Changelog in Linux kernel 5.15.203

 
ACPI: EC: Fix EC address space handler unregistration [+ + +]
Author: Hans de Goede <hansg@kernel.org>
Date:   Thu Dec 8 15:23:34 2022 +0100

    ACPI: EC: Fix EC address space handler unregistration
    
    [ Upstream commit a5072078dbfaa9d70130805766dfa34bbb7bf2a7 ]
    
    When an ECDT table is present the EC address space handler gets registered
    on the root node. So to unregister it properly the unregister call also
    must be done on the root node.
    
    Store the ACPI handle used for the acpi_install_address_space_handler()
    call and use te same handle for the acpi_remove_address_space_handler()
    call.
    
    Reported-by: Rafael J. Wysocki <rafael@kernel.org>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPI: EC: Fix ECDT probe ordering issues [+ + +]
Author: Hans de Goede <hansg@kernel.org>
Date:   Thu Dec 8 15:23:35 2022 +0100

    ACPI: EC: Fix ECDT probe ordering issues
    
    [ Upstream commit ab4620f58d38206687b9f99d9d2cc1d5a2640985 ]
    
    ACPI-2.0 says that the EC OpRegion handler must be available immediately
    (like the standard default OpRegion handlers):
    
    Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
    2. OSPM must make Embedded Controller operation regions, accessed via
    the Embedded Controllers described in ECDT, available before executing
    any control method. These operation regions may become inaccessible
    after OSPM runs _REG(EmbeddedControl, 0)."
    
    So acpi_bus_init() calls acpi_ec_ecdt_probe(), which calls
    acpi_install_address_space_handler() to install the EC's OpRegion
    handler, early on.
    
    This not only installs the OpRegion handler, but also calls the EC's
    _REG method. The _REG method call is a problem because it may rely on
    initialization done by the _INI methods of one of the PCI / _SB root devs,
    see for example: https://bugzilla.kernel.org/show_bug.cgi?id=214899 .
    
    Generally speaking _REG methods are executed when the ACPI-device they
    are part of has a driver bound to it. Where as _INI methods must be
    executed at table load time (according to the spec). The problem here
    is that the early acpi_install_address_space_handler() call causes
    the _REG handler to run too early.
    
    To allow fixing this the ACPICA code now allows to split the OpRegion
    handler installation and the executing of _REG into 2 separate steps.
    
    This commit uses this ACPICA functionality to fix the EC probe ordering
    by delaying the executing of _REG for ECDT described ECs till the matching
    EC device in the DSDT gets parsed and acpi_ec_add() for it gets called.
    This moves the calling of _REG for the EC on devices with an ECDT to
    the same point in time where it is called on devices without an ECDT table.
    
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214899
    Reported-and-tested-by: Johannes Penßel <johannespenssel@posteo.net>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPI: OSI: Add DMI quirk for Acer Aspire One D255 [+ + +]
Author: Sofia Schneider <sofia@schn.dev>
Date:   Sun Feb 22 23:52:40 2026 -0300

    ACPI: OSI: Add DMI quirk for Acer Aspire One D255
    
    [ Upstream commit 5ede90206273ff156a778254f0f972a55e973c89 ]
    
    The screen backlight turns off during boot (specifically during udev device
    initialization) when returning true for _OSI("Windows 2009").
    
    Analyzing the device's DSDT reveals that the firmware takes a different
    code path when Windows 7 is reported, which leads to the backlight shutoff.
    Add a DMI quirk to invoke dmi_disable_osi_win7 for this model.
    
    Signed-off-by: Sofia Schneider <sofia@schn.dev>
    Link: https://patch.msgid.link/20260223025240.518509-1-sofia@schn.dev
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() [+ + +]
Author: Ben Dooks <ben.dooks@codethink.co.uk>
Date:   Wed Mar 11 10:58:35 2026 +0000

    ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
    
    [ Upstream commit 393815f57651101f1590632092986d1d5a3a41bd ]
    
    The pointer returned from acpi_os_map_generic_address() is
    tagged with __iomem, so make the rv it is returned to also
    of void __iomem * type.
    
