboe <axboe@kernel.dk>
io_uring/poll: don't poll a writer for a read side hangup
Shang En Sim <sim@shangen.org>
io_uring/poll: cancel all matching requests in one pass
Shang En Sim <sim@shangen.org>
io_uring/cancel: count all requests that a CANCEL_ALL cancels
Shakeel Butt <shakeel.butt@linux.dev>
io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread
Shuai Liu <847807867@qq.com>
io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit
Jens Axboe <axboe@kernel.dk>
io_uring/sqpoll: don't attach to a thread that is canceling
Chris Mason <mason@kernel.org>
io_uring/cancel: drop sqd->lock while SQPOLL waits
Til Kaiser <mail@tk154.de>
mlxsw: Initialize register query payloads
Janne Grunau <j@jannau.net>
wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload
Gael Blivet <gael.blivet@gmail.com>
ksmbd: look up stream size by exact xattr name
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Don't assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
Xiaoyao Li <xiaoyao.li@intel.com>
KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
Shivank Garg <shivankg@amd.com>
KVM: guest_memfd: take the invalidate lock when unbinding a dying file
Sean Christopherson <seanjc@google.com>
KVM: Only bind memslot to guest_memfd instance for CREATE operations
Sean Christopherson <seanjc@google.com>
KVM: Harden and prepare for modifying existing guest_memfd memslots
Sean Christopherson <seanjc@google.com>
KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
Chuck Lever <chuck.lever@oracle.com>
NFSD: Complete a cld upcall when copying its reply fails
Chuck Lever <chuck.lever@oracle.com>
NFSD: Complete a cld upcall when the daemon closes the pipe
Chuck Lever <chuck.lever@oracle.com>
NFSD: Move the cld upcall message out of the caller's stack frame
Chuck Lever <chuck.lever@oracle.com>
NFSD: Send a meaningful CB_RECALL_ANY keep count
Chuck Lever <chuck.lever@oracle.com>
NFSD: Count the delegations held by each client
Mike Snitzer <snitzer@kernel.org>
NFS/localio: detect a short read or write before the iterator has moved
Jeff Layton <jlayton@kernel.org>
NFSD: stop registering with rpcbind after a failure in listener_set
Jeff Layton <jlayton@kernel.org>
SUNRPC: report local rpcbind calls that get no answer
Jeff Layton <jlayton@kernel.org>
NFSD: report listener creation failures through extack
Jeff Layton <jlayton@kernel.org>
nfsd: don't offer flexfiles layouts when NFSv3 isn't being served
Christoph Hellwig <hch@lst.de>
exportfs,nfsd: rework checking for layout-based block device access support
Christoph Hellwig <hch@lst.de>
exportfs: split out the ops for layout-based block device access
André Almeida <andrealmeid@igalia.com>
exportfs: Complete kernel-doc for struct export_operations
Sergey Bashirov <sergeybashirov@gmail.com>
NFSD/blocklayout: Extract extent mapping from proc_layoutget
Chuck Lever <chuck.lever@oracle.com>
NFSD: map fh_verify() status codes for NFS_ACLv2 replies
Chuck Lever <chuck.lever@oracle.com>
NFSD: Move version-specific ACCESS maps into per-version code
Chuck Lever <chuck.lever@oracle.com>
NFSD: Replace nfsd_write()'s "stable" argument with "iocb_flags"
Bharath SM <bharathsm@microsoft.com>
smb: align durable reconnect v2 context to 8 byte boundary
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
smb: client: bound POSIX lock data area by response length
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
Darrick J. Wong <djwong@kernel.org>
xfs: improve dirent bounds checking in scrub and repair
Darrick J. Wong <djwong@kernel.org>
xfs: refactor directory data block walking loops in scrub
Darrick J. Wong <djwong@kernel.org>
xfs: check for buffer overruns when examining local/remote xattr entries
Darrick J. Wong <djwong@kernel.org>
xfs: break out xattr entry checks into separate functions
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
smb: client: validate SMB1 EA list bounds before parsing
Zhaoyang Huang <zhaoyang.huang@unisoc.com>
mm: remove '!root_reclaim' checking in should_abort_scan()
Paulo Alcantara <pc@manguebit.org>
smb: client: require stable pages for SMB compression
Abdifatah Suruur <suruurism@gmail.com>
smb: client: reject short SESSION_SETUP responses
Diego Oliva <diego@bynar.io>
smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
Diego Oliva <diego@bynar.io>
smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb: move some duplicate struct definitions to common/fscc.h
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb: move list of FileSystemAttributes to common/fscc.h
ZhangGuoDong <zhangguodong@kylinos.cn>
smb: move some duplicate definitions to common/smb2pdu.h
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb: move create_durable_rsp_v2 to common/smb2pdu.h
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb: move create_durable_req_v2 to common/smb2pdu.h
ZhangGuoDong <zhangguodong@kylinos.cn>
smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h
Eduard Zateev <hackerowskiy@gmail.com>
smb: client: hold server info until cifsd exits
Thomas Huth <thuth@redhat.com>
smb: client: Avoid leaking sensitive data to the heap in connect.c
Jinwang Li <jinwang.li@oss.qualcomm.com>
Bluetooth: L2CAP: Ignore connection responses with wrong ident
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Only accept connection responses to outstanding requests
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Reject signalling responses in invalid states
Eric Biggers <ebiggers@kernel.org>
fsverity: Tell LSMs about signature only after verity is enabled
Eric Biggers <ebiggers@kernel.org>
crypto: sa2ul - Fix HMAC key preparation
Andrew Stellman <astellman@stellman-greene.com>
nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()
Chris Mason <mason@kernel.org>
backing-file: always end a queued write
Ashok Raj <ashok.raj@oss.qualcomm.com>
cxl/features: Ensure that count is set before access to ent[] __counted_by()
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: x86: hdmi: fix chmap array missing terminator entry
Abdifatah Suruur <suruurism@gmail.com>
smb: client: validate the data area in SMB2_read()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.rst | 97 +--
Documentation/admin-guide/kernel-parameters.txt | 109 +++
Documentation/filesystems/fsverity.rst | 3 +
Documentation/filesystems/overlayfs.rst | 3 +-
Documentation/filesystems/resctrl.rst | 87 +-
Documentation/hwmon/coretemp.rst | 3 +
MAINTAINERS | 2 +-
Makefile | 4 +-
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/sdei.h | 3 +-
arch/arm64/include/asm/suspend.h | 2 +-
arch/arm64/kernel/entry-common.c | 40 +-
arch/arm64/kernel/machine_kexec_file.c | 2 +
arch/arm64/kernel/process.c | 17 +
arch/arm64/kernel/sdei.c | 59 +-
arch/arm64/kernel/topology.c | 13 +-
arch/arm64/kvm/arch_timer.c | 27 +-
arch/arm64/kvm/arm.c | 4 +-
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 28 +-
arch/arm64/kvm/hyp/vhe/switch.c | 11 +-
arch/arm64/kvm/mmu.c | 4 +-
arch/arm64/kvm/nested.c | 10 +
arch/arm64/kvm/ptdump.c | 50 +-
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 10 +
arch/arm64/kvm/vgic/vgic.c | 11 +-
arch/arm64/mm/mmap.c | 4 +-
arch/arm64/mm/proc.S | 8 +
arch/loongarch/include/asm/hw_breakpoint.h | 4 +-
arch/loongarch/include/asm/loongarch.h | 3 +
arch/loongarch/include/asm/processor.h | 1 +
arch/loongarch/include/asm/switch_to.h | 2 +-
arch/loongarch/kernel/hw_breakpoint.c | 39 +-
arch/loongarch/kernel/numa.c | 8 +-
arch/m68k/68000/entry.S | 24 +-
arch/m68k/coldfire/entry.S | 3 +-
arch/mips/mm/cex-gen.S | 16 +
arch/mips/pci/ops-mace.c | 26 +-
arch/mips/pci/pci-ip32.c | 9 +-
arch/mips/sgi-ip32/ip32-irq.c | 45 +-
arch/openrisc/kernel/or32_ksyms.c | 1 +
arch/powerpc/net/bpf_jit.h | 7 +
arch/powerpc/net/bpf_jit_comp.c | 35 +-
arch/powerpc/platforms/pseries/iommu.c | 67 +-
arch/s390/pci/pci_irq.c | 26 +-
arch/x86/boot/startup/sme.c | 2 +-
arch/x86/include/asm/vmware.h | 24 +-
arch/x86/include/asm/xor_avx.h | 4 +
arch/x86/kernel/acpi/cppc.c | 15 +
arch/x86/kernel/cpu/bugs.c | 12 +-
arch/x86/kernel/cpu/resctrl/internal.h | 4 +-
arch/x86/kernel/cpu/resctrl/monitor.c | 4 +-
arch/x86/kernel/nmi.c | 8 +
arch/x86/kernel/x86_init.c | 2 +-
arch/x86/kvm/mmu/mmu.c | 10 +
arch/x86/kvm/mmu/paging_tmpl.h | 11 +-
arch/x86/kvm/svm/nested.c | 1 +
arch/x86/kvm/vmx/nested.c | 1 +
arch/x86/kvm/vmx/tdx.c | 42 +-
arch/x86/kvm/x86.c | 33 +-
arch/x86/mm/tlb.c | 16 +-
block/blk-iocost.c | 3 +
block/blk-mq.c | 17 +-
block/bsg.c | 5 +-
block/ioctl.c | 4 +-
drivers/acpi/apei/ghes.c | 6 +-
drivers/acpi/cppc_acpi.c | 58 +-
drivers/acpi/riscv/cppc.c | 26 +-
drivers/ata/Kconfig | 7 -
drivers/ata/Makefile | 1 -
drivers/ata/libata-eh.c | 6 +-
drivers/ata/libata-pmp.c | 16 +-
drivers/ata/libata-scsi.c | 25 +
drivers/ata/libata.h | 4 +-
drivers/ata/sata_inic162x.c | 902 ---------------------
drivers/base/devtmpfs.c | 108 ++-
drivers/block/ublk_drv.c | 60 +-
drivers/block/virtio_blk.c | 2 +-
drivers/bluetooth/btqca.c | 3 +-
drivers/char/hw_random/virtio-rng.c | 7 +
drivers/char/tpm/tpm2-cmd.c | 3 +-
drivers/clk/nuvoton/clk-ma35d1.c | 7 +-
drivers/cpufreq/amd-pstate.c | 25 +-
drivers/crypto/omap-sham.c | 28 +-
drivers/crypto/sa2ul.c | 119 +--
drivers/cxl/core/features.c | 2 +-
drivers/cxl/core/mbox.c | 8 +-
drivers/cxl/core/port.c | 60 +-
drivers/dma/qcom/bam_dma.c | 10 +-
drivers/gpio/gpio-pca953x.c | 7 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 16 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 +
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 1 -
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 +-
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 +-
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 +-
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +
drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 13 +-
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/navi10_ih.c | 41 +-
.../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 3 +-
.../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 3 +
.../display/dc/link/protocols/link_dp_capability.c | 6 +-
.../gpu/drm/amd/display/dc/optc/dcn20/dcn20_optc.c | 7 +
.../amd/display/dc/resource/dcn32/dcn32_resource.c | 15 +-
.../drm/amd/display/modules/freesync/freesync.c | 6 +-
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 35 +-
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 +-
.../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 38 +-
drivers/gpu/drm/bridge/nwl-dsi.c | 17 +-
drivers/gpu/drm/display/drm_dp_helper.c | 3 +-
drivers/gpu/drm/drm_crtc.c | 15 +-
drivers/gpu/drm/drm_panic.c | 7 +-
drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 40 +-
.../gpu/drm/i915/display/intel_display_device.c | 5 +-
drivers/gpu/drm/i915/display/intel_plane.c | 11 +
drivers/gpu/drm/i915/display/intel_psr.c | 96 +--
drivers/gpu/drm/i915/display/intel_psr_regs.h | 4 +-
drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +-
drivers/gpu/drm/loongson/lsdc_gem.c | 14 +-
drivers/gpu/drm/loongson/lsdc_plane.c | 2 +-
drivers/gpu/drm/loongson/lsdc_ttm.c | 14 +-
drivers/gpu/drm/loongson/lsdc_ttm.h | 2 +-
drivers/gpu/drm/nouveau/nvkm/core/subdev.c | 1 +
.../gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c | 20 +
drivers/gpu/drm/v3d/v3d_gem.c | 5 +-
drivers/gpu/drm/v3d/v3d_sched.c | 2 +
drivers/gpu/drm/vc4/vc4_gem.c | 14 +-
drivers/gpu/drm/vc4/vc4_hdmi.c | 10 +-
drivers/gpu/drm/vc4/vc4_hdmi_phy.c | 5 +
drivers/hwmon/aquacomputer_d5next.c | 58 +-
drivers/hwmon/asus_wmi_sensors.c | 13 +-
drivers/hwmon/chipcap2.c | 53 +-
drivers/hwmon/coretemp.c | 27 +-
drivers/hwmon/corsair-cpro.c | 3 +-
drivers/hwmon/gpio-fan.c | 7 +-
drivers/hwmon/hp-wmi-sensors.c | 29 +-
drivers/hwmon/lm70.c | 8 +-
drivers/hwmon/lm87.c | 7 +-
drivers/hwmon/nct6683.c | 4 +-
drivers/hwmon/nct6775-platform.c | 24 +
drivers/hwmon/peci/dimmtemp.c | 21 +-
drivers/hwmon/pmbus/pmbus_core.c | 51 +-
drivers/hwmon/pmbus/q54sj108a2.c | 2 +
drivers/hwmon/sht4x.c | 4 +-
drivers/hwmon/tmp102.c | 8 +-
drivers/hwmon/tmp108.c | 8 +-
drivers/iio/adc/ad4080.c | 3 +-
drivers/iio/adc/ad7192.c | 2 +-
drivers/iio/dac/mcp4821.c | 7 +-
drivers/iio/light/adux1020.c | 4 +-
drivers/iio/light/apds9160.c | 7 +-
drivers/iio/light/apds9300.c | 4 +-
drivers/iio/light/apds9306.c | 3 +-
drivers/iio/light/apds9960.c | 4 +-
drivers/iio/light/bh1745.c | 3 +-
drivers/iio/light/cm3605.c | 4 +-
drivers/iio/light/gp2ap002.c | 4 +-
drivers/iio/light/isl29028.c | 43 +-
drivers/iio/light/ltr390.c | 3 +-
drivers/iio/light/ltr501.c | 7 +-
drivers/iio/light/opt4060.c | 2 +-
drivers/iio/light/rpr0521.c | 5 +-
drivers/iio/light/si1145.c | 4 +-
drivers/iio/light/st_uvis25_core.c | 5 +-
drivers/iio/light/stk3310.c | 5 +-
drivers/iio/light/tsl2563.c | 2 +-
drivers/iio/light/tsl2772.c | 5 +-
drivers/iio/light/veml6030.c | 4 +-
drivers/iio/light/vl6180.c | 2 +-
drivers/iio/pressure/dps310.c | 6 +-
drivers/iommu/amd/init.c | 41 +-
drivers/iommu/iommufd/io_pagetable.c | 2 +-
drivers/iommu/iommufd/iova_bitmap.c | 18 +-
drivers/iommu/virtio-iommu.c | 6 +-
drivers/irqchip/irq-renesas-rzv2h.c | 6 +-
drivers/media/common/cypress_firmware.c | 2 +
drivers/media/i2c/adv748x/adv748x-core.c | 13 +-
drivers/media/i2c/imx219.c | 88 +-
drivers/media/i2c/og01a1b.c | 97 +--
drivers/media/i2c/ov5647.c | 4 +
drivers/media/pci/intel/ipu6/ipu6-fw-isys.c | 88 +-
drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 4 +-
drivers/media/pci/intel/ipu6/ipu6-isys.c | 6 +-
drivers/media/pci/intel/ipu6/ipu6-isys.h | 5 +-
.../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 +-
.../media/platform/microchip/microchip-isc-base.c | 20 +-
.../media/platform/microchip/microchip-isc-regs.h | 16 +-
drivers/media/platform/microchip/microchip-isc.h | 4 +-
.../platform/microchip/microchip-sama5d2-isc.c | 20 +-
.../platform/microchip/microchip-sama7g5-isc.c | 20 +-
drivers/media/platform/qcom/iris/iris_core.h | 6 +
drivers/media/platform/qcom/iris/iris_probe.c | 62 +-
drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +-
drivers/media/platform/rockchip/rga/rga.c | 69 +-
drivers/media/platform/rockchip/rga/rga.h | 7 +-
drivers/media/rc/redrat3.c | 11 +-
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 2 +
drivers/media/usb/uvc/uvc_driver.c | 20 +
drivers/mfd/ab8500-core.c | 44 +-
drivers/mfd/twl-core.c | 25 +-
drivers/misc/fastrpc.c | 81 +-
drivers/mtd/nand/raw/Kconfig | 3 +-
drivers/mtd/nand/raw/ndfc.c | 41 +-
drivers/mtd/spi-nor/macronix.c | 2 +
drivers/net/can/dev/netlink.c | 4 +-
drivers/net/can/dev/skb.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 7 +-
drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 33 +
drivers/net/ethernet/broadcom/bgmac.c | 10 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 53 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 52 +-
drivers/net/ethernet/broadcom/tg3.c | 42 +-
drivers/net/ethernet/jme.c | 37 +-
drivers/net/ethernet/jme.h | 1 +
drivers/net/ethernet/mellanox/mlxsw/core.c | 4 +-
drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 4 +-
.../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +-
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 4 +-
drivers/net/hamradio/6pack.c | 6 +
drivers/net/hamradio/bpqether.c | 8 +-
drivers/net/hamradio/mkiss.c | 70 +-
drivers/net/ppp/pppoe.c | 22 +-
drivers/net/veth.c | 5 +-
drivers/net/vxlan/vxlan_core.c | 14 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 7 +
.../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 14 +
drivers/net/wireless/mediatek/mt76/mt76.h | 2 +
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +-
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 +
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 12 +-
drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +
drivers/net/wireless/realtek/rtw88/reg.h | 2 +
drivers/net/wireless/realtek/rtw88/tx.c | 9 +-
drivers/net/wireless/realtek/rtw88/tx.h | 3 +-
drivers/net/wireless/realtek/rtw88/usb.c | 68 +-
drivers/net/wireless/realtek/rtw88/usb.h | 5 +
drivers/net/wireless/rsi/rsi_91x_core.c | 2 +-
drivers/nvme/common/keyring.c | 1 +
drivers/nvme/host/core.c | 3 +-
drivers/nvme/host/pci.c | 2 +
drivers/nvme/host/pr.c | 8 +-
drivers/nvme/host/tcp.c | 196 ++++-
drivers/nvme/target/admin-cmd.c | 16 +-
drivers/nvme/target/configfs.c | 4 +-
drivers/nvme/target/core.c | 8 +-
drivers/nvme/target/nvmet.h | 8 +
drivers/nvme/target/rdma.c | 3 +-
drivers/nvme/target/tcp.c | 26 +-
drivers/nvmem/rockchip-otp.c | 24 +-
drivers/pci/controller/cadence/pcie-cadence-plat.c | 33 +-
drivers/pci/controller/dwc/pci-imx6.c | 2 +-
drivers/pci/controller/dwc/pcie-designware.c | 2 +
drivers/pci/controller/dwc/pcie-designware.h | 1 +
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 54 ++
drivers/pci/endpoint/functions/pci-epf-vntb.c | 69 +-
drivers/pci/pcie/aer.c | 23 +-
drivers/platform/x86/amd/pmf/core.c | 1 +
drivers/platform/x86/asus-wmi.c | 30 +-
drivers/platform/x86/intel/int3472/discrete.c | 53 +-
drivers/platform/x86/lenovo/Kconfig | 4 +-
drivers/platform/x86/lenovo/Makefile | 2 +-
.../x86/lenovo/{wmi-capdata01.c => wmi-capdata.c} | 142 ++--
.../x86/lenovo/{wmi-capdata01.h => wmi-capdata.h} | 10 +-
drivers/platform/x86/lenovo/wmi-other.c | 11 +-
drivers/power/supply/ltc2941-battery-gauge.c | 6 +-
drivers/ptp/ptp_sysfs.c | 6 +-
drivers/s390/char/vmcp.c | 4 +-
drivers/scsi/aic7xxx/aic79xx_core.c | 4 +-
drivers/scsi/aic7xxx/aic79xx_osm.h | 26 +-
drivers/scsi/aic7xxx/aic7xxx_core.c | 8 +-
drivers/scsi/aic7xxx/aic7xxx_pci.c | 20 +-
drivers/scsi/scsi_bsg.c | 6 +-
drivers/scsi/scsi_ioctl.c | 11 +-
drivers/soc/qcom/pmic_glink_altmode.c | 4 +-
drivers/spi/atmel-quadspi.c | 34 +-
drivers/spi/spi-cadence-xspi.c | 522 ++++++------
drivers/target/target_core_device.c | 18 +-
drivers/target/target_core_fabric_lib.c | 10 +
drivers/target/target_core_tpg.c | 10 +-
drivers/target/target_core_user.c | 5 +
drivers/tty/serial/sc16is7xx.c | 14 +-
drivers/ufs/core/ufs_bsg.c | 13 +
drivers/ufs/core/ufshcd.c | 48 +-
drivers/vdpa/solidrun/snet_ctrl.c | 3 +-
drivers/vdpa/vdpa_user/iova_domain.c | 11 +-
drivers/vfio/pci/vfio_pci_rdwr.c | 3 -
drivers/vhost/scsi.c | 7 +-
drivers/vhost/vdpa.c | 8 +-
drivers/vhost/vhost.c | 3 +-
drivers/vhost/vringh.c | 27 +-
drivers/vhost/vsock.c | 34 +-
drivers/video/fbdev/core/fb_info.c | 1 +
drivers/video/fbdev/core/fbcon_rotate.c | 3 +-
drivers/video/fbdev/nvidia/nvidia.c | 20 +-
drivers/video/fbdev/sh_mobile_lcdcfb.c | 34 +-
drivers/watchdog/hpwdt.c | 24 +-
drivers/xen/gntdev-dmabuf.c | 4 +-
fs/9p/v9fs.c | 16 +-
fs/9p/vfs_inode.c | 8 +
fs/backing-file.c | 5 +-
fs/btrfs/sysfs.c | 1 +
fs/buffer.c | 29 -
fs/ceph/addr.c | 6 +
fs/ceph/crypto.c | 8 +
fs/dcache.c | 4 +
fs/erofs/zdata.c | 11 +-
fs/exfat/file.c | 18 +-
fs/ext2/file.c | 3 +-
fs/ext2/inode.c | 13 +-
fs/f2fs/checkpoint.c | 13 +-
fs/f2fs/data.c | 25 +-
fs/f2fs/f2fs.h | 8 +-
fs/f2fs/file.c | 2 +-
fs/f2fs/gc.c | 2 +-
fs/f2fs/node.c | 71 +-
fs/f2fs/segment.c | 3 +-
fs/f2fs/super.c | 24 +
fs/fat/inode.c | 2 +
fs/fs-writeback.c | 13 +-
fs/fuse/virtio_fs.c | 59 +-
fs/gfs2/glops.c | 10 +-
fs/inode.c | 51 +-
fs/iomap/buffered-io.c | 3 +-
fs/iomap/direct-io.c | 56 +-
fs/nfs/callback_xdr.c | 7 +
fs/nfs/localio.c | 12 +-
fs/nfsd/blocklayout.c | 125 +--
fs/nfsd/export.c | 3 +-
fs/nfsd/nfs2acl.c | 64 +-
fs/nfsd/nfs3proc.c | 58 +-
fs/nfsd/nfs3xdr.c | 2 +
fs/nfsd/nfs4layouts.c | 31 +-
fs/nfsd/nfs4proc.c | 60 +-
fs/nfsd/nfs4recover.c | 49 +-
fs/nfsd/nfs4state.c | 21 +-
fs/nfsd/nfs4xdr.c | 2 +-
fs/nfsd/nfsctl.c | 56 +-
fs/nfsd/nfsproc.c | 2 +-
fs/nfsd/state.h | 2 +
fs/nfsd/vfs.c | 108 +--
fs/nfsd/vfs.h | 21 +-
fs/nfsd/xdr3.h | 2 +-
fs/notify/inotify/inotify_fsnotify.c | 2 +-
fs/ntfs3/xattr.c | 25 +-
fs/ocfs2/alloc.c | 20 +-
fs/ocfs2/cluster/tcp.c | 5 +-
fs/ocfs2/dcache.h | 5 +-
fs/ocfs2/dlm/dlmmaster.c | 70 +-
fs/ocfs2/dlmglue.c | 34 +-
fs/ocfs2/filecheck.c | 2 +
fs/ocfs2/journal.c | 15 +-
fs/ocfs2/journal.h | 1 +
fs/ocfs2/super.c | 3 +
fs/ocfs2/xattr.c | 120 ++-
fs/overlayfs/export.c | 4 +-
fs/overlayfs/inode.c | 8 +
fs/overlayfs/namei.c | 13 +-
fs/overlayfs/overlayfs.h | 2 +-
fs/overlayfs/super.c | 12 +-
fs/proc/task_mmu.c | 2 +-
fs/smb/client/cifsglob.h | 3 +
fs/smb/client/cifspdu.h | 253 +-----
fs/smb/client/cifsproto.h | 1 +
fs/smb/client/cifssmb.c | 65 +-
fs/smb/client/connect.c | 36 +-
fs/smb/client/inode.c | 8 +-
fs/smb/client/readdir.c | 68 +-
fs/smb/client/smb2misc.c | 15 +
fs/smb/client/smb2ops.c | 14 +-
fs/smb/client/smb2pdu.c | 57 +-
fs/smb/client/smb2pdu.h | 82 --
fs/smb/client/trace.h | 1 +
fs/smb/common/fscc.h | 157 ++++
fs/smb/common/smb2pdu.h | 230 +++++-
fs/smb/server/mgmt/tree_connect.c | 8 +
fs/smb/server/oplock.c | 8 +-
fs/smb/server/smb2ops.c | 6 +-
fs/smb/server/smb2pdu.c | 162 ++--
fs/smb/server/smb2pdu.h | 69 --
fs/smb/server/smb_common.h | 195 +----
fs/smb/server/smbacl.c | 5 +-
fs/smb/server/vfs.c | 6 +-
fs/smb/server/vfs.h | 2 +
fs/udf/balloc.c | 11 +-
fs/udf/inode.c | 42 +-
fs/udf/super.c | 80 +-
fs/udf/truncate.c | 7 +-
fs/verity/enable.c | 8 +
fs/verity/fsverity_private.h | 8 +
fs/verity/measure.c | 10 +
fs/verity/open.c | 9 +
fs/verity/read_metadata.c | 14 +-
fs/verity/signature.c | 55 +-
fs/xfs/libxfs/xfs_attr_leaf.c | 9 +-
fs/xfs/libxfs/xfs_bmap.c | 14 +-
fs/xfs/libxfs/xfs_bmap.h | 10 +-
fs/xfs/libxfs/xfs_btree.c | 4 +-
fs/xfs/scrub/attr.c | 102 ++-
fs/xfs/scrub/attr_repair.c | 18 +-
fs/xfs/scrub/dir.c | 110 ++-
fs/xfs/scrub/dir_repair.c | 100 ++-
fs/xfs/scrub/quota_repair.c | 33 +-
fs/xfs/scrub/xfarray.c | 69 +-
fs/xfs/xfs_aops.c | 2 +-
fs/xfs/xfs_discard.c | 26 +-
fs/xfs/xfs_export.c | 4 +-
fs/xfs/xfs_ioctl32.c | 4 +-
fs/xfs/xfs_iomap.c | 8 +
fs/xfs/xfs_pnfs.c | 76 +-
fs/xfs/xfs_pnfs.h | 11 +-
include/acpi/cppc_acpi.h | 6 +
include/asm-generic/tlb.h | 3 +-
include/dt-bindings/clock/nuvoton,ma35d1-clk.h | 3 +-
include/kvm/arm_arch_timer.h | 15 +
include/linux/backing-dev.h | 5 +-
include/linux/bio.h | 15 +
include/linux/buffer_head.h | 3 -
include/linux/can/can-ml.h | 3 +
include/linux/cgroup.h | 65 +-
include/linux/damon.h | 6 +
include/linux/exportfs.h | 22 +-
include/linux/exportfs_block.h | 89 ++
include/linux/fb.h | 9 +
include/linux/fs.h | 78 +-
include/linux/hugetlb.h | 24 +-
include/linux/memcontrol.h | 26 +-
include/linux/memfd.h | 9 +
include/linux/migrate.h | 8 +-
include/linux/mmu_notifier.h | 3 +-
include/linux/nfs4.h | 6 +
include/linux/page_owner.h | 7 +-
include/linux/pagemap.h | 11 +
include/linux/panic.h | 3 +-
include/linux/rculist_nulls.h | 59 ++
include/linux/srcu.h | 36 +
include/linux/sunrpc/clnt.h | 3 +-
include/linux/sunrpc/svc.h | 7 +-
include/linux/writeback.h | 4 +
include/net/espintcp.h | 5 +-
include/net/netns/can.h | 2 +-
include/net/netrom.h | 15 +-
include/net/rose.h | 3 +
include/net/sctp/sm.h | 1 +
include/sound/hwdep.h | 1 +
include/trace/events/migrate.h | 8 +-
include/uapi/linux/iommufd.h | 6 +
io_uring/cancel.c | 26 +-
io_uring/poll.c | 62 +-
io_uring/rsrc.c | 21 +-
io_uring/sqpoll.c | 26 +-
ipc/namespace.c | 7 +
ipc/shm.c | 2 -
kernel/cgroup/cgroup-internal.h | 6 -
kernel/cgroup/cgroup.c | 55 --
kernel/events/core.c | 9 +
kernel/kexec_handover.c | 7 +
kernel/panic.c | 10 +-
kernel/sched/ext.c | 14 +-
kernel/time/posix-stubs.c | 4 +-
kernel/time/posix-timers.c | 41 +-
kernel/time/tick-sched.c | 14 +-
kernel/time/timekeeping.c | 5 +
kernel/trace/trace_events_hist.c | 3 +
lib/cmdline.c | 13 +-
lib/crypto/Kconfig | 6 +-
lib/raid6/avx2.c | 6 +
lib/raid6/avx512.c | 6 +
lib/raid6/recov_avx2.c | 2 +
lib/raid6/recov_avx512.c | 2 +
lib/tests/cmdline_kunit.c | 101 +++
mm/cma.c | 4 +
mm/damon/core.c | 68 +-
mm/damon/sysfs-schemes.c | 8 +-
mm/damon/tests/core-kunit.h | 16 +-
mm/filemap.c | 55 +-
mm/gup.c | 68 +-
mm/huge_memory.c | 72 +-
mm/hugetlb.c | 133 ++-
mm/hugetlb_vmemmap.c | 20 +-
mm/internal.h | 2 +
mm/khugepaged.c | 29 +-
mm/ksm.c | 10 +-
mm/madvise.c | 9 +
mm/memcontrol.c | 111 ++-
mm/memfd.c | 33 +-
mm/memory-tiers.c | 29 +-
mm/memory.c | 77 +-
mm/mempolicy.c | 15 +-
mm/migrate.c | 17 +-
mm/mm_init.c | 2 -
mm/mmu_notifier.c | 24 +-
mm/mremap.c | 22 +-
mm/page-writeback.c | 8 +-
mm/page_alloc.c | 71 +-
mm/page_counter.c | 21 +-
mm/page_owner.c | 4 +-
mm/page_vma_mapped.c | 22 +-
mm/shmem.c | 109 ++-
mm/shmem_quota.c | 28 +-
mm/swapfile.c | 4 +-
mm/userfaultfd.c | 5 +-
mm/vma.c | 65 +-
mm/vmscan.c | 16 +-
net/9p/trans_usbg.c | 91 ++-
net/9p/trans_virtio.c | 5 +
net/9p/trans_xen.c | 10 +
net/ax25/af_ax25.c | 119 ++-
net/ax25/ax25_ds_timer.c | 2 +-
net/ax25/ax25_in.c | 56 +-
net/ax25/ax25_ip.c | 9 +-
net/ax25/ax25_out.c | 17 +-
net/ax25/ax25_std_timer.c | 2 +-
net/ax25/sysctl_net_ax25.c | 2 +-
net/batman-adv/bat_iv_ogm.c | 5 +
net/batman-adv/distributed-arp-table.c | 1 +
net/batman-adv/main.c | 12 +-
net/batman-adv/multicast_forw.c | 5 +-
net/batman-adv/tp_meter.c | 2 +-
net/batman-adv/translation-table.c | 134 ++-
net/batman-adv/types.h | 8 +-
net/bluetooth/hci_sync.c | 25 +-
net/bluetooth/l2cap_core.c | 47 +-
net/bluetooth/selftest.c | 1 +
net/bluetooth/smp.c | 1 +
net/can/af_can.c | 53 +-
net/can/bcm.c | 50 +-
net/can/gw.c | 7 +-
net/can/isotp.c | 236 +++---
net/can/proc.c | 69 +-
net/can/raw.c | 282 ++++---
net/core/filter.c | 23 +-
net/core/net_namespace.c | 4 +-
net/core/sock.c | 6 +-
net/ipv4/cipso_ipv4.c | 9 +-
net/ipv4/inet_connection_sock.c | 6 +-
net/ipv4/inet_hashtables.c | 2 +-
net/ipv4/inet_timewait_sock.c | 4 +-
net/ipv4/ip_gre.c | 1 +
net/ipv4/ipmr.c | 28 +-
net/ipv4/syncookies.c | 2 +-
net/ipv4/tcp_fastopen.c | 2 +-
net/ipv4/xfrm4_output.c | 7 +-
net/ipv6/addrconf.c | 3 +-
net/ipv6/datagram.c | 4 +
net/ipv6/inet6_hashtables.c | 2 +-
net/ipv6/ip6_gre.c | 1 +
net/ipv6/ip6mr.c | 5 +-
net/ipv6/raw.c | 3 +
net/l2tp/l2tp_core.c | 13 +-
net/mac80211/tdls.c | 3 +-
net/mac80211/tx.c | 57 +-
net/mptcp/pm_kernel.c | 1 +
net/mptcp/protocol.c | 31 +-
net/mptcp/protocol.h | 4 +-
net/mptcp/subflow.c | 17 +-
net/mptcp/token.c | 68 +-
net/mptcp/token_test.c | 4 +-
net/netrom/af_netrom.c | 109 ++-
net/netrom/nr_in.c | 50 +-
net/netrom/nr_out.c | 23 +-
net/netrom/nr_route.c | 100 +--
net/rds/recv.c | 6 +-
net/rose/af_rose.c | 130 ++-
net/rose/rose_in.c | 11 +-
net/rose/rose_link.c | 85 +-
net/rose/rose_loopback.c | 1 +
net/rose/rose_route.c | 67 +-
net/rose/sysctl_net_rose.c | 13 +-
net/sched/sch_generic.c | 41 +-
net/sched/sch_qfq.c | 3 +
net/sched/sch_taprio.c | 5 +
net/sctp/sm_make_chunk.c | 14 +-
net/sctp/socket.c | 57 +-
net/smc/smc_rx.c | 39 +-
net/sunrpc/rpcb_clnt.c | 22 +-
net/sunrpc/svc.c | 42 +-
net/wireless/reg.c | 3 +
net/xfrm/espintcp.c | 43 +-
net/xfrm/xfrm_interface_core.c | 8 +
net/xfrm/xfrm_policy.c | 11 +-
rust/kernel/bug.rs | 12 +-
rust/kernel/cpufreq.rs | 4 +-
sound/core/compress_offload.c | 18 +-
sound/core/control.c | 19 +-
sound/core/hwdep.c | 25 +-
sound/core/init.c | 23 +-
sound/core/jack.c | 38 +-
sound/core/oss/mixer_oss.c | 13 +-
sound/core/oss/pcm_oss.c | 21 +-
sound/core/pcm_native.c | 44 +-
sound/core/rawmidi.c | 16 +-
sound/core/seq/oss/seq_oss.c | 21 +-
sound/core/seq/seq_clientmgr.c | 19 +-
sound/core/sound.c | 9 +-
sound/core/timer.c | 26 +-
sound/core/timer_compat.c | 1 +
sound/core/ump_convert.c | 2 +-
sound/hda/codecs/realtek/alc269.c | 124 ++-
sound/hda/codecs/side-codecs/cs35l41_hda.c | 22 +-
sound/hda/codecs/side-codecs/tas2781_hda.c | 27 +-
sound/pci/cs46xx/dsp_spos.c | 2 +
sound/pci/cs46xx/dsp_spos_scb_lib.c | 3 +-
sound/soc/amd/acp-config.c | 43 +-
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/codecs/hdac_hda.c | 25 +-
sound/soc/qcom/qdsp6/q6apm-dai.c | 12 +-
sound/soc/qcom/qdsp6/q6apm.c | 6 +-
sound/soc/qcom/qdsp6/q6prm.c | 3 +
sound/soc/sof/intel/hda-codec.c | 23 +-
sound/soc/stm/stm32_i2s.c | 27 +-
sound/usb/bcd2000/bcd2000.c | 20 +-
sound/usb/caiaq/input.c | 2 +
sound/usb/line6/capture.c | 29 +
sound/usb/midi.c | 64 +-
sound/usb/misc/ua101.c | 29 +-
sound/usb/usx2y/us122l.c | 27 +-
sound/usb/usx2y/usX2Yhwdep.c | 5 +
sound/usb/usx2y/usb_stream.c | 9 +-
sound/usb/usx2y/usbusx2yaudio.c | 43 +-
sound/x86/intel_hdmi_audio.c | 9 +-
tools/perf/tests/tool_pmu.c | 79 ++
tools/perf/util/evsel.c | 30 +-
tools/perf/util/hwmon_pmu.c | 2 +-
tools/perf/util/python.c | 2 +
tools/perf/util/tool_pmu.c | 2 +-
tools/testing/selftests/landlock/audit_test.c | 2 +-
tools/testing/selftests/landlock/net_test.c | 4 +-
tools/testing/selftests/landlock/ptrace_test.c | 2 +-
tools/testing/selftests/net/fib_nexthops.sh | 40 +-
tools/testing/vma/vma_internal.h | 2 +
virt/kvm/guest_memfd.c | 125 ++-
virt/kvm/kvm_main.c | 45 +-
virt/kvm/kvm_mm.h | 18 +-
645 files changed, 10332 insertions(+), 5997 deletions(-)
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH 6.18 001/686] smb: client: validate the data area in SMB2_read()
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 002/686] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
` (45 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
[ Upstream commit 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1 ]
SMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from
(char *)rsp + rsp->DataOffset without checking that the range lies
within the response actually received. A READ response with
DataOffset == 0 makes smb2_get_data_area_len() zero the data length, so
smb2_check_message() accepts a frame as short as the fixed response,
while SMB2_read() still uses the server-supplied DataLength, capped only
by CIFS_MAX_MSGSIZE and the caller's length.