    Fixes the following sparse warning:
    
    drivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)
    drivers/acpi/osl.c:1686:20:    expected void *rv
    drivers/acpi/osl.c:1686:20:    got void [noderef] __iomem *
    
    Fixes: 6915564dc5a8 ("ACPI: OSL: Change the type of acpi_os_map_generic_address() return value")
    Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
    [ rjw: Subject tweak, added Fixes tag ]
    Link: https://patch.msgid.link/20260311105835.463030-1-ben.dooks@codethink.co.uk
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPI: PM: Save NVS memory on Lenovo G70-35 [+ + +]
Author: Piotr Mazek <pmazek@outlook.com>
Date:   Thu Feb 5 23:05:02 2026 +0100

    ACPI: PM: Save NVS memory on Lenovo G70-35
    
    [ Upstream commit 023cd6d90f8aa2ef7b72d84be84a18e61ecebd64 ]
    
    [821d6f0359b0614792ab8e2fb93b503e25a65079] prevented machines
    produced later than 2012 from saving NVS region to accelerate S3.
    
    Despite being made after 2012, Lenovo G70-35 still needs NVS memory
    saving during S3. A quirk is introduced for this platform.
    
    Signed-off-by: Piotr Mazek <pmazek@outlook.com>
    [ rjw: Subject adjustment ]
    Link: https://patch.msgid.link/GV2PPF3CD5B63CC2442EE3F76F8443EAD90D499A@GV2PPF3CD5B63CC.EURP251.PROD.OUTLOOK.COM
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPI: processor: Fix previous acpi_processor_errata_piix4() fix [+ + +]
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Tue Mar 17 21:39:05 2026 +0100

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
    
    [ Upstream commit bf504b229cb8d534eccbaeaa23eba34c05131e25 ]
    
    After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference
    in acpi_processor_errata_piix4()"), device pointers may be dereferenced
    after dropping references to the device objects pointed to by them,
    which may cause a use-after-free to occur.
    
    Moreover, debug messages about enabling the errata may be printed
    if the errata flags corresponding to them are unset.
    
    Address all of these issues by moving message printing to the points
    in the code where the errata flags are set.
    
    Fixes: f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()")
    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Closes: https://lore.kernel.org/linux-acpi/938e2206-def5-4b7a-9b2c-d1fd37681d8a@roeck-us.net/
    Reviewed-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Link: https://patch.msgid.link/5975693.DvuYhMxLoT@rafael.j.wysocki
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps [+ + +]
Author: Hans de Goede <hansg@kernel.org>
Date:   Thu Dec 8 15:23:33 2022 +0100

    ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
    
    [ Upstream commit 54c516aeb8b39eeae6450b7d8076d381568dca46 ]
    
    ACPI-2.0 says that the EC op_region handler must be available immediately
    (like the standard default op_region handlers):
    
    Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
    2. OSPM must make Embedded Controller operation regions, accessed via
    the Embedded Controllers described in ECDT, available before executing
    any control method. These operation regions may become inaccessible
    after OSPM runs _REG(EmbeddedControl, 0)."
    
    So the OS must probe the ECDT described EC and install the OpRegion handler
    before calling acpi_enable_subsystem() and acpi_initialize_objects().
    
    This is a problem because calling acpi_install_address_space_handler()
    does not just install the op_region handler, it also runs the EC's _REG
    method. This _REG method may rely on initialization done by the _INI
    methods of one of the PCI / _SB root devices.
    
    For the other early/default op_region handlers the op_region handler
    install and the _REG execution is split into 2 separate steps:
    1. acpi_ev_install_region_handlers(), called early from acpi_load_tables()
    2. acpi_ev_initialize_op_regions(), called from acpi_initialize_objects()
    
    To fix the EC op_region issue, add 2 bew functions:
    1. acpi_install_address_space_handler_no_reg()
    2. acpi_execute_reg_methods()
    to allow doing things in 2 steps for other op_region handlers,
    like the EC handler, too.
    
    Note that the comment describing acpi_ev_install_region_handlers() even has
    an alinea describing this problem. Using the new methods allows users
    to avoid this problem.
    
    Link: https://github.com/acpica/acpica/pull/786
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=214899
    Reported-and-tested-by: Johannes Penßel <johannespenssel@posteo.net>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ACPICA: include/acpi/acpixf.h: Fix indentation [+ + +]
Author: Hans de Goede <hansg@kernel.org>
Date:   Thu Dec 8 15:23:32 2022 +0100

    ACPICA: include/acpi/acpixf.h: Fix indentation
    
    [ Upstream commit 7a9d74e7e403cb2e60d4d00c05f2f3ab2a33d0c3 ]
    
    A bunch of the functions declared in include/acpi/acpixf.h have their
    name aligned a space after the '(' of e.g. the
    `ACPI_EXTERNAL_RETURN_STATUS(acpi_status` line above rather then being
    directly aligned after the '('.
    