A malicious server can answer the synchronous read used by the
mfsymlinks (or SFU) symlink parser with an 81-byte READ response
carrying DataOffset 0 and DataLength 1067, making the client copy 1067
bytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to
16 KiB in the general case).
Clamp a zero (or header-overlapping) DataOffset to read_rsp_size, as
handle_read_data() does for the asynchronous path, and reject the
response unless DataOffset + DataLength fits within rsp_iov.iov_len.
The SMB1 helper was fixed the same way in 5be5bdda5863.
Fixes: d8e050398d23 ("CIFS: Add readpage support for SMB2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
[ sashal: Replaced the smb_EIO2() call with -EIO because smb_eio_trace_read_bad_offset is unavailable. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 6d610f136f43e..5185f8cc8bcc8 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4839,6 +4839,7 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
struct kvec iov[1];
struct kvec rsp_iov;
unsigned int total_len;
+ u16 data_offset;
int flags = CIFS_LOG_ERROR;
struct cifs_ses *ses = io_parms->tcon->ses;
@@ -4897,8 +4898,28 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
*nbytes = 0;
}
+ data_offset = rsp->DataOffset;
+ if (data_offset < io_parms->server->vals->read_rsp_size) {
+ /*
+ * win2k8 sometimes sends an offset of 0 when the read is beyond
+ * the EOF. Treat it as if the data starts just after the header,
+ * as handle_read_data() does.
+ */
+ cifs_dbg(FYI, "data offset %u inside read response header\n",
+ data_offset);
+ data_offset = io_parms->server->vals->read_rsp_size;
+ }
+
+ /* The data area must lie within the response actually received */
+ if (*nbytes && (size_t)data_offset + *nbytes > rsp_iov.iov_len) {
+ cifs_dbg(FYI, "bad data offset %u length %u for response of %zu\n",
+ data_offset, *nbytes, rsp_iov.iov_len);
+ rc = -EIO;
+ *nbytes = 0;
+ }
+
if (*buf) {
- memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes);
+ memcpy(*buf, (char *)rsp + data_offset, *nbytes);
free_rsp_buf(resp_buftype, rsp_iov.iov_base);
} else if (resp_buftype != CIFS_NO_BUFFER) {
*buf = rsp_iov.iov_base;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 002/686] ALSA: x86: hdmi: fix chmap array missing terminator entry
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 001/686] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 003/686] cxl/features: Ensure that count is set before access to ent[] __counted_by() Greg Kroah-Hartman
` (44 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit f5e1a9a3fddab8421416b68bb132ae9626d07156 ]
had_build_channel_allocation_map() allocates a single struct
snd_pcm_chmap_elem via kzalloc() and stores it as
intelhaddata->chmap->chmap. struct snd_pcm_chmap.chmap is expected to
be a zero-terminated array (see snd_pcm_std_chmaps[]), but
had_register_chmap_ctls() never overrides the TLV callback installed
by snd_pcm_add_chmap_ctls(), so the generic pcm_chmap_ctl_tlv() from
ALSA core is left in place.
pcm_chmap_ctl_tlv() is reachable by any local user via
SNDRV_CTL_IOCTL_TLV_READ on the "Playback Channel Map" control and
walks the array with "for (map = info->chmap; map->channels; map++)".
Since the driver's single element is never terminated, this walks
past the allocation. The same pointer is also freed on hot-unplug and
rebuilt on hot-plug under intelhaddata->mutex, while the TLV callback
runs under card->controls_rwsem without that mutex, so the walk can
also race a concurrent free of the array.
Fix this by allocating a second, zeroed element so the array is
properly terminated, and by dropping the inherited TLV callback
entirely at registration time, since the driver never implements one
of its own.
Fixes: 5dab11d89777 ("ALSA: x86: hdmi: Add audio support for BYT and CHT")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085411.13742-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ sashal: Adapted the allocation hunk to replace kzalloc(sizeof(*chmap), GFP_KERNEL) instead of kzalloc_obj(*chmap). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/x86/intel_hdmi_audio.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
index 8e2a007311d36..21ee9c9154804 100644
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -475,7 +475,8 @@ static void had_build_channel_allocation_map(struct snd_intelhad *intelhaddata)
kfree(intelhaddata->chmap->chmap);
intelhaddata->chmap->chmap = NULL;
- chmap = kzalloc(sizeof(*chmap), GFP_KERNEL);
+ /* info->chmap must be zero-terminated; allocate a spare terminator entry */
+ chmap = kzalloc_objs(*chmap, 2);
if (!chmap)
return;
@@ -575,6 +576,12 @@ static int had_register_chmap_ctls(struct snd_intelhad *intelhaddata,
intelhaddata->chmap->kctl->info = had_chmap_ctl_info;
intelhaddata->chmap->kctl->get = had_chmap_ctl_get;
intelhaddata->chmap->chmap = NULL;
+
+ /* drop the inherited TLV read: it walks chmap without our mutex */
+ intelhaddata->chmap->kctl->tlv.c = NULL;
+ intelhaddata->chmap->kctl->vd[0].access &=
+ ~(SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK);
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 003/686] cxl/features: Ensure that count is set before access to ent[] __counted_by()
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 001/686] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 002/686] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 004/686] backing-file: always end a queued write Greg Kroah-Hartman
` (43 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashok Raj, Dave Jiang,
Jonathan Cameron, Ahmed Abdelfattah, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashok Raj <ashok.raj@oss.qualcomm.com>
commit c1031c2474f73261d8d5e4deef2b5dc20fb964f5 upstream.
get_supported_features() assigns entries->num_features only after the
memcpy() loop that fills entries->ent[] has already run. Since ent[]
is __counted_by(num_features), the compiler's bounds instrumentation
sees a 0-length array during that loop and FORTIFY_SOURCE trips on
the memcpy. Set @num_features right after allocation, before any
write into ent[], so the bound is correct for the whole lifetime of
the array.
This was found via a fortify panic:
memcpy: detected buffer overflow: 384 byte write of buffer size 0
WARNING: lib/string_helpers.c:1035 at __fortify_report+0x54/0xa0
kernel BUG at lib/string_helpers.c:1043!
Call trace:
__fortify_panic+0x10/0x18
get_supported_features.isra.0+0x4a0/0x4d0 [cxl_core]
devm_cxl_setup_features+0x84/0x120 [cxl_core]
cxl_pci_probe+0x254/0x5e0 [cxl_pci]
Same class of bug, same fix shape as commit 6c9d2e87df40
("cxl/fwctl: Fix __fortify_panic"), which fixed the analogous issue
in cxlctl_get_supported_features() but missed this one.
[ dj: Fixed up title typo per Jonathan. ]
Fixes: f0e6a2329bf9 ("cxl: Add Get Supported Features command for kernel usage")
Signed-off-by: Ashok Raj <ashok.raj@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260911215304.1816467-1-ashok.raj@oss.qualcomm.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Ahmed Abdelfattah <me@ahmedabdelfattah.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/features.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
index bb73f205f16cf..0ea5a31275d38 100644
--- a/drivers/cxl/core/features.c
+++ b/drivers/cxl/core/features.c
@@ -97,6 +97,7 @@ get_supported_features(struct cxl_features_state *cxlfs)
kvmalloc(struct_size(entries, ent, count), GFP_KERNEL);
if (!entries)
return NULL;
+ entries->num_features = count;
struct cxl_mbox_get_sup_feats_out *mbox_out __free(kvfree) =
kvmalloc(cxl_mbox->payload_size, GFP_KERNEL);
@@ -174,7 +175,6 @@ get_supported_features(struct cxl_features_state *cxlfs)
start += num_entries;
} while (remain_feats);
- entries->num_features = count;
entries->num_user_features = user_feats;
return no_free_ptr(entries);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 004/686] backing-file: always end a queued write
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 003/686] cxl/features: Ensure that count is set before access to ent[] __counted_by() Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 005/686] nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline() Greg Kroah-Hartman
` (42 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Amir Goldstein,
Christian Brauner (Amutable), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <mason@kernel.org>
commit 627cdcbc2a2eceb0452078a0c14370f9f1f17a91 upstream.
Writes to a loop device with direct I/O on an overlay file make the
next freeze of the upper filesystem hang for ever.
Every kiocb_start_write() needs a kiocb_end_write(). For a write that
is queued, vfs_iocb_iter_write() leaves the end to the completion, and
backing_aio_rw_complete() only calls kiocb_end_write() when IOCB_WRITE
is set in the flags copied from the submitter. In-kernel submitters
such as loop do not set that flag, so each queued write keeps the
freeze protection of the backing filesystem.
Direct writes to a loop device with direct I/O backed by an overlay
file left fsfreeze of the ext4 upper filesystem, and a later touch
there, blocked in D state. It takes write access to the node of the
loop device, which root has by default, to attach the file and to write.
The fix used here is to mark a write in struct backing_aio and to call
kiocb_end_write() on completion of every marked write.
Reproduced under qemu without KVM, on v7.3-rc6-21-g602042bf29f6 with
earlier fixes of this series applied, with and without this change,
once each. The kernel was not changed for the run. With this change
fsfreeze finished in about a second. Not run: the nvmet and LIO file
backends, which do not set IOCB_WRITE either, FUSE passthrough, and an
xfs upper filesystem.
Fixes: 2406a307ac7d ("ovl: implement async IO routines")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
[amir: use aio->is_write to explicitly mark a write aio]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20261029180319.2852090-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/backing-file.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/backing-file.c b/fs/backing-file.c
index bf526fa2e29df..ed8e793564c36 100644
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -106,6 +106,7 @@ struct backing_aio {
refcount_t ref;
struct kiocb *orig_iocb;
/* used for aio completion */
+ bool is_write;
void (*end_write)(struct kiocb *iocb, ssize_t);
struct work_struct work;
long res;
@@ -146,7 +147,8 @@ static void backing_aio_rw_complete(struct kiocb *iocb, long res)
struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb);
struct kiocb *orig_iocb = aio->orig_iocb;
- if (iocb->ki_flags & IOCB_WRITE)
+ /* Pairs with kiocb_start_write() in vfs_iocb_iter_write() */
+ if (aio->is_write)
kiocb_end_write(iocb);
backing_aio_cleanup(aio, res);
@@ -287,6 +289,7 @@ ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter,
goto out;
aio->orig_iocb = iocb;
+ aio->is_write = true;
aio->end_write = ctx->end_write;
kiocb_clone(&aio->iocb, iocb, get_file(file));
aio->iocb.ki_flags = flags;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 005/686] nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 004/686] backing-file: always end a queued write Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 006/686] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
` (41 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Keith Busch,
Andrew Stellman, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Stellman <astellman@stellman-greene.com>
[ Upstream commit d1512773a0d539669440bd9f6d050b8e12923b5f ]
nvmet_rdma_map_sgl_inline() bounds the host-supplied in-capsule SGL
offset with "off + len > inline_data_size", evaluated in 64-bit
arithmetic. off is taken straight from the host SGL descriptor
(le64_to_cpu(sgl->addr)) and len is promoted to 64-bit, so the sum
wraps: an off within len of 2^64 makes it small and the check passes.
off is then used as page_idx = off / PAGE_SIZE to index the fixed-size
rsp->cmd->inline_sg[] array (NVMET_RDMA_MAX_INLINE_SGE entries), so a
crafted offset yields an out-of-bounds scatterlist index that is written
through in nvmet_rdma_use_inline_sg().
The mapping runs while handling a received capsule, before the command
executes, so a remote RDMA peer can reach it (the Connect capsule is a
write and takes this path on a queue that has no controller yet). The
host controls only the low bits of the resulting displacement, so the
expected impact is an out-of-bounds write that faults the target
(remote denial of service).
This wrap was reported, with a KASAN reproduction, on linux-nvme in May,
and the check below was suggested in that thread. The fix that was
applied, 48c0162f647b, reworked how the offset is mapped but kept the
original check, and its page index turns a wrapped offset into an
out-of-bounds index into inline_sg[].
Reject the offset before it can wrap.
Found independently by static analysis with AI assistance, not
reproduced at runtime.
Fixes: 0d5ee2b2ab4f ("nvmet-rdma: support max(16KB, PAGE_SIZE) inline data")
Fixes: 48c0162f647b ("nvmet-rdma: handle inline data with a nonzero offset")
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Closes: https://lore.kernel.org/all/LM21QIR-1-qJb7PViyJKCnGBnUzizeiNJVWQ3wb7ZwGezodjgKg3f-iobqOyequ-sT1jFCKJImfqNO_BKU3KO80xFITnaI5GTV_GxLUNDDc=@proton.me/
Suggested-by: Keith Busch <kbusch@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Andrew Stellman <astellman@stellman-greene.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/rdma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index a0ba6641c7ffb..ae44a0ff34d74 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -864,7 +864,8 @@ static u16 nvmet_rdma_map_sgl_inline(struct nvmet_rdma_rsp *rsp)
return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
}
- if (off + len > rsp->queue->dev->inline_data_size) {
+ if (off > (u64)rsp->queue->dev->inline_data_size ||
+ len > (u64)rsp->queue->dev->inline_data_size - off) {
pr_err("invalid inline data offset!\n");
return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 006/686] crypto: sa2ul - Fix HMAC key preparation
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 005/686] nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline() Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 007/686] fsverity: Tell LSMs about signature only after verity is enabled Greg Kroah-Hartman
` (40 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 780cd10c8e78f97ed768be229acff0ffd5483477 upstream.
sa_prepare_iopads() has multiple bugs, as discussed at
https://lore.kernel.org/linux-crypto/20260831055141.1632832-1-s-vadapalli@ti.com/T/#u
- Commit 3bf533787910 ("crypto: sha256 - Use the partial block API")
introduced a 1-byte buffer overflow in the SHA-256 case by making the
crypto_shash_export() write 1 more than sizeof(struct sha256_state).
- It never worked for HMAC keys longer than 64 bytes in the first place.
Fix both of these bugs by just using the crypto library to prepare the
key, like what the chelsio and qat drivers do. Also remove the
pointless use of an indirect call.
Fixes: 3bf533787910 ("crypto: sha256 - Use the partial block API")
Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sa2ul.c | 121 +++++++++--------------------------------
1 file changed, 27 insertions(+), 94 deletions(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index 4a766e4351970..563e0f0d574ad 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -125,9 +125,7 @@ struct sa_cmdl_cfg {
* @mci_enc: Mode Control Instruction for Encryption algorithm
* @mci_dec: Mode Control Instruction for Decryption
* @inv_key: Whether the encryption algorithm demands key inversion
- * @ctx: Pointer to the algorithm context
* @keyed_mac: Whether the authentication algorithm has key
- * @prep_iopad: Function pointer to generate intermediate ipad/opad
*/
struct algo_data {
struct sa_eng_info enc_eng;
@@ -141,10 +139,7 @@ struct algo_data {
u8 *mci_enc;
u8 *mci_dec;
bool inv_key;
- struct sa_tfm_ctx *ctx;
bool keyed_mac;
- void (*prep_iopad)(struct algo_data *algo, const u8 *key,
- u16 key_sz, __be32 *ipad, __be32 *opad);
};
/**
@@ -381,86 +376,36 @@ static void sa_swiz_128(u8 *in, u16 len)
}
}
-/* Prepare the ipad and opad from key as per SHA algorithm step 1*/
-static void prepare_kipad(u8 *k_ipad, const u8 *key, u16 key_sz)
+static void sa_prepare_iopads(struct algo_data *data, const u8 *key, u16 key_sz,
+ __be32 *ipad, __be32 *opad)
{
- int i;
-
- for (i = 0; i < key_sz; i++)
- k_ipad[i] = key[i] ^ 0x36;
-
- /* Instead of XOR with 0 */
- for (; i < SHA1_BLOCK_SIZE; i++)
- k_ipad[i] = 0x36;
-}
-
-static void prepare_kopad(u8 *k_opad, const u8 *key, u16 key_sz)
-{
- int i;
-
- for (i = 0; i < key_sz; i++)
- k_opad[i] = key[i] ^ 0x5c;
-
- /* Instead of XOR with 0 */
- for (; i < SHA1_BLOCK_SIZE; i++)
- k_opad[i] = 0x5c;
-}
-
-static void sa_export_shash(void *state, struct shash_desc *hash,
- int digest_size, __be32 *out)
-{
- struct sha1_state *sha1;
- struct sha256_state *sha256;
- u32 *result;
-
- switch (digest_size) {
- case SHA1_DIGEST_SIZE:
- sha1 = state;
- result = sha1->state;
+ union {
+ struct hmac_sha1_key sha1;
+ struct hmac_sha256_key sha256;
+ } k;
+
+ switch (data->aalg_id) {
+ case SA_AALG_ID_HMAC_SHA1:
+ hmac_sha1_preparekey(&k.sha1, key, key_sz);
+ cpu_to_be32_array(ipad, k.sha1.istate.h,
+ ARRAY_SIZE(k.sha1.istate.h));
+ cpu_to_be32_array(opad, k.sha1.ostate.h,
+ ARRAY_SIZE(k.sha1.ostate.h));
break;
- case SHA256_DIGEST_SIZE:
- sha256 = state;
- result = sha256->state;
+ case SA_AALG_ID_HMAC_SHA2_256:
+ hmac_sha256_preparekey(&k.sha256, key, key_sz);
+ cpu_to_be32_array(ipad, k.sha256.key.istate.h,
+ ARRAY_SIZE(k.sha256.key.istate.h));
+ cpu_to_be32_array(opad, k.sha256.key.ostate.h,
+ ARRAY_SIZE(k.sha256.key.ostate.h));
break;
default:
- dev_err(sa_k3_dev, "%s: bad digest_size=%d\n", __func__,
- digest_size);
+ dev_err(sa_k3_dev, "%s: bad aalg_id=%d\n", __func__,
+ data->aalg_id);
return;
}
- crypto_shash_export(hash, state);
-
- cpu_to_be32_array(out, result, digest_size / 4);
-}
-
-static void sa_prepare_iopads(struct algo_data *data, const u8 *key,
- u16 key_sz, __be32 *ipad, __be32 *opad)
-{
- SHASH_DESC_ON_STACK(shash, data->ctx->shash);
- int block_size = crypto_shash_blocksize(data->ctx->shash);
- int digest_size = crypto_shash_digestsize(data->ctx->shash);
- union {
- struct sha1_state sha1;
- struct sha256_state sha256;
- u8 k_pad[SHA1_BLOCK_SIZE];
- } sha;
-
- shash->tfm = data->ctx->shash;
-
- prepare_kipad(sha.k_pad, key, key_sz);
-
- crypto_shash_init(shash);
- crypto_shash_update(shash, sha.k_pad, block_size);
- sa_export_shash(&sha, shash, digest_size, ipad);
-
- prepare_kopad(sha.k_pad, key, key_sz);
-
- crypto_shash_init(shash);
- crypto_shash_update(shash, sha.k_pad, block_size);
-
- sa_export_shash(&sha, shash, digest_size, opad);
-
- memzero_explicit(&sha, sizeof(sha));
+ memzero_explicit(&k, sizeof(k));
}
/* Derive the inverse key used in AES-CBC decryption operation */
@@ -544,7 +489,7 @@ static void sa_set_sc_auth(struct algo_data *ad, const u8 *key, u16 key_sz,
/* Copy the keys or ipad/opad */
if (ad->keyed_mac)
- ad->prep_iopad(ad, key, key_sz, ipad, opad);
+ sa_prepare_iopads(ad, key, key_sz, ipad, opad);
else {
/* basic hash */
sc_buf[1] |= SA_BASIC_HASH;
@@ -1697,8 +1642,7 @@ static void sa_aead_dma_in_callback(void *data)
aead_request_complete(req, err);
}
-static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
- const char *fallback)
+static int sa_cra_init_aead(struct crypto_aead *tfm, const char *fallback)
{
struct sa_tfm_ctx *ctx = crypto_aead_ctx(tfm);
struct sa_crypto_data *data = dev_get_drvdata(sa_k3_dev);
@@ -1707,12 +1651,6 @@ static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
memzero_explicit(ctx, sizeof(*ctx));
ctx->dev_data = data;
- ctx->shash = crypto_alloc_shash(hash, 0, CRYPTO_ALG_NEED_FALLBACK);
- if (IS_ERR(ctx->shash)) {
- dev_err(sa_k3_dev, "base driver %s couldn't be loaded\n", hash);
- return PTR_ERR(ctx->shash);
- }
-
ctx->fallback.aead = crypto_alloc_aead(fallback, 0,
CRYPTO_ALG_NEED_FALLBACK);
@@ -1744,14 +1682,12 @@ static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
static int sa_cra_init_aead_sha1(struct crypto_aead *tfm)
{
- return sa_cra_init_aead(tfm, "sha1",
- "authenc(hmac(sha1),cbc(aes))");
+ return sa_cra_init_aead(tfm, "authenc(hmac(sha1),cbc(aes))");
}
static int sa_cra_init_aead_sha256(struct crypto_aead *tfm)
{
- return sa_cra_init_aead(tfm, "sha256",
- "authenc(hmac(sha256),cbc(aes))");
+ return sa_cra_init_aead(tfm, "authenc(hmac(sha256),cbc(aes))");
}
static void sa_exit_tfm_aead(struct crypto_aead *tfm)
@@ -1759,7 +1695,6 @@ static void sa_exit_tfm_aead(struct crypto_aead *tfm)
struct sa_tfm_ctx *ctx = crypto_aead_ctx(tfm);
struct sa_crypto_data *data = dev_get_drvdata(sa_k3_dev);
- crypto_free_shash(ctx->shash);
crypto_free_aead(ctx->fallback.aead);
sa_free_ctx_info(&ctx->enc, data);
@@ -1785,7 +1720,6 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
if (key_idx >= 3)
return -EINVAL;
- ad->ctx = ctx;
ad->enc_eng.eng_id = SA_ENG_ID_EM1;
ad->enc_eng.sc_size = SA_CTX_ENC_TYPE1_SZ;
ad->auth_eng.eng_id = SA_ENG_ID_AM1;
@@ -1795,7 +1729,6 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
ad->inv_key = true;
ad->keyed_mac = true;
ad->ealg_id = SA_EALG_ID_AES_CBC;
- ad->prep_iopad = sa_prepare_iopads;
memset(&cfg, 0, sizeof(cfg));
cfg.enc = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 007/686] fsverity: Tell LSMs about signature only after verity is enabled
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 006/686] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 008/686] Bluetooth: L2CAP: Reject signalling responses in invalid states Greg Kroah-Hartman
` (39 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Eric Biggers, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 28d74059fddbd8ae83c7715056b303c402071f6f upstream.
FS_IOC_ENABLE_VERITY calls security_inode_setintegrity() before verity
has finished being enabled. That's broken because enabling verity can
still fail at that point, e.g. due to insufficient xattr space.
Afterwards, arbitrary contents can be written to the file, which doesn't
actually have verity enabled. The in-core inode stays the same, so the
LSM considers it to have verity enabled with a valid signature. (Or
rather, in the case of IPE, which is the only LSM that implements
security_inode_setintegrity(), it also checks IS_VERITY(), which can be
bypassed by enabling verity with no signature after the file writes.)
Fix this by moving the call to security_inode_setintegrity() out of
fsverity_verify_signature() and into a new function that is called from
the appropriate places.
Fixes: 7c373e4f1445 ("fsverity: expose verified fsverity built-in signatures to LSMs")
Cc: stable@vger.kernel.org
Reviewed-by: Fan Wu <wufan@kernel.org>
Tested-by: Fan Wu <wufan@kernel.org>
Link: https://patch.msgid.link/20261025204534.122506-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/verity/enable.c | 8 ++++++
fs/verity/fsverity_private.h | 8 ++++++
fs/verity/open.c | 9 ++++++
fs/verity/signature.c | 55 ++++++++++++++++++++++++++----------
4 files changed, 65 insertions(+), 15 deletions(-)
diff --git a/fs/verity/enable.c b/fs/verity/enable.c
index 95ec42b847972..05fbcae57e5db 100644
--- a/fs/verity/enable.c
+++ b/fs/verity/enable.c
@@ -287,6 +287,14 @@ static int enable_verity(struct file *filp,
* just after the filesystem has successfully enabled verity.
*/
fsverity_set_info(inode, vi);
+
+ /*
+ * Now that verity is enabled, report the signature (if any) to
+ * LSMs. We tolerate that a process racing with this ioctl can
+ * briefly see verity enabled with no signature reported yet.
+ */
+ fsverity_report_valid_sig(inode, desc->signature,
+ le32_to_cpu(desc->sig_size));
}
out:
kfree(params.hashstate);
diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h
index dd20b138d452f..0a2ddca3c838d 100644
--- a/fs/verity/fsverity_private.h
+++ b/fs/verity/fsverity_private.h
@@ -142,6 +142,8 @@ void __init fsverity_init_info_cache(void);
extern int fsverity_require_signatures;
int fsverity_verify_signature(const struct fsverity_info *vi,
const u8 *signature, size_t sig_size);
+void fsverity_report_valid_sig(const struct inode *inode, const u8 *signature,
+ size_t sig_size);
void __init fsverity_init_signature(void);
#else /* !CONFIG_FS_VERITY_BUILTIN_SIGNATURES */
@@ -152,6 +154,12 @@ fsverity_verify_signature(const struct fsverity_info *vi,
return 0;
}
+static inline void fsverity_report_valid_sig(const struct inode *inode,
+ const u8 *signature,
+ size_t sig_size)
+{
+}
+
static inline void fsverity_init_signature(void)
{
}
diff --git a/fs/verity/open.c b/fs/verity/open.c
index 02e2c14ab3ffb..dbc2a25e9158e 100644
--- a/fs/verity/open.c
+++ b/fs/verity/open.c
@@ -369,6 +369,15 @@ static int ensure_verity_info(struct inode *inode)
goto out_free_desc;
}
+ /*
+ * Now that the signature (if any) has been verified, report it to LSMs.
+ * Do this before setting the fsverity_info, so that anyone who
+ * concurrently retrieves the fsverity_info for the same inode is
+ * guaranteed to see the LSM's signature status populated.
+ */
+ fsverity_report_valid_sig(inode, desc->signature,
+ le32_to_cpu(desc->sig_size));
+
fsverity_set_info(inode, vi);
err = 0;
out_free_desc:
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 0302a4e506ec4..212e873c84998 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c
@@ -42,13 +42,16 @@ static struct key *fsverity_keyring;
* @sig_size: size of signature in bytes, or 0 if no signature
*
* If the file includes a signature of its fs-verity file digest, verify it
- * against the certificates in the fs-verity keyring. Note that signatures
- * are verified regardless of the state of the 'fsverity_require_signatures'
- * variable and the LSM subsystem relies on this behavior to help enforce
- * file integrity policies. Please discuss changes with the LSM list
- * (thank you!).
+ * against the certificates in the fs-verity keyring.
*
- * Return: 0 on success (signature valid or not required); -errno on failure
+ * Note that signatures are verified regardless of the state of the
+ * 'fsverity_require_signatures' variable, and the LSM subsystem relies on this
+ * behavior to help enforce file integrity policies. (See
+ * fsverity_report_valid_sig(), which assumes that the signature, if present,
+ * was verified here.) Please discuss changes with the LSM list (thank you!).
+ *
+ * Return: 0 if the signature is present and valid, or absent and not required;
+ * -errno on failure
*/
int fsverity_verify_signature(const struct fsverity_info *vi,
const u8 *signature, size_t sig_size)
@@ -111,18 +114,40 @@ int fsverity_verify_signature(const struct fsverity_info *vi,
return err;
}
- err = security_inode_setintegrity(inode,
- LSM_INT_FSVERITY_BUILTINSIG_VALID,
- signature,
- sig_size);
+ return 0;
+}
- if (err) {
+/*
+ * If the signature exists, this tells the LSM that it was verified.
+ *
+ * fsverity_verify_signature() must have already been called with the same
+ * signature, *and* the inode must have verity enabled with the signature
+ * matching it. If called from FS_IOC_ENABLE_VERITY, the latter means that we
+ * must be past the point of no return, i.e. verity won't fail to be enabled at
+ * a later point. This is critical, since LSMs must be told about the signature
+ * only when the verity status is permanent in the in-core inode.
+ */
+void fsverity_report_valid_sig(const struct inode *inode, const u8 *signature,
+ size_t sig_size)
+{
+ int err;
+
+ if (WARN_ON_ONCE(!IS_VERITY(inode)))
+ return;
+
+ if (sig_size == 0)
+ return;
+
+ err = security_inode_setintegrity(
+ inode, LSM_INT_FSVERITY_BUILTINSIG_VALID, signature, sig_size);
+ if (err)
fsverity_err(inode, "Error %d exposing file signature to LSMs",
err);
- return err;
- }
-
- return 0;
+ /*
+ * Besides the logging above, ignore errors here. The LSM hook just
+ * records the signature and doesn't perform access control. And in the
+ * case of FS_IOC_ENABLE_VERITY verity was already enabled.
+ */
}
void __init fsverity_init_signature(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 008/686] Bluetooth: L2CAP: Reject signalling responses in invalid states
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 007/686] fsverity: Tell LSMs about signature only after verity is enabled Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 009/686] Bluetooth: L2CAP: Only accept connection responses to outstanding requests Greg Kroah-Hartman
` (38 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
commit 6320736af7dcb90da6ee9fd651ecc11c564d45b7 upstream.
Adjusted context as stable does not have the lockdep_assert_held()
calls, and l2cap_get_chan_by_scid() still returns the channel locked,
so l2cap_config_rsp() does not lock it again.
A peer can send configuration messages while an
incoming channel is in BT_CONNECT2, before the
security or deferred accept gate has completed. A
configuration response can then promote the channel
to BT_CONNECTED. Configuration responses can also
act on channels that are closing, and a late connection
response can move a disconnecting channel back to
BT_CONFIG.
Accept connection responses only while waiting in
BT_CONNECT. Answer configuration requests in
BT_CONNECT2, but defer our own request until
BT_CONFIG so configuration cannot complete before
the gate. Ignore configuration responses outside
BT_CONFIG and BT_CONNECTED, and only complete
configuration in BT_CONFIG.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0ba7b1ea435cc..52ff1b8785d77 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4310,6 +4310,10 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
l2cap_chan_lock(chan);
+ /* Ignore a late response after the channel has left BT_CONNECT. */
+ if (chan->state != BT_CONNECT)
+ goto done;
+
switch (result) {
case L2CAP_CR_SUCCESS:
if (__l2cap_get_chan_by_dcid(conn, dcid)) {
@@ -4339,6 +4343,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
break;
}
+done:
l2cap_chan_unlock(chan);
l2cap_chan_put(chan);
@@ -4471,7 +4476,13 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
goto unlock;
}
- if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
+ /* A channel in BT_CONNECT2 has not passed security or userspace
+ * accept yet. Answer the peer's request, but hold our own until
+ * the channel reaches BT_CONFIG: the CONNECT2 -> CONFIG sites send
+ * it. Connected channels may also need to reconfigure.
+ */
+ if ((chan->state == BT_CONFIG || chan->state == BT_CONNECTED) &&
+ !test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
u8 buf[64];
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
@@ -4519,6 +4530,10 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
if (!chan)
return 0;
+ /* Connected channels may also receive reconfiguration responses. */
+ if (chan->state != BT_CONFIG && chan->state != BT_CONNECTED)
+ goto done;
+
switch (result) {
case L2CAP_CONF_SUCCESS:
l2cap_conf_rfc_get(chan, rsp->data, len);
@@ -4586,6 +4601,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
set_default_fcs(chan);
+ if (chan->state != BT_CONFIG)
+ goto done;
+
if (chan->mode == L2CAP_MODE_ERTM ||
chan->mode == L2CAP_MODE_STREAMING)
err = l2cap_ertm_init(chan);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 009/686] Bluetooth: L2CAP: Only accept connection responses to outstanding requests
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 008/686] Bluetooth: L2CAP: Reject signalling responses in invalid states Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 010/686] Bluetooth: L2CAP: Ignore connection responses with wrong ident Greg Kroah-Hartman
` (37 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
commit a518b9a9ef6ee3b18ecdf6ba5360c608aaf969e9 upstream.
Adjusted context as stable does not have the lockdep_assert_held()
call and the __must_hold() context analysis annotations.
An outgoing channel waits in BT_CONNECT until security
and the feature mask exchange complete, and only then
sends its connection request. A peer can answer it
before that with a connection response matching our
source CID. The channel then moves to BT_CONFIG,
completes configuration and becomes connected before
security has completed. If security then fails,
l2cap_security_cfm() leaves the connected channel
alone, so it stays up on a link that did not reach
the required security level.
A connection response with a zero source CID is
matched by identifier. Another channel can hold the
same identifier for a response it still has to send,
so the lookup can pick the wrong channel.
Only accept a connection response while our request
is outstanding, and only look at such channels when
matching by identifier.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 31 ++++++++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 52ff1b8785d77..22bac1222fab7 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -161,6 +161,28 @@ static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
return NULL;
}
+/* Our connection request has been sent and is still outstanding */
+static bool l2cap_chan_connect_pending(struct l2cap_chan *chan)
+{
+ return chan->state == BT_CONNECT &&
+ test_bit(CONF_CONNECT_PEND, &chan->conf_state);
+}
+
+/* Other channels may hold the same ident for a response they still have
+ * to send, so only look at channels waiting for a connection response.
+ */
+static struct l2cap_chan *__l2cap_get_connect_chan_by_ident(struct l2cap_conn *conn,
+ u8 ident)
+{
+ struct l2cap_chan *c;
+
+ list_for_each_entry(c, &conn->chan_l, list) {
+ if (c->ident == ident && l2cap_chan_connect_pending(c))
+ return c;
+ }
+ return NULL;
+}
+
static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
u8 src_type)
{
@@ -4297,7 +4319,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
if (!chan)
return -EBADSLT;
} else {
- chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
+ chan = __l2cap_get_connect_chan_by_ident(conn, cmd->ident);
if (!chan)
return -EBADSLT;
}
@@ -4310,8 +4332,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
l2cap_chan_lock(chan);
- /* Ignore a late response after the channel has left BT_CONNECT. */
- if (chan->state != BT_CONNECT)
+ /* Only accept a response to a connection request we sent and that
+ * is still outstanding. A channel waiting in BT_CONNECT for security
+ * or the feature mask has not sent one yet.
+ */
+ if (!l2cap_chan_connect_pending(chan))
goto done;
switch (result) {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 010/686] Bluetooth: L2CAP: Ignore connection responses with wrong ident
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 009/686] Bluetooth: L2CAP: Only accept connection responses to outstanding requests Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 011/686] smb: client: Avoid leaking sensitive data to the heap in connect.c Greg Kroah-Hartman
` (36 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinwang Li, Luiz Augusto von Dentz,
Siwei Zhang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
commit a9f9eeb5344fc7dc625e5700ccf09891bc2603b5 upstream.
Adjusted context as stable does not have the lockdep_assert_held()
call in l2cap_connect_create_rsp().
L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
that carries an invalid Identifier.
l2cap_connect_create_rsp() only checks that a connection request is
outstanding, not that the response answers it. Add an ident check
against the pending request so that a mismatched response is dropped.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 22bac1222fab7..d648d57299541 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4332,11 +4332,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
l2cap_chan_lock(chan);
- /* Only accept a response to a connection request we sent and that
- * is still outstanding. A channel waiting in BT_CONNECT for security
- * or the feature mask has not sent one yet.
+ /* Only accept a response matching a connection request we sent and
+ * that is still outstanding. A channel waiting in BT_CONNECT for
+ * security or the feature mask has not sent one yet.
*/
- if (!l2cap_chan_connect_pending(chan))
+ if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
goto done;
switch (result) {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 011/686] smb: client: Avoid leaking sensitive data to the heap in connect.c
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 010/686] Bluetooth: L2CAP: Ignore connection responses with wrong ident Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 012/686] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
` (35 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Huth, Namjae Jeon,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <thuth@redhat.com>
[ Upstream commit 111a2b8717efbd9729d36828308d5163fdc977c3 ]
TCP_Server_Info contains a preauth_sha_hash[] and a cryptkey[] array
that might contain sensitive data. Thus free its memory with
kfree_sensitive() to avoid that we are leaking this information to
the heap.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Stable-dep-of: 482c117c6dbe ("smb: client: hold server info until cifsd exits")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/connect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 2cbbbf0c93b80..fa7c2f70b6ed3 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1147,7 +1147,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
put_net(cifs_net_ns(server));
kfree(server->leaf_fullpath);
kfree(server->hostname);
- kfree(server);
+ kfree_sensitive(server);
length = atomic_dec_return(&tcpSesAllocCount);
if (length > 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 012/686] smb: client: hold server info until cifsd exits
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 011/686] smb: client: Avoid leaking sensitive data to the heap in connect.c Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 013/686] smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h Greg Kroah-Hartman
` (34 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5c3ed2a0de3270efc921,
syzbot+c2ec61adfbcb24e5ec20, Eduard Zateev,
Michail Andreas Michalopoulos, Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zateev <hackerowskiy@gmail.com>
[ Upstream commit 482c117c6dbeee382790168af10959810450ab09 ]
The last session reference can be dropped while the cifsd demultiplex
thread is still running clean_demultiplex_info(). That thread frees
TCP_Server_Info there, racing with cifs_put_tcp_session() as it releases
the server crypto state. syzbot reported a KASAN use-after-free in
cifs_crypto_secmech_release().
Keep an object reference for the cifsd thread. Defer final crypto,
session-key, network namespace, string, and structure cleanup until both
the last session reference and the thread reference are dropped. Drop the
thread reference after clean_demultiplex_info() has finished using the
server.
Build-tested with ARCH=arm64 and W=1 for
fs/smb/client/connect.o. The KASAN reproducer was not run on the patched
kernel.
Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
Reported-by: syzbot+5c3ed2a0de3270efc921@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c3ed2a0de3270efc921
Reported-by: syzbot+c2ec61adfbcb24e5ec20@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=c2ec61adfbcb24e5ec20
Assisted-by: LLM OpenAI Codex
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifsglob.h | 2 ++
fs/smb/client/connect.c | 33 +++++++++++++++++++++------------
2 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h
index 8d751026dd4a2..d529446e4984b 100644
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -16,6 +16,7 @@
#include <linux/scatterlist.h>
#include <linux/mm.h>
#include <linux/mempool.h>
+#include <linux/refcount.h>
#include <linux/workqueue.h>
#include <linux/utsname.h>
#include <linux/sched/mm.h>
@@ -678,6 +679,7 @@ struct TCP_Server_Info {
spinlock_t srv_lock; /* protect anything here that is not protected */
__u64 conn_id; /* connection identifier (useful for debugging) */
int srv_count; /* reference counter */
+ refcount_t obj_refs; /* struct lifetime: srv_count users + cifsd */
int rfc1001_sessinit; /* whether to estasblish netbios session */
bool with_rfc1001; /* if netbios session is used */
/* 15 character server name + 0x20 16th byte indicating type = srv */
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index fa7c2f70b6ed3..0a60c411aba67 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1059,6 +1059,19 @@ cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)
return 0;
}
+static void cifs_tcp_server_put(struct TCP_Server_Info *server)
+{
+ if (!refcount_dec_and_test(&server->obj_refs))
+ return;
+
+ cifs_crypto_secmech_release(server);
+ kfree_sensitive(server->session_key.response);
+ put_net(cifs_net_ns(server));
+ kfree(server->leaf_fullpath);
+ kfree(server->hostname);
+ kfree_sensitive(server);
+}
+
static noinline_for_stack void
clean_demultiplex_info(struct TCP_Server_Info *server)
{
@@ -1144,14 +1157,11 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
*/
}
- put_net(cifs_net_ns(server));
- kfree(server->leaf_fullpath);
- kfree(server->hostname);
- kfree_sensitive(server);
-
length = atomic_dec_return(&tcpSesAllocCount);
if (length > 0)
mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ cifs_tcp_server_put(server);
}
static int
@@ -1730,7 +1740,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
else
cancel_delayed_work_sync(&server->reconnect);
- /* For secondary channels, we pick up ref-count on the primary server */
+ /* For secondary channels, drop the reference on the primary server */
if (SERVER_IS_CHAN(server))
cifs_put_tcp_session(server->primary_server, from_reconnect);
@@ -1738,15 +1748,11 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
server->tcpStatus = CifsExiting;
spin_unlock(&server->srv_lock);
- cifs_crypto_secmech_release(server);
-
- kfree_sensitive(server->session_key.response);
- server->session_key.response = NULL;
- server->session_key.len = 0;
-
task = xchg(&server->tsk, NULL);
if (task)
send_sig(SIGKILL, task, 1);
+
+ cifs_tcp_server_put(server);
}
struct TCP_Server_Info *
@@ -1768,6 +1774,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx,
rc = -ENOMEM;
goto out_err;
}
+ refcount_set(&tcp_ses->obj_refs, 1);
tcp_ses->hostname = kstrdup(ctx->server_hostname, GFP_KERNEL);
if (!tcp_ses->hostname) {
@@ -1906,6 +1913,8 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx,
module_put(THIS_MODULE);
goto out_err_crypto_release;
}
+ /* Keep the server alive until the demultiplex thread has exited */
+ refcount_inc(&tcp_ses->obj_refs);
/* thread created, put it on the list */
spin_lock(&cifs_tcp_ses_lock);
list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 013/686] smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 012/686] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 014/686] smb: move create_durable_req_v2 " Greg Kroah-Hartman
` (33 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, ZhangGuoDong,
Namjae Jeon, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <zhangguodong@kylinos.cn>
[ Upstream commit 7844d50ca239f0788e732608820f7026cb0cc8fb ]
Rename 4 places:
- iface_info_ipv4 -> smb_sockaddr_in
- iface_info_ipv6 -> smb_sockaddr_in6
- IPv4address -> IPv4Address
- IPv6address -> IPv6Address
Then move duplicate definitions to common header file.
Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 8 ++++----
fs/smb/client/smb2pdu.h | 13 -------------
fs/smb/common/smb2pdu.h | 15 +++++++++++++++
fs/smb/server/smb2pdu.c | 4 ++--
fs/smb/server/smb2pdu.h | 13 -------------
5 files changed, 21 insertions(+), 32 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 7cf6419df037d..71cf42981ab04 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -635,8 +635,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
struct network_interface_info_ioctl_rsp *p;
struct sockaddr_in *addr4;
struct sockaddr_in6 *addr6;
- struct iface_info_ipv4 *p4;
- struct iface_info_ipv6 *p6;
+ struct smb_sockaddr_in *p4;
+ struct smb_sockaddr_in6 *p6;
struct cifs_server_iface *info = NULL, *iface = NULL, *niface = NULL;
struct cifs_server_iface tmp_iface;
__be16 port;
@@ -698,7 +698,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
*/
case INTERNETWORK:
addr4 = (struct sockaddr_in *)&tmp_iface.sockaddr;
- p4 = (struct iface_info_ipv4 *)p->Buffer;
+ p4 = (struct smb_sockaddr_in *)p->Buffer;
addr4->sin_family = AF_INET;
memcpy(&addr4->sin_addr, &p4->IPv4Address, 4);
@@ -710,7 +710,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
break;
case INTERNETWORKV6:
addr6 = (struct sockaddr_in6 *)&tmp_iface.sockaddr;
- p6 = (struct iface_info_ipv6 *)p->Buffer;
+ p6 = (struct smb_sockaddr_in6 *)p->Buffer;
addr6->sin6_family = AF_INET6;
memcpy(&addr6->sin6_addr, &p6->IPv6Address, 16);
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index cdf7c588cc00d..de2d83c6463c9 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -255,19 +255,6 @@ struct network_interface_info_ioctl_rsp {
__u8 Buffer[126];
} __packed;
-struct iface_info_ipv4 {
- __be16 Port;
- __be32 IPv4Address;
- __be64 Reserved;
-} __packed;
-
-struct iface_info_ipv6 {
- __be16 Port;
- __be32 FlowInfo;
- __u8 IPv6Address[16];
- __be32 ScopeId;
-} __packed;
-
#define NO_FILE_ID 0xFFFFFFFFFFFFFFFFULL /* general ioctls to srv not to file */
struct compress_ioctl {
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 528ba77247e80..1bd5835c56e45 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1433,6 +1433,21 @@ struct smb2_ioctl_rsp {
__u8 Buffer[];
} __packed;
+/* See MS-SMB2 2.2.32.5.1.1 */
+struct smb_sockaddr_in {
+ __be16 Port;
+ __be32 IPv4Address;
+ __u8 Reserved[8];
+} __packed;
+
+/* See MS-SMB2 2.2.32.5.1.2 */
+struct smb_sockaddr_in6 {
+ __be16 Port;
+ __be32 FlowInfo;
+ __u8 IPv6Address[16];
+ __be32 ScopeId;
+} __packed;
+
/* this goes in the ioctl buffer when doing FSCTL_SET_ZERO_DATA */
struct file_zero_data_information {
__le64 FileOffset;
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a8a42fde4ca02..55d634b5d2e2f 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8297,7 +8297,7 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
idev = __in_dev_get_rtnl(netdev);
if (!idev)
continue;
- sockaddr_storage->addr4.IPv4address =
+ sockaddr_storage->addr4.IPv4Address =
idev_ipv4_address(idev);
nbytes += sizeof(struct network_interface_info_ioctl_rsp);
ipv4_set = true;
@@ -8305,7 +8305,7 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
} else {
struct inet6_dev *idev6;
struct inet6_ifaddr *ifa;
- __u8 *ipv6_addr = sockaddr_storage->addr6.IPv6address;
+ __u8 *ipv6_addr = sockaddr_storage->addr6.IPv6Address;
sockaddr_storage->Family = cpu_to_le16(INTERNETWORKV6);
sockaddr_storage->addr6.Port = 0;
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 23abb70ea5d3d..48026edb7314b 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -138,19 +138,6 @@ struct create_posix_rsp {
#define SMB2_0_IOCTL_IS_FSCTL 0x00000001
-struct smb_sockaddr_in {
- __be16 Port;
- __be32 IPv4address;
- __u8 Reserved[8];
-} __packed;
-
-struct smb_sockaddr_in6 {
- __be16 Port;
- __be32 FlowInfo;
- __u8 IPv6address[16];
- __be32 ScopeId;
-} __packed;
-
#define INTERNETWORK 0x0002
#define INTERNETWORKV6 0x0017
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 014/686] smb: move create_durable_req_v2 to common/smb2pdu.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 013/686] smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 015/686] smb: move create_durable_handle_reconnect_v2 " Greg Kroah-Hartman
` (32 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Namjae Jeon,
Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit 833a75fc9ecc3856a52223d8c245e52703e0a9f1 ]
Modify the following places:
- some fields in "struct create_durable_req_v2" ->
struct durable_context_v2
- durable_context_v2 -> durable_context_v2_req
- create_durable_v2 -> create_durable_req_v2
Then move duplicate definitions to common header file.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.c | 14 +++++++-------
fs/smb/client/smb2pdu.h | 12 ------------
fs/smb/common/smb2pdu.h | 14 ++++++++++++++
fs/smb/server/smb2pdu.c | 8 ++++----
fs/smb/server/smb2pdu.h | 9 ---------
5 files changed, 25 insertions(+), 32 deletions(-)
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 5185f8cc8bcc8..d8c97c1c63b5f 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2456,21 +2456,21 @@ add_lease_context(struct TCP_Server_Info *server,
return 0;
}
-static struct create_durable_v2 *
+static struct create_durable_req_v2 *
create_durable_v2_buf(struct cifs_open_parms *oparms)
{
struct cifs_fid *pfid = oparms->fid;
- struct create_durable_v2 *buf;
+ struct create_durable_req_v2 *buf;
- buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
+ buf = kzalloc(sizeof(struct create_durable_req_v2), GFP_KERNEL);
if (!buf)
return NULL;
buf->ccontext.DataOffset = cpu_to_le16(offsetof
- (struct create_durable_v2, dcontext));
- buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
+ (struct create_durable_req_v2, dcontext));
+ buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2_req));
buf->ccontext.NameOffset = cpu_to_le16(offsetof
- (struct create_durable_v2, Name));
+ (struct create_durable_req_v2, Name));
buf->ccontext.NameLength = cpu_to_le16(4);
/*
@@ -2540,7 +2540,7 @@ add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
iov[num].iov_base = create_durable_v2_buf(oparms);
if (iov[num].iov_base == NULL)
return -ENOMEM;
- iov[num].iov_len = sizeof(struct create_durable_v2);
+ iov[num].iov_len = sizeof(struct create_durable_req_v2);
*num_iovec = num + 1;
return 0;
}
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index de2d83c6463c9..472553e499830 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -137,18 +137,6 @@ struct share_redirect_error_context_rsp {
/* See MS-SMB2 2.2.13.2.11 */
/* Flags */
#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-struct durable_context_v2 {
- __le32 Timeout;
- __le32 Flags;
- __u64 Reserved;
- __u8 CreateGuid[16];
-} __packed;
-
-struct create_durable_v2 {
- struct create_context_hdr ccontext;
- __u8 Name[8];
- struct durable_context_v2 dcontext;
-} __packed;
/* See MS-SMB2 2.2.13.2.12 */
struct durable_reconnect_context_v2 {
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 1bd5835c56e45..ca47c54afd324 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1290,6 +1290,20 @@ struct create_mxac_req {
__le64 Timestamp;
} __packed;
+/* See MS-SMB2 2.2.13.2.11 */
+struct durable_context_v2_req {
+ __le32 Timeout;
+ __le32 Flags; /* see SMB2_DHANDLE_FLAG_PERSISTENT */
+ __u64 Reserved;
+ __u8 CreateGuid[16];
+} __packed;
+
+struct create_durable_req_v2 {
+ struct create_context_hdr ccontext;
+ __u8 Name[8];
+ struct durable_context_v2_req dcontext;
+} __packed;
+
/* See MS-SMB2 2.2.14.2.5 */
struct create_mxac_rsp {
struct create_context_hdr ccontext;
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 55d634b5d2e2f..9e54b4301106b 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2908,7 +2908,7 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
durable_v2_blob =
(struct create_durable_req_v2 *)context;
ksmbd_debug(SMB, "Request for durable v2 open\n");
- dh_info->fp = ksmbd_lookup_fd_cguid(durable_v2_blob->CreateGuid);
+ dh_info->fp = ksmbd_lookup_fd_cguid(durable_v2_blob->dcontext.CreateGuid);
if (dh_info->fp) {
if (!memcmp(conn->ClientGUID, dh_info->fp->client_guid,
SMB2_CLIENT_GUID_SIZE)) {
@@ -2933,11 +2933,11 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||
req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {
dh_info->CreateGuid =
- durable_v2_blob->CreateGuid;
+ durable_v2_blob->dcontext.CreateGuid;
dh_info->persistent =
- le32_to_cpu(durable_v2_blob->Flags);
+ le32_to_cpu(durable_v2_blob->dcontext.Flags);
dh_info->timeout =
- le32_to_cpu(durable_v2_blob->Timeout);
+ le32_to_cpu(durable_v2_blob->dcontext.Timeout);
dh_info->type = dh_idx;
}
break;
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 48026edb7314b..189e0d955b4a5 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -66,15 +66,6 @@ struct preauth_integrity_info {
/* Apple Defined Contexts */
#define SMB2_CREATE_AAPL "AAPL"
-struct create_durable_req_v2 {
- struct create_context_hdr ccontext;
- __u8 Name[8];
- __le32 Timeout;
- __le32 Flags;
- __u8 Reserved[8];
- __u8 CreateGuid[16];
-} __packed;
-
#define DURABLE_HANDLE_MAX_TIMEOUT 300000
struct create_durable_reconn_req {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 015/686] smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 014/686] smb: move create_durable_req_v2 " Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 016/686] smb: move create_durable_rsp_v2 " Greg Kroah-Hartman
` (31 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Namjae Jeon,
Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit 81a45de432c6c7d82821fb09cb9fc1cf58629f3a ]
Modify the following places:
- some fields in "struct create_durable_reconn_v2_req" ->
struct durable_reconnect_context_v2
- create_durable_reconn_v2_req -> create_durable_handle_reconnect_v2
Then move duplicate definitions to common header file.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.h | 17 -----------------
fs/smb/common/smb2pdu.h | 16 ++++++++++++++++
fs/smb/server/smb2pdu.c | 10 +++++-----
fs/smb/server/smb2pdu.h | 11 -----------
4 files changed, 21 insertions(+), 33 deletions(-)
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index 472553e499830..a75cde061a67d 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -138,29 +138,12 @@ struct share_redirect_error_context_rsp {
/* Flags */
#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-/* See MS-SMB2 2.2.13.2.12 */
-struct durable_reconnect_context_v2 {
- struct {
- __u64 PersistentFileId;
- __u64 VolatileFileId;
- } Fid;
- __u8 CreateGuid[16];
- __le32 Flags; /* see above DHANDLE_FLAG_PERSISTENT */
-} __packed;
-
/* See MS-SMB2 2.2.14.2.12 */
struct durable_reconnect_context_v2_rsp {
__le32 Timeout;
__le32 Flags; /* see above DHANDLE_FLAG_PERSISTENT */
} __packed;
-struct create_durable_handle_reconnect_v2 {
- struct create_context_hdr ccontext;
- __u8 Name[8];
- struct durable_reconnect_context_v2 dcontext;
- __u8 Pad[4];
-} __packed;
-
/* See MS-SMB2 2.2.13.2.5 */
struct crt_twarp_ctxt {
struct create_context_hdr ccontext;
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index ca47c54afd324..7899e7706318f 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1304,6 +1304,22 @@ struct create_durable_req_v2 {
struct durable_context_v2_req dcontext;
} __packed;
+/* See MS-SMB2 2.2.13.2.12 */
+struct durable_reconnect_context_v2 {
+ struct {
+ __u64 PersistentFileId;
+ __u64 VolatileFileId;
+ } Fid;
+ __u8 CreateGuid[16];
+ __le32 Flags; /* see SMB2_DHANDLE_FLAG_PERSISTENT */
+} __packed;
+
+struct create_durable_handle_reconnect_v2 {
+ struct create_context_hdr ccontext;
+ __u8 Name[8];
+ struct durable_reconnect_context_v2 dcontext;
+} __packed;
+
/* See MS-SMB2 2.2.14.2.5 */
struct create_mxac_rsp {
struct create_context_hdr ccontext;
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 9e54b4301106b..d16df43f7c772 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2818,7 +2818,7 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
switch (dh_idx) {
case DURABLE_RECONN_V2:
{
- struct create_durable_reconn_v2_req *recon_v2;
+ struct create_durable_handle_reconnect_v2 *recon_v2;
if (dh_info->type == DURABLE_RECONN ||
dh_info->type == DURABLE_REQ_V2) {
@@ -2828,13 +2828,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
if (le16_to_cpu(context->DataOffset) +
le32_to_cpu(context->DataLength) <
- sizeof(struct create_durable_reconn_v2_req)) {
+ sizeof(struct create_durable_handle_reconnect_v2)) {
err = -EINVAL;
goto out;
}
- recon_v2 = (struct create_durable_reconn_v2_req *)context;
- persistent_id = recon_v2->Fid.PersistentFileId;
+ recon_v2 = (struct create_durable_handle_reconnect_v2 *)context;
+ persistent_id = recon_v2->dcontext.Fid.PersistentFileId;
dh_info->fp = ksmbd_lookup_durable_fd(persistent_id);
if (!dh_info->fp) {
ksmbd_debug(SMB, "Failed to get durable handle state\n");
@@ -2842,7 +2842,7 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
goto out;
}
- if (memcmp(dh_info->fp->create_guid, recon_v2->CreateGuid,
+ if (memcmp(dh_info->fp->create_guid, recon_v2->dcontext.CreateGuid,
SMB2_CREATE_GUID_SIZE)) {
err = -EBADF;
ksmbd_put_durable_fd(dh_info->fp);
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 189e0d955b4a5..8ef681f7075ad 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -80,17 +80,6 @@ struct create_durable_reconn_req {
} Data;
} __packed;
-struct create_durable_reconn_v2_req {
- struct create_context_hdr ccontext;
- __u8 Name[8];
- struct {
- __u64 PersistentFileId;
- __u64 VolatileFileId;
- } Fid;
- __u8 CreateGuid[16];
- __le32 Flags;
-} __packed;
-
struct create_alloc_size_req {
struct create_context_hdr ccontext;
__u8 Name[8];
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 016/686] smb: move create_durable_rsp_v2 to common/smb2pdu.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 015/686] smb: move create_durable_handle_reconnect_v2 " Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 017/686] smb: move some duplicate definitions " Greg Kroah-Hartman
` (30 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Namjae Jeon,
Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit 96721fd292264d712b7b9a51752ab87de5035db4 ]
Modify the following places:
- some fields in "struct create_durable_v2_rsp" ->
struct durable_context_v2_rsp
- durable_reconnect_context_v2_rsp -> durable_context_v2_rsp
- create_durable_v2_rsp -> create_durable_rsp_v2
Then move them to common header file.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.h | 6 ------
fs/smb/common/smb2pdu.h | 12 ++++++++++++
fs/smb/server/oplock.c | 8 ++++----
fs/smb/server/smb2ops.c | 6 +++---
fs/smb/server/smb2pdu.h | 6 ------
5 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index a75cde061a67d..be0a4f5b26c2e 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -138,12 +138,6 @@ struct share_redirect_error_context_rsp {
/* Flags */
#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-/* See MS-SMB2 2.2.14.2.12 */
-struct durable_reconnect_context_v2_rsp {
- __le32 Timeout;
- __le32 Flags; /* see above DHANDLE_FLAG_PERSISTENT */
-} __packed;
-
/* See MS-SMB2 2.2.13.2.5 */
struct crt_twarp_ctxt {
struct create_context_hdr ccontext;
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 7899e7706318f..52250409efc8e 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1320,6 +1320,18 @@ struct create_durable_handle_reconnect_v2 {
struct durable_reconnect_context_v2 dcontext;
} __packed;
+/* See MS-SMB2 2.2.14.2.12 */
+struct durable_context_v2_rsp {
+ __le32 Timeout;
+ __le32 Flags; /* see SMB2_DHANDLE_FLAG_PERSISTENT */
+} __packed;
+
+struct create_durable_rsp_v2 {
+ struct create_context_hdr ccontext;
+ __u8 Name[8];
+ struct durable_context_v2_rsp dcontext;
+} __packed;
+
/* See MS-SMB2 2.2.14.2.5 */
struct create_mxac_rsp {
struct create_context_hdr ccontext;
diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 90cd8c962f785..c6a6c1181be66 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1858,9 +1858,9 @@ void create_durable_rsp_buf(char *cc)
*/
void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp)
{
- struct create_durable_v2_rsp *buf;
+ struct create_durable_rsp_v2 *buf;
- buf = (struct create_durable_v2_rsp *)cc;
+ buf = (struct create_durable_rsp_v2 *)cc;
memset(buf, 0, sizeof(struct create_durable_rsp));
buf->ccontext.DataOffset = cpu_to_le16(offsetof
(struct create_durable_rsp, Data));
@@ -1874,9 +1874,9 @@ void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp)
buf->Name[2] = '2';
buf->Name[3] = 'Q';
- buf->Timeout = cpu_to_le32(fp->durable_timeout);
+ buf->dcontext.Timeout = cpu_to_le32(fp->durable_timeout);
if (fp->is_persistent)
- buf->Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
+ buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
}
/**
diff --git a/fs/smb/server/smb2ops.c b/fs/smb/server/smb2ops.c
index 4c50b7f57f763..5aa8e63f31902 100644
--- a/fs/smb/server/smb2ops.c
+++ b/fs/smb/server/smb2ops.c
@@ -59,7 +59,7 @@ static struct smb_version_values smb30_server_values = {
.cap_large_files = SMB2_LARGE_FILES,
.create_lease_size = sizeof(struct create_lease_v2),
.create_durable_size = sizeof(struct create_durable_rsp),
- .create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+ .create_durable_v2_size = sizeof(struct create_durable_rsp_v2),
.create_mxac_size = sizeof(struct create_mxac_rsp),
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
@@ -86,7 +86,7 @@ static struct smb_version_values smb302_server_values = {
.cap_large_files = SMB2_LARGE_FILES,
.create_lease_size = sizeof(struct create_lease_v2),
.create_durable_size = sizeof(struct create_durable_rsp),
- .create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+ .create_durable_v2_size = sizeof(struct create_durable_rsp_v2),
.create_mxac_size = sizeof(struct create_mxac_rsp),
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
@@ -113,7 +113,7 @@ static struct smb_version_values smb311_server_values = {
.cap_large_files = SMB2_LARGE_FILES,
.create_lease_size = sizeof(struct create_lease_v2),
.create_durable_size = sizeof(struct create_durable_rsp),
- .create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+ .create_durable_v2_size = sizeof(struct create_durable_rsp_v2),
.create_mxac_size = sizeof(struct create_mxac_rsp),
.create_disk_id_size = sizeof(struct create_disk_id_rsp),
.create_posix_size = sizeof(struct create_posix_rsp),
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 8ef681f7075ad..02fbae7531cfd 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -98,12 +98,6 @@ struct create_durable_rsp {
/* See MS-SMB2 2.2.13.2.11 */
/* Flags */
#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-struct create_durable_v2_rsp {
- struct create_context_hdr ccontext;
- __u8 Name[8];
- __le32 Timeout;
- __le32 Flags;
-} __packed;
/* equivalent of the contents of SMB3.1.1 POSIX open context response */
struct create_posix_rsp {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 017/686] smb: move some duplicate definitions to common/smb2pdu.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 016/686] smb: move create_durable_rsp_v2 " Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 018/686] smb: move list of FileSystemAttributes to common/fscc.h Greg Kroah-Hartman
` (29 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, ZhangGuoDong,
Namjae Jeon, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <zhangguodong@kylinos.cn>
[ Upstream commit 1172d8598499a006d172bb24bebaa3fdc99064a8 ]
In order to maintain the code more easily, move duplicate definitions to
common header file.
There are only 4 different definitions, the client uses cpu_to_le16()
but the server does not:
- RSS_CAPABLE
- RDMA_CAPABLE
- INTERNETWORK
- INTERNETWORKV6
The other definitions are exactly the same on both client and server.
The struct smb_hdr is defined in MS-CIFS and MS-SMB, but it's also used by
SMB2 and SMB3, so move it to the common smb2pdu.h.
Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifspdu.h | 135 +----------------------------
fs/smb/client/smb2pdu.h | 21 -----
fs/smb/common/smb2pdu.h | 172 +++++++++++++++++++++++++++++++++++--
fs/smb/server/smb2pdu.c | 8 +-
fs/smb/server/smb2pdu.h | 19 ----
fs/smb/server/smb_common.h | 75 +---------------
6 files changed, 173 insertions(+), 257 deletions(-)
diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h
index c86a329e58221..212cd57357ce2 100644
--- a/fs/smb/client/cifspdu.h
+++ b/fs/smb/client/cifspdu.h
@@ -12,6 +12,7 @@
#include <net/sock.h>
#include <linux/unaligned.h>
#include "../common/smbfsctl.h"
+#include "../common/smb2pdu.h"
#define CIFS_PROT 0
#define POSIX_PROT (CIFS_PROT+1)
@@ -180,98 +181,7 @@
#define SMBFLG2_ERR_STATUS cpu_to_le16(0x4000)
#define SMBFLG2_UNICODE cpu_to_le16(0x8000)
-/*
- * These are the file access permission bits defined in CIFS for the
- * NTCreateAndX as well as the level 0x107
- * TRANS2_QUERY_PATH_INFORMATION API. The level 0x107, SMB_QUERY_FILE_ALL_INFO
- * responds with the AccessFlags.
- * The AccessFlags specifies the access permissions a caller has to the
- * file and can have any suitable combination of the following values:
- */
-
-#define FILE_READ_DATA 0x00000001 /* Data can be read from the file */
- /* or directory child entries can */
- /* be listed together with the */
- /* associated child attributes */
- /* (so the FILE_READ_ATTRIBUTES on */
- /* the child entry is not needed) */
-#define FILE_WRITE_DATA 0x00000002 /* Data can be written to the file */
- /* or new file can be created in */
- /* the directory */
-#define FILE_APPEND_DATA 0x00000004 /* Data can be appended to the file */
- /* (for non-local files over SMB it */
- /* is same as FILE_WRITE_DATA) */
- /* or new subdirectory can be */
- /* created in the directory */
-#define FILE_READ_EA 0x00000008 /* Extended attributes associated */
- /* with the file can be read */
-#define FILE_WRITE_EA 0x00000010 /* Extended attributes associated */
- /* with the file can be written */
-#define FILE_EXECUTE 0x00000020 /*Data can be read into memory from */
- /* the file using system paging I/O */
- /* for executing the file / script */
- /* or right to traverse directory */
- /* (but by default all users have */
- /* directory bypass traverse */
- /* privilege and do not need this */
- /* permission on directories at all)*/
-#define FILE_DELETE_CHILD 0x00000040 /* Child entry can be deleted from */
- /* the directory (so the DELETE on */
- /* the child entry is not needed) */
-#define FILE_READ_ATTRIBUTES 0x00000080 /* Attributes associated with the */
- /* file or directory can be read */
-#define FILE_WRITE_ATTRIBUTES 0x00000100 /* Attributes associated with the */
- /* file or directory can be written */
-#define DELETE 0x00010000 /* The file or dir can be deleted */
-#define READ_CONTROL 0x00020000 /* The discretionary access control */
- /* list and ownership associated */
- /* with the file or dir can be read */
-#define WRITE_DAC 0x00040000 /* The discretionary access control */
- /* list associated with the file or */
- /* directory can be written */
-#define WRITE_OWNER 0x00080000 /* Ownership information associated */
- /* with the file/dir can be written */
-#define SYNCHRONIZE 0x00100000 /* The file handle can waited on to */
- /* synchronize with the completion */
- /* of an input/output request */
-#define SYSTEM_SECURITY 0x01000000 /* The system access control list */
- /* associated with the file or */
- /* directory can be read or written */
- /* (cannot be in DACL, can in SACL) */
-#define MAXIMUM_ALLOWED 0x02000000 /* Maximal subset of GENERIC_ALL */
- /* permissions which can be granted */
- /* (cannot be in DACL nor SACL) */
-#define GENERIC_ALL 0x10000000 /* Same as: GENERIC_EXECUTE | */
- /* GENERIC_WRITE | */
- /* GENERIC_READ | */
- /* FILE_DELETE_CHILD | */
- /* DELETE | */
- /* WRITE_DAC | */
- /* WRITE_OWNER */
- /* So GENERIC_ALL contains all bits */
- /* mentioned above except these two */
- /* SYSTEM_SECURITY MAXIMUM_ALLOWED */
-#define GENERIC_EXECUTE 0x20000000 /* Same as: FILE_EXECUTE | */
- /* FILE_READ_ATTRIBUTES | */
- /* READ_CONTROL | */
- /* SYNCHRONIZE */
-#define GENERIC_WRITE 0x40000000 /* Same as: FILE_WRITE_DATA | */
- /* FILE_APPEND_DATA | */
- /* FILE_WRITE_EA | */
- /* FILE_WRITE_ATTRIBUTES | */
- /* READ_CONTROL | */
- /* SYNCHRONIZE */
-#define GENERIC_READ 0x80000000 /* Same as: FILE_READ_DATA | */
- /* FILE_READ_EA | */
- /* FILE_READ_ATTRIBUTES | */
- /* READ_CONTROL | */
- /* SYNCHRONIZE */
-
-#define FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES)
-#define FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
- | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
-#define FILE_EXEC_RIGHTS (FILE_EXECUTE)
-
+/* Combinations of file access permission bits */
#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_WRITE_EA \
| FILE_READ_ATTRIBUTES \
| FILE_WRITE_ATTRIBUTES \
@@ -283,15 +193,6 @@
| FILE_WRITE_ATTRIBUTES \
| DELETE | READ_CONTROL | WRITE_DAC \
| WRITE_OWNER | SYNCHRONIZE)
-#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
- | FILE_READ_ATTRIBUTES \
- | FILE_WRITE_ATTRIBUTES \
- | DELETE | READ_CONTROL | WRITE_DAC \
- | WRITE_OWNER | SYNCHRONIZE)
-
-#define SET_MINIMUM_RIGHTS (FILE_READ_EA | FILE_READ_ATTRIBUTES \
- | READ_CONTROL | SYNCHRONIZE)
-
/*
* Invalid readdir handle
@@ -417,38 +318,6 @@
#define GETU16(var) (*((__u16 *)var)) /* BB check for endian issues */
#define GETU32(var) (*((__u32 *)var)) /* BB check for endian issues */
-struct smb_hdr {
- __be32 smb_buf_length; /* BB length is only two (rarely three) bytes,
- with one or two byte "type" preceding it that will be
- zero - we could mask the type byte off */
- __u8 Protocol[4];
- __u8 Command;
- union {
- struct {
- __u8 ErrorClass;
- __u8 Reserved;
- __le16 Error;
- } __attribute__((packed)) DosError;
- __le32 CifsError;
- } __attribute__((packed)) Status;
- __u8 Flags;
- __le16 Flags2; /* note: le */
- __le16 PidHigh;
- union {
- struct {
- __le32 SequenceNumber; /* le */
- __u32 Reserved; /* zero */
- } __attribute__((packed)) Sequence;
- __u8 SecuritySignature[8]; /* le */
- } __attribute__((packed)) Signature;
- __u8 pad[2];
- __u16 Tid;
- __le16 Pid;
- __u16 Uid;
- __le16 Mid;
- __u8 WordCount;
-} __attribute__((packed));
-
/* given a pointer to an smb_hdr, retrieve a void pointer to the ByteCount */
static inline void *
BCC(struct smb_hdr *smb)
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index be0a4f5b26c2e..311758398b436 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -133,11 +133,6 @@ struct share_redirect_error_context_rsp {
#define SMB2_LEASE_HANDLE_CACHING_HE 0x02
#define SMB2_LEASE_WRITE_CACHING_HE 0x04
-
-/* See MS-SMB2 2.2.13.2.11 */
-/* Flags */
-#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-
/* See MS-SMB2 2.2.13.2.5 */
struct crt_twarp_ctxt {
struct create_context_hdr ccontext;
@@ -204,22 +199,6 @@ struct network_resiliency_req {
} __packed;
/* There is no buffer for the response ie no struct network_resiliency_rsp */
-#define RSS_CAPABLE cpu_to_le32(0x00000001)
-#define RDMA_CAPABLE cpu_to_le32(0x00000002)
-
-#define INTERNETWORK cpu_to_le16(0x0002)
-#define INTERNETWORKV6 cpu_to_le16(0x0017)
-
-struct network_interface_info_ioctl_rsp {
- __le32 Next; /* next interface. zero if this is last one */
- __le32 IfIndex;
- __le32 Capability; /* RSS or RDMA Capable */
- __le32 Reserved;
- __le64 LinkSpeed;
- __le16 Family;
- __u8 Buffer[126];
-} __packed;
-
#define NO_FILE_ID 0xFFFFFFFFFFFFFFFFULL /* general ioctls to srv not to file */
struct compress_ioctl {
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 52250409efc8e..7377b5a9f8a55 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1149,12 +1149,6 @@ struct smb2_server_client_notification {
#define FILE_OVERWRITE_IF_LE cpu_to_le32(0x00000005)
#define FILE_CREATE_MASK_LE cpu_to_le32(0x00000007)
-#define FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA \
- | FILE_READ_ATTRIBUTES)
-#define FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
- | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
-#define FILE_EXEC_RIGHTS (FILE_EXECUTE)
-
/* CreateOptions Flags */
#define FILE_DIRECTORY_FILE_LE cpu_to_le32(0x00000001)
/* same as #define CREATE_NOT_FILE_LE cpu_to_le32(0x00000001) */
@@ -1290,6 +1284,14 @@ struct create_mxac_req {
__le64 Timestamp;
} __packed;
+/*
+ * Flags
+ * See MS-SMB2 2.2.13.2.11
+ * MS-SMB2 2.2.13.2.12
+ * MS-SMB2 2.2.14.2.12
+ */
+#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
+
/* See MS-SMB2 2.2.13.2.11 */
struct durable_context_v2_req {
__le32 Timeout;
@@ -1490,6 +1492,26 @@ struct smb_sockaddr_in6 {
__be32 ScopeId;
} __packed;
+/* See MS-SMB2 2.2.32.5 and MS-SMB2 2.2.32.5.1 */
+#define RSS_CAPABLE cpu_to_le32(0x00000001)
+#define RDMA_CAPABLE cpu_to_le32(0x00000002)
+#define INTERNETWORK cpu_to_le16(0x0002)
+#define INTERNETWORKV6 cpu_to_le16(0x0017)
+struct network_interface_info_ioctl_rsp {
+ __le32 Next; /* next interface. zero if this is last one */
+ __le32 IfIndex;
+ __le32 Capability; /* RSS or RDMA Capable */
+ __le32 Reserved;
+ __le64 LinkSpeed;
+ union {
+ char SockAddr_Storage[128];
+ struct {
+ __le16 Family;
+ __u8 Buffer[126];
+ };
+ };
+} __packed;
+
/* this goes in the ioctl buffer when doing FSCTL_SET_ZERO_DATA */
struct file_zero_data_information {
__le64 FileOffset;
@@ -1979,6 +2001,144 @@ struct smb2_lease_ack {
__le64 LeaseDuration;
} __packed;
+/*
+ * See MS-CIFS 2.2.3.1
+ * MS-SMB 2.2.3.1
+ */
+struct smb_hdr {
+ __be32 smb_buf_length; /* BB length is only two (rarely three) bytes,
+ with one or two byte "type" preceding it that will be
+ zero - we could mask the type byte off */
+ __u8 Protocol[4];
+ __u8 Command;
+ union {
+ struct {
+ __u8 ErrorClass;
+ __u8 Reserved;
+ __le16 Error;
+ } __packed DosError;
+ __le32 CifsError;
+ } __packed Status;
+ __u8 Flags;
+ __le16 Flags2; /* note: le */
+ __le16 PidHigh;
+ union {
+ struct {
+ __le32 SequenceNumber; /* le */
+ __u32 Reserved; /* zero */
+ } __packed Sequence;
+ __u8 SecuritySignature[8]; /* le */
+ } __packed Signature;
+ __u8 pad[2];
+ __u16 Tid;
+ __le16 Pid;
+ __u16 Uid;
+ __le16 Mid;
+ __u8 WordCount;
+} __packed;
+
#define OP_BREAK_STRUCT_SIZE_20 24
#define OP_BREAK_STRUCT_SIZE_21 36
+
+/*
+ * See MS-SMB2 2.2.13.1.1
+ * MS-SMB 2.2.1.4.1
+ * These are the file access permission bits defined in CIFS for the
+ * NTCreateAndX as well as the level 0x107
+ * TRANS2_QUERY_PATH_INFORMATION API. The level 0x107, SMB_QUERY_FILE_ALL_INFO
+ * responds with the AccessFlags.