    This breaks applying patches generated from the ACPICA upstream git,
    remove the extra space before the function-names and all the arguments
    to fix this.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
af_key: validate families in pfkey_send_migrate() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Sat Mar 14 17:02:10 2026 +0000

    af_key: validate families in pfkey_send_migrate()
    
    [ Upstream commit eb2d16a7d599dc9d4df391b5e660df9949963786 ]
    
    syzbot was able to trigger a crash in skb_put() [1]
    
    Issue is that pfkey_send_migrate() does not check old/new families,
    and that set_ipsecrequest() @family argument was truncated,
    thus possibly overfilling the skb.
    
    Validate families early, do not wait set_ipsecrequest().
    
    [1]
    
    skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
     kernel BUG at net/core/skbuff.c:214 !
    Call Trace:
     <TASK>
      skb_over_panic net/core/skbuff.c:219 [inline]
      skb_put+0x159/0x210 net/core/skbuff.c:2655
      skb_put_zero include/linux/skbuff.h:2788 [inline]
      set_ipsecrequest net/key/af_key.c:3532 [inline]
      pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636
      km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848
      xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705
      xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
    
    Fixes: 08de61beab8a ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)")
    Reported-by: syzbot+b518dfc8e021988fbd55@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/69b5933c.050a0220.248e02.00f2.GAE@google.com/T/#u
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
alarmtimer: Fix argument order in alarm_timer_forward() [+ + +]
Author: Zhan Xusheng <zhanxusheng1024@gmail.com>
Date:   Mon Mar 23 14:11:30 2026 +0800

    alarmtimer: Fix argument order in alarm_timer_forward()
    
    commit 5d16467ae56343b9205caedf85e3a131e0914ad8 upstream.
    
    alarm_timer_forward() passes arguments to alarm_forward() in the wrong
    order:
    
      alarm_forward(alarm, timr->it_interval, now);
    
    However, alarm_forward() is defined as:
    
      u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
    
    and uses the second argument as the current time:
    
      delta = ktime_sub(now, alarm->node.expires);
    
    Passing the interval as "now" results in incorrect delta computation,
    which can lead to missed expirations or incorrect overrun accounting.
    
    This issue has been present since the introduction of
    alarm_timer_forward().
    
    Fix this by swapping the arguments.
    
    Fixes: e7561f1633ac ("alarmtimer: Implement forward callback")
    Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
    Signed-off-by: Thomas Gleixner <tglx@kernel.org>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260323061130.29991-1-zhanxusheng@xiaomi.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ALSA: caiaq: fix stack out-of-bounds read in init_card [+ + +]
Author: Berk Cem Goksel <berkcgoksel@gmail.com>
Date:   Sun Mar 29 16:38:25 2026 +0300

    ALSA: caiaq: fix stack out-of-bounds read in init_card
    
    commit 45424e871abf2a152e247a9cff78359f18dd95c0 upstream.
    
    The loop creates a whitespace-stripped copy of the card shortname
    where `len < sizeof(card->id)` is used for the bounds check. Since
    sizeof(card->id) is 16 and the local id buffer is also 16 bytes,
    writing 16 non-space characters fills the entire buffer,
    overwriting the terminating nullbyte.
    
    When this non-null-terminated string is later passed to
    snd_card_set_id() -> copy_valid_id_string(), the function scans
    forward with `while (*nid && ...)` and reads past the end of the
    stack buffer, reading the contents of the stack.
    
    A USB device with a product name containing many non-ASCII, non-space
    characters (e.g. multibyte UTF-8) will reliably trigger this as follows:
    
      BUG: KASAN: stack-out-of-bounds in copy_valid_id_string
           sound/core/init.c:696 [inline]
      BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c
           sound/core/init.c:718
    
    The off-by-one has been present since commit bafeee5b1f8d ("ALSA:
    snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1),
    which first introduced this whitespace-stripping loop. The original
    code never accounted for the null terminator when bounding the copy.
    
    Fix this by changing the loop bound to `sizeof(card->id) - 1`,
    ensuring at least one byte remains as the null terminator.
    