+ * The AccessFlags specifies the access permissions a caller has to the
+ * file and can have any suitable combination of the following values:
+ */
+#define FILE_READ_DATA 0x00000001 /* Data can be read from the file */
+ /* or directory child entries can */
+ /* be listed together with the */
+ /* associated child attributes */
+ /* (so the FILE_READ_ATTRIBUTES on */
+ /* the child entry is not needed) */
+#define FILE_WRITE_DATA 0x00000002 /* Data can be written to the file */
+ /* or new file can be created in */
+ /* the directory */
+#define FILE_APPEND_DATA 0x00000004 /* Data can be appended to the file */
+ /* (for non-local files over SMB it */
+ /* is same as FILE_WRITE_DATA) */
+ /* or new subdirectory can be */
+ /* created in the directory */
+#define FILE_READ_EA 0x00000008 /* Extended attributes associated */
+ /* with the file can be read */
+#define FILE_WRITE_EA 0x00000010 /* Extended attributes associated */
+ /* with the file can be written */
+#define FILE_EXECUTE 0x00000020 /*Data can be read into memory from */
+ /* the file using system paging I/O */
+ /* for executing the file / script */
+ /* or right to traverse directory */
+ /* (but by default all users have */
+ /* directory bypass traverse */
+ /* privilege and do not need this */
+ /* permission on directories at all)*/
+#define FILE_DELETE_CHILD 0x00000040 /* Child entry can be deleted from */
+ /* the directory (so the DELETE on */
+ /* the child entry is not needed) */
+#define FILE_READ_ATTRIBUTES 0x00000080 /* Attributes associated with the */
+ /* file or directory can be read */
+#define FILE_WRITE_ATTRIBUTES 0x00000100 /* Attributes associated with the */
+ /* file or directory can be written */
+#define DELETE 0x00010000 /* The file or dir can be deleted */
+#define READ_CONTROL 0x00020000 /* The discretionary access control */
+ /* list and ownership associated */
+ /* with the file or dir can be read */
+#define WRITE_DAC 0x00040000 /* The discretionary access control */
+ /* list associated with the file or */
+ /* directory can be written */
+#define WRITE_OWNER 0x00080000 /* Ownership information associated */
+ /* with the file/dir can be written */
+#define SYNCHRONIZE 0x00100000 /* The file handle can waited on to */
+ /* synchronize with the completion */
+ /* of an input/output request */
+#define SYSTEM_SECURITY 0x01000000 /* The system access control list */
+ /* associated with the file or */
+ /* directory can be read or written */
+ /* (cannot be in DACL, can in SACL) */
+#define MAXIMUM_ALLOWED 0x02000000 /* Maximal subset of GENERIC_ALL */
+ /* permissions which can be granted */
+ /* (cannot be in DACL nor SACL) */
+#define GENERIC_ALL 0x10000000 /* Same as: GENERIC_EXECUTE | */
+ /* GENERIC_WRITE | */
+ /* GENERIC_READ | */
+ /* FILE_DELETE_CHILD | */
+ /* DELETE | */
+ /* WRITE_DAC | */
+ /* WRITE_OWNER */
+ /* So GENERIC_ALL contains all bits */
+ /* mentioned above except these two */
+ /* SYSTEM_SECURITY MAXIMUM_ALLOWED */
+#define GENERIC_EXECUTE 0x20000000 /* Same as: FILE_EXECUTE | */
+ /* FILE_READ_ATTRIBUTES | */
+ /* READ_CONTROL | */
+ /* SYNCHRONIZE */
+#define GENERIC_WRITE 0x40000000 /* Same as: FILE_WRITE_DATA | */
+ /* FILE_APPEND_DATA | */
+ /* FILE_WRITE_EA | */
+ /* FILE_WRITE_ATTRIBUTES | */
+ /* READ_CONTROL | */
+ /* SYNCHRONIZE */
+#define GENERIC_READ 0x80000000 /* Same as: FILE_READ_DATA | */
+ /* FILE_READ_EA | */
+ /* FILE_READ_ATTRIBUTES | */
+ /* READ_CONTROL | */
+ /* SYNCHRONIZE */
+
+/* Combinations of file access permission bits */
+#define FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES)
+#define FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+ | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
+#define FILE_EXEC_RIGHTS (FILE_EXECUTE)
+#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
+ | FILE_READ_ATTRIBUTES \
+ | FILE_WRITE_ATTRIBUTES \
+ | DELETE | READ_CONTROL | WRITE_DAC \
+ | WRITE_OWNER | SYNCHRONIZE)
+#define SET_MINIMUM_RIGHTS (FILE_READ_EA | FILE_READ_ATTRIBUTES \
+ | READ_CONTROL | SYNCHRONIZE)
+
#endif /* _COMMON_SMB2PDU_H */
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index d16df43f7c772..33b4708cc214c 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8263,9 +8263,9 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
nii_rsp->Capability = 0;
if (netdev->real_num_tx_queues > 1)
- nii_rsp->Capability |= cpu_to_le32(RSS_CAPABLE);
+ nii_rsp->Capability |= RSS_CAPABLE;
if (ksmbd_rdma_capable_netdev(netdev))
- nii_rsp->Capability |= cpu_to_le32(RDMA_CAPABLE);
+ nii_rsp->Capability |= RDMA_CAPABLE;
nii_rsp->Next = cpu_to_le32(152);
nii_rsp->Reserved = 0;
@@ -8291,7 +8291,7 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
if (!ipv4_set) {
struct in_device *idev;
- sockaddr_storage->Family = cpu_to_le16(INTERNETWORK);
+ sockaddr_storage->Family = INTERNETWORK;
sockaddr_storage->addr4.Port = 0;
idev = __in_dev_get_rtnl(netdev);
@@ -8307,7 +8307,7 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
struct inet6_ifaddr *ifa;
__u8 *ipv6_addr = sockaddr_storage->addr6.IPv6Address;
- sockaddr_storage->Family = cpu_to_le16(INTERNETWORKV6);
+ sockaddr_storage->Family = INTERNETWORKV6;
sockaddr_storage->addr6.Port = 0;
sockaddr_storage->addr6.FlowInfo = 0;
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 02fbae7531cfd..0a294378c73d3 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -95,10 +95,6 @@ struct create_durable_rsp {
} Data;
} __packed;
-/* See MS-SMB2 2.2.13.2.11 */
-/* Flags */
-#define SMB2_DHANDLE_FLAG_PERSISTENT 0x00000002
-
/* equivalent of the contents of SMB3.1.1 POSIX open context response */
struct create_posix_rsp {
struct create_context_hdr ccontext;
@@ -112,9 +108,6 @@ struct create_posix_rsp {
#define SMB2_0_IOCTL_IS_FSCTL 0x00000001
-#define INTERNETWORK 0x0002
-#define INTERNETWORKV6 0x0017
-
struct sockaddr_storage_rsp {
__le16 Family;
union {
@@ -123,18 +116,6 @@ struct sockaddr_storage_rsp {
};
} __packed;
-#define RSS_CAPABLE 0x00000001
-#define RDMA_CAPABLE 0x00000002
-
-struct network_interface_info_ioctl_rsp {
- __le32 Next; /* next interface. zero if this is last one */
- __le32 IfIndex;
- __le32 Capability; /* RSS or RDMA Capable */
- __le32 Reserved;
- __le64 LinkSpeed;
- char SockAddr_Storage[128];
-} __packed;
-
struct file_object_buf_type1_ioctl_rsp {
__u8 ObjectId[16];
__u8 BirthVolumeId[16];
diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
index 95062e922de93..4568896273bec 100644
--- a/fs/smb/server/smb_common.h
+++ b/fs/smb/server/smb_common.h
@@ -77,42 +77,7 @@
#define FILE_CASE_PRESERVED_NAMES 0x00000002
#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
-#define FILE_READ_DATA 0x00000001 /* Data can be read from the file */
-#define FILE_WRITE_DATA 0x00000002 /* Data can be written to the file */
-#define FILE_APPEND_DATA 0x00000004 /* Data can be appended to the file */
-#define FILE_READ_EA 0x00000008 /* Extended attributes associated */
-/* with the file can be read */
-#define FILE_WRITE_EA 0x00000010 /* Extended attributes associated */
-/* with the file can be written */
-#define FILE_EXECUTE 0x00000020 /*Data can be read into memory from */
-/* the file using system paging I/O */
-#define FILE_DELETE_CHILD 0x00000040
-#define FILE_READ_ATTRIBUTES 0x00000080 /* Attributes associated with the */
-/* file can be read */
-#define FILE_WRITE_ATTRIBUTES 0x00000100 /* Attributes associated with the */
-/* file can be written */
-#define DELETE 0x00010000 /* The file can be deleted */
-#define READ_CONTROL 0x00020000 /* The access control list and */
-/* ownership associated with the */
-/* file can be read */
-#define WRITE_DAC 0x00040000 /* The access control list and */
-/* ownership associated with the */
-/* file can be written. */
-#define WRITE_OWNER 0x00080000 /* Ownership information associated */
-/* with the file can be written */
-#define SYNCHRONIZE 0x00100000 /* The file handle can waited on to */
-/* synchronize with the completion */
-/* of an input/output request */
-#define GENERIC_ALL 0x10000000
-#define GENERIC_EXECUTE 0x20000000
-#define GENERIC_WRITE 0x40000000
-#define GENERIC_READ 0x80000000
-/* In summary - Relevant file */
-/* access flags from CIFS are */
-/* file_read_data, file_write_data */
-/* file_execute, file_read_attributes*/
-/* write_dac, and delete. */
-
+/* Combinations of file access permission bits */
#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA \
| FILE_READ_ATTRIBUTES \
| DELETE | READ_CONTROL | WRITE_DAC \
@@ -123,14 +88,6 @@
| FILE_WRITE_ATTRIBUTES \
| DELETE | READ_CONTROL | WRITE_DAC \
| WRITE_OWNER | SYNCHRONIZE)
-#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
- | FILE_READ_ATTRIBUTES \
- | FILE_WRITE_ATTRIBUTES \
- | DELETE | READ_CONTROL | WRITE_DAC \
- | WRITE_OWNER | SYNCHRONIZE)
-
-#define SET_MINIMUM_RIGHTS (FILE_READ_EA | FILE_READ_ATTRIBUTES \
- | READ_CONTROL | SYNCHRONIZE)
/* generic flags for file open */
#define GENERIC_READ_FLAGS (READ_CONTROL | FILE_READ_DATA | \
@@ -162,36 +119,6 @@
#define SMBFLG2_ERR_STATUS cpu_to_le16(0x4000)
#define SMBFLG2_UNICODE cpu_to_le16(0x8000)
-struct smb_hdr {
- __be32 smb_buf_length;
- __u8 Protocol[4];
- __u8 Command;
- union {
- struct {
- __u8 ErrorClass;
- __u8 Reserved;
- __le16 Error;
- } __packed DosError;
- __le32 CifsError;
- } __packed Status;
- __u8 Flags;
- __le16 Flags2; /* note: le */
- __le16 PidHigh;
- union {
- struct {
- __le32 SequenceNumber; /* le */
- __u32 Reserved; /* zero */
- } __packed Sequence;
- __u8 SecuritySignature[8]; /* le */
- } __packed Signature;
- __u8 pad[2];
- __le16 Tid;
- __le16 Pid;
- __le16 Uid;
- __le16 Mid;
- __u8 WordCount;
-} __packed;
-
struct smb_negotiate_req {
struct smb_hdr hdr; /* wct = 0 */
__le16 ByteCount;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 018/686] smb: move list of FileSystemAttributes to common/fscc.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 017/686] smb: move some duplicate definitions " Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 019/686] smb: move some duplicate struct definitions " Greg Kroah-Hartman
` (28 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Namjae Jeon,
Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit 84d8d4cf8873b4a9da0d76e9ba9d94ec88311cfd ]
These definitions are exactly the same on both client and server,
so move them to new common header file.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifsglob.h | 1 +
fs/smb/client/cifspdu.h | 27 ------------------------
fs/smb/common/fscc.h | 42 ++++++++++++++++++++++++++++++++++++++
fs/smb/server/smb_common.h | 28 +------------------------
4 files changed, 44 insertions(+), 54 deletions(-)
create mode 100644 fs/smb/common/fscc.h
diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h
index d529446e4984b..2d5a4a26c931e 100644
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -28,6 +28,7 @@
#include <uapi/linux/cifs/cifs_mount.h>
#include "../common/cifsglob.h"
#include "../common/smb2pdu.h"
+#include "../common/fscc.h"
#include "smb2pdu.h"
#include <linux/filelock.h>
diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h
index 212cd57357ce2..3ea8aa2a8d2db 100644
--- a/fs/smb/client/cifspdu.h
+++ b/fs/smb/client/cifspdu.h
@@ -2100,33 +2100,6 @@ typedef struct {
/* minimum includes first three fields, and empty FS Name */
#define MIN_FS_ATTR_INFO_SIZE 12
-
-/* List of FileSystemAttributes - see 2.5.1 of MS-FSCC */
-#define FILE_SUPPORTS_SPARSE_VDL 0x10000000 /* faster nonsparse extend */
-#define FILE_SUPPORTS_BLOCK_REFCOUNTING 0x08000000 /* allow ioctl dup extents */
-#define FILE_SUPPORT_INTEGRITY_STREAMS 0x04000000
-#define FILE_SUPPORTS_USN_JOURNAL 0x02000000
-#define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000
-#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
-#define FILE_SUPPORTS_HARD_LINKS 0x00400000
-#define FILE_SUPPORTS_TRANSACTIONS 0x00200000
-#define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000
-#define FILE_READ_ONLY_VOLUME 0x00080000
-#define FILE_NAMED_STREAMS 0x00040000
-#define FILE_SUPPORTS_ENCRYPTION 0x00020000
-#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
-#define FILE_VOLUME_IS_COMPRESSED 0x00008000
-#define FILE_SUPPORTS_POSIX_UNLINK_RENAME 0x00000400
-#define FILE_RETURNS_CLEANUP_RESULT_INFO 0x00000200
-#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
-#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
-#define FILE_SUPPORTS_SPARSE_FILES 0x00000040
-#define FILE_VOLUME_QUOTAS 0x00000020
-#define FILE_FILE_COMPRESSION 0x00000010
-#define FILE_PERSISTENT_ACLS 0x00000008
-#define FILE_UNICODE_ON_DISK 0x00000004
-#define FILE_CASE_PRESERVED_NAMES 0x00000002
-#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
typedef struct {
__le32 Attributes;
__le32 MaxPathNameComponentLength;
diff --git a/fs/smb/common/fscc.h b/fs/smb/common/fscc.h
new file mode 100644
index 0000000000000..c8bfb87232ac0
--- /dev/null
+++ b/fs/smb/common/fscc.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: LGPL-2.1 */
+/*
+ *
+ * Copyright (c) International Business Machines Corp., 2009, 2013
+ * Etersoft, 2012
+ * 2018 Samsung Electronics Co., Ltd.
+ * Author(s): Steve French (sfrench@us.ibm.com)
+ * Pavel Shilovsky (pshilovsky@samba.org) 2012
+ * Namjae Jeon (linkinjeon@kernel.org)
+ *
+ */
+#ifndef _COMMON_SMB_FSCC_H
+#define _COMMON_SMB_FSCC_H
+
+/* List of FileSystemAttributes - see MS-FSCC 2.5.1 */
+#define FILE_SUPPORTS_SPARSE_VDL 0x10000000 /* faster nonsparse extend */
+#define FILE_SUPPORTS_BLOCK_REFCOUNTING 0x08000000 /* allow ioctl dup extents */
+#define FILE_SUPPORT_INTEGRITY_STREAMS 0x04000000
+#define FILE_SUPPORTS_USN_JOURNAL 0x02000000
+#define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000
+#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
+#define FILE_SUPPORTS_HARD_LINKS 0x00400000
+#define FILE_SUPPORTS_TRANSACTIONS 0x00200000
+#define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000
+#define FILE_READ_ONLY_VOLUME 0x00080000
+#define FILE_NAMED_STREAMS 0x00040000
+#define FILE_SUPPORTS_ENCRYPTION 0x00020000
+#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
+#define FILE_VOLUME_IS_COMPRESSED 0x00008000
+#define FILE_SUPPORTS_POSIX_UNLINK_RENAME 0x00000400
+#define FILE_RETURNS_CLEANUP_RESULT_INFO 0x00000200
+#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
+#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
+#define FILE_SUPPORTS_SPARSE_FILES 0x00000040
+#define FILE_VOLUME_QUOTAS 0x00000020
+#define FILE_FILE_COMPRESSION 0x00000010
+#define FILE_PERSISTENT_ACLS 0x00000008
+#define FILE_UNICODE_ON_DISK 0x00000004
+#define FILE_CASE_PRESERVED_NAMES 0x00000002
+#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
+
+#endif /* _COMMON_SMB_FSCC_H */
diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
index 4568896273bec..bea0a250169c3 100644
--- a/fs/smb/server/smb_common.h
+++ b/fs/smb/server/smb_common.h
@@ -12,6 +12,7 @@
#include "nterr.h"
#include "../common/cifsglob.h"
#include "../common/smb2pdu.h"
+#include "../common/fscc.h"
#include "smb2pdu.h"
/* ksmbd's Specific ERRNO */
@@ -50,33 +51,6 @@
#define ATTR_NO_BUFFERING 0x20000000
#define ATTR_WRITE_THROUGH 0x80000000
-/* List of FileSystemAttributes - see 2.5.1 of MS-FSCC */
-#define FILE_SUPPORTS_SPARSE_VDL 0x10000000 /* faster nonsparse extend */
-#define FILE_SUPPORTS_BLOCK_REFCOUNTING 0x08000000 /* allow ioctl dup extents */
-#define FILE_SUPPORT_INTEGRITY_STREAMS 0x04000000
-#define FILE_SUPPORTS_USN_JOURNAL 0x02000000
-#define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000
-#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
-#define FILE_SUPPORTS_HARD_LINKS 0x00400000
-#define FILE_SUPPORTS_TRANSACTIONS 0x00200000
-#define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000
-#define FILE_READ_ONLY_VOLUME 0x00080000
-#define FILE_NAMED_STREAMS 0x00040000
-#define FILE_SUPPORTS_ENCRYPTION 0x00020000
-#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
-#define FILE_VOLUME_IS_COMPRESSED 0x00008000
-#define FILE_SUPPORTS_POSIX_UNLINK_RENAME 0x00000400
-#define FILE_RETURNS_CLEANUP_RESULT_INFO 0x00000200
-#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
-#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
-#define FILE_SUPPORTS_SPARSE_FILES 0x00000040
-#define FILE_VOLUME_QUOTAS 0x00000020
-#define FILE_FILE_COMPRESSION 0x00000010
-#define FILE_PERSISTENT_ACLS 0x00000008
-#define FILE_UNICODE_ON_DISK 0x00000004
-#define FILE_CASE_PRESERVED_NAMES 0x00000002
-#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
-
/* Combinations of file access permission bits */
#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA \
| FILE_READ_ATTRIBUTES \
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 019/686] smb: move some duplicate struct definitions to common/fscc.h
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 018/686] smb: move list of FileSystemAttributes to common/fscc.h Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 020/686] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
` (27 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, Namjae Jeon,
Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit d7edd3892d97e6746e30f36f4f13f887ec4d80ed ]
Modify the following places:
- smb2_file_ntwrk_info -> smb2_file_network_open_info
- struct filesystem_device_info -> FILE_SYSTEM_DEVICE_INFO
- struct file_directory_info -> FILE_DIRECTORY_INFO
- struct file_full_directory_info -> FILE_FULL_DIRECTORY_INFO
- struct file_both_directory_info -> FILE_BOTH_DIRECTORY_INFO
- struct file_id_full_dir_info -> FILE_ID_FULL_DIR_INFO
- struct filesystem_posix_info -> FILE_SYSTEM_POSIX_INFO
The fields of these structures are exactly the same on both client and
server, so move duplicate definitions to common header file.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: f8171804a39e ("smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifspdu.h | 91 -----------------------------
fs/smb/client/inode.c | 4 +-
fs/smb/client/readdir.c | 2 +-
fs/smb/client/smb2pdu.c | 2 +-
fs/smb/client/smb2pdu.h | 13 -----
fs/smb/common/fscc.h | 115 +++++++++++++++++++++++++++++++++++++
fs/smb/server/smb2pdu.c | 72 +++++++++++------------
fs/smb/server/smb2pdu.h | 11 ----
fs/smb/server/smb_common.h | 92 -----------------------------
fs/smb/server/vfs.c | 2 +-
10 files changed, 156 insertions(+), 248 deletions(-)
diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h
index 3ea8aa2a8d2db..c5c890cf3605a 100644
--- a/fs/smb/client/cifspdu.h
+++ b/fs/smb/client/cifspdu.h
@@ -2036,28 +2036,6 @@ typedef struct {
#define CIFS_POSIX_EXTENSIONS 0x00000010 /* support for new QFSInfo */
-typedef struct {
- /* For undefined recommended transfer size return -1 in that field */
- __le32 OptimalTransferSize; /* bsize on some os, iosize on other os */
- __le32 BlockSize;
- /* The next three fields are in terms of the block size.
- (above). If block size is unknown, 4096 would be a
- reasonable block size for a server to report.
- Note that returning the blocks/blocksavail removes need
- to make a second call (to QFSInfo level 0x103 to get this info.
- UserBlockAvail is typically less than or equal to BlocksAvail,
- if no distinction is made return the same value in each */
- __le64 TotalBlocks;
- __le64 BlocksAvail; /* bfree */
- __le64 UserBlocksAvail; /* bavail */
- /* For undefined Node fields or FSID return -1 */
- __le64 TotalFileNodes;
- __le64 FreeFileNodes;
- __le64 FileSysIdentifier; /* fsid */
- /* NB Namelen comes from FILE_SYSTEM_ATTRIBUTE_INFO call */
- /* NB flags can come from FILE_SYSTEM_DEVICE_INFO call */
-} __attribute__((packed)) FILE_SYSTEM_POSIX_INFO;
-
/* DeviceType Flags */
#define FILE_DEVICE_CD_ROM 0x00000002
#define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
@@ -2092,11 +2070,6 @@ typedef struct {
#define FILE_PORTABLE_DEVICE 0x00004000
#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
-typedef struct {
- __le32 DeviceType;
- __le32 DeviceCharacteristics;
-} __attribute__((packed)) FILE_SYSTEM_DEVICE_INFO; /* device info level 0x104 */
-
/* minimum includes first three fields, and empty FS Name */
#define MIN_FS_ATTR_INFO_SIZE 12
@@ -2332,70 +2305,6 @@ typedef struct {
};
} __attribute__((packed)) FILE_UNIX_INFO; /* level 0x202 */
-typedef struct {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- char FileName[];
-} __attribute__((packed)) FILE_DIRECTORY_INFO; /* level 0x101 FF resp data */
-
-typedef struct {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize; /* length of the xattrs */
- char FileName[];
-} __attribute__((packed)) FILE_FULL_DIRECTORY_INFO; /* level 0x102 rsp data */
-
-typedef struct {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize; /* EA size */
- __le32 Reserved;
- __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
- char FileName[];
-} __attribute__((packed)) SEARCH_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */
-
-typedef struct {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize; /* length of the xattrs */
- __u8 ShortNameLength;
- __u8 Reserved;
- __u8 ShortName[24];
- char FileName[];
-} __attribute__((packed)) FILE_BOTH_DIRECTORY_INFO; /* level 0x104 FFrsp data */
-
typedef struct {
__u32 ResumeKey;
__le16 CreationDate; /* SMB Date */
diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index 7c638b8d5490f..d9c502efe84bc 100644
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -1348,7 +1348,7 @@ static int cifs_get_fattr(struct cifs_open_info_data *data,
/* for easier reading */
FILE_ALL_INFO *fi;
FILE_DIRECTORY_INFO *fdi;
- SEARCH_ID_FULL_DIR_INFO *si;
+ FILE_ID_FULL_DIR_INFO *si;
rc = cifs_backup_query_path_info(xid, tcon, sb,
full_path,
@@ -1359,7 +1359,7 @@ static int cifs_get_fattr(struct cifs_open_info_data *data,
move_cifs_info_to_smb2(&data->fi, fi);
fdi = (FILE_DIRECTORY_INFO *)fi;
- si = (SEARCH_ID_FULL_DIR_INFO *)fi;
+ si = (FILE_ID_FULL_DIR_INFO *)fi;
cifs_dir_info_to_fattr(fattr, fdi, cifs_sb);
fattr->cf_uniqueid = le64_to_cpu(si->UniqueId);
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index b19c36f6a78b4..cf6b440f757b6 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -559,7 +559,7 @@ static void cifs_fill_dirent_full(struct cifs_dirent *de,
}
static void cifs_fill_dirent_search(struct cifs_dirent *de,
- const SEARCH_ID_FULL_DIR_INFO *info)
+ const FILE_ID_FULL_DIR_INFO *info)
{
de->name = &info->FileName[0];
de->namelen = le32_to_cpu(info->FileNameLength);
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index d8c97c1c63b5f..d0c56caed1626 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -5576,7 +5576,7 @@ smb2_parse_query_directory(struct cifs_tcon *tcon,
info_buf_size = sizeof(FILE_DIRECTORY_INFO);
break;
case SMB_FIND_FILE_ID_FULL_DIR_INFO:
- info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO);
+ info_buf_size = sizeof(FILE_ID_FULL_DIR_INFO);
break;
case SMB_FIND_FILE_POSIX_INFO:
/* note that posix payload are variable size */
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index 311758398b436..2a2f52be7d6f1 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -230,19 +230,6 @@ struct smb2_file_reparse_point_info {
__le32 Tag;
} __packed;
-struct smb2_file_network_open_info {
- struct_group_attr(network_open_info, __packed,
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 AllocationSize;
- __le64 EndOfFile;
- __le32 Attributes;
- );
- __le32 Reserved;
-} __packed; /* level 34 Query also similar returned in close rsp and open rsp */
-
/* See MS-FSCC 2.4.21 */
struct smb2_file_id_information {
__le64 VolumeSerialNumber;
diff --git a/fs/smb/common/fscc.h b/fs/smb/common/fscc.h
index c8bfb87232ac0..6fa7c65d304b5 100644
--- a/fs/smb/common/fscc.h
+++ b/fs/smb/common/fscc.h
@@ -12,6 +12,88 @@
#ifndef _COMMON_SMB_FSCC_H
#define _COMMON_SMB_FSCC_H
+/* See MS-FSCC 2.4.8 */
+typedef struct {
+ __le32 NextEntryOffset;
+ __u32 FileIndex;
+ __le64 CreationTime;
+ __le64 LastAccessTime;
+ __le64 LastWriteTime;
+ __le64 ChangeTime;
+ __le64 EndOfFile;
+ __le64 AllocationSize;
+ __le32 ExtFileAttributes;
+ __le32 FileNameLength;
+ __le32 EaSize; /* length of the xattrs */
+ __u8 ShortNameLength;
+ __u8 Reserved;
+ __u8 ShortName[24];
+ char FileName[];
+} __packed FILE_BOTH_DIRECTORY_INFO; /* level 0x104 FFrsp data */
+
+/* See MS-FSCC 2.4.10 */
+typedef struct {
+ __le32 NextEntryOffset;
+ __u32 FileIndex;
+ __le64 CreationTime;
+ __le64 LastAccessTime;
+ __le64 LastWriteTime;
+ __le64 ChangeTime;
+ __le64 EndOfFile;
+ __le64 AllocationSize;
+ __le32 ExtFileAttributes;
+ __le32 FileNameLength;
+ char FileName[];
+} __packed FILE_DIRECTORY_INFO; /* level 0x101 FF resp data */
+
+/* See MS-FSCC 2.4.14 */
+typedef struct {
+ __le32 NextEntryOffset;
+ __u32 FileIndex;
+ __le64 CreationTime;
+ __le64 LastAccessTime;
+ __le64 LastWriteTime;
+ __le64 ChangeTime;
+ __le64 EndOfFile;
+ __le64 AllocationSize;
+ __le32 ExtFileAttributes;
+ __le32 FileNameLength;
+ __le32 EaSize; /* length of the xattrs */
+ char FileName[];
+} __packed FILE_FULL_DIRECTORY_INFO; /* level 0x102 rsp data */
+
+/* See MS-FSCC 2.4.24 */
+typedef struct {
+ __le32 NextEntryOffset;
+ __u32 FileIndex;
+ __le64 CreationTime;
+ __le64 LastAccessTime;
+ __le64 LastWriteTime;
+ __le64 ChangeTime;
+ __le64 EndOfFile;
+ __le64 AllocationSize;
+ __le32 ExtFileAttributes;
+ __le32 FileNameLength;
+ __le32 EaSize; /* EA size */
+ __le32 Reserved;
+ __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
+ char FileName[];
+} __packed FILE_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */
+
+/* See MS-FSCC 2.4.34 */
+struct smb2_file_network_open_info {
+ struct_group_attr(network_open_info, __packed,
+ __le64 CreationTime;
+ __le64 LastAccessTime;
+ __le64 LastWriteTime;
+ __le64 ChangeTime;
+ __le64 AllocationSize;
+ __le64 EndOfFile;
+ __le32 Attributes;
+ );
+ __le32 Reserved;
+} __packed; /* level 34 Query also similar returned in close rsp and open rsp */
+
/* List of FileSystemAttributes - see MS-FSCC 2.5.1 */
#define FILE_SUPPORTS_SPARSE_VDL 0x10000000 /* faster nonsparse extend */
#define FILE_SUPPORTS_BLOCK_REFCOUNTING 0x08000000 /* allow ioctl dup extents */
@@ -39,4 +121,37 @@
#define FILE_CASE_PRESERVED_NAMES 0x00000002
#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
+/* See MS-FSCC 2.5.10 */
+typedef struct {
+ __le32 DeviceType;
+ __le32 DeviceCharacteristics;
+} __packed FILE_SYSTEM_DEVICE_INFO; /* device info level 0x104 */
+
+/*
+ * See POSIX Extensions to MS-FSCC 2.3.2.1
+ * Link: https://gitlab.com/samba-team/smb3-posix-spec/-/blob/master/fscc_posix_extensions.md
+ */
+typedef struct {
+ /* For undefined recommended transfer size return -1 in that field */
+ __le32 OptimalTransferSize; /* bsize on some os, iosize on other os */
+ __le32 BlockSize;
+ /* The next three fields are in terms of the block size.
+ * (above). If block size is unknown, 4096 would be a
+ * reasonable block size for a server to report.
+ * Note that returning the blocks/blocksavail removes need
+ * to make a second call (to QFSInfo level 0x103 to get this info.
+ * UserBlockAvail is typically less than or equal to BlocksAvail,
+ * if no distinction is made return the same value in each
+ */
+ __le64 TotalBlocks;
+ __le64 BlocksAvail; /* bfree */
+ __le64 UserBlocksAvail; /* bavail */
+ /* For undefined Node fields or FSID return -1 */
+ __le64 TotalFileNodes;
+ __le64 FreeFileNodes;
+ __le64 FileSysIdentifier; /* fsid */
+ /* NB Namelen comes from FILE_SYSTEM_ATTRIBUTE_INFO call */
+ /* NB flags can come from FILE_SYSTEM_DEVICE_INFO call */
+} __packed FILE_SYSTEM_POSIX_INFO;
+
#endif /* _COMMON_SMB_FSCC_H */
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 33b4708cc214c..c784aa6d9b6ad 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3965,15 +3965,15 @@ static int readdir_info_level_struct_sz(int info_level)
{
switch (info_level) {
case FILE_FULL_DIRECTORY_INFORMATION:
- return sizeof(struct file_full_directory_info);
+ return sizeof(FILE_FULL_DIRECTORY_INFO);
case FILE_BOTH_DIRECTORY_INFORMATION:
- return sizeof(struct file_both_directory_info);
+ return sizeof(FILE_BOTH_DIRECTORY_INFO);
case FILE_DIRECTORY_INFORMATION:
- return sizeof(struct file_directory_info);
+ return sizeof(FILE_DIRECTORY_INFO);
case FILE_NAMES_INFORMATION:
return sizeof(struct file_names_info);
case FILEID_FULL_DIRECTORY_INFORMATION:
- return sizeof(struct file_id_full_dir_info);
+ return sizeof(FILE_ID_FULL_DIR_INFO);
case FILEID_BOTH_DIRECTORY_INFORMATION:
return sizeof(struct file_id_both_directory_info);
case SMB_FIND_FILE_POSIX_INFO:
@@ -3988,9 +3988,9 @@ static int dentry_name(struct ksmbd_dir_info *d_info, int info_level)
switch (info_level) {
case FILE_FULL_DIRECTORY_INFORMATION:
{
- struct file_full_directory_info *ffdinfo;
+ FILE_FULL_DIRECTORY_INFO *ffdinfo;
- ffdinfo = (struct file_full_directory_info *)d_info->rptr;
+ ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->rptr;
d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset);
d_info->name = ffdinfo->FileName;
d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength);
@@ -3998,9 +3998,9 @@ static int dentry_name(struct ksmbd_dir_info *d_info, int info_level)
}
case FILE_BOTH_DIRECTORY_INFORMATION:
{
- struct file_both_directory_info *fbdinfo;
+ FILE_BOTH_DIRECTORY_INFO *fbdinfo;
- fbdinfo = (struct file_both_directory_info *)d_info->rptr;
+ fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->rptr;
d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset);
d_info->name = fbdinfo->FileName;
d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength);
@@ -4008,9 +4008,9 @@ static int dentry_name(struct ksmbd_dir_info *d_info, int info_level)
}
case FILE_DIRECTORY_INFORMATION:
{
- struct file_directory_info *fdinfo;
+ FILE_DIRECTORY_INFO *fdinfo;
- fdinfo = (struct file_directory_info *)d_info->rptr;
+ fdinfo = (FILE_DIRECTORY_INFO *)d_info->rptr;
d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset);
d_info->name = fdinfo->FileName;
d_info->name_len = le32_to_cpu(fdinfo->FileNameLength);
@@ -4028,9 +4028,9 @@ static int dentry_name(struct ksmbd_dir_info *d_info, int info_level)
}
case FILEID_FULL_DIRECTORY_INFORMATION:
{
- struct file_id_full_dir_info *dinfo;
+ FILE_ID_FULL_DIR_INFO *dinfo;
- dinfo = (struct file_id_full_dir_info *)d_info->rptr;
+ dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->rptr;
d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset);
d_info->name = dinfo->FileName;
d_info->name_len = le32_to_cpu(dinfo->FileNameLength);
@@ -4113,9 +4113,9 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
switch (info_level) {
case FILE_FULL_DIRECTORY_INFORMATION:
{
- struct file_full_directory_info *ffdinfo;
+ FILE_FULL_DIRECTORY_INFO *ffdinfo;
- ffdinfo = (struct file_full_directory_info *)kstat;
+ ffdinfo = (FILE_FULL_DIRECTORY_INFO *)kstat;
ffdinfo->FileNameLength = cpu_to_le32(conv_len);
ffdinfo->EaSize =
smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
@@ -4129,9 +4129,9 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
}
case FILE_BOTH_DIRECTORY_INFORMATION:
{
- struct file_both_directory_info *fbdinfo;
+ FILE_BOTH_DIRECTORY_INFO *fbdinfo;
- fbdinfo = (struct file_both_directory_info *)kstat;
+ fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)kstat;
fbdinfo->FileNameLength = cpu_to_le32(conv_len);
fbdinfo->EaSize =
smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
@@ -4147,9 +4147,9 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
}
case FILE_DIRECTORY_INFORMATION:
{
- struct file_directory_info *fdinfo;
+ FILE_DIRECTORY_INFO *fdinfo;
- fdinfo = (struct file_directory_info *)kstat;
+ fdinfo = (FILE_DIRECTORY_INFO *)kstat;
fdinfo->FileNameLength = cpu_to_le32(conv_len);
if (d_info->hide_dot_file && d_info->name[0] == '.')
fdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
@@ -4169,9 +4169,9 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
}
case FILEID_FULL_DIRECTORY_INFORMATION:
{
- struct file_id_full_dir_info *dinfo;
+ FILE_ID_FULL_DIR_INFO *dinfo;
- dinfo = (struct file_id_full_dir_info *)kstat;
+ dinfo = (FILE_ID_FULL_DIR_INFO *)kstat;
dinfo->FileNameLength = cpu_to_le32(conv_len);
dinfo->EaSize =
smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
@@ -4375,9 +4375,9 @@ static int reserve_populate_dentry(struct ksmbd_dir_info *d_info,
switch (info_level) {
case FILE_FULL_DIRECTORY_INFORMATION:
{
- struct file_full_directory_info *ffdinfo;
+ FILE_FULL_DIRECTORY_INFO *ffdinfo;
- ffdinfo = (struct file_full_directory_info *)d_info->wptr;
+ ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->wptr;
memcpy(ffdinfo->FileName, d_info->name, d_info->name_len);
ffdinfo->FileName[d_info->name_len] = 0x00;
ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
@@ -4386,9 +4386,9 @@ static int reserve_populate_dentry(struct ksmbd_dir_info *d_info,
}
case FILE_BOTH_DIRECTORY_INFORMATION:
{
- struct file_both_directory_info *fbdinfo;
+ FILE_BOTH_DIRECTORY_INFO *fbdinfo;
- fbdinfo = (struct file_both_directory_info *)d_info->wptr;
+ fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->wptr;
memcpy(fbdinfo->FileName, d_info->name, d_info->name_len);
fbdinfo->FileName[d_info->name_len] = 0x00;
fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
@@ -4397,9 +4397,9 @@ static int reserve_populate_dentry(struct ksmbd_dir_info *d_info,
}
case FILE_DIRECTORY_INFORMATION:
{
- struct file_directory_info *fdinfo;
+ FILE_DIRECTORY_INFO *fdinfo;
- fdinfo = (struct file_directory_info *)d_info->wptr;
+ fdinfo = (FILE_DIRECTORY_INFO *)d_info->wptr;
memcpy(fdinfo->FileName, d_info->name, d_info->name_len);
fdinfo->FileName[d_info->name_len] = 0x00;
fdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
@@ -4419,9 +4419,9 @@ static int reserve_populate_dentry(struct ksmbd_dir_info *d_info,
}
case FILEID_FULL_DIRECTORY_INFORMATION:
{
- struct file_id_full_dir_info *dinfo;
+ FILE_ID_FULL_DIR_INFO *dinfo;
- dinfo = (struct file_id_full_dir_info *)d_info->wptr;
+ dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->wptr;
memcpy(dinfo->FileName, d_info->name, d_info->name_len);
dinfo->FileName[d_info->name_len] = 0x00;
dinfo->FileNameLength = cpu_to_le32(d_info->name_len);
@@ -4686,7 +4686,7 @@ int smb2_query_dir(struct ksmbd_work *work)
goto err_out;
} else {
no_buf_len:
- ((struct file_directory_info *)
+ ((FILE_DIRECTORY_INFO *)
((char *)rsp->Buffer + d_info.last_entry_offset))
->NextEntryOffset = 0;
if (d_info.data_count >= d_info.last_entry_off_align)
@@ -5341,7 +5341,7 @@ static int get_file_internal_info(struct smb2_query_info_rsp *rsp,
static int get_file_network_open_info(struct smb2_query_info_rsp *rsp,
struct ksmbd_file *fp, void *rsp_org)
{
- struct smb2_file_ntwrk_info *file_info;
+ struct smb2_file_network_open_info *file_info;
struct kstat stat;
u64 time;
int ret;
@@ -5357,7 +5357,7 @@ static int get_file_network_open_info(struct smb2_query_info_rsp *rsp,
if (ret)
return ret;
- file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer;
+ file_info = (struct smb2_file_network_open_info *)rsp->Buffer;
file_info->CreationTime = cpu_to_le64(fp->create_time);
time = ksmbd_UnixTimeToNT(stat.atime);
@@ -5376,7 +5376,7 @@ static int get_file_network_open_info(struct smb2_query_info_rsp *rsp,
}
file_info->Reserved = cpu_to_le32(0);
rsp->OutputBufferLength =
- cpu_to_le32(sizeof(struct smb2_file_ntwrk_info));
+ cpu_to_le32(sizeof(struct smb2_file_network_open_info));
return 0;
}
@@ -5714,9 +5714,9 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work,
switch (fsinfoclass) {
case FS_DEVICE_INFORMATION:
{
- struct filesystem_device_info *info;
+ FILE_SYSTEM_DEVICE_INFO *info;
- info = (struct filesystem_device_info *)rsp->Buffer;
+ info = (FILE_SYSTEM_DEVICE_INFO *)rsp->Buffer;
info->DeviceType = cpu_to_le32(FILE_DEVICE_DISK);
info->DeviceCharacteristics =
@@ -5882,14 +5882,14 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work,
}
case FS_POSIX_INFORMATION:
{
- struct filesystem_posix_info *info;
+ FILE_SYSTEM_POSIX_INFO *info;
if (!work->tcon->posix_extensions) {
pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
path_put(&path);
return -EOPNOTSUPP;
} else {
- info = (struct filesystem_posix_info *)(rsp->Buffer);
+ info = (FILE_SYSTEM_POSIX_INFO *)(rsp->Buffer);
info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize);
info->BlockSize = cpu_to_le32(stfs.f_bsize);
info->TotalBlocks = cpu_to_le64(stfs.f_blocks);
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 0a294378c73d3..ea07c5552f41e 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -224,17 +224,6 @@ struct smb2_file_stream_info {
char StreamName[];
} __packed;
-struct smb2_file_ntwrk_info {
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 AllocationSize;
- __le64 EndOfFile;
- __le32 Attributes;
- __le32 Reserved;
-} __packed;
-
struct smb2_file_standard_info {
__le64 AllocationSize;
__le64 EndOfFile;
diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
index bea0a250169c3..d6f72195482f9 100644
--- a/fs/smb/server/smb_common.h
+++ b/fs/smb/server/smb_common.h
@@ -112,11 +112,6 @@ struct filesystem_attribute_info {
__le16 FileSystemName[]; /* do not have to save this - get subset? */
} __packed;
-struct filesystem_device_info {
- __le32 DeviceType;
- __le32 DeviceCharacteristics;
-} __packed; /* device info level 0x104 */
-
struct filesystem_vol_info {
__le64 VolumeCreationTime;
__le32 SerialNumber;
@@ -148,20 +143,6 @@ struct object_id_info {
struct fs_extended_info extended_info;
} __packed;
-struct file_directory_info {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- char FileName[];
-} __packed; /* level 0x101 FF resp data */
-
struct file_names_info {
__le32 NextEntryOffset;
__u32 FileIndex;
@@ -169,39 +150,6 @@ struct file_names_info {
char FileName[];
} __packed; /* level 0xc FF resp data */
-struct file_full_directory_info {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize;
- char FileName[];
-} __packed; /* level 0x102 FF resp */
-
-struct file_both_directory_info {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize; /* length of the xattrs */
- __u8 ShortNameLength;
- __u8 Reserved;
- __u8 ShortName[24];
- char FileName[];
-} __packed; /* level 0x104 FFrsp data */
-
struct file_id_both_directory_info {
__le32 NextEntryOffset;
__u32 FileIndex;
@@ -222,46 +170,6 @@ struct file_id_both_directory_info {
char FileName[];
} __packed;
-struct file_id_full_dir_info {
- __le32 NextEntryOffset;
- __u32 FileIndex;
- __le64 CreationTime;
- __le64 LastAccessTime;
- __le64 LastWriteTime;
- __le64 ChangeTime;
- __le64 EndOfFile;
- __le64 AllocationSize;
- __le32 ExtFileAttributes;
- __le32 FileNameLength;
- __le32 EaSize; /* EA size */
- __le32 Reserved;
- __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
- char FileName[];
-} __packed; /* level 0x105 FF rsp data */
-
-struct filesystem_posix_info {
- /* For undefined recommended transfer size return -1 in that field */
- __le32 OptimalTransferSize; /* bsize on some os, iosize on other os */
- __le32 BlockSize;
- /* The next three fields are in terms of the block size.
- * (above). If block size is unknown, 4096 would be a
- * reasonable block size for a server to report.
- * Note that returning the blocks/blocksavail removes need
- * to make a second call (to QFSInfo level 0x103 to get this info.
- * UserBlockAvail is typically less than or equal to BlocksAvail,
- * if no distinction is made return the same value in each
- */
- __le64 TotalBlocks;
- __le64 BlocksAvail; /* bfree */
- __le64 UserBlocksAvail; /* bavail */
- /* For undefined Node fields or FSID return -1 */
- __le64 TotalFileNodes;
- __le64 FreeFileNodes;
- __le64 FileSysIdentifier; /* fsid */
- /* NB Namelen comes from FILE_SYSTEM_ATTRIBUTE_INFO call */
- /* NB flags can come from FILE_SYSTEM_DEVICE_INFO call */
-} __packed;
-
struct smb_version_ops {
u16 (*get_cmd_val)(struct ksmbd_work *swork);
int (*init_rsp_hdr)(struct ksmbd_work *swork);
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 130dd0a4001f2..c470d419e7ce8 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1798,7 +1798,7 @@ int ksmbd_vfs_get_dos_attrib_xattr(struct mnt_idmap *idmap,
*/
void *ksmbd_vfs_init_kstat(char **p, struct ksmbd_kstat *ksmbd_kstat)
{
- struct file_directory_info *info = (struct file_directory_info *)(*p);
+ FILE_DIRECTORY_INFO *info = (FILE_DIRECTORY_INFO *)(*p);
struct kstat *kstat = ksmbd_kstat->kstat;
u64 time;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 020/686] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 019/686] smb: move some duplicate struct definitions " Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 021/686] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
` (26 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
[ Upstream commit f8171804a39ee89a11cd462f67862899de9c6b10 ]
cifs_fill_dirent() reads the fixed part of a directory entry and the
name length it holds, or for SMB_FIND_FILE_UNIX scans the name for its
terminating NUL, without knowing where the response ends.
cifs_save_resume_key() calls it for the entry at the LastNameOffset the
server chose, after every FindNext and after the FindFirst of a search
rewind, and records the name it returns as the resume name of the
search without bounding it; the next CIFSFindNext() copies up to
PATH_MAX - 1 bytes from that name into its request and sends them to
the server. cifs_filldir() bounds
the name against the end of the response since
commit f8cf09a53a0d ("smb: client: bound dirent name against end of
SMB response in cifs_filldir"), but only after cifs_fill_dirent() has
read the entry, and nxt_dir_entry() checks the entries it walks only
against sizeof(FILE_DIRECTORY_INFO), for every level but
SMB_FIND_FILE_INFO_STANDARD, and never sees the first entry of a
response.
Bounding where last_entry starts, as the preceding patch does, does
not bound the read. A last entry that starts within the final bytes of
the response still has its fixed part read past the end of the
received data, and the name length it declares, a __le32 for every
level but SMB_FIND_FILE_INFO_STANDARD and SMB_FIND_FILE_UNIX, is
recorded without being checked against anything. CIFSFindNext()
rejects only a length of PATH_MAX or more, then copies the name, up to
4095 bytes, into its request and sends it, and as the report below
shows that copy can run past the end of the cifs_request allocation
that holds the response. For SMB_FIND_FILE_UNIX the name is in
addition scanned for its terminating NUL over up to PATH_MAX + 1
UTF-16 units, or PATH_MAX bytes, before any check. The FindNext that
carries the name is only sent by the SMB1 dialect, which is not
negotiated by default; reaching it requires an explicit vers=1.0
mount.
With KASAN enabled, a response whose last entry declares a name
longer than the bytes that follow it gives:
==================================================================
BUG: KASAN: slab-out-of-bounds in CIFSFindNext+0x8ca/0x14c0
Read of size 4080 at addr ffff88807c823f98 by task ls/83
CPU: 0 UID: 0 PID: 83 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
CIFSFindNext+0x8ca/0x14c0
cifs_readdir+0xf51/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 83 on cpu 1 at 13.497119s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address belongs to the object at ffff88807c820000
which belongs to the cache cifs_request of size 16588
The buggy address is located 16280 bytes inside of
allocated 16588-byte region [ffff88807c820000, ffff88807c8240cc)
==================================================================
The read is the memcpy() that copies the recorded name into the next
request, so those bytes go to the server.
Pass the end of the response to cifs_fill_dirent() and have it reject
an entry whose fixed part does not fit or whose name extends past the
end, before either is used, so that both callers are covered;
cifs_save_resume_key() computes the end the same way cifs_readdir()
does. The name bound compares the bytes left between the name and the
end with the name length rather than adding the length to the name
pointer, since the length is a 32-bit value taken from the entry and
the sum could wrap on 32-bit systems. cifs_fill_dirent() is also used
on the SMB2 readdir path; there smb2_parse_query_directory() has
already checked every entry against the end of the response, so a
valid SMB2 response is not rejected by the new checks. The check
cifs_filldir() applies after the parse is left in place. The NUL scan
for SMB_FIND_FILE_UNIX names is capped by a separate patch.
An entry and its name lie inside the data area of the response, so a
server that points LastNameOffset at the entry is not affected. One
that points it at the file name, as MS-CIFS 2.2.6.2.2 describes, has
its last entry rejected here; the listing is unaffected, because
cifs_readdir() records the resume name from an entry it emitted, and
before this series such a response could instead end the listing early,
since a name length read from the wrong place is usually PATH_MAX or
more, which CIFSFindNext() rejects with -EINVAL.
On trees before v6.19 the type for the level 0x105 fixed part is
spelled SEARCH_ID_FULL_DIR_INFO; adjust when backporting.
Fixes: 0752f1522a91 ("[CIFS] make sure we have the right resume info before calling CIFSFindNext")
Cc: stable@vger.kernel.org # 6.1.x: f8cf09a53a0d: smb: client: bound dirent name against end of SMB response in cifs_filldir
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/readdir.c | 39 ++++++++++++++++++++++++++++++++++++---
1 file changed, 36 insertions(+), 3 deletions(-)
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index cf6b440f757b6..69eb0feb7bed1 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -585,30 +585,46 @@ static void cifs_fill_dirent_std(struct cifs_dirent *de,
}
static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
- u16 level, bool is_unicode)
+ const char *end, u16 level, bool is_unicode)
{
+ size_t len = end > (const char *)info ? end - (const char *)info : 0;
+
memset(de, 0, sizeof(*de));
switch (level) {
case SMB_FIND_FILE_POSIX_INFO:
+ if (len < sizeof(struct smb2_posix_info))
+ goto too_short;
cifs_fill_dirent_posix(de, info);
break;
case SMB_FIND_FILE_UNIX:
+ if (len < offsetof(FILE_UNIX_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_unix(de, info, is_unicode);
break;
case SMB_FIND_FILE_DIRECTORY_INFO:
+ if (len < offsetof(FILE_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_dir(de, info);
break;
case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
+ if (len < offsetof(FILE_FULL_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_full(de, info);
break;
case SMB_FIND_FILE_ID_FULL_DIR_INFO:
+ if (len < offsetof(FILE_ID_FULL_DIR_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_search(de, info);
break;
case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
+ if (len < offsetof(FILE_BOTH_DIRECTORY_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_both(de, info);
break;
case SMB_FIND_FILE_INFO_STANDARD:
+ if (len < offsetof(FIND_FILE_STANDARD_INFO, FileName))
+ goto too_short;
cifs_fill_dirent_std(de, info);
break;
default:
@@ -616,7 +632,19 @@ static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
return -EINVAL;
}
+ if (de->name &&
+ (end < de->name || (size_t)(end - de->name) < de->namelen)) {
+ cifs_dbg(VFS, "%s: search entry name extends past end of SMB\n",
+ __func__);
+ return -EINVAL;
+ }
+
return 0;
+
+too_short:
+ cifs_dbg(VFS, "%s: search entry extends past end of SMB\n",
+ __func__);
+ return -EINVAL;
}
#define UNICODE_DOT cpu_to_le16(0x2e)
@@ -671,10 +699,14 @@ static int is_dir_changed(struct file *file)
static int cifs_save_resume_key(const char *current_entry,
struct cifsFileInfo *file_info)
{
+ struct TCP_Server_Info *server = tlink_tcon(file_info->tlink)->ses->server;
+ char *buf = file_info->srch_inf.ntwrk_buf_start;
+ const char *end = buf + server->ops->calc_smb_size(buf);
struct cifs_dirent de;
int rc;
- rc = cifs_fill_dirent(&de, current_entry, file_info->srch_inf.info_level,
+ rc = cifs_fill_dirent(&de, current_entry, end,
+ file_info->srch_inf.info_level,
file_info->srch_inf.unicode);
if (!rc) {
file_info->srch_inf.presume_name = de.name;
@@ -973,7 +1005,8 @@ static int cifs_filldir(char *find_entry, struct file *file,
struct qstr name;
int rc = 0;
- rc = cifs_fill_dirent(&de, find_entry, file_info->srch_inf.info_level,
+ rc = cifs_fill_dirent(&de, find_entry, end_of_smb,
+ file_info->srch_inf.info_level,
file_info->srch_inf.unicode);
if (rc)
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 021/686] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 020/686] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 022/686] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
` (25 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Oliva, David Howells,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Oliva <diego@bynar.io>
[ Upstream commit fa0c2f082946917c3f07d2475c8ce73a8c96d0e2 ]
cifs_fill_dirent_unix() finds the length of an SMB_FIND_FILE_UNIX
entry name by scanning for its terminating NUL, over up to PATH_MAX + 1
UTF-16 units in cifs_unicode_bytelen() or PATH_MAX bytes in strnlen().
Neither scan knows where the response ends. cifs_fill_dirent() only
requires the fixed part of the entry to fit, so the name can start
exactly at the end of the received data, and a name that holds no
terminator is then scanned for 8194 bytes, or 4096 bytes without
unicode, past the end of the received data. SendReceive() copies at
most 16468 bytes into the 16588-byte cifs_request allocation, so for a
response of that length up to 8074 of the bytes scanned lie past the
end of the allocation. Before the preceding patches bounded where the
entry starts, the entry itself could start up to 820 bytes past the
end of the allocation at the default CIFSMaxBufSize, and its name 928
bytes past it, so all 8194 scanned bytes would lie outside.
cifs_fill_dirent() rejects the name afterwards because it extends past
the end of the response, so nothing of what was read is used, but the
out-of-bounds read itself remains.
SMB_FIND_FILE_UNIX is only used with SMB1 servers that offer the Unix
extensions; SMB1 is not negotiated by default and requires an explicit
vers=1.0 mount.
Before the preceding patches, an entry placed past the buffer left the
scan out of bounds from its first read. They bound where the entry
starts, but nothing bounds the scan, so a name that holds no
terminator still runs off the end of the allocation. Reproduced on
the unpatched tree with KASAN enabled, for an entry that starts
inside the response, which is the case the preceding patches leave
open:
==================================================================
BUG: KASAN: slab-out-of-bounds in cifs_save_resume_key.isra.0+0x75c/0x7f0
Read of size 2 at addr ffff88807ee640cc by task ls/84
CPU: 0 UID: 0 PID: 84 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
Call Trace:
<TASK>
kasan_report+0xdf/0x1a0
cifs_save_resume_key.isra.0+0x75c/0x7f0
cifs_readdir+0x1ed6/0x29c0
iterate_dir+0x1c0/0x570
__x64_sys_getdents64+0x133/0x270
do_syscall_64+0x109/0x5d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 84 on cpu 1 at 15.751078s:
cifs_buf_get+0x36/0x90
smb_init+0x4f/0x110
CIFSFindNext+0xf7/0x14c0
cifs_readdir+0xf51/0x29c0
The buggy address belongs to the object at ffff88807ee60000
which belongs to the cache cifs_request of size 16588
The buggy address is located 0 bytes to the right of
allocated 16588-byte region [ffff88807ee60000, ffff88807ee640cc)
==================================================================
The two bytes read there are one UTF-16 unit of the scan, at the first
byte past the end of the object. The scan carries on from there,
reported again 2, 4 and 6 bytes to the right.
Pass the number of bytes that follow the fixed part of the entry to
cifs_fill_dirent_unix() and stop both scans there. A scan that reaches
the end of the response without finding a terminator now fails: it
returns a name that ends exactly at the end of the response and would
otherwise pass the bound, so cifs_fill_dirent() requires the position
of the terminator of an SMB_FIND_FILE_UNIX name to lie inside the
response as well. Accepting such a name truncated at the end of the
response would turn a malformed entry into a directory entry, or a
resume name, that no server sent. A name longer than the PATH_MAX cap
of the scans is still truncated there, as before, when the response
extends past the cap. The message cifs_unicode_bytelen() logs when it
finds no terminator now covers both limits.
This patch depends on "smb: client: fix OOB read of the resume name
sent in TRANS2_FIND_NEXT2", which adds the end argument of
cifs_fill_dirent() and the length it derives from it; the backport
note in that patch applies to this one as well.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/readdir.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index 69eb0feb7bed1..00c3b7a82f4c1 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -455,17 +455,20 @@ initiate_cifs_search(const unsigned int xid, struct file *file,
}
/* return length of unicode string in bytes */
-static int cifs_unicode_bytelen(const char *str)
+static size_t cifs_unicode_bytelen(const char *str, size_t maxlen)
{
- int len;
const __le16 *ustr = (const __le16 *)str;
+ size_t len;
- for (len = 0; len <= PATH_MAX; len++) {
+ maxlen = umin(PATH_MAX + 1, maxlen / sizeof(__le16));
+ for (len = 0; len < maxlen; len++) {
if (ustr[len] == 0)
- return len << 1;
+ return len * sizeof(__le16);
}
- cifs_dbg(FYI, "Unicode string longer than PATH_MAX found\n");
- return len << 1;
+ len *= sizeof(__le16);
+ cifs_dbg(FYI, "%s: Unicode string not terminated within %zu bytes\n",
+ __func__, len);
+ return len;
}
static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level)
@@ -531,13 +534,13 @@ static void cifs_fill_dirent_posix(struct cifs_dirent *de,
}
static void cifs_fill_dirent_unix(struct cifs_dirent *de,
- const FILE_UNIX_INFO *info, bool is_unicode)
+ const FILE_UNIX_INFO *info, bool is_unicode, size_t maxlen)
{
de->name = &info->FileName[0];
if (is_unicode)
- de->namelen = cifs_unicode_bytelen(de->name);
+ de->namelen = cifs_unicode_bytelen(de->name, maxlen);
else
- de->namelen = strnlen(de->name, PATH_MAX);
+ de->namelen = strnlen(de->name, min_t(size_t, maxlen, PATH_MAX));
de->resume_key = info->ResumeKey;
de->ino = le64_to_cpu(info->basic.UniqueId);
}
@@ -588,6 +591,7 @@ static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
const char *end, u16 level, bool is_unicode)
{
size_t len = end > (const char *)info ? end - (const char *)info : 0;
+ size_t nul_len = 0;
memset(de, 0, sizeof(*de));
@@ -600,7 +604,9 @@ static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
case SMB_FIND_FILE_UNIX:
if (len < offsetof(FILE_UNIX_INFO, FileName))
goto too_short;
- cifs_fill_dirent_unix(de, info, is_unicode);
+ cifs_fill_dirent_unix(de, info, is_unicode,
+ len - offsetof(FILE_UNIX_INFO, FileName));
+ nul_len = is_unicode ? sizeof(__le16) : sizeof(__u8);
break;
case SMB_FIND_FILE_DIRECTORY_INFO:
if (len < offsetof(FILE_DIRECTORY_INFO, FileName))
@@ -633,7 +639,8 @@ static int cifs_fill_dirent(struct cifs_dirent *de, const void *info,
}
if (de->name &&
- (end < de->name || (size_t)(end - de->name) < de->namelen)) {
+ (end < de->name ||
+ (size_t)(end - de->name) < de->namelen + nul_len)) {
cifs_dbg(VFS, "%s: search entry name extends past end of SMB\n",
__func__);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 022/686] smb: client: reject short SESSION_SETUP responses
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 021/686] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 023/686] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
` (24 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Namjae Jeon,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
[ Upstream commit 4d8930afa3446041358a7db33e7b23a0bb9459b5 ]
smb2_check_message() accepts frames shorter than struct smb2_pdu when
the SMB2 status is non-zero, before the minimum-PDU check added by
b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
response is therefore accepted even though it cannot contain the
SecurityBufferOffset and SecurityBufferLength fields.
The parser then reads those fields from stale bytes left in the reused
receive buffer by an earlier frame. With a long stale
SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
64 KB from beyond the receive object and sends the data back to the
server in the NTLMv2 AUTHENTICATE target info.
Reject short MPR SESSION_SETUP responses before the short-error path,
and validate SecurityBufferOffset + SecurityBufferLength against the
received response length before decoding the challenge.
The ordering bypass is not new: the short-error early return predates
b4694f269e66d, and the unvalidated SecurityBufferLength read predates
the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable
trees are affected. Reproduced on 6.6.87.2; the path is unchanged on
mainline.
Fixes: 5478f9ba9a34 ("CIFS: Add session setup/logoff capability for SMB2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
[ sashal: Replaced the unavailable smb2_min_pdu_len lookup with sizeof(struct smb2_sess_setup_rsp). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2misc.c | 15 +++++++++++++++
fs/smb/client/smb2pdu.c | 18 ++++++++++++------
2 files changed, 27 insertions(+), 6 deletions(-)
diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index 34d2401c6c665..46c98d024f068 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -194,6 +194,21 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server)
return 1;
}
+ /*
+ * A SESSION_SETUP response that asks for more processing carries a
+ * security blob and is parsed as a normal reply. Do not let the
+ * short-error path below accept a frame that cannot hold the fixed
+ * response fields.
+ */
+ if (command == SMB2_SESSION_SETUP_HE &&
+ shdr->Status == STATUS_MORE_PROCESSING_REQUIRED &&
+ len < sizeof(struct smb2_sess_setup_rsp)) {
+ cifs_server_dbg(VFS,
+ "%s: session setup response too short: %u < %zu\n",
+ __func__, len, sizeof(struct smb2_sess_setup_rsp));
+ return 1;
+ }
+
if (len < pdu_size) {
if ((len >= hdr_size)
&& (shdr->Status != 0)) {
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index d0c56caed1626..3302923f98893 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -1757,15 +1757,21 @@ SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
if (rc)
goto out;
- if (offsetof(struct smb2_sess_setup_rsp, Buffer) !=
- le16_to_cpu(rsp->SecurityBufferOffset)) {
- cifs_dbg(VFS, "Invalid security buffer offset %d\n",
- le16_to_cpu(rsp->SecurityBufferOffset));
+ u16 boff = le16_to_cpu(rsp->SecurityBufferOffset);
+ u16 blen = le16_to_cpu(rsp->SecurityBufferLength);
+
+ if (offsetof(struct smb2_sess_setup_rsp, Buffer) != boff) {
+ cifs_dbg(VFS, "Invalid security buffer offset %d\n", boff);
rc = -EIO;
goto out;
}
- rc = decode_ntlmssp_challenge(rsp->Buffer,
- le16_to_cpu(rsp->SecurityBufferLength), ses);
+ if ((u32)boff + blen > sess_data->iov[0].iov_len) {
+ cifs_dbg(VFS, "%s: invalid security buffer length: %u\n",
+ __func__, blen);
+ rc = -EINVAL;
+ goto out;
+ }
+ rc = decode_ntlmssp_challenge(rsp->Buffer, blen, ses);
if (rc)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 023/686] smb: client: require stable pages for SMB compression
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 022/686] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 024/686] mm: remove !root_reclaim checking in should_abort_scan() Greg Kroah-Hartman
` (23 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Paulo Alcantara,
Namjae Jeon, Ronnie Sahlberg, Shyam Prasad N, Tom Talpey,
Bharath SM, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
[ Upstream commit 8667061cf99394526dd9c0ea2662e6bbc7ae7848 ]
Like signing, SMB compression builds the write payload from the pagecache
folios: should_compress() lets a write request through and smb_compress()
compresses those folios on the way to the socket. If a buffered write
mutates a folio while a write subrequest is still in flight, the compressed
bytes no longer correspond to a consistent view of the data, and the server
silently stores corrupted contents - worse than the signed case, which at
least fails loudly with STATUS_ACCESS_DENIED.
Mark the mapping for stable writes when a write may be compressed, i.e. the
same condition should_compress() tests (compression negotiated and the share
allows compressed data), so netfs_perform_write() waits for writeback to
complete before modifying an in-flight folio.
Fixes: f046d71e84e1 ("smb: client: insert compression check/call on write requests")
Suggested-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Replaced tcon references with direct cifs_sb_master_tcon(cifs_sb) lookups because the local variable is absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/inode.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index d9c502efe84bc..b8f9dd47a56e7 100644
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -87,7 +87,9 @@ static void cifs_set_ops(struct inode *inode)
else
inode->i_data.a_ops = &cifs_addr_ops;
mapping_set_large_folios(inode->i_mapping);
- if (cifs_sb_master_tcon(cifs_sb)->ses->server->sign)
+ if (cifs_sb_master_tcon(cifs_sb)->ses->server->sign ||
+ (cifs_sb_master_tcon(cifs_sb)->ses->server->compression.enabled &&
+ (cifs_sb_master_tcon(cifs_sb)->share_flags & SMB2_SHAREFLAG_COMPRESS_DATA)))
mapping_set_stable_writes(inode->i_mapping);
break;
case S_IFDIR:
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 024/686] mm: remove !root_reclaim checking in should_abort_scan()
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 023/686] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 025/686] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
` (22 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhaoyang Huang, T.J.Mercier,
Shakeel Butt, Qi Zheng, Barry Song, Kairui Song, Johannes Weiner,
Michal Hocko, Rik van Riel, Roman Gushchin, Yu Zhao,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Andrew Morton, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
[ Upstream commit 19999e479c2a38672789e66b4830f43c645ca1f2 ]
Android systems usually use memory.reclaim interface to implement user
space memory management which expects that the requested reclaim target
and actually reclaimed amount memory are not diverging by too much. With
the current MGRLU implementation there is, however, no bail out when the
reclaim target is reached and this could lead to an excessive reclaim
that scales with the reclaim hierarchy size.For example, we can get a
nr_reclaimed=394/nr_to_reclaim=32 proactive reclaim under a common 1-N
cgroup hierarchy.
This defect arose from the goal of keeping fairness among memcgs that is,
for try_to_free_mem_cgroup_pages -> shrink_node_memcgs -> shrink_lruvec ->
lru_gen_shrink_lruvec -> try_to_shrink_lruvec, the !root_reclaim(sc) check
was there for reclaim fairness, which was necessary before commit
b82b530740b9 ("mm: vmscan: restore incremental cgroup iteration") because
the fairness depended on attempted proportional reclaim from every memcg
under the target memcg. However after commit b82b530740b9 there is no
longer a need to visit every memcg to ensure fairness. Let's have
try_to_shrink_lruvec bail out when the nr_reclaimed achieved.
Link: https://lore.kernel.org/20260318011558.1696310-1-zhaoyang.huang@unisoc.com
Link: https://lore.kernel.org/20260212032111.408865-1-zhaoyang.huang@unisoc.com
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Suggested-by: T.J.Mercier <tjmercier@google.com>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Qi Zheng <qi.zheng@linux.dev>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Kairui Song <kasong@tencent.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmscan.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index e72d50bab730a..e640d1ec59749 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -4844,10 +4844,6 @@ static bool should_abort_scan(struct lruvec *lruvec, struct scan_control *sc)
int i;
enum zone_watermarks mark;
- /* don't abort memcg reclaim to ensure fairness */
- if (!root_reclaim(sc))
- return false;
-
if (sc->nr_reclaimed >= max(sc->nr_to_reclaim, compact_gap(sc->order)))
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 025/686] smb: client: validate SMB1 EA list bounds before parsing
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 024/686] mm: remove !root_reclaim checking in should_abort_scan() Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 026/686] xfs: break out xattr entry checks into separate functions Greg Kroah-Hartman
` (21 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Paulo Alcantara,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
[ Upstream commit ddc7a7e1eeb116ccaf010a6f1fb6ab927f3f888d ]
CIFSSMBQAllEAs() checks the server-provided EA list length by adding it
to the response pointer. On 32-bit systems, a positive length can wrap
the pointer and pass the comparison. The parser then walks outside the
received response while reading the next FEA header.
A response with a list length of 0x40000000 reproduces this as a native
i386 page fault and kernel panic from listxattr() against an SMB1
server.
Check that the EA list starts within the SMB byte area before reading
its header. Keep its length unsigned and compare it with the bytes left
in the response without pointer addition.