    Fixes: bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname")
    Cc: stable@vger.kernel.org
    Cc: Andrey Konovalov <andreyknvl@gmail.com>
    Reported-by: Berk Cem Goksel <berkcgoksel@gmail.com>
    Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com>
    Link: https://patch.msgid.link/20260329133825.581585-1-berkcgoksel@gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: ctxfi: Fix missing SPDIFI1 index handling [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sun Mar 29 11:12:37 2026 +0200

    ALSA: ctxfi: Fix missing SPDIFI1 index handling
    
    commit b045ab3dff97edae6d538eeff900a34c098761f8 upstream.
    
    SPDIF1 DAIO type isn't properly handled in daio_device_index() for
    hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds
    array access.  Follow the hw20k1 pattern and return the proper index
    for this type, too.
    
    Reported-and-tested-by: Karsten Hohmeier <linux@hohmatik.de>
    Closes: https://lore.kernel.org/20260315155004.15633-1-linux@hohmatik.de
    Cc: <stable@vger.kernel.org>
    Link: https://patch.msgid.link/20260329091240.420194-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Sat Feb 7 14:13:17 2026 +0100

    ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
    
    [ Upstream commit 1585cf83e98db32463e5d54161b06a5f01fe9976 ]
    
    It was reported that we need the same quirk for HP ZBook Studio G4
    (SSID 103c:826b) as other HP models to make the mute-LED working.
    
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/64d78753-b9ff-4c64-8920-64d8d31cd20c@gmail.com
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=221002
    Link: https://patch.msgid.link/20260207131324.2428030-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 17 11:44:11 2026 +0100

    ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
    
    [ Upstream commit 7bc0df86c2384bc1e2012a2c946f82305054da64 ]
    
    Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin
    configurations for NID 0x16 and 0x19 to make the headphone / headset
    jack working.  NID 0x17 can remain as is for the working speaker, and
    the built-in mic is supported via SOF.
    
    Cc: <stable@vger.kernel.org>
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=221086
    Link: https://patch.msgid.link/20260217104414.62911-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 [+ + +]
Author: Uzair Mughal <contact@uzair.is-a.dev>
Date:   Sat Mar 7 06:29:06 2026 +0500

    ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
    
    [ Upstream commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 ]
    
    The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288)
    does not report headset button press events. Headphone insertion is
    detected (SW_HEADPHONE_INSERT), but pressing the inline microphone
    button on a headset produces no input events.
    
    Add a SND_PCI_QUIRK entry that maps this subsystem ID to
    ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables
    headset jack button detection through alc_fixup_headset_jack()
    and ThinkPad ACPI integration. This is the same fixup used by
    similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3).
    
    Signed-off-by: Uzair Mughal <contact@uzair.is-a.dev>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Link: https://patch.msgid.link/20260307012906.20093-1-contact@uzair.is-a.dev
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 25 09:52:30 2026 +0100

    ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
    
    [ Upstream commit c5bf24c8aba1ff711226ee0f039ff01a5754692b ]
    
    Although DIYINHK USB Audio 2.0 (ID 20b1:2009) shows the implicit
    feedback source for the capture stream, this would cause several
    problems for the playback.  Namely, the device can get wMaxPackSize
    1024 for 24/32 bit format with 6 channels, and when a high sample rate
    like 352.8kHz or 384kHz is played, the packet size overflows the max
    limit.  Also, the device has another two playback altsets, and those
    aren't properly handled with the implicit feedback.
    
    Since the device has been working well even before introducing the
    implicit feedback, we can assume that it works fine in the async mode.
    This patch adds the explicit skip of the implicit fb detection to make
    the playback running in the async mode.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Link: https://patch.msgid.link/20260225085233.316306-4-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: usb-audio: Cap the packet size pre-calculations [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 25 09:52:28 2026 +0100

    ALSA: usb-audio: Cap the packet size pre-calculations
    
    [ Upstream commit 7fe8dec3f628e9779f1631576f8e693370050348 ]
    
    We calculate the possible packet sizes beforehand for adaptive and
    synchronous endpoints, but we didn't take care of the max frame size
    for those pre-calculated values.  When a device or a bus limits the
    packet size, a high sample rate or a high number of channels may lead
    to the packet sizes that are larger than the given limit, which
    results in an error from the USB core at submitting URBs.
    
    As a simple workaround, just add the sanity checks of pre-calculated
    packet sizes to have the upper boundary of ep->maxframesize.
    