SMB1 is not negotiated by default and requires an explicit vers=1.0
mount.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
[ sashal: adjusted the CIFSSMBQAllEAs() hunk for plain -EIO where upstream already used smb_EIO2() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifssmb.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 6e4b845a4078c..14d5c1924ae2b 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -6082,9 +6082,11 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
int rc = 0;
int bytes_returned;
int list_len;
+ u32 ea_list_len;
struct fealist *ea_response_data;
struct fea *temp_fea;
char *temp_ptr;
+ char *byte_area;
char *end_of_smb;
__u16 params, byte_count, data_offset;
unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0;
@@ -6161,9 +6163,19 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
ea_response_data = (struct fealist *)
(((char *) &pSMBr->hdr.Protocol) + data_offset);
- list_len = le32_to_cpu(ea_response_data->list_len);
- cifs_dbg(FYI, "ea length %d\n", list_len);
- if (list_len <= 8) {
+ byte_area = pByteArea(&pSMBr->hdr);
+ end_of_smb = byte_area + get_bcc(&pSMBr->hdr);
+ if ((char *)ea_response_data < byte_area ||
+ (char *)ea_response_data >
+ end_of_smb - sizeof(ea_response_data->list_len)) {
+ rc = smb_EIO2(smb_eio_trace_qalleas_overlong,
+ data_offset, get_bcc(&pSMBr->hdr));
+ goto QAllEAsOut;
+ }
+
+ ea_list_len = le32_to_cpu(ea_response_data->list_len);
+ cifs_dbg(FYI, "%s: ea length: %u\n", __func__, ea_list_len);
+ if (ea_list_len <= 8) {
cifs_dbg(FYI, "empty EA list returned from server\n");
/* didn't find the named attribute */
if (ea_name)
@@ -6172,12 +6184,14 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
}
/* make sure list_len doesn't go past end of SMB */
- end_of_smb = (char *)pByteArea(&pSMBr->hdr) + get_bcc(&pSMBr->hdr);
- if ((char *)ea_response_data + list_len > end_of_smb) {
+ if (ea_list_len > end_of_smb - (char *)ea_response_data) {
cifs_dbg(FYI, "EA list appears to go beyond SMB\n");
- rc = -EIO;
+ rc = smb_EIO2(smb_eio_trace_qalleas_overlong,
+ ea_list_len,
+ end_of_smb - (char *)ea_response_data);
goto QAllEAsOut;
}
+ list_len = ea_list_len;
/* account for ea list len */
list_len -= 4;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 026/686] xfs: break out xattr entry checks into separate functions
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 025/686] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 027/686] xfs: check for buffer overruns when examining local/remote xattr entries Greg Kroah-Hartman
` (20 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 9eb04a6d41c7e474d4665118895c3c2d8e5a2741 ]
We're going to add more xattr entry checking code in xchk_xattr_entry so
break these out into separate functions so that we don't go crazy
indenting. There's a slight behavior change here where we skip updating
the usedmap if we've decided the xattr structure is corrupt.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Stable-dep-of: 91c41f952490 ("xfs: check for buffer overruns when examining local/remote xattr entries")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/attr.c | 90 ++++++++++++++++++++++++++++++++++-----------
1 file changed, 68 insertions(+), 22 deletions(-)
diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index 7315d0cb1e2e7..84507c80cf945 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -293,6 +293,66 @@ xchk_xattr_set_map(
return ret;
}
+static unsigned int
+xchk_xattr_local_entry(
+ struct xchk_da_btree *ds,
+ int level,
+ char *buf_end,
+ struct xfs_attr_leafblock *leaf,
+ int idx)
+{
+ struct xfs_attr_leaf_name_local *lentry =
+ xfs_attr3_leaf_name_local(leaf, idx);
+ char *name_end;
+ unsigned int namesize;
+
+ namesize = xfs_attr_leaf_entsize_local(lentry->namelen,
+ be16_to_cpu(lentry->valuelen));
+ name_end = (char *)lentry + namesize;
+ if (lentry->namelen == 0) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+ if (name_end > buf_end) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+
+ return namesize;
+}
+
+static unsigned int
+xchk_xattr_remote_entry(
+ struct xchk_da_btree *ds,
+ int level,
+ char *buf_end,
+ struct xfs_attr_leafblock *leaf,
+ int idx,
+ struct xfs_attr_leaf_entry *ent)
+{
+ struct xfs_attr_leaf_name_remote *rentry =
+ xfs_attr3_leaf_name_remote(leaf, idx);
+ char *name_end;
+ unsigned int namesize;
+
+ namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
+ name_end = (char *)rentry + namesize;
+ if (rentry->namelen == 0) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+ if (rentry->valueblk == 0 && !(ent->flags & XFS_ATTR_INCOMPLETE)) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+ if (name_end > buf_end) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+
+ return namesize;
+}
+
/*
* Check this leaf entry's relations to everything else.
* Returns the number of bytes used for the name/value data.
@@ -311,9 +371,6 @@ xchk_xattr_entry(
{
struct xfs_mount *mp = ds->state->mp;
struct xchk_xattr_buf *ab = ds->sc->buf;
- char *name_end;
- struct xfs_attr_leaf_name_local *lentry;
- struct xfs_attr_leaf_name_remote *rentry;
unsigned int nameidx;
unsigned int namesize;
@@ -333,25 +390,14 @@ xchk_xattr_entry(
}
/* Check the name information. */
- if (ent->flags & XFS_ATTR_LOCAL) {
- lentry = xfs_attr3_leaf_name_local(leaf, idx);
- namesize = xfs_attr_leaf_entsize_local(lentry->namelen,
- be16_to_cpu(lentry->valuelen));
- name_end = (char *)lentry + namesize;
- if (lentry->namelen == 0)
- xchk_da_set_corrupt(ds, level);
- } else {
- rentry = xfs_attr3_leaf_name_remote(leaf, idx);
- namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
- name_end = (char *)rentry + namesize;
- if (rentry->namelen == 0)
- xchk_da_set_corrupt(ds, level);
- if (rentry->valueblk == 0 &&
- !(ent->flags & XFS_ATTR_INCOMPLETE))
- xchk_da_set_corrupt(ds, level);
- }
- if (name_end > buf_end)
- xchk_da_set_corrupt(ds, level);
+ if (ent->flags & XFS_ATTR_LOCAL)
+ namesize = xchk_xattr_local_entry(ds, level, buf_end, leaf,
+ idx);
+ else
+ namesize = xchk_xattr_remote_entry(ds, level, buf_end, leaf,
+ idx, ent);
+ if (!namesize)
+ return;
if (!xchk_xattr_set_map(ds->sc, ab->usedmap, nameidx, namesize))
xchk_da_set_corrupt(ds, level);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 027/686] xfs: check for buffer overruns when examining local/remote xattr entries
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 026/686] xfs: break out xattr entry checks into separate functions Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 028/686] xfs: refactor directory data block walking loops in scrub Greg Kroah-Hartman
` (19 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 91c41f9524906a8ebd2ae68c98a07b4bd5255ddb ]
LOLLM noticed that the xattr scrub and repair code can walk off the end
of the buffer if the xattr entry record starts so close to the end of
the buffer that there's not even space for the entry structure itself.
Strengthen the bounds checking here.
Cc: stable@vger.kernel.org # v4.15
Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/attr.c | 12 ++++++++++++
fs/xfs/scrub/attr_repair.c | 16 +++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index 84507c80cf945..68d9666ab201a 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -306,6 +306,12 @@ xchk_xattr_local_entry(
char *name_end;
unsigned int namesize;
+ name_end = (char *)lentry + offsetof(typeof(*lentry), nameval[0]);
+ if (name_end > buf_end) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+
namesize = xfs_attr_leaf_entsize_local(lentry->namelen,
be16_to_cpu(lentry->valuelen));
name_end = (char *)lentry + namesize;
@@ -335,6 +341,12 @@ xchk_xattr_remote_entry(
char *name_end;
unsigned int namesize;
+ name_end = (char *)rentry + offsetof(typeof(*rentry), name[0]);
+ if (name_end > buf_end) {
+ xchk_da_set_corrupt(ds, level);
+ return 0;
+ }
+
namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
name_end = (char *)rentry + namesize;
if (rentry->namelen == 0) {
diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index ab5bd7a4d4abb..2c573897c0c6a 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -285,6 +285,7 @@ xrep_xattr_salvage_local_attr(
struct xfs_attr_leaf_name_local *lentry)
{
struct xchk_xattr_buf *ab = rx->sc->buf;
+ char *name_end;
unsigned char *value;
unsigned int valuelen;
unsigned int namesize;
@@ -293,10 +294,14 @@ xrep_xattr_salvage_local_attr(
* Decode the leaf local entry format. If something seems wrong, we
* junk the attribute.
*/
+ name_end = (char *)lentry + offsetof(typeof(*lentry), nameval[0]);
+ if (name_end > buf_end)
+ return 0;
value = &lentry->nameval[lentry->namelen];
valuelen = be16_to_cpu(lentry->valuelen);
namesize = xfs_attr_leaf_entsize_local(lentry->namelen, valuelen);
- if ((char *)lentry + namesize > buf_end)
+ name_end = (char *)lentry + namesize;
+ if (name_end > buf_end)
return 0;
if (!xrep_xattr_want_salvage(rx, ent->flags, lentry->nameval,
lentry->namelen, value, valuelen))
@@ -333,8 +338,8 @@ xrep_xattr_salvage_remote_attr(
.attr_filter = ent->flags & XFS_ATTR_NSP_ONDISK_MASK,
.namelen = rentry->namelen,
.name = rentry->name,
- .valuelen = be32_to_cpu(rentry->valuelen),
};
+ char *name_end;
unsigned int namesize;
int error;
@@ -343,9 +348,14 @@ xrep_xattr_salvage_remote_attr(
* junk the attribute. Note that we should never find a zero-length
* remote attribute value.
*/
+ name_end = (char *)rentry + offsetof(typeof(*rentry), name[0]);
+ if (name_end > buf_end)
+ return 0;
namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
- if ((char *)rentry + namesize > buf_end)
+ name_end = (char *)rentry + namesize;
+ if (name_end > buf_end)
return 0;
+ args.valuelen = be32_to_cpu(rentry->valuelen);
if (args.valuelen == 0 ||
!xrep_xattr_want_salvage(rx, ent->flags, rentry->name,
rentry->namelen, NULL, args.valuelen))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 028/686] xfs: refactor directory data block walking loops in scrub
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 027/686] xfs: check for buffer overruns when examining local/remote xattr entries Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 029/686] xfs: improve dirent bounds checking in scrub and repair Greg Kroah-Hartman
` (18 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 19b5653cc870788df71e7fcf2dd7b6131d8868dc ]
Hoist the inner loop code of the directory data block walking code in
the directory scrub and repair code to separate functions in preparation
for strengthening the validation in a subsequent patch.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Stable-dep-of: 5d470234d04d ("xfs: improve dirent bounds checking in scrub and repair")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/dir.c | 56 ++++++++++++++++++++++++++----
fs/xfs/scrub/dir_repair.c | 73 ++++++++++++++++++++++++++++-----------
2 files changed, 102 insertions(+), 27 deletions(-)
diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index 7b0a9d2aea3ec..2f73baee0f0b4 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -313,6 +313,45 @@ xchk_dir_actor(
return error;
}
+/*
+ * Deal with an unused directory entry. Returns a positive number of bytes to
+ * advance in the directory block, zero to stop processing, or -1 if corruption
+ * was found.
+ */
+static int
+xchk_dir_check_unused(
+ struct xchk_da_btree *ds,
+ struct xfs_buf *bp,
+ unsigned int iter_off,
+ unsigned int end)
+{
+ struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
+
+ return be16_to_cpu(dup->length);
+}
+
+/*
+ * Check a directory entry. Returns a positive number of bytes to advance
+ * in the directory block, zero to stop processing, or -1 if corruption was
+ * found.
+ */
+static int
+xchk_dir_check_entry(
+ struct xchk_da_btree *ds,
+ struct xfs_buf *bp,
+ unsigned int iter_off,
+ unsigned int end,
+ struct xfs_dir2_data_entry *dent)
+{
+ struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
+ struct xfs_mount *mp = ds->state->mp;
+
+ if (dep == dent)
+ return 0;
+
+ return xfs_dir2_data_entsize(mp, dep->namelen);
+}
+
/* Scrub a directory btree record. */
STATIC int
xchk_dir_rec(
@@ -389,21 +428,24 @@ xchk_dir_rec(
goto out_relse;
}
for (;;) {
- struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
+ int advance;
if (iter_off >= end) {
xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
goto out_relse;
}
- if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
- iter_off += be16_to_cpu(dup->length);
- continue;
- }
- if (dep == dent)
+ if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG))
+ advance = xchk_dir_check_unused(ds, bp, iter_off, end);
+ else
+ advance = xchk_dir_check_entry(ds, bp, iter_off, end,
+ dent);
+ if (advance < 0)
+ goto out_relse;
+ if (!advance)
break;
- iter_off += xfs_dir2_data_entsize(mp, dep->namelen);
+ iter_off += advance;
}
/* Retrieve the entry, sanity check it, and compare hashes. */
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 9aafe5c31cbe3..f8e88b638c43d 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -462,6 +462,52 @@ xrep_dir_salvage_data_entry(
return xrep_dir_salvage_entry(rd, dep->name, dep->namelen, ino);
}
+/*
+ * Deal with an unused directory entry. Returns a positive number of bytes to
+ * advance in the directory block, or zero to stop processing.
+ */
+static int
+xrep_dir_recover_unused(
+ struct xfs_buf *bp,
+ unsigned int offset,
+ unsigned int end)
+{
+ struct xfs_dir2_data_unused *dup = bp->b_addr + offset;
+
+ return be16_to_cpu(dup->length);
+}
+
+/*
+ * Salvage a directory entry. Returns a positive number of bytes to advance
+ * in the directory block, zero to stop processing, or a negative errno.
+ */
+static int
+xrep_dir_recover_entry(
+ struct xrep_dir *rd,
+ struct xfs_buf *bp,
+ unsigned int offset,
+ unsigned int end)
+{
+ struct xfs_dir2_data_entry *dep = bp->b_addr + offset;
+ unsigned int advance;
+ int error;
+
+ /* Don't walk off the end of the block. */
+ advance = xfs_dir2_data_entsize(rd->sc->mp, dep->namelen);
+ if (!advance)
+ return 0;
+ if (offset + advance > end)
+ return 0;
+
+ /* Ok, let's save this entry. */
+ error = xrep_dir_salvage_data_entry(rd, dep);
+ if (error < 0)
+ return error;
+
+ return advance;
+}
+
+
/* Try to recover block/data format directory entries. */
STATIC int
xrep_dir_recover_data(
@@ -483,33 +529,20 @@ xrep_dir_recover_data(
while (offset < end) {
struct xfs_dir2_data_unused *dup = bp->b_addr + offset;
- struct xfs_dir2_data_entry *dep = bp->b_addr + offset;
- unsigned int advance;
+ int advance;
if (xchk_should_terminate(rd->sc, &error))
return error;
- /* Skip unused entries. */
- if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
- if (!dup->length)
- break;
- offset += be16_to_cpu(dup->length);
- continue;
- }
-
- /* Don't walk off the end of the block. */
- advance = xfs_dir2_data_entsize(rd->sc->mp, dep->namelen);
+ if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG))
+ advance = xrep_dir_recover_unused(bp, offset, end);
+ else
+ advance = xrep_dir_recover_entry(rd, bp, offset, end);
+ if (advance < 0)
+ return advance;
if (!advance)
break;
offset += advance;
- if (offset > end)
- break;
-
- /* Ok, let's save this entry. */
- error = xrep_dir_salvage_data_entry(rd, dep);
- if (error)
- return error;
-
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 029/686] xfs: improve dirent bounds checking in scrub and repair
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 028/686] xfs: refactor directory data block walking loops in scrub Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 030/686] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
` (17 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 5d470234d04dae6fe2ca2cf4b9ef277b78c7e05a ]
LOLLM complains that we don't do enough bounds checking of the directory
entries in directory blocks when we're looking for errors or trying to
salvage entries. Let's improve that with more detailed checks.
Cc: stable@vger.kernel.org # v4.16
Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/dir.c | 68 +++++++++++++++++++++++++++++++++------
fs/xfs/scrub/dir_repair.c | 37 ++++++++++++++++++---
2 files changed, 91 insertions(+), 14 deletions(-)
diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index 2f73baee0f0b4..495fdf3b519ae 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -323,11 +323,24 @@ xchk_dir_check_unused(
struct xchk_da_btree *ds,
struct xfs_buf *bp,
unsigned int iter_off,
- unsigned int end)
+ unsigned int end,
+ xfs_dablk_t rec_bno)
{
struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
+ unsigned int advance;
+
+ if (iter_off + sizeof(*dup) > end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ return -1;
+ }
+
+ advance = xfs_dir2_data_unusedsize(be16_to_cpu(dup->length));
+ if (!advance || iter_off + advance > end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ return -1;
+ }
- return be16_to_cpu(dup->length);
+ return advance;
}
/*
@@ -341,15 +354,31 @@ xchk_dir_check_entry(
struct xfs_buf *bp,
unsigned int iter_off,
unsigned int end,
- struct xfs_dir2_data_entry *dent)
+ struct xfs_dir2_data_entry *dent,
+ xfs_dablk_t rec_bno)
{
struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
struct xfs_mount *mp = ds->state->mp;
+ unsigned int advance;
+
+ /* must have namelen */
+ advance = offsetof(typeof(*dep), name);
+ if (iter_off + advance >= end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ return -1;
+ }
+
+ /* Don't walk off the end of the block. */
+ advance = xfs_dir2_data_entsize(mp, dep->namelen);
+ if (!advance || iter_off + advance > end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ return -1;
+ }
if (dep == dent)
return 0;
- return xfs_dir2_data_entsize(mp, dep->namelen);
+ return advance;
}
/* Scrub a directory btree record. */
@@ -377,6 +406,7 @@ xchk_dir_rec(
xfs_dahash_t hash;
struct xfs_dir3_icleaf_hdr hdr;
unsigned int tag;
+ bool foundit = false;
int error;
ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC ||
@@ -421,33 +451,44 @@ xchk_dir_rec(
dent = bp->b_addr + off;
/* Make sure we got a real directory entry. */
- iter_off = geo->data_entry_offset;
end = xfs_dir3_data_end_offset(geo, bp->b_addr);
if (!end) {
xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
goto out_relse;
}
- for (;;) {
+ iter_off = geo->data_entry_offset;
+ while (iter_off < end) {
struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
int advance;
- if (iter_off >= end) {
+ /* must have freetag */
+ advance = offsetof(typeof(*dup), length);
+ if (iter_off + advance >= end) {
xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
goto out_relse;
}
if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG))
- advance = xchk_dir_check_unused(ds, bp, iter_off, end);
+ advance = xchk_dir_check_unused(ds, bp, iter_off, end,
+ rec_bno);
else
advance = xchk_dir_check_entry(ds, bp, iter_off, end,
- dent);
+ dent, rec_bno);
if (advance < 0)
goto out_relse;
- if (!advance)
+ if (!advance) {
+ foundit = true;
break;
+ }
iter_off += advance;
}
+ /* Hash tree must point to the exact dirent */
+ if (!foundit) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ goto out_relse;
+ }
+
/* Retrieve the entry, sanity check it, and compare hashes. */
ino = be64_to_cpu(dent->inumber);
hash = be32_to_cpu(ent->hashval);
@@ -459,6 +500,13 @@ xchk_dir_rec(
goto out_relse;
}
+ /* Name must not overflow end of block */
+ if ((char *)dent->name + dent->namelen >
+ (char *)bp->b_addr + BBTOB(bp->b_length)) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ goto out_relse;
+ }
+
/* Does the directory hash match? */
dname.name = dent->name;
dname.len = dent->namelen;
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index f8e88b638c43d..c7fd39fd83a48 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -473,8 +473,16 @@ xrep_dir_recover_unused(
unsigned int end)
{
struct xfs_dir2_data_unused *dup = bp->b_addr + offset;
+ unsigned int advance;
+
+ if (offset + sizeof(*dup) > end)
+ return 0;
+
+ advance = xfs_dir2_data_unusedsize(be16_to_cpu(dup->length));
+ if (!advance || offset + advance > end)
+ return 0;
- return be16_to_cpu(dup->length);
+ return advance;
}
/*
@@ -492,11 +500,14 @@ xrep_dir_recover_entry(
unsigned int advance;
int error;
+ /* must have namelen */
+ advance = offsetof(typeof(*dep), name);
+ if (offset + advance >= end)
+ return 0;
+
/* Don't walk off the end of the block. */
advance = xfs_dir2_data_entsize(rd->sc->mp, dep->namelen);
- if (!advance)
- return 0;
- if (offset + advance > end)
+ if (!advance || offset + advance > end)
return 0;
/* Ok, let's save this entry. */
@@ -534,6 +545,11 @@ xrep_dir_recover_data(
if (xchk_should_terminate(rd->sc, &error))
return error;
+ /* must have freetag */
+ advance = offsetof(typeof(*dup), length);
+ if (offset + advance >= end)
+ break;
+
if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG))
advance = xrep_dir_recover_unused(bp, offset, end);
else
@@ -565,6 +581,19 @@ xrep_dir_recover_sf(
hdr = ifp->if_data;
end = (unsigned char *)ifp->if_data + ifp->if_bytes;
+ /* sf header must be big enough for count/i8count */
+ if (!hdr || ifp->if_bytes < 2)
+ return 0;
+
+ /* and large enough for the parent inumber */
+ if (hdr->i8count) {
+ if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[8]))
+ return 0;
+ } else {
+ if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[4]))
+ return 0;
+ }
+
ino = xfs_dir2_sf_get_parent_ino(hdr);
trace_xrep_dir_salvaged_parent(rd->sc->ip, ino);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 030/686] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 029/686] xfs: improve dirent bounds checking in scrub and repair Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 031/686] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
` (16 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
[ Upstream commit 32f0967ea296d447925465c98e7eec71d4e2f755 ]
decode_devicenotify_args() hands the server's notification count
straight to kmalloc_objs() as the array length, without checking it
against the message that carried it. Bound it the way nfs4xdr.c bounds
an attribute length, against xdr_stream_remaining().
Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
[ sashal: Adjusted context to retain the existing kmalloc_array() allocation instead of kmalloc_objs(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/callback_xdr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 1aa6a6e14b057..34fa00f1a1c20 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -275,6 +275,13 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
if (n == 0)
goto out;
+ /* sanity check the count against the remaining stream */
+ if (n > xdr_stream_remaining(xdr) /
+ ((4 * sizeof(uint32_t)) + NFS4_DEVICEID4_SIZE)) {
+ status = htonl(NFS4ERR_BADXDR);
+ goto out;
+ }
+
args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL);
if (!args->devs) {
status = htonl(NFS4ERR_DELAY);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 031/686] smb: client: bound POSIX lock data area by response length
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 030/686] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 032/686] smb: align durable reconnect v2 context to 8 byte boundary Greg Kroah-Hartman
` (15 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratnaker Gautam, Namjae Jeon,
Paulo Alcantara, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
[ Upstream commit 8fc9af68c57156ff64769f30e831553cd03b3000 ]
CIFSSMBPosixLock() receives a TRANS2 response whose server-provided
DataOffset and DataCount are not required by validate_t2() to describe an
interval inside the response. A server can therefore make the client read a
cifs_posix_lock beyond the response buffer and return those kernel bytes
through F_GETLK.
Use smbCalcSize() to obtain the full response length after any multipart
TRANS2 reassembly, then reject data areas that extend past it before
dereferencing them.
Fixes: fc94cdb94462 ("[CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock")
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifssmb.c | 8 ++++++++
fs/smb/client/trace.h | 1 +
2 files changed, 9 insertions(+)
diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 14d5c1924ae2b..1049a64241bc0 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -2338,6 +2338,7 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon,
cifs_dbg(FYI, "Send error in Posix Lock = %d\n", rc);
} else if (pLockData) {
/* lock structure can be returned on get */
+ unsigned int rsp_len;
__u16 data_offset;
__u16 data_count;
rc = validate_t2((struct smb_t2_rsp *)pSMBr);
@@ -2348,10 +2349,17 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon,
}
data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
data_count = le16_to_cpu(pSMBr->t2.DataCount);
+ rsp_len = smbCalcSize(&pSMBr->hdr);
if (data_count < sizeof(struct cifs_posix_lock)) {
rc = -EIO;
goto plk_err_exit;
}
+ if (data_offset > rsp_len ||
+ data_count > rsp_len - data_offset) {
+ rc = smb_EIO2(smb_eio_trace_lock_data_area,
+ data_offset, data_count);
+ goto plk_err_exit;
+ }
parm_data = (struct cifs_posix_lock *)
((char *)&pSMBr->hdr.Protocol + data_offset);
if (parm_data->lock_type == cpu_to_le16(CIFS_UNLCK))
diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h
index a56fbacf28d14..670612d1a4497 100644
--- a/fs/smb/client/trace.h
+++ b/fs/smb/client/trace.h
@@ -42,6 +42,7 @@
EM(smb_eio_trace_ioctl_no_rsp, "ioctl_no_rsp") \
EM(smb_eio_trace_ioctl_out_off, "ioctl_out_off") \
EM(smb_eio_trace_lock_bcc_too_small, "lock_bcc_too_small") \
+ EM(smb_eio_trace_lock_data_area, "lock_data_area") \
EM(smb_eio_trace_lock_data_too_small, "lock_data_too_small") \
EM(smb_eio_trace_malformed_ksid_key, "malformed_ksid_key") \
EM(smb_eio_trace_malformed_sid_key, "malformed_sid_key") \
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 032/686] smb: align durable reconnect v2 context to 8 byte boundary
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 031/686] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 033/686] NFSD: Replace nfsd_write()s "stable" argument with "iocb_flags" Greg Kroah-Hartman
` (14 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bharath SM,
Paulo Alcantara (Red Hat), Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharath SM <bharathsm@microsoft.com>
[ Upstream commit 05f5e355cf783b30bd6eb3dec17ed1a8b3cfa95c ]
Add a 4-byte Pad to create_durable_handle_reconnect_v2 so the DH2C
create context is 8 byte aligned.
This avoids malformed CREATE contexts on reconnect.
Recent change removed this Padding, adding it back.
Fixes: 81a45de432c6 ("smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h")
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/common/smb2pdu.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 7377b5a9f8a55..4b8ed28a72c61 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1320,6 +1320,7 @@ struct create_durable_handle_reconnect_v2 {
struct create_context_hdr ccontext;
__u8 Name[8];
struct durable_reconnect_context_v2 dcontext;
+ __u8 Pad[4];
} __packed;
/* See MS-SMB2 2.2.14.2.12 */
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 033/686] NFSD: Replace nfsd_write()s "stable" argument with "iocb_flags"
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 032/686] smb: align durable reconnect v2 context to 8 byte boundary Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 034/686] NFSD: Move version-specific ACCESS maps into per-version code Greg Kroah-Hartman
` (13 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit 7f7dde9a45dfd9b3c9f35cb24aff9e45669071cc ]
The current nfsd_write() API is not NFS version-agnostic, as it
relies on callers to pass an NFSv3 stable_how value to determine
the persistence of the requested WRITE. NFSv2 does not use a
stable-how value on the wire, and NFSv4 has its own stable_how4
(though stable_how and stable_how4 happen to share the same
numeric values).
To remove the dependence on NFSv3-specific XDR values from NFSD's
generic VFS APIs, replace nfsd_write()'s stable argument with an
argument that passes a set of IOCB flags instead of an XDR-defined
value.
The NFSv4 WRITE and COPY paths had been borrowing the NFSv3
stable_how constants for their own on-the-wire stable values,
relying on the numeric coincidence noted above. Convert those
sites to the stable_how4 enumerators so the v4 code expresses
its own protocol's values directly, with no change in behavior.
While here, bound-check the decoded NFSv3 WRITE stable value, as
the NFSv4 WRITE decoder already does, and make the nfsd3_writeargs
stable field unsigned to suit.
The larger benefit is one less NFSv4 dependency on nfs3.h.
Link: https://patch.msgid.link/20260723182043.990391-3-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Stable-dep-of: ccfc4db5ab74 ("NFSD: map fh_verify() status codes for NFS_ACLv2 replies")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs3proc.c | 17 ++++++++++++++++-
fs/nfsd/nfs3xdr.c | 2 ++
fs/nfsd/nfs4proc.c | 18 ++++++++++++++++--
fs/nfsd/nfs4xdr.c | 2 +-
fs/nfsd/nfsproc.c | 2 +-
fs/nfsd/vfs.c | 30 ++++++++++--------------------
fs/nfsd/vfs.h | 6 ++++--
fs/nfsd/xdr3.h | 2 +-
include/linux/nfs4.h | 6 ++++++
9 files changed, 57 insertions(+), 28 deletions(-)
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index fbf573c317193..b71c869aaea7c 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -48,6 +48,20 @@ static bool nfsd3_time_in_range(const struct iattr *iap)
return true;
}
+static int nfsd3_iocb_flags(enum nfs3_stable_how how)
+{
+ switch (how) {
+ case NFS_FILE_SYNC:
+ /* persist data and timestamps */
+ return IOCB_DSYNC | IOCB_SYNC;
+ case NFS_DATA_SYNC:
+ /* persist data only */
+ return IOCB_DSYNC;
+ default:
+ return 0;
+ }
+}
+
static __be32 nfsd3_map_status(__be32 status)
{
switch (status) {
@@ -260,7 +274,8 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
resp->committed = argp->stable;
resp->status = nfsd_write(rqstp, &resp->fh, argp->offset,
&argp->payload, &cnt,
- resp->committed, resp->verf);
+ nfsd3_iocb_flags(resp->committed),
+ resp->verf);
resp->count = cnt;
resp->status = nfsd3_map_status(resp->status);
return rpc_success;
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index ef4971d71ac4b..067ae1c8aaa5a 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -556,6 +556,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, struct xdr_stream *xdr)
return false;
if (xdr_stream_decode_u32(xdr, &args->stable) < 0)
return false;
+ if (args->stable > NFS_FILE_SYNC)
+ return false;
/* opaque data */
if (xdr_stream_decode_u32(xdr, &args->len) < 0)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 1bf4a84d6a19c..161208b972be2 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -68,6 +68,20 @@ MODULE_PARM_DESC(nfsd4_ssc_umount_timeout,
#define NFSDDBG_FACILITY NFSDDBG_PROC
+static int nfsd4_iocb_flags(enum stable_how4 how)
+{
+ switch (how) {
+ case FILE_SYNC4:
+ /* persist data and timestamps */
+ return IOCB_DSYNC | IOCB_SYNC;
+ case DATA_SYNC4:
+ /* persist data only */
+ return IOCB_DSYNC;
+ default:
+ return 0;
+ }
+}
+
static u32 nfsd_attrmask[] = {
NFSD_WRITEABLE_ATTRS_WORD0,
NFSD_WRITEABLE_ATTRS_WORD1,
@@ -1302,7 +1316,7 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
write->wr_how_written = write->wr_stable_how;
status = nfsd_vfs_write(rqstp, &cstate->current_fh, nf,
write->wr_offset, &write->wr_payload,
- &cnt, write->wr_how_written,
+ &cnt, nfsd4_iocb_flags(write->wr_how_written),
(__be32 *)write->wr_verifier.data);
nfsd_file_put(nf);
@@ -1826,7 +1840,7 @@ static void nfsd4_init_copy_res(struct nfsd4_copy *copy, bool sync)
{
copy->cp_res.wr_stable_how =
test_bit(NFSD4_COPY_F_COMMITTED, ©->cp_flags) ?
- NFS_FILE_SYNC : NFS_UNSTABLE;
+ FILE_SYNC4 : UNSTABLE4;
nfsd4_copy_set_sync(copy, sync);
}
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 2fe4767dca5b5..7b243d9d71733 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1458,7 +1458,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
return nfserr_bad_xdr;
if (xdr_stream_decode_u32(argp->xdr, &write->wr_stable_how) < 0)
return nfserr_bad_xdr;
- if (write->wr_stable_how > NFS_FILE_SYNC)
+ if (write->wr_stable_how > FILE_SYNC4)
return nfserr_bad_xdr;
if (xdr_stream_decode_u32(argp->xdr, &write->wr_buflen) < 0)
return nfserr_bad_xdr;
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index c561d7014b49f..aab68a65ad563 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -280,7 +280,7 @@ nfsd_proc_write(struct svc_rqst *rqstp)
fh_copy(&resp->fh, &argp->fh);
resp->status = nfsd_write(rqstp, &resp->fh, argp->offset,
- &argp->payload, &cnt, NFS_DATA_SYNC, NULL);
+ &argp->payload, &cnt, IOCB_DSYNC, NULL);
if (resp->status == nfs_ok)
resp->status = fh_getattr(&resp->fh, &resp->stat);
else if (resp->status == nfserr_jukebox)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 53b55ee4e00ee..a126da5c3e8e3 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1185,7 +1185,7 @@ static int wait_for_concurrent_writes(struct file *file)
* @offset: Byte offset of start
* @payload: xdr_buf containing the write payload
* @cnt: IN: number of bytes to write, OUT: number of bytes actually written
- * @stable: An NFS stable_how value
+ * @iocb_flags: VFS IOCB_* flags expressing the requested write stability
* @verf: NFS WRITE verifier
*
* Upon return, caller must invoke fh_put on @fhp.
@@ -1197,7 +1197,7 @@ __be32
nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp,
struct nfsd_file *nf, loff_t offset,
const struct xdr_buf *payload, unsigned long *cnt,
- int stable, __be32 *verf)
+ int iocb_flags, __be32 *verf)
{
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
struct file *file = nf->nf_file;
@@ -1234,21 +1234,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp,
exp = fhp->fh_export;
if (!EX_ISSYNC(exp))
- stable = NFS_UNSTABLE;
+ iocb_flags = 0;
init_sync_kiocb(&kiocb, file);
kiocb.ki_pos = offset;
- if (likely(!fhp->fh_use_wgather)) {
- switch (stable) {
- case NFS_FILE_SYNC:
- /* persist data and timestamps */
- kiocb.ki_flags |= IOCB_DSYNC | IOCB_SYNC;
- break;
- case NFS_DATA_SYNC:
- /* persist data only */
- kiocb.ki_flags |= IOCB_DSYNC;
- break;
- }
- }
+ if (likely(!fhp->fh_use_wgather))
+ kiocb.ki_flags |= iocb_flags;
nvecs = xdr_buf_to_bvec(rqstp->rq_bvec, rqstp->rq_maxpages, payload);
if (nvecs < 0) {
@@ -1284,7 +1274,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp,
goto out_nfserr;
}
- if (stable && fhp->fh_use_wgather) {
+ if (iocb_flags && fhp->fh_use_wgather) {
host_err = wait_for_concurrent_writes(file);
if (host_err < 0)
commit_reset_write_verifier(nn, rqstp, host_err);
@@ -1375,7 +1365,7 @@ __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
* @offset: Byte offset of start
* @payload: xdr_buf containing the write payload
* @cnt: IN: number of bytes to write, OUT: number of bytes actually written
- * @stable: An NFS stable_how value
+ * @iocb_flags: VFS IOCB_* flags expressing the requested write stability
* @verf: NFS WRITE verifier
*
* Upon return, caller must invoke fh_put on @fhp.