    Fixes: f0bd62b64016 ("ALSA: usb-audio: Improve frames size computation")
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Link: https://patch.msgid.link/20260225085233.316306-2-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: usb-audio: Check max frame size for implicit feedback mode, too [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 25 09:52:29 2026 +0100

    ALSA: usb-audio: Check max frame size for implicit feedback mode, too
    
    [ Upstream commit 7cb2a5422f5bbdf1cf32eae0eda41000485b9346 ]
    
    When the packet sizes are taken from the capture stream in the
    implicit feedback mode, the sizes might be larger than the upper
    boundary defined by the descriptor.  As already done for other
    transfer modes, we have to cap the sizes accordingly at sending,
    otherwise this would lead to an error in USB core at submission of
    URBs.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Link: https://patch.msgid.link/20260225085233.316306-3-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ALSA: usb-audio: Use correct version for UAC3 header validation [+ + +]
Author: Jun Seo <jun.seo.93@proton.me>
Date:   Thu Feb 26 10:08:20 2026 +0900

    ALSA: usb-audio: Use correct version for UAC3 header validation
    
    commit 54f9d645a5453d0bfece0c465d34aaf072ea99fa upstream.
    
    The entry of the validators table for UAC3 AC header descriptor is
    defined with the wrong protocol version UAC_VERSION_2, while it should
    have been UAC_VERSION_3.  This results in the validator never matching
    for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
    header descriptors to bypass validation entirely.  A malicious USB
    device presenting a truncated UAC3 header could exploit this to cause
    out-of-bounds reads when the driver later accesses unvalidated
    descriptor fields.
    
    The bug was introduced in the same commit as the recently fixed UAC3
    feature unit sub-type typo, and appears to be from the same copy-paste
    error when the UAC3 section was created from the UAC2 section.
    
    Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jun Seo <jun.seo.93@proton.me>
    Link: https://patch.msgid.link/20260226010820.36529-1-jun.seo.93@proton.me
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: usb-audio: Use inclusive terms [+ + +]
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Feb 25 09:52:31 2026 +0100

    ALSA: usb-audio: Use inclusive terms
    
    [ Upstream commit 4e9113c533acee2ba1f72fd68ee6ecd36b64484e ]
    
    Replace the remaining with inclusive terms; it's only this function
    name we overlooked at the previous conversion.
    
    Fixes: 53837b4ac2bd ("ALSA: usb-audio: Replace slave/master terms")
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Link: https://patch.msgid.link/20260225085233.316306-5-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
amd-xgbe: fix sleep while atomic on suspend/resume [+ + +]
Author: Raju Rangoju <Raju.Rangoju@amd.com>
Date:   Mon Mar 2 09:51:24 2026 +0530

    amd-xgbe: fix sleep while atomic on suspend/resume
    
    [ Upstream commit e2f27363aa6d983504c6836dd0975535e2e9dba0 ]
    
    The xgbe_powerdown() and xgbe_powerup() functions use spinlocks
    (spin_lock_irqsave) while calling functions that may sleep:
    - napi_disable() can sleep waiting for NAPI polling to complete
    - flush_workqueue() can sleep waiting for pending work items
    
    This causes a "BUG: scheduling while atomic" error during suspend/resume
    cycles on systems using the AMD XGBE Ethernet controller.
    
    The spinlock protection in these functions is unnecessary as these
    functions are called from suspend/resume paths which are already serialized
    by the PM core
    
    Fix this by removing the spinlock. Since only code that takes this lock
    is xgbe_powerdown() and xgbe_powerup(), remove it completely.
    
    Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver")
    Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
    Link: https://patch.msgid.link/20260302042124.1386445-1-Raju.Rangoju@amd.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
apparmor: fix differential encoding verification [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:34 2026 -0700

    apparmor: fix differential encoding verification
    
    commit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.
    
    Differential encoding allows loops to be created if it is abused. To
    prevent this the unpack should verify that a diff-encode chain
    terminates.
    
    Unfortunately the differential encode verification had two bugs.
    
    1. it conflated states that had gone through check and already been
       marked, with states that were currently being checked and marked.
       This means that loops in the current chain being verified are treated
       as a chain that has already been verified.
    
    2. the order bailout on already checked states compared current chain
       check iterators j,k instead of using the outer loop iterator i.
       Meaning a step backwards in states in the current chain verification
       was being mistaken for moving to an already verified state.
    
    Move to a double mark scheme where already verified states get a
    different mark, than the current chain being kept. This enables us
    to also drop the backwards verification check that was the cause of
    the second error as any already verified state is already marked.
    
    Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: Fix double free of ns_name in aa_replace_profiles() [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:32 2026 -0700

    apparmor: Fix double free of ns_name in aa_replace_profiles()
    
    commit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream.
    
    if ns_name is NULL after
    1071         error = aa_unpack(udata, &lh, &ns_name);
    
    and if ent->ns_name contains an ns_name in
    1089                 } else if (ent->ns_name) {
    
    then ns_name is assigned the ent->ns_name
    1095                         ns_name = ent->ns_name;
    
    however ent->ns_name is freed at
    1262                 aa_load_ent_free(ent);
    
    and then again when freeing ns_name at
    1270         kfree(ns_name);
    
    Fix this by NULLing out ent->ns_name after it is transferred to ns_name
    
    Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load
    ")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix memory leak in verify_header [+ + +]
Author: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Date:   Sun Apr 12 23:46:27 2026 -0700

    apparmor: fix memory leak in verify_header
    
    commit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.
    
    The function sets `*ns = NULL` on every call, leaking the namespace
    string allocated in previous iterations when multiple profiles are
    unpacked. This also breaks namespace consistency checking since *ns
    is always NULL when the comparison is made.
    
    Remove the incorrect assignment.
    The caller (aa_unpack) initializes *ns to NULL once before the loop,
    which is sufficient.
    
    Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix missing bounds check on DEFAULT table in verify_dfa() [+ + +]
Author: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Date:   Sun Apr 12 23:46:31 2026 -0700

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
    
    commit d352873bbefa7eb39995239d0b44ccdf8aaa79a4 upstream.
    
    The verify_dfa() function only checks DEFAULT_TABLE bounds when the state
    is not differentially encoded.
    
    When the verification loop traverses the differential encoding chain,
    it reads k = DEFAULT_TABLE[j] and uses k as an array index without
    validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count,
    therefore, causes both out-of-bounds reads and writes.
    
    [   57.179855] ==================================================================
    [   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660
    [   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993
    
    [   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)
    [   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [   57.181563] Call Trace:
    [   57.181572]  <TASK>
    [   57.181577]  dump_stack_lvl+0x5e/0x80
    [   57.181596]  print_report+0xc8/0x270
    [   57.181605]  ? verify_dfa+0x59a/0x660
    [   57.181608]  kasan_report+0x118/0x150
    [   57.181620]  ? verify_dfa+0x59a/0x660
    [   57.181623]  verify_dfa+0x59a/0x660
    [   57.181627]  aa_dfa_unpack+0x1610/0x1740
    [   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470
    [   57.181640]  unpack_pdb+0x86d/0x46b0
    [   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   57.181656]  ? aa_unpack_nameX+0x1a8/0x300
    [   57.181659]  aa_unpack+0x20b0/0x4c30
    [   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   57.181664]  ? stack_depot_save_flags+0x33/0x700
    [   57.181681]  ? kasan_save_track+0x4f/0x80
    [   57.181683]  ? kasan_save_track+0x3e/0x80
    [   57.181686]  ? __kasan_kmalloc+0x93/0xb0
    [   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780
    [   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130
    [   57.181697]  ? policy_update+0x154/0x330
    [   57.181704]  aa_replace_profiles+0x15a/0x1dd0
    [   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780
    [   57.181712]  ? aa_loaddata_alloc+0x77/0x140
    [   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   57.181717]  ? _copy_from_user+0x2a/0x70
    [   57.181730]  policy_update+0x17a/0x330
    [   57.181733]  profile_replace+0x153/0x1a0
    [   57.181735]  ? rw_verify_area+0x93/0x2d0
    [   57.181740]  vfs_write+0x235/0xab0
    [   57.181745]  ksys_write+0xb0/0x170
    [   57.181748]  do_syscall_64+0x8e/0x660
    [   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
    [   57.181765] RIP: 0033:0x7f6192792eb2
    
    Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE
    entries unconditionally.
    
    Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix race between freeing data and fs accessing it [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:36 2026 -0700

    apparmor: fix race between freeing data and fs accessing it
    
    commit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 upstream.
    
    Backport for conflicts introdued by
    - conversion from sha1 