@@ -1385,8 +1375,8 @@ __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
*/
__be32
nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,
- const struct xdr_buf *payload, unsigned long *cnt, int stable,
- __be32 *verf)
+ const struct xdr_buf *payload, unsigned long *cnt,
+ int iocb_flags, __be32 *verf)
{
struct nfsd_file *nf;
__be32 err;
@@ -1398,7 +1388,7 @@ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,
goto out;
err = nfsd_vfs_write(rqstp, fhp, nf, offset, payload, cnt,
- stable, verf);
+ iocb_flags, verf);
nfsd_file_put(nf);
out:
trace_nfsd_write_done(rqstp, fhp, offset, *cnt);
diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
index 1dd3ae3ceb3a8..2f589c4f0248c 100644
--- a/fs/nfsd/vfs.h
+++ b/fs/nfsd/vfs.h
@@ -131,11 +131,13 @@ __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
u32 *eof);
__be32 nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp,
loff_t offset, const struct xdr_buf *payload,
- unsigned long *cnt, int stable, __be32 *verf);
+ unsigned long *cnt, int iocb_flags,
+ __be32 *verf);
__be32 nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp,
struct nfsd_file *nf, loff_t offset,
const struct xdr_buf *payload,
- unsigned long *cnt, int stable, __be32 *verf);
+ unsigned long *cnt, int iocb_flags,
+ __be32 *verf);
__be32 nfsd_readlink(struct svc_rqst *, struct svc_fh *,
char *, int *);
__be32 nfsd_symlink(struct svc_rqst *, struct svc_fh *,
diff --git a/fs/nfsd/xdr3.h b/fs/nfsd/xdr3.h
index 522067b7fd755..7b5e3e3bac006 100644
--- a/fs/nfsd/xdr3.h
+++ b/fs/nfsd/xdr3.h
@@ -38,7 +38,7 @@ struct nfsd3_writeargs {
svc_fh fh;
__u64 offset;
__u32 count;
- int stable;
+ __u32 stable;
__u32 len;
struct xdr_buf payload;
};
diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index e947af6a3684a..7c5ab7ae7b532 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -390,6 +390,12 @@ enum why_no_delegation4 { /* new to v4.1 */
WND4_IS_DIR = 8,
};
+enum stable_how4 {
+ UNSTABLE4 = 0,
+ DATA_SYNC4 = 1,
+ FILE_SYNC4 = 2,
+};
+
enum lock_type4 {
NFS4_UNLOCK_LT = 0,
NFS4_READ_LT = 1,
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 034/686] NFSD: Move version-specific ACCESS maps into per-version code
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 033/686] NFSD: Replace nfsd_write()s "stable" argument with "iocb_flags" Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 035/686] NFSD: map fh_verify() status codes for NFS_ACLv2 replies Greg Kroah-Hartman
` (12 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit 3423b5f91d80d3a76424e1c9f1d0f95d4dd80101 ]
nfsd_access() owns three static tables that map on-the-wire ACCESS
bits to NFSD_MAY flags, and every NFS version shares them. That puts
protocol-version specifics in the version-agnostic VFS layer. The
NFSv4.2 extended-attribute bits are wedged into the NFSv3 tables
under CONFIG_NFSD_V4.
Give each version its own tables in its proc code and pass the
matching set into nfsd_access() as a new argument.
Splitting the tables also stops the NFSv2-ACL and NFSv3 ACCESS paths
from answering for the NFSv4.2 extended-attribute bits. Both use the
NFSv4-augmented table whenever CONFIG_NFSD_V4 is set, so an NFSv3
request that sets an xattr bit has it echoed back in the reply even
though those bits are undefined for v3.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260810141900.33846-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Stable-dep-of: ccfc4db5ab74 ("NFSD: map fh_verify() status codes for NFS_ACLv2 replies")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs2acl.c | 46 ++++++++++++++++++++++++++-
fs/nfsd/nfs3proc.c | 41 +++++++++++++++++++++++-
fs/nfsd/nfs4proc.c | 42 +++++++++++++++++++++++--
fs/nfsd/vfs.c | 78 ++++++++++------------------------------------
fs/nfsd/vfs.h | 15 ++++++++-
5 files changed, 155 insertions(+), 67 deletions(-)
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 2998640f259de..537097ce8c767 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -15,6 +15,48 @@
#define NFSDDBG_FACILITY NFSDDBG_PROC
+/*
+ * These maps are identical to the NFSv3 maps (nfs3proc.c). This enables
+ * the behavior of the two versions to diverge if needed.
+ */
+static const struct nfsd_access_map nfsd2_regaccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_map nfsd2_diraccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_LOOKUP, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_EXEC|NFSD_MAY_WRITE },
+ { NFS3_ACCESS_DELETE, NFSD_MAY_REMOVE },
+ { 0, 0 }
+};
+
+/*
+ * Some clients - Solaris 2.6 at least, make an access call to the NFS
+ * server to check for access for things like /dev/null (which really,
+ * NFSD doesn't care about). So NFSD provides simple access checking
+ * for those objects, looking mainly at mode bits, ignoring read-only
+ * filesystem checks.
+ */
+static const struct nfsd_access_map nfsd2_otheraccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_maps nfsd2_access_maps = {
+ .regular = nfsd2_regaccess,
+ .directory = nfsd2_diraccess,
+ .other = nfsd2_otheraccess,
+};
+
/*
* NULL call.
*/
@@ -180,7 +222,9 @@ static __be32 nfsacld_proc_access(struct svc_rqst *rqstp)
fh_copy(&resp->fh, &argp->fh);
resp->access = argp->access;
- resp->status = nfsd_access(rqstp, &resp->fh, &resp->access, NULL);
+
+ resp->status = nfsd_access(rqstp, &resp->fh, &nfsd2_access_maps,
+ &resp->access, NULL);
if (resp->status != nfs_ok)
goto out;
resp->status = fh_getattr(&resp->fh, &resp->stat);
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index b71c869aaea7c..87c5e766133c8 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -48,6 +48,44 @@ static bool nfsd3_time_in_range(const struct iattr *iap)
return true;
}
+static const struct nfsd_access_map nfsd3_regaccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_map nfsd3_diraccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_LOOKUP, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_EXEC|NFSD_MAY_WRITE },
+ { NFS3_ACCESS_DELETE, NFSD_MAY_REMOVE },
+ { 0, 0 }
+};
+
+/*
+ * Some clients - Solaris 2.6 at least, make an access call to the NFS
+ * server to check for access for things like /dev/null (which really,
+ * NFSD doesn't care about). So NFSD provides simple access checking
+ * for those objects, looking mainly at mode bits, ignoring read-only
+ * filesystem checks.
+ */
+static const struct nfsd_access_map nfsd3_otheraccess[] = {
+ { NFS3_ACCESS_READ, NFSD_MAY_READ },
+ { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_maps nfsd3_access_maps = {
+ .regular = nfsd3_regaccess,
+ .directory = nfsd3_diraccess,
+ .other = nfsd3_otheraccess,
+};
+
static int nfsd3_iocb_flags(enum nfs3_stable_how how)
{
switch (how) {
@@ -185,7 +223,8 @@ nfsd3_proc_access(struct svc_rqst *rqstp)
fh_copy(&resp->fh, &argp->fh);
resp->access = argp->access;
- resp->status = nfsd_access(rqstp, &resp->fh, &resp->access, NULL);
+ resp->status = nfsd_access(rqstp, &resp->fh, &nfsd3_access_maps,
+ &resp->access, NULL);
resp->status = nfsd3_map_status(resp->status);
return rpc_success;
}
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 161208b972be2..6c33eebd1a144 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -68,6 +68,43 @@ MODULE_PARM_DESC(nfsd4_ssc_umount_timeout,
#define NFSDDBG_FACILITY NFSDDBG_PROC
+static const struct nfsd_access_map nfsd4_regaccess[] = {
+ { NFS4_ACCESS_READ, NFSD_MAY_READ },
+ { NFS4_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS4_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS4_ACCESS_EXTEND, NFSD_MAY_WRITE },
+ { NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
+ { NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
+ { NFS4_ACCESS_XALIST, NFSD_MAY_READ },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_map nfsd4_diraccess[] = {
+ { NFS4_ACCESS_READ, NFSD_MAY_READ },
+ { NFS4_ACCESS_LOOKUP, NFSD_MAY_EXEC },
+ { NFS4_ACCESS_MODIFY, NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
+ { NFS4_ACCESS_EXTEND, NFSD_MAY_EXEC|NFSD_MAY_WRITE },
+ { NFS4_ACCESS_DELETE, NFSD_MAY_REMOVE },
+ { NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
+ { NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
+ { NFS4_ACCESS_XALIST, NFSD_MAY_READ },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_map nfsd4_otheraccess[] = {
+ { NFS4_ACCESS_READ, NFSD_MAY_READ },
+ { NFS4_ACCESS_EXECUTE, NFSD_MAY_EXEC },
+ { NFS4_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { NFS4_ACCESS_EXTEND, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
+ { 0, 0 }
+};
+
+static const struct nfsd_access_maps nfsd4_access_maps = {
+ .regular = nfsd4_regaccess,
+ .directory = nfsd4_diraccess,
+ .other = nfsd4_otheraccess,
+};
+
static int nfsd4_iocb_flags(enum stable_how4 how)
{
switch (how) {
@@ -764,10 +801,9 @@ nfsd4_access(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
if (access->ac_req_access & ~access_full)
return nfserr_inval;
-
access->ac_resp_access = access->ac_req_access;
- return nfsd_access(rqstp, &cstate->current_fh, &access->ac_resp_access,
- &access->ac_supported);
+ return nfsd_access(rqstp, &cstate->current_fh, &nfsd4_access_maps,
+ &access->ac_resp_access, &access->ac_supported);
}
static __be32
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index a126da5c3e8e3..7094902ca93a8 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -753,64 +753,21 @@ __be32 nfsd4_vfs_fallocate(struct svc_rqst *rqstp, struct svc_fh *fhp,
}
#endif /* defined(CONFIG_NFSD_V4) */
-/*
- * Check server access rights to a file system object
+/**
+ * nfsd_access - Check caller's access rights to a file system object
+ * @rqstp: RPC transaction context
+ * @fhp: target NFS filehandle
+ * @maps: tables mapping on-the-wire access bits to NFSD_MAY flags
+ * @access: requested access bits on entry, permitted bits on return
+ * @supported: optional output of the access bits the server supports
+ *
+ * Return: nfs_ok on success, otherwise an nfserr status code
*/
-struct accessmap {
- u32 access;
- int how;
-};
-static struct accessmap nfs3_regaccess[] = {
- { NFS3_ACCESS_READ, NFSD_MAY_READ },
- { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
- { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_TRUNC },
- { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE },
-
-#ifdef CONFIG_NFSD_V4
- { NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
- { NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
- { NFS4_ACCESS_XALIST, NFSD_MAY_READ },
-#endif
-
- { 0, 0 }
-};
-
-static struct accessmap nfs3_diraccess[] = {
- { NFS3_ACCESS_READ, NFSD_MAY_READ },
- { NFS3_ACCESS_LOOKUP, NFSD_MAY_EXEC },
- { NFS3_ACCESS_MODIFY, NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC},
- { NFS3_ACCESS_EXTEND, NFSD_MAY_EXEC|NFSD_MAY_WRITE },
- { NFS3_ACCESS_DELETE, NFSD_MAY_REMOVE },
-
-#ifdef CONFIG_NFSD_V4
- { NFS4_ACCESS_XAREAD, NFSD_MAY_READ },
- { NFS4_ACCESS_XAWRITE, NFSD_MAY_WRITE },
- { NFS4_ACCESS_XALIST, NFSD_MAY_READ },
-#endif
-
- { 0, 0 }
-};
-
-static struct accessmap nfs3_anyaccess[] = {
- /* Some clients - Solaris 2.6 at least, make an access call
- * to the server to check for access for things like /dev/null
- * (which really, the server doesn't care about). So
- * We provide simple access checking for them, looking
- * mainly at mode bits, and we make sure to ignore read-only
- * filesystem checks
- */
- { NFS3_ACCESS_READ, NFSD_MAY_READ },
- { NFS3_ACCESS_EXECUTE, NFSD_MAY_EXEC },
- { NFS3_ACCESS_MODIFY, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
- { NFS3_ACCESS_EXTEND, NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS },
-
- { 0, 0 }
-};
-
-__be32
-nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
+__be32 nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ const struct nfsd_access_maps *maps,
+ u32 *access, u32 *supported)
{
- struct accessmap *map;
+ const struct nfsd_access_map *map;
struct svc_export *export;
struct dentry *dentry;
u32 query, result = 0, sresult = 0;
@@ -824,12 +781,11 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
dentry = fhp->fh_dentry;
if (d_is_reg(dentry))
- map = nfs3_regaccess;
+ map = maps->regular;
else if (d_is_dir(dentry))
- map = nfs3_diraccess;
+ map = maps->directory;
else
- map = nfs3_anyaccess;
-
+ map = maps->other;
query = *access;
for (; map->access; map++) {
@@ -839,7 +795,7 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
sresult |= map->access;
err2 = nfsd_permission(&rqstp->rq_cred, export,
- dentry, map->how);
+ dentry, map->may);
switch (err2) {
case nfs_ok:
result |= map->access;
diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
index 2f589c4f0248c..7f6b90b6272d1 100644
--- a/fs/nfsd/vfs.h
+++ b/fs/nfsd/vfs.h
@@ -38,6 +38,17 @@
#define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE)
#define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC)
+struct nfsd_access_map {
+ u32 access;
+ int may;
+};
+
+struct nfsd_access_maps {
+ const struct nfsd_access_map *regular;
+ const struct nfsd_access_map *directory;
+ const struct nfsd_access_map *other;
+};
+
struct nfsd_file;
/*
@@ -96,7 +107,9 @@ __be32 nfsd_create_locked(struct svc_rqst *, struct svc_fh *,
__be32 nfsd_create(struct svc_rqst *, struct svc_fh *,
char *name, int len, struct nfsd_attrs *attrs,
int type, dev_t rdev, struct svc_fh *res);
-__be32 nfsd_access(struct svc_rqst *, struct svc_fh *, u32 *, u32 *);
+__be32 nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ const struct nfsd_access_maps *maps,
+ u32 *access, u32 *supported);
__be32 nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
struct svc_fh *resfhp, struct nfsd_attrs *iap);
__be32 nfsd_commit(struct svc_rqst *rqst, struct svc_fh *fhp,
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 035/686] NFSD: map fh_verify() status codes for NFS_ACLv2 replies
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 034/686] NFSD: Move version-specific ACCESS maps into per-version code Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 036/686] NFSD/blocklayout: Extract extent mapping from proc_layoutget Greg Kroah-Hartman
` (11 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit ccfc4db5ab740175b9958ea0cf5986957bf4e659 ]
The NFS_ACL v2 protocol shares its status code space with NFSv2,
which has no NFSERR_BADHANDLE and no NFSERR_NOFILEHANDLE. An
NFS_ACLv2 GETACL, SETACL, GETATTR, or ACCESS request that carries a
malformed or empty file handle gets a reply with status 10001 or
10020, values the client cannot interpret.
Commit 1459ad57673b ("nfsd: Move error code mapping to per-version
proc code.") removed the version check from fh_verify() that turned
those codes into NFSERR_STALE for any version 2 program. The NFSv2
procedures gained nfsd_map_status() in exchange, but the NFS_ACL v2
procedures did not, so the unmapped status reaches the encoder.
Add the same mapping to the NFS_ACL v2 procedures.
Fixes: 1459ad57673b ("nfsd: Move error code mapping to per-version proc code.")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260916004240.141975-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs2acl.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 537097ce8c767..87269be93d0f6 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -57,6 +57,20 @@ static const struct nfsd_access_maps nfsd2_access_maps = {
.other = nfsd2_otheraccess,
};
+static __be32 nfsacld_map_status(__be32 status)
+{
+ switch (status) {
+ case nfserr_nofilehandle:
+ case nfserr_badhandle:
+ status = nfserr_stale;
+ break;
+ case nfserr_wrongsec:
+ status = nfserr_acces;
+ break;
+ }
+ return status;
+}
+
/*
* NULL call.
*/
@@ -121,6 +135,7 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp)
/* resp->acl_{access,default} are released in nfssvc_release_getacl. */
out:
+ resp->status = nfsacld_map_status(resp->status);
return rpc_success;
fail:
@@ -179,6 +194,7 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst *rqstp)
out:
/* argp->acl_{access,default} are released in nfsaclsvc_release_setacl. */
+ resp->status = nfsacld_map_status(resp->status);
return rpc_success;
out_drop_lock:
@@ -205,6 +221,7 @@ static __be32 nfsacld_proc_getattr(struct svc_rqst *rqstp)
goto out;
resp->status = fh_getattr(&resp->fh, &resp->stat);
out:
+ resp->status = nfsacld_map_status(resp->status);
return rpc_success;
}
@@ -229,6 +246,7 @@ static __be32 nfsacld_proc_access(struct svc_rqst *rqstp)
goto out;
resp->status = fh_getattr(&resp->fh, &resp->stat);
out:
+ resp->status = nfsacld_map_status(resp->status);
return rpc_success;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 036/686] NFSD/blocklayout: Extract extent mapping from proc_layoutget
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 035/686] NFSD: map fh_verify() status codes for NFS_ACLv2 replies Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 037/686] exportfs: Complete kernel-doc for struct export_operations Greg Kroah-Hartman
` (10 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Bashirov, Christoph Hellwig,
Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <sergeybashirov@gmail.com>
[ Upstream commit a1dce715c64d4376321b5534366ae48fd7d14bcc ]
No changes in functionality. Split the proc_layoutget function to
create a helper function that maps single extent to the requested
range. This helper function is then used to implement support for
multiple extents per LAYOUTGET.
Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: 5d28b2c920d9 ("nfsd: don't offer flexfiles layouts when NFSv3 isn't being served")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/blocklayout.c | 115 ++++++++++++++++++++++++------------------
1 file changed, 66 insertions(+), 49 deletions(-)
diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c
index e9512c34c9dcf..8f6478d88ea22 100644
--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
@@ -17,68 +17,44 @@
#define NFSDDBG_FACILITY NFSDDBG_PNFS
+/*
+ * Get an extent from the file system that starts at offset or below
+ * and may be shorter than the requested length.
+ */
static __be32
-nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
- const struct svc_fh *fhp, struct nfsd4_layoutget *args)
+nfsd4_block_map_extent(struct inode *inode, const struct svc_fh *fhp,
+ u64 offset, u64 length, u32 iomode, u64 minlength,
+ struct pnfs_block_extent *bex)
{
- struct nfsd4_layout_seg *seg = &args->lg_seg;
struct super_block *sb = inode->i_sb;
- u64 length;
- u32 block_size = i_blocksize(inode);
- struct pnfs_block_extent *bex;
struct iomap iomap;
u32 device_generation = 0;
int error;
- if (locks_in_grace(SVC_NET(rqstp)))
- return nfserr_grace;
-
- if (seg->offset & (block_size - 1)) {
- dprintk("pnfsd: I/O misaligned\n");
- goto out_layoutunavailable;
- }
-
- /*
- * Some clients barf on non-zero block numbers for NONE or INVALID
- * layouts, so make sure to zero the whole structure.
- */
- error = -ENOMEM;
- bex = kzalloc(sizeof(*bex), GFP_KERNEL);
- if (!bex)
- goto out_error;
- args->lg_content = bex;
-
- error = sb->s_export_op->map_blocks(inode, seg->offset, seg->length,
- &iomap, seg->iomode != IOMODE_READ,
- &device_generation);
+ error = sb->s_export_op->map_blocks(inode, offset, length, &iomap,
+ iomode != IOMODE_READ, &device_generation);
if (error) {
if (error == -ENXIO)
- goto out_layoutunavailable;
- goto out_error;
- }
-
- length = iomap.offset + iomap.length - seg->offset;
- if (length < args->lg_minlength) {
- dprintk("pnfsd: extent smaller than minlength\n");
- goto out_layoutunavailable;
+ return nfserr_layoutunavailable;
+ return nfserrno(error);
}
switch (iomap.type) {
case IOMAP_MAPPED:
- if (seg->iomode == IOMODE_READ)
+ if (iomode == IOMODE_READ)
bex->es = PNFS_BLOCK_READ_DATA;
else
bex->es = PNFS_BLOCK_READWRITE_DATA;
bex->soff = iomap.addr;
break;
case IOMAP_UNWRITTEN:
- if (seg->iomode & IOMODE_RW) {
+ if (iomode & IOMODE_RW) {
/*
* Crack monkey special case from section 2.3.1.
*/
- if (args->lg_minlength == 0) {
+ if (minlength == 0) {
dprintk("pnfsd: no soup for you!\n");
- goto out_layoutunavailable;
+ return nfserr_layoutunavailable;
}
bex->es = PNFS_BLOCK_INVALID_DATA;
@@ -87,7 +63,7 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
}
fallthrough;
case IOMAP_HOLE:
- if (seg->iomode == IOMODE_READ) {
+ if (iomode == IOMODE_READ) {
bex->es = PNFS_BLOCK_NONE_DATA;
break;
}
@@ -95,27 +71,68 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
case IOMAP_DELALLOC:
default:
WARN(1, "pnfsd: filesystem returned %d extent\n", iomap.type);
- goto out_layoutunavailable;
+ return nfserr_layoutunavailable;
}
error = nfsd4_set_deviceid(&bex->vol_id, fhp, device_generation);
if (error)
- goto out_error;
+ return nfserrno(error);
+
bex->foff = iomap.offset;
bex->len = iomap.length;
+ return nfs_ok;
+}
+
+static __be32
+nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
+ const struct svc_fh *fhp, struct nfsd4_layoutget *args)
+{
+ struct nfsd4_layout_seg *seg = &args->lg_seg;
+ struct pnfs_block_extent *bex;
+ u64 length;
+ u32 block_size = i_blocksize(inode);
+ __be32 nfserr;
+
+ if (locks_in_grace(SVC_NET(rqstp)))
+ return nfserr_grace;
- seg->offset = iomap.offset;
- seg->length = iomap.length;
+ nfserr = nfserr_layoutunavailable;
+ if (seg->offset & (block_size - 1)) {
+ dprintk("pnfsd: I/O misaligned\n");
+ goto out_error;
+ }
+
+ /*
+ * Some clients barf on non-zero block numbers for NONE or INVALID
+ * layouts, so make sure to zero the whole structure.
+ */
+ nfserr = nfserrno(-ENOMEM);
+ bex = kzalloc(sizeof(*bex), GFP_KERNEL);
+ if (!bex)
+ goto out_error;
+ args->lg_content = bex;
+
+ nfserr = nfsd4_block_map_extent(inode, fhp, seg->offset, seg->length,
+ seg->iomode, args->lg_minlength, bex);
+ if (nfserr != nfs_ok)
+ goto out_error;
+
+ nfserr = nfserr_layoutunavailable;
+ length = bex->foff + bex->len - seg->offset;
+ if (length < args->lg_minlength) {
+ dprintk("pnfsd: extent smaller than minlength\n");
+ goto out_error;
+ }
+
+ seg->offset = bex->foff;
+ seg->length = bex->len;
dprintk("GET: 0x%llx:0x%llx %d\n", bex->foff, bex->len, bex->es);
- return 0;
+ return nfs_ok;
out_error:
seg->length = 0;
- return nfserrno(error);
-out_layoutunavailable:
- seg->length = 0;
- return nfserr_layoutunavailable;
+ return nfserr;
}
static __be32
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 037/686] exportfs: Complete kernel-doc for struct export_operations
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 036/686] NFSD/blocklayout: Extract extent mapping from proc_layoutget Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 038/686] exportfs: split out the ops for layout-based block device access Greg Kroah-Hartman
` (9 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, André Almeida, Chuck Lever,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Almeida <andrealmeid@igalia.com>
[ Upstream commit 7a6f811e2c06d656996776771f0498df129a0cc2 ]
Write down the missing members definitions for struct export_operations,
using as a reference the commit messages that created the members.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-3-acc1889de772@igalia.com
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 5d28b2c920d9 ("nfsd: don't offer flexfiles layouts when NFSv3 isn't being served")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/exportfs.h | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h
index f0cf2714ec52d..0dc1bae9e1654 100644
--- a/include/linux/exportfs.h
+++ b/include/linux/exportfs.h
@@ -201,7 +201,7 @@ struct handle_to_path_ctx {
* @commit_metadata: commit metadata changes to stable storage
*
* See Documentation/filesystems/nfs/exporting.rst for details on how to use
- * this interface correctly.
+ * this interface correctly and the definition of the flags.
*
* encode_fh:
* @encode_fh should store in the file handle fragment @fh (using at most
@@ -252,6 +252,19 @@ struct handle_to_path_ctx {
* commit_metadata:
* @commit_metadata should commit metadata changes to stable storage.
*
+ * @get_uuid:
+ * Get a filesystem unique signature exposed to clients.
+ *
+ * @map_blocks:
+ * Map and, if necessary, allocate blocks for a layout.
+ *
+ * @commit_blocks:
+ * Commit blocks in a layout once the client is done with them.
+ *
+ * @flags:
+ * Allows the filesystem to communicate to nfsd that it may want to do things
+ * differently when dealing with it.
+ *
* Locking rules:
* get_parent is called with child->d_inode->i_rwsem down
* get_name is not (which is possibly inconsistent)
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 038/686] exportfs: split out the ops for layout-based block device access
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 037/686] exportfs: Complete kernel-doc for struct export_operations Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 039/686] exportfs,nfsd: rework checking for layout-based block device access support Greg Kroah-Hartman
` (8 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jeff Layton,
Chuck Lever, Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit d5758c31a81bcd9d5ac8a7456549b05df3579068 ]
The support to grant layouts for direct block device access works
at a very different layer than the rest of exports. Split the methods
for it into a separate struct, and move that into a separate header
to better split things out. The pointer to the new operation vector
is kept in export_operations to avoid bloating the super_block.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20260423181854.743150-3-cel@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 5d28b2c920d9 ("nfsd: don't offer flexfiles layouts when NFSv3 isn't being served")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
MAINTAINERS | 2 +-
fs/nfsd/blocklayout.c | 14 ++++++------
fs/nfsd/nfs4layouts.c | 9 ++++----
fs/xfs/xfs_export.c | 4 +---
fs/xfs/xfs_pnfs.c | 12 ++++++++---
fs/xfs/xfs_pnfs.h | 11 +++++-----
include/linux/exportfs.h | 25 +++++++---------------
include/linux/exportfs_block.h | 39 ++++++++++++++++++++++++++++++++++
8 files changed, 74 insertions(+), 42 deletions(-)
create mode 100644 include/linux/exportfs_block.h
diff --git a/MAINTAINERS b/MAINTAINERS
index f5ea8588244c9..5821d97ae3304 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9606,7 +9606,7 @@ S: Supported
F: Documentation/filesystems/nfs/exporting.rst
F: fs/exportfs/
F: fs/fhandle.c
-F: include/linux/exportfs.h
+F: include/linux/exportfs*.h
FILESYSTEMS [IDMAPPED MOUNTS]
M: Christian Brauner <brauner@kernel.org>
diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c
index 8f6478d88ea22..ac1312fd1c457 100644
--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
@@ -2,7 +2,7 @@
/*
* Copyright (c) 2014-2016 Christoph Hellwig.
*/
-#include <linux/exportfs.h>
+#include <linux/exportfs_block.h>
#include <linux/iomap.h>
#include <linux/slab.h>
#include <linux/pr.h>
@@ -31,8 +31,8 @@ nfsd4_block_map_extent(struct inode *inode, const struct svc_fh *fhp,
u32 device_generation = 0;
int error;
- error = sb->s_export_op->map_blocks(inode, offset, length, &iomap,
- iomode != IOMODE_READ, &device_generation);
+ error = sb->s_export_op->block_ops->map_blocks(inode, offset, length,
+ &iomap, iomode != IOMODE_READ, &device_generation);
if (error) {
if (error == -ENXIO)
return nfserr_layoutunavailable;
@@ -154,8 +154,8 @@ nfsd4_block_commit_blocks(struct inode *inode, struct nfsd4_layoutcommit *lcp,
iattr.ia_size = lcp->lc_newsize;
}
- error = inode->i_sb->s_export_op->commit_blocks(inode, iomaps,
- nr_iomaps, &iattr);
+ error = inode->i_sb->s_export_op->block_ops->commit_blocks(inode,
+ iomaps, nr_iomaps, &iattr);
kfree(iomaps);
return nfserrno(error);
}
@@ -178,8 +178,8 @@ nfsd4_block_get_device_info_simple(struct super_block *sb,
b->type = PNFS_BLOCK_VOLUME_SIMPLE;
b->simple.sig_len = PNFS_BLOCK_UUID_LEN;
- return sb->s_export_op->get_uuid(sb, b->simple.sig, &b->simple.sig_len,
- &b->simple.offset);
+ return sb->s_export_op->block_ops->get_uuid(sb, b->simple.sig,
+ &b->simple.sig_len, &b->simple.offset);
}
static __be32
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 2121ef26e7a98..6b6f55ae0472d 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -3,6 +3,7 @@
* Copyright (c) 2014 Christoph Hellwig.
*/
#include <linux/blkdev.h>
+#include <linux/exportfs_block.h>
#include <linux/kmod.h>
#include <linux/file.h>
#include <linux/jhash.h>
@@ -127,6 +128,7 @@ void nfsd4_setup_layout_type(struct svc_export *exp)
{
#if defined(CONFIG_NFSD_BLOCKLAYOUT) || defined(CONFIG_NFSD_SCSILAYOUT)
struct super_block *sb = exp->ex_path.mnt->mnt_sb;
+ const struct exportfs_block_ops *bops = sb->s_export_op->block_ops;
#endif
if (!(exp->ex_flags & NFSEXP_PNFS))
@@ -136,14 +138,11 @@ void nfsd4_setup_layout_type(struct svc_export *exp)
exp->ex_layout_types |= 1 << LAYOUT_FLEX_FILES;
#endif
#ifdef CONFIG_NFSD_BLOCKLAYOUT
- if (sb->s_export_op->get_uuid &&
- sb->s_export_op->map_blocks &&
- sb->s_export_op->commit_blocks)
+ if (bops && bops->get_uuid && bops->map_blocks && bops->commit_blocks)
exp->ex_layout_types |= 1 << LAYOUT_BLOCK_VOLUME;
#endif
#ifdef CONFIG_NFSD_SCSILAYOUT
- if (sb->s_export_op->map_blocks &&
- sb->s_export_op->commit_blocks &&
+ if (bops && bops->map_blocks && bops->commit_blocks &&
sb->s_bdev &&
sb->s_bdev->bd_disk->fops->pr_ops &&
sb->s_bdev->bd_disk->fops->get_unique_id)
diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c
index 201489d3de089..f64e035cacb55 100644
--- a/fs/xfs/xfs_export.c
+++ b/fs/xfs/xfs_export.c
@@ -244,8 +244,6 @@ const struct export_operations xfs_export_operations = {
.get_parent = xfs_fs_get_parent,
.commit_metadata = xfs_fs_nfs_commit_metadata,
#ifdef CONFIG_EXPORTFS_BLOCK_OPS
- .get_uuid = xfs_fs_get_uuid,
- .map_blocks = xfs_fs_map_blocks,
- .commit_blocks = xfs_fs_commit_blocks,
+ .block_ops = &xfs_export_block_ops,
#endif
};
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index afe7497012d4c..c685995b69d7e 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -49,7 +49,7 @@ xfs_break_leased_layouts(
* Get a unique ID including its location so that the client can identify
* the exported device.
*/
-int
+static int
xfs_fs_get_uuid(
struct super_block *sb,
u8 *buf,
@@ -104,7 +104,7 @@ xfs_fs_map_update_inode(
/*
* Get a layout for the pNFS client.
*/
-int
+static int
xfs_fs_map_blocks(
struct inode *inode,
loff_t offset,
@@ -252,7 +252,7 @@ xfs_pnfs_validate_isize(
* to manually flush the cache here similar to what the fsync code path does
* for datasyncs on files that have no dirty metadata.
*/
-int
+static int
xfs_fs_commit_blocks(
struct inode *inode,
struct iomap *maps,
@@ -332,3 +332,9 @@ xfs_fs_commit_blocks(
xfs_iunlock(ip, XFS_IOLOCK_EXCL);
return error;
}
+
+const struct exportfs_block_ops xfs_export_block_ops = {
+ .get_uuid = xfs_fs_get_uuid,
+ .map_blocks = xfs_fs_map_blocks,
+ .commit_blocks = xfs_fs_commit_blocks,
+};
diff --git a/fs/xfs/xfs_pnfs.h b/fs/xfs/xfs_pnfs.h
index 940c6c2ad88c5..bf43b2009e4cc 100644
--- a/fs/xfs/xfs_pnfs.h
+++ b/fs/xfs/xfs_pnfs.h
@@ -2,13 +2,9 @@
#ifndef _XFS_PNFS_H
#define _XFS_PNFS_H 1
-#ifdef CONFIG_EXPORTFS_BLOCK_OPS
-int xfs_fs_get_uuid(struct super_block *sb, u8 *buf, u32 *len, u64 *offset);
-int xfs_fs_map_blocks(struct inode *inode, loff_t offset, u64 length,
- struct iomap *iomap, bool write, u32 *device_generation);
-int xfs_fs_commit_blocks(struct inode *inode, struct iomap *maps, int nr_maps,
- struct iattr *iattr);
+#include <linux/exportfs_block.h>
+#ifdef CONFIG_EXPORTFS_BLOCK_OPS
int xfs_break_leased_layouts(struct inode *inode, uint *iolock,
bool *did_unlock);
#else
@@ -18,4 +14,7 @@ xfs_break_leased_layouts(struct inode *inode, uint *iolock, bool *did_unlock)
return 0;
}
#endif /* CONFIG_EXPORTFS_BLOCK_OPS */
+
+extern const struct exportfs_block_ops xfs_export_block_ops;
+
#endif /* _XFS_PNFS_H */
diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h
index 0dc1bae9e1654..dfeadad435a60 100644
--- a/include/linux/exportfs.h
+++ b/include/linux/exportfs.h
@@ -6,9 +6,8 @@
#include <linux/path.h>
struct dentry;
-struct iattr;
+struct exportfs_block_ops;
struct inode;
-struct iomap;
struct super_block;
struct vfsmount;
@@ -252,19 +251,13 @@ struct handle_to_path_ctx {
* commit_metadata:
* @commit_metadata should commit metadata changes to stable storage.
*
- * @get_uuid:
- * Get a filesystem unique signature exposed to clients.
- *
- * @map_blocks:
- * Map and, if necessary, allocate blocks for a layout.
- *
- * @commit_blocks:
- * Commit blocks in a layout once the client is done with them.
- *
* @flags:
* Allows the filesystem to communicate to nfsd that it may want to do things
* differently when dealing with it.
*
+ * @block_ops:
+ * Operations for layout grants to block on the underlying device.
+ *
* Locking rules:
* get_parent is called with child->d_inode->i_rwsem down
* get_name is not (which is possibly inconsistent)
@@ -282,12 +275,6 @@ struct export_operations {
struct dentry * (*get_parent)(struct dentry *child);
int (*commit_metadata)(struct inode *inode);
- int (*get_uuid)(struct super_block *sb, u8 *buf, u32 *len, u64 *offset);
- int (*map_blocks)(struct inode *inode, loff_t offset,
- u64 len, struct iomap *iomap,
- bool write, u32 *device_generation);
- int (*commit_blocks)(struct inode *inode, struct iomap *iomaps,
- int nr_iomaps, struct iattr *iattr);
int (*permission)(struct handle_to_path_ctx *ctx, unsigned int oflags);
struct file * (*open)(const struct path *path, unsigned int oflags);
#define EXPORT_OP_NOWCC (0x1) /* don't collect v3 wcc data */
@@ -300,6 +287,10 @@ struct export_operations {
#define EXPORT_OP_FLUSH_ON_CLOSE (0x20) /* fs flushes file data on close */
#define EXPORT_OP_NOLOCKS (0x40) /* no file locking support */
unsigned long flags;
+
+#ifdef CONFIG_EXPORTFS_BLOCK_OPS
+ const struct exportfs_block_ops *block_ops;
+#endif
};
/**
diff --git a/include/linux/exportfs_block.h b/include/linux/exportfs_block.h
new file mode 100644
index 0000000000000..1f52fea8e4dce
--- /dev/null
+++ b/include/linux/exportfs_block.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2014-2026 Christoph Hellwig.
+ *
+ * Support for exportfs-based layout grants for direct block device access.
+ */
+#ifndef LINUX_EXPORTFS_BLOCK_H
+#define LINUX_EXPORTFS_BLOCK_H 1
+
+#include <linux/types.h>
+
+struct iattr;
+struct inode;
+struct iomap;
+struct super_block;
+
+struct exportfs_block_ops {
+ /*
+ * Get the in-band device unique signature exposed to clients.
+ */
+ int (*get_uuid)(struct super_block *sb, u8 *buf, u32 *len, u64 *offset);
+
+ /*
+ * Map blocks for direct block access.
+ * If @write is %true, also allocate the blocks for the range if needed.
+ */
+ int (*map_blocks)(struct inode *inode, loff_t offset, u64 len,
+ struct iomap *iomap, bool write,
+ u32 *device_generation);
+
+ /*
+ * Commit blocks previously handed out by ->map_blocks and written to by
+ * the client.
+ */
+ int (*commit_blocks)(struct inode *inode, struct iomap *iomaps,
+ int nr_iomaps, struct iattr *iattr);
+};
+
+#endif /* LINUX_EXPORTFS_BLOCK_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 039/686] exportfs,nfsd: rework checking for layout-based block device access support
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 038/686] exportfs: split out the ops for layout-based block device access Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 040/686] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
` (7 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jeff Layton,
Chuck Lever, Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit da9baa5470dcb077a7c9806f0925c60b530c470b ]
Currently NFSD hard codes checking support for block-style layouts.
Lift the checks into a file system-helper and provide a exportfs-level
helper to implement the typical checks.
This prepares for supporting block layout export of multiple devices
per file system.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20260423181854.743150-5-cel@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 5d28b2c920d9 ("nfsd: don't offer flexfiles layouts when NFSv3 isn't being served")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/export.c | 3 +-
fs/nfsd/nfs4layouts.c | 26 +++++------------
fs/xfs/xfs_pnfs.c | 13 +++++++++
include/linux/exportfs_block.h | 52 +++++++++++++++++++++++++++++++++-
4 files changed, 73 insertions(+), 21 deletions(-)
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 2a1499f2ad196..e33843a937dd6 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -722,7 +722,8 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
goto out4;
err = 0;
- nfsd4_setup_layout_type(&exp);
+ if (exp.ex_flags & NFSEXP_PNFS)
+ nfsd4_setup_layout_type(&exp);
}
expp = svc_export_lookup(&exp);
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 6b6f55ae0472d..c2d435c99bf5e 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -2,7 +2,6 @@
/*
* Copyright (c) 2014 Christoph Hellwig.
*/
-#include <linux/blkdev.h>
#include <linux/exportfs_block.h>
#include <linux/kmod.h>
#include <linux/file.h>
@@ -126,28 +125,17 @@ nfsd4_set_deviceid(struct nfsd4_deviceid *id, const struct svc_fh *fhp,
void nfsd4_setup_layout_type(struct svc_export *exp)
{
-#if defined(CONFIG_NFSD_BLOCKLAYOUT) || defined(CONFIG_NFSD_SCSILAYOUT)
struct super_block *sb = exp->ex_path.mnt->mnt_sb;
- const struct exportfs_block_ops *bops = sb->s_export_op->block_ops;
-#endif
-
- if (!(exp->ex_flags & NFSEXP_PNFS))
- return;
+ expfs_block_layouts_t block_supported = exportfs_layouts_supported(sb);
-#ifdef CONFIG_NFSD_FLEXFILELAYOUT
- exp->ex_layout_types |= 1 << LAYOUT_FLEX_FILES;
-#endif
-#ifdef CONFIG_NFSD_BLOCKLAYOUT
- if (bops && bops->get_uuid && bops->map_blocks && bops->commit_blocks)
+ if (IS_ENABLED(CONFIG_NFSD_FLEXFILELAYOUT))
+ exp->ex_layout_types |= 1 << LAYOUT_FLEX_FILES;
+ if (IS_ENABLED(CONFIG_NFSD_BLOCKLAYOUT) &&
+ (block_supported & EXPFS_BLOCK_IN_BAND_ID))
exp->ex_layout_types |= 1 << LAYOUT_BLOCK_VOLUME;
-#endif
-#ifdef CONFIG_NFSD_SCSILAYOUT
- if (bops && bops->map_blocks && bops->commit_blocks &&
- sb->s_bdev &&
- sb->s_bdev->bd_disk->fops->pr_ops &&
- sb->s_bdev->bd_disk->fops->get_unique_id)
+ if (IS_ENABLED(CONFIG_NFSD_SCSILAYOUT) &&
+ (block_supported & EXPFS_BLOCK_OUT_OF_BAND_ID))
exp->ex_layout_types |= 1 << LAYOUT_SCSI;
-#endif
}
void nfsd4_close_layout(struct nfs4_layout_stateid *ls)
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index c685995b69d7e..1b0b739571612 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -13,6 +13,7 @@
#include "xfs_bmap.h"
#include "xfs_iomap.h"
#include "xfs_pnfs.h"
+#include <linux/exportfs_block.h>
/*
* Ensure that we do not have any outstanding pNFS layouts that can be used by
@@ -45,6 +46,17 @@ xfs_break_leased_layouts(
return error;
}
+static expfs_block_layouts_t
+xfs_fs_layouts_supported(
+ struct super_block *sb)
+{
+ expfs_block_layouts_t supported = EXPFS_BLOCK_IN_BAND_ID;
+
+ if (exportfs_bdev_supports_out_of_band_id(sb->s_bdev))
+ supported |= EXPFS_BLOCK_OUT_OF_BAND_ID;
+ return supported;
+}
+
/*
* Get a unique ID including its location so that the client can identify
* the exported device.
@@ -334,6 +346,7 @@ xfs_fs_commit_blocks(
}
const struct exportfs_block_ops xfs_export_block_ops = {
+ .layouts_supported = xfs_fs_layouts_supported,
.get_uuid = xfs_fs_get_uuid,
.map_blocks = xfs_fs_map_blocks,
.commit_blocks = xfs_fs_commit_blocks,
diff --git a/include/linux/exportfs_block.h b/include/linux/exportfs_block.h
index 1f52fea8e4dce..92f990d190bba 100644
--- a/include/linux/exportfs_block.h
+++ b/include/linux/exportfs_block.h
@@ -7,14 +7,36 @@
#ifndef LINUX_EXPORTFS_BLOCK_H
#define LINUX_EXPORTFS_BLOCK_H 1
-#include <linux/types.h>
+#include <linux/blkdev.h>
+#include <linux/exportfs.h>
+#include <linux/fs.h>
struct iattr;
struct inode;
struct iomap;
struct super_block;
+/*
+ * There are the two types of block-style layout support:
+ * - In-band implies a device identified by a unique cookie inside the actual
+ * device address space checked by the ->get_uuid method as used by the pNFS
+ * block layout. This is a bit dangerous and deprecated.
+ * - Out of band implies identification by out of band unique identifiers
+ * specified by the storage protocol, which is much safer and used by the
+ * pNFS SCSI/NVMe layouts.
+ */
+typedef unsigned int __bitwise expfs_block_layouts_t;
+#define EXPFS_BLOCK_FLAG(__bit) \
+ ((__force expfs_block_layouts_t)(1u << __bit))
+#define EXPFS_BLOCK_IN_BAND_ID EXPFS_BLOCK_FLAG(0)
+#define EXPFS_BLOCK_OUT_OF_BAND_ID EXPFS_BLOCK_FLAG(1)
+
struct exportfs_block_ops {
+ /*
+ * Returns the EXPFS_BLOCK_* bitmap of supported layout types.
+ */
+ expfs_block_layouts_t (*layouts_supported)(struct super_block *sb);
+
/*
* Get the in-band device unique signature exposed to clients.
*/
@@ -36,4 +58,32 @@ struct exportfs_block_ops {
int nr_iomaps, struct iattr *iattr);
};
+static inline bool
+exportfs_bdev_supports_out_of_band_id(struct block_device *bdev)
+{
+ return bdev->bd_disk->fops->pr_ops &&
+ bdev->bd_disk->fops->get_unique_id;
+}
+
+#ifdef CONFIG_EXPORTFS_BLOCK_OPS
+static inline expfs_block_layouts_t
+exportfs_layouts_supported(struct super_block *sb)
+{
+ const struct exportfs_block_ops *bops = sb->s_export_op->block_ops;
+
+ if (!bops ||
+ !bops->layouts_supported ||
+ WARN_ON_ONCE(!bops->map_blocks) ||
+ WARN_ON_ONCE(!bops->commit_blocks))
+ return 0;
+ return bops->layouts_supported(sb);
+}
+#else
+static inline expfs_block_layouts_t
+exportfs_layouts_supported(struct super_block *sb)
+{
+ return 0;
+}
+#endif /* CONFIG_EXPORTFS_BLOCK_OPS */
+
#endif /* LINUX_EXPORTFS_BLOCK_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 040/686] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 039/686] exportfs,nfsd: rework checking for layout-based block device access support Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 041/686] NFSD: report listener creation failures through extack Greg Kroah-Hartman
` (6 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benji Wiebe, Jeff Layton,
Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 5d28b2c920d9d9d3c45b41769342ad785eb372a7 ]
The flexfiles layout driver hands out a deviceinfo that names this server
as an NFSv3 DS (flexfilelayout.c hardcodes da->version = 3). With v3
disabled, the client can't talk to the DS: it loops on v3 NULL calls that
the server answers with PROG_MISMATCH, and I/O hangs in D state.
Skip LAYOUT_FLEX_FILES in nfsd4_setup_layout_type() unless v3 is enabled.
Reported-by: Benji Wiebe <itsme@benjiwiebe.com>
Closes: https://lore.kernel.org/linux-nfs/c734eeb8-8486-4491-bb4d-b9656cbaffbe@app.fastmail.com/
Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260904-pnfs-ff-v1-1-5f502cf25401@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4layouts.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index c2d435c99bf5e..8ec980c69bec5 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -125,10 +125,12 @@ nfsd4_set_deviceid(struct nfsd4_deviceid *id, const struct svc_fh *fhp,
void nfsd4_setup_layout_type(struct svc_export *exp)
{
+ struct nfsd_net *nn = net_generic(exp->cd->net, nfsd_net_id);
struct super_block *sb = exp->ex_path.mnt->mnt_sb;
expfs_block_layouts_t block_supported = exportfs_layouts_supported(sb);
- if (IS_ENABLED(CONFIG_NFSD_FLEXFILELAYOUT))
+ if (IS_ENABLED(CONFIG_NFSD_FLEXFILELAYOUT) &&
+ nfsd_vers(nn, 3, NFSD_TEST))
exp->ex_layout_types |= 1 << LAYOUT_FLEX_FILES;
if (IS_ENABLED(CONFIG_NFSD_BLOCKLAYOUT) &&
(block_supported & EXPFS_BLOCK_IN_BAND_ID))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 041/686] NFSD: report listener creation failures through extack
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 040/686] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 042/686] SUNRPC: report local rpcbind calls that get no answer Greg Kroah-Hartman
` (5 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 8e590a16853fedd2697a3b0c32b3cbf1a444f7b2 ]
nfsd_nl_listener_set_doit() returns the raw errno from
svc_xprt_create_from_sa() and sets no extack. A failed LISTENER_SET
therefore tells userland only "Address already in use", or whatever else
the transport returned. It never tells userland which entry failed.
Record the attribute and the transport name of the entry whose errno the
call returns, and report both after the loop. NL_SET_BAD_ATTR() names the
entry, which the message alone cannot do: a request can carry several
entries with the same transport name.
The rejections in nfsd_nl_validate_listeners() other than -E2BIG and the
unsupported transport name still carry no extack. This patch does not
change them.
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-5-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Stable-dep-of: bf0f3a37e6cc ("NFSD: stop registering with rpcbind after a failure in listener_set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfsctl.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 967c5bf30d051..49cd0588deb39 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -2026,7 +2026,9 @@ static int nfsd_nl_validate_listeners(struct genl_info *info)
int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
{
struct net *net = genl_info_net(info);
+ const struct nlattr *bad_attr = NULL;
struct svc_xprt *xprt, *tmp;
+ const char *bad_xprt = NULL;
const struct nlattr *attr;
struct svc_serv *serv;
LIST_HEAD(permsocks);
@@ -2145,8 +2147,22 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
ret = svc_xprt_create_from_sa(serv, xcl_name, net, sa, 0,
current_cred());
/* always save the latest error */
- if (ret < 0)
+ if (ret < 0) {
+ bad_attr = attr;
+ bad_xprt = xcl_name;
err = ret;
+ }
+ }
+
+ /*
+ * The ack carries the errno of the last entry that failed. Point at
+ * that entry as well, since several entries can share a transport
+ * name and the errno alone cannot tell them apart.
+ */
+ if (err) {
+ NL_SET_BAD_ATTR(info->extack, bad_attr);
+ NL_SET_ERR_MSG_FMT(info->extack, "cannot create %s listener",
+ bad_xprt);
}
if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 042/686] SUNRPC: report local rpcbind calls that get no answer
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 041/686] NFSD: report listener creation failures through extack Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 043/686] NFSD: stop registering with rpcbind after a failure in listener_set Greg Kroah-Hartman
` (4 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 202a557d0c8e65c7fd7fcff2ad2756468d1ab711 ]
A caller that creates many listeners in one operation calls svc_register()
once for each of them. Every call waits for the local rpcbind on its own,
so a rpcbind that never answers costs the caller one timeout per listener.
The caller has no way to learn that the first call already failed.
Split rpcb_register_call() failures by whether rpcbind answered:
- answered: a FALSE reply, or an RPC-level rejection that
rpc_decode_header() derives from the reply. -EACCES (FALSE reply or
AUTH_ERROR), -EPROTONOSUPPORT, -EPFNOSUPPORT, -EOPNOTSUPP.
- never sent: -ENOMEM, -EMSGSIZE, -ERESTARTSYS.
- no answer: everything else, i.e. transport errors.
Any no-answer error gets represented by -EIO, which is already what the
RPC layer reports for most of it: rpc_check_timeout() returns -EIO for a
soft timeout without RPC_TASK_TIMEOUT, and call_status() documents -EIO
as "shutdown or soft timeout".
Keep a count of the number of rpcbind failures in the serv. Later
patches will use that to watch for hard rpcbind failures, and alter
their behavior accordingly.
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-6-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Stable-dep-of: bf0f3a37e6cc ("NFSD: stop registering with rpcbind after a failure in listener_set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sunrpc/clnt.h | 3 ++-
include/linux/sunrpc/svc.h | 7 +++++--
net/sunrpc/rpcb_clnt.c | 22 ++++++++++++++++---
net/sunrpc/svc.c | 42 ++++++++++++++++++++++++++++++++++++-
4 files changed, 67 insertions(+), 7 deletions(-)
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 3c2b8c355ab3a..30344c0d6a9d7 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -199,7 +199,8 @@ struct rpc_xprt *rpc_task_get_xprt(struct rpc_clnt *clnt,
int rpcb_create_local(struct net *);
void rpcb_put_local(struct net *);
-int rpcb_register(struct net *, u32, u32, int, unsigned short);
+int rpcb_register(struct net *net, u32 prog, u32 vers, int prot,
+ unsigned short port);
int rpcb_v4_register(struct net *net, const u32 program,
const u32 version,
const struct sockaddr *address,
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 5506d20857c31..1668804db44dd 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -75,6 +75,7 @@ struct svc_serv {
unsigned int sv_max_payload; /* datagram payload size */
unsigned int sv_max_mesg; /* max_payload + 1 page for overheads */
unsigned int sv_xdrsize; /* XDR buffer size */
+ atomic_t sv_rpcb_failures; /* unanswered rpcbind calls */
struct list_head sv_permsocks; /* all permanent sockets */
struct list_head sv_tempsocks; /* all temporary sockets */
int sv_tmpcnt; /* count of temporary "valid" sockets */
@@ -435,6 +436,7 @@ int sunrpc_set_pool_mode(const char *val);
int sunrpc_get_pool_mode(char *val, size_t size);
void svc_rpcb_cleanup(struct svc_serv *serv, struct net *net);
int svc_bind(struct svc_serv *serv, struct net *net);
+unsigned int svc_rpcb_failure_count(struct svc_serv *serv);
struct svc_serv *svc_create(struct svc_program *, unsigned int,
int (*threadfn)(void *data));
bool svc_rqst_replace_page(struct svc_rqst *rqstp,
@@ -450,8 +452,9 @@ int svc_set_num_threads(struct svc_serv *, struct svc_pool *, int);
int svc_pool_stats_open(struct svc_info *si, struct file *file);
void svc_process(struct svc_rqst *rqstp);
void svc_process_bc(struct rpc_rqst *req, struct svc_rqst *rqstp);
-int svc_register(const struct svc_serv *, struct net *, const int,
- const unsigned short, const unsigned short);
+int svc_register(struct svc_serv *serv, struct net *net,
+ const int family, const unsigned short proto,
+ const unsigned short port);
void svc_wake_up(struct svc_serv *);
void svc_reserve(struct svc_rqst *rqstp, int space);
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 2d74c660de666..9b90350820be4 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -400,7 +400,8 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *nodename,
return rpc_create(&args);
}
-static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, struct rpc_message *msg, bool is_set)
+static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt,
+ struct rpc_message *msg, bool is_set)
{
int flags = RPC_TASK_NOCONNECT;
int error, result = 0;
@@ -410,8 +411,23 @@ static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, stru
msg->rpc_resp = &result;
error = rpc_call_sync(clnt, msg, flags);
- if (error < 0)
- return error;
+ if (error < 0) {
+ switch (error) {
+ /* rpcbind answered; the reply itself carries the error */
+ case -EPROTONOSUPPORT:
+ case -EPFNOSUPPORT:
+ case -EOPNOTSUPP:
+ case -EACCES:
+ /* the call never made it onto the wire */
+ case -ENOMEM:
+ case -EMSGSIZE:
+ /* the caller is going away; this says nothing about rpcbind */
+ case -ERESTARTSYS:
+ return error;
+ }
+ /* anything else, we assume that rpcbind isn't functional */
+ return -EIO;
+ }
if (!result)
return -EACCES;
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 61c3c3a743289..a3933f86f2d42 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1207,10 +1207,40 @@ int svc_generic_rpcbind_set(struct net *net,
error = svc_rpcbind_set_version(net, progp, version,
family, proto, port);
+ /* -EIO means no answer, not a refusal, so vs_rpcb_optnl must keep it. */
+ if (error == -EIO)
+ return error;
+
return (vers->vs_rpcb_optnl) ? 0 : error;
}
EXPORT_SYMBOL_GPL(svc_generic_rpcbind_set);
+/**
+ * svc_rpcb_failure_count - local rpcbind calls for @serv that got no answer
+ * @serv: RPC service to query
+ *
+ * svc_register() adds one for each of its calls that got no answer. A reply
+ * that refuses one entry does not count, because rpcbind answered and the
+ * next entry may still succeed.
+ *
+ * The count is kept per serv rather than per net. The local rpcbind client
+ * is per-net and lockd shares it, but a count that another service can move
+ * says nothing about this serv's own calls.
+ *
+ * This is for callers that cannot see the svc_register() return, because a
+ * transport class sits in between. Such a caller reads the count before it
+ * starts and compares as it goes, so there is no state to reset between
+ * operations. The count never resets, and callers must not attach meaning
+ * to the value itself.
+ *
+ * Return: the number of unanswered calls since this serv was created.
+ */
+unsigned int svc_rpcb_failure_count(struct svc_serv *serv)
+{
+ return atomic_read(&serv->sv_rpcb_failures);
+}
+EXPORT_SYMBOL_GPL(svc_rpcb_failure_count);
+
/**
* svc_register - register an RPC service with the local portmapper
* @serv: svc_serv struct for the service to register
@@ -1221,10 +1251,11 @@ EXPORT_SYMBOL_GPL(svc_generic_rpcbind_set);
*
* Service is registered for any address in the passed-in protocol family
*/
-int svc_register(const struct svc_serv *serv, struct net *net,
+int svc_register(struct svc_serv *serv, struct net *net,
const int family, const unsigned short proto,
const unsigned short port)
{
+ bool noanswer = false;
unsigned int p, i;
int error = 0;
@@ -1236,10 +1267,16 @@ int svc_register(const struct svc_serv *serv, struct net *net,
struct svc_program *progp = &serv->sv_programs[p];
for (i = 0; i < progp->pg_nvers; i++) {
+ const struct svc_version *vers = progp->pg_vers[i];
int ret;
ret = progp->pg_rpcbind_set(net, progp, i,
family, proto, port);
+ if (ret == -EIO) {
+ noanswer = true;
+ if (vers && vers->vs_rpcb_optnl)
+ ret = 0;
+ }
if (ret < 0) {
printk(KERN_WARNING "svc: failed to register "
"%sv%u RPC service (errno %d).\n",
@@ -1251,6 +1288,9 @@ int svc_register(const struct svc_serv *serv, struct net *net,
}
}
+ if (noanswer)
+ atomic_inc(&serv->sv_rpcb_failures);
+
return error;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 043/686] NFSD: stop registering with rpcbind after a failure in listener_set
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 042/686] SUNRPC: report local rpcbind calls that get no answer Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 045/686] NFSD: Count the delegations held by each client Greg Kroah-Hartman
` (3 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Jeff Layton,
Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit bf0f3a37e6ccb78ae80cc6eb2edde4f033c7574c ]
nfsd_nl_listener_set_doit() calls svc_xprt_create_from_sa() once for each
requested listener and passes flags of 0, so every listener registers with
rpcbind on its own. A rpcbind that accepts the connection and never replies
therefore costs one timeout for each entry. With the cap of 1024 entries
the request can hold nfsd_mutex for about 34 minutes, which is roughly 17
times the hung-task threshold.
One failure is enough to know that the next call will not fare better.
Read svc_rpcb_failure_count() before the create loop, and pass
SVC_SOCK_ANONYMOUS for the rest of the request once the count moves.
Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Link: https://syzkaller.appspot.com/bug?extid=c7eae0eb80858a2dba0f
Suggested-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-10-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfsctl.c | 42 ++++++++++++++++++++++++++++++++++++++----
1 file changed, 38 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 49cd0588deb39..9ffa72c15aed2 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -2029,7 +2029,10 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
const struct nlattr *bad_attr = NULL;
struct svc_xprt *xprt, *tmp;
const char *bad_xprt = NULL;
+ unsigned int rpcb_failures;
const struct nlattr *attr;
+ bool skipped_rpcb = false;
+ bool bad_rpcb = false;
struct svc_serv *serv;
LIST_HEAD(permsocks);
struct nfsd_net *nn;
@@ -2119,13 +2122,16 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
if (delete)
svc_xprt_destroy_all(serv, net, false);
+ rpcb_failures = svc_rpcb_failure_count(serv);
+
/* walk list of addrs again, open any that still don't exist */
nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
GENL_HDRLEN, rem) {
struct nlattr *tb[NFSD_A_SOCK_MAX + 1];
const char *xcl_name;
struct sockaddr *sa;
- int ret;
+ bool hit_rpcb;
+ int flags, ret;
/* validated up front in nfsd_nl_validate_listeners() */
if (nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
@@ -2144,12 +2150,27 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
continue;
}
- ret = svc_xprt_create_from_sa(serv, xcl_name, net, sa, 0,
+ flags = skipped_rpcb ? SVC_SOCK_ANONYMOUS : 0;
+ ret = svc_xprt_create_from_sa(serv, xcl_name, net, sa, flags,
current_cred());
+
+ hit_rpcb = false;
+ if (!skipped_rpcb &&
+ svc_rpcb_failure_count(serv) != rpcb_failures) {
+ skipped_rpcb = true;
+ hit_rpcb = true;
+ if (ret < 0)
+ ret = svc_xprt_create_from_sa(serv, xcl_name,
+ net, sa,
+ SVC_SOCK_ANONYMOUS,
+ current_cred());
+ }
+
/* always save the latest error */
if (ret < 0) {
bad_attr = attr;
bad_xprt = xcl_name;
+ bad_rpcb = hit_rpcb;
err = ret;
}
}
@@ -2161,8 +2182,21 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
*/
if (err) {
NL_SET_BAD_ATTR(info->extack, bad_attr);
- NL_SET_ERR_MSG_FMT(info->extack, "cannot create %s listener",
- bad_xprt);
+ if (bad_rpcb)
+ NL_SET_ERR_MSG_FMT(info->extack,
+ "cannot create %s listener; rpcbind did not answer",
+ bad_xprt);
+ else if (skipped_rpcb)
+ NL_SET_ERR_MSG_FMT(info->extack,
+ "cannot create %s listener; rpcbind did not answer earlier, so some listeners are not registered",
+ bad_xprt);
+ else
+ NL_SET_ERR_MSG_FMT(info->extack,
+ "cannot create %s listener",
+ bad_xprt);
+ } else if (skipped_rpcb) {
+ NL_SET_ERR_MSG(info->extack,
+ "rpcbind did not answer, some listeners are not registered");
}
if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 045/686] NFSD: Count the delegations held by each client
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 043/686] NFSD: stop registering with rpcbind after a failure in listener_set Greg Kroah-Hartman
@ 2026-11-13 15:42 ` Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 054/686] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
` (2 subsequent siblings)
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit 5d5a6e996e7c36bc2f7b035743c16f2bf03a227d ]
struct nfs4_client records the delegations it holds on cl_delegations
but keeps no count of them. deleg_reaper() walks nn->client_lru under
nn->client_lock, but cl_delegations is serialized by nn->deleg_lock,
which nests outside nn->client_lock. A caller there cannot take
nn->deleg_lock to count the list. The cost tells against the walk as
well: an O(n) count per client, on a pass that already visits every
client.
Add cl_deleg_count, maintained at the two sites that mutate
cl_delegations. Both hold nn->deleg_lock, so the counter is already
serialized against itself and needs no atomic of its own. The decrement
sits below the delegation_hashed() test, next to the list_del_init it
pairs with, so it runs only when the delegation really leaves the list.
A reader that holds only nn->client_lock is not synchronized against
either update site, so it can see a count that does not match the
list. Such a reader marks the access with data_race() and may not
depend on the value for correctness.
No functional change.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260817-recall-any-keep-count-v5-2-3b2cffce701e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Stable-dep-of: 9af39c0773ef ("NFSD: Send a meaningful CB_RECALL_ANY keep count")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4state.c | 2 ++
fs/nfsd/state.h | 2 ++
2 files changed, 4 insertions(+)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 42035bfebda7a..222f2aadaafad 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1423,6 +1423,7 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
dp->dl_stid.sc_type = SC_TYPE_DELEG;
list_add(&dp->dl_perfile, &fp->fi_delegations);
list_add(&dp->dl_perclnt, &clp->cl_delegations);
+ clp->cl_deleg_count++;
return 0;
}
@@ -1454,6 +1455,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp, unsigned short statusmask)
++dp->dl_time;
spin_lock(&fp->fi_lock);
list_del_init(&dp->dl_perclnt);
+ dp->dl_stid.sc_client->cl_deleg_count--;
list_del_init(&dp->dl_recall_lru);
list_del_init(&dp->dl_perfile);
spin_unlock(&fp->fi_lock);
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 926e4e8063b33..fd61bac52721d 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -525,6 +525,8 @@ struct nfs4_client {
unsigned int cl_state;
atomic_t cl_delegs_in_recall;
+ /* Length of cl_delegations, updated under nn->deleg_lock */
+ unsigned int cl_deleg_count;
struct nfsd4_cb_recall_any *cl_ra;
time64_t cl_ra_time;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 054/686] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-11-13 15:42 ` [PATCH 6.18 045/686] NFSD: Count the delegations held by each client Greg Kroah-Hartman
@ 2026-11-13 15:43 ` Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 055/686] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 056/686] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Sean Christopherson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
[ Upstream commit e5f1d62c59aea4f270773de1bf6e8867f5b1124c ]
Forcefully update the exit_reason to KVM's "standard" EXIT_REASON_UNDEFINED
if tdx_vcpu_run() bails without trying to run the vCPU because KVM needs to
wait for an in-progress S-EPT zap to complete. This avoids handling the
previous exit multiple times due to a stale exit_reason.
Fixes: 4b2abc49712b ("KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-6-xiaoyao.li@intel.com
[sean: use EXIT_REASON_UNDEFINED, drop comment about bits 31:16]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/vmx/tdx.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index dcbfcd79791c8..02a15ad90c586 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1041,8 +1041,16 @@ fastpath_t tdx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
* allowing vCPU entry to avoid contention with tdh_vp_enter() and
* TDCALLs.
*/
- if (unlikely(READ_ONCE(to_kvm_tdx(vcpu->kvm)->wait_for_sept_zap)))
+ if (unlikely(READ_ONCE(to_kvm_tdx(vcpu->kvm)->wait_for_sept_zap))) {
+ /*
+ * The vCPU never entered the guest, but this looks like a
+ * handled exit to the caller. Synthesize an invalid exit
+ * reason so the previous exit's stale value isn't consumed
+ * a second time.
+ */
+ vt->exit_reason.full = EXIT_REASON_UNDEFINED;
return EXIT_FASTPATH_EXIT_HANDLED;
+ }
trace_kvm_entry(vcpu, run_flags & KVM_RUN_FORCE_IMMEDIATE_EXIT);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 055/686] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-11-13 15:43 ` [PATCH 6.18 054/686] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
@ 2026-11-13 15:43 ` Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 056/686] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Rick Edgecombe,
Binbin Wu, Sean Christopherson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
[ Upstream commit b43c520b198ab70868307a489ef2117ed6d6c4cc ]
Set bits 31:16 to 0 instead of all-1s when synthesizing an exit reason,
e.g. if the TDX Module never attempted VM-Enter, or when stuffing the exit
reason due to an unexpected "real" EPT Misconfig. Opportunistically use
VMX's KVM-defined EXIT_REASON_UNDEFINED (0xdead) instead of -1u.
KVM is going to support Bus Lock VM exit for TDX, after which bit 26 of
the Exit Reason becomes meaningful and indicates that a bus lock happened.
The existing synthesized Exit Reason, -1u, will cause a false positive in
that case. Change the synthesized Exit Reason from -1u to U16_MAX, so that
bits 31:16 are set to 0. This also avoids the potential issues when other
bits in 31:16 become valid in the future.
As a bonus, the check for synthesized Exit Reason in tdx_failed_vmentry()
becomes unnecessary. Just drop it.
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-4-xiaoyao.li@intel.com
[sean: use EXIT_REASON_UNDEFINED instead of another magic value]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/vmx/tdx.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 02a15ad90c586..411291603681f 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -904,8 +904,13 @@ static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
struct vcpu_tdx *tdx = to_tdx(vcpu);
u32 exit_reason;
+ /*
+ * Return the synthesized invalid Exit Reason, as the TDX module
+ * never attempted to run the vCPU, i.e. the Exit Reason is undefined,
+ * but this is NOT a failed VM-Enter.
+ */
if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
- return -1u;
+ return EXIT_REASON_UNDEFINED;
exit_reason = tdx->vp_enter_ret;
@@ -920,7 +925,7 @@ static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
* Defer KVM_BUG_ON() until tdx_handle_exit() because this is in
* non-instrumentable code with interrupts disabled.
*/
- return -1u;
+ return EXIT_REASON_UNDEFINED;
default:
break;
}
@@ -951,8 +956,7 @@ static noinstr void tdx_vcpu_enter_exit(struct kvm_vcpu *vcpu)
static bool tdx_failed_vmentry(struct kvm_vcpu *vcpu)
{
- return vmx_get_exit_reason(vcpu).failed_vmentry &&
- vmx_get_exit_reason(vcpu).full != -1u;
+ return vmx_get_exit_reason(vcpu).failed_vmentry;
}
static fastpath_t tdx_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH 6.18 056/686] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-11-13 15:43 ` [PATCH 6.18 055/686] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
@ 2026-11-13 15:43 ` Greg Kroah-Hartman
46 siblings, 0 replies; 48+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-13 15:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoyao Li, Sean Christopherson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <xiaoyao.li@intel.com>
[ Upstream commit bc335ce04408750585b4b32f248c543c9493d545 ]
When handling the real Exit Reason, don't assume the upper 16 bits as
all-0 in tdx_to_vmx_exit_reason(), in preparation for enabling Bus Lock
VM exit.
When Bus Lock VM exit is enabled, the bit 26 of Exit Reason becomes
valid and it can be 1 with various exit reasons. Change the logic in
tdx_to_vmx_exit_reason() to check the 'basic' Exit Reason for correctness.
Also preserve bit[31:16] when changing the (basic) Exit Reason, to not
lose the information in bit[31:16].
Change the return type of tdx_to_vmx_exit_reason() to
"union vmx_exit_reason" for the convenience of manipulating the basic
field.
Fixes: c42856af8f70 ("KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL)")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-5-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/vmx/tdx.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 411291603681f..43d6b20dfbb16 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -899,10 +899,10 @@ static __always_inline bool tdx_is_exit_reason_valid(u64 vp_enter_ret)
}
}
-static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+static __always_inline union vmx_exit_reason tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
{
struct vcpu_tdx *tdx = to_tdx(vcpu);
- u32 exit_reason;
+ union vmx_exit_reason exit_reason;
/*
* Return the synthesized invalid Exit Reason, as the TDX module
@@ -910,22 +910,26 @@ static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
* but this is NOT a failed VM-Enter.
*/
if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
- return EXIT_REASON_UNDEFINED;
+ return (union vmx_exit_reason) {
+ .basic = EXIT_REASON_UNDEFINED,
+ };
- exit_reason = tdx->vp_enter_ret;
+ exit_reason.full = (u32)tdx->vp_enter_ret;
- switch (exit_reason) {
+ switch (exit_reason.basic) {
case EXIT_REASON_TDCALL:
if (tdvmcall_exit_type(vcpu))
- return EXIT_REASON_VMCALL;
-
- return tdcall_to_vmx_exit_reason(vcpu);
+ exit_reason.basic = EXIT_REASON_VMCALL;
+ else
+ exit_reason.basic = tdcall_to_vmx_exit_reason(vcpu);
+ break;
case EXIT_REASON_EPT_MISCONFIG:
/*
* Defer KVM_BUG_ON() until tdx_handle_exit() because this is in
* non-instrumentable code with interrupts disabled.
*/
- return EXIT_REASON_UNDEFINED;
+ exit_reason.basic = EXIT_REASON_UNDEFINED;
+ break;
default:
break;
}
@@ -942,7 +946,7 @@ static noinstr void tdx_vcpu_enter_exit(struct kvm_vcpu *vcpu)
tdx->vp_enter_ret = tdh_vp_enter(&tdx->vp, &tdx->vp_enter_args);
- vt->exit_reason.full = tdx_to_vmx_exit_reason(vcpu);
+ vt->exit_reason = tdx_to_vmx_exit_reason(vcpu);
vt->exit_qualification = tdx->vp_enter_args.rcx;
tdx->ext_exit_qualification = tdx->vp_enter_args.rdx;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
end of thread, other threads:[~2026-11-13 16:06 UTC | newest]
Thread overview: 48+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 15:42 [PATCH 6.18 000/686] 6.18.64-rc1 review Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 001/686] smb: client: validate the data area in SMB2_read() Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 002/686] ALSA: x86: hdmi: fix chmap array missing terminator entry Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 003/686] cxl/features: Ensure that count is set before access to ent[] __counted_by() Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 004/686] backing-file: always end a queued write Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 005/686] nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline() Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 006/686] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 007/686] fsverity: Tell LSMs about signature only after verity is enabled Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 008/686] Bluetooth: L2CAP: Reject signalling responses in invalid states Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 009/686] Bluetooth: L2CAP: Only accept connection responses to outstanding requests Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 010/686] Bluetooth: L2CAP: Ignore connection responses with wrong ident Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 011/686] smb: client: Avoid leaking sensitive data to the heap in connect.c Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 012/686] smb: client: hold server info until cifsd exits Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 013/686] smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 014/686] smb: move create_durable_req_v2 " Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 015/686] smb: move create_durable_handle_reconnect_v2 " Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 016/686] smb: move create_durable_rsp_v2 " Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 017/686] smb: move some duplicate definitions " Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 018/686] smb: move list of FileSystemAttributes to common/fscc.h Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 019/686] smb: move some duplicate struct definitions " Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 020/686] smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2 Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 021/686] smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 022/686] smb: client: reject short SESSION_SETUP responses Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 023/686] smb: client: require stable pages for SMB compression Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 024/686] mm: remove !root_reclaim checking in should_abort_scan() Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 025/686] smb: client: validate SMB1 EA list bounds before parsing Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 026/686] xfs: break out xattr entry checks into separate functions Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 027/686] xfs: check for buffer overruns when examining local/remote xattr entries Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 028/686] xfs: refactor directory data block walking loops in scrub Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 029/686] xfs: improve dirent bounds checking in scrub and repair Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 030/686] NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 031/686] smb: client: bound POSIX lock data area by response length Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 032/686] smb: align durable reconnect v2 context to 8 byte boundary Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 033/686] NFSD: Replace nfsd_write()s "stable" argument with "iocb_flags" Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 034/686] NFSD: Move version-specific ACCESS maps into per-version code Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 035/686] NFSD: map fh_verify() status codes for NFS_ACLv2 replies Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 036/686] NFSD/blocklayout: Extract extent mapping from proc_layoutget Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 037/686] exportfs: Complete kernel-doc for struct export_operations Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 038/686] exportfs: split out the ops for layout-based block device access Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 039/686] exportfs,nfsd: rework checking for layout-based block device access support Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 040/686] nfsd: dont offer flexfiles layouts when NFSv3 isnt being served Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 041/686] NFSD: report listener creation failures through extack Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 042/686] SUNRPC: report local rpcbind calls that get no answer Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 043/686] NFSD: stop registering with rpcbind after a failure in listener_set Greg Kroah-Hartman
2026-11-13 15:42 ` [PATCH 6.18 045/686] NFSD: Count the delegations held by each client Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 054/686] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 055/686] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason Greg Kroah-Hartman
2026-11-13 15:43 ` [PATCH 6.18 056/686] KVM: TDX: Dont assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason() Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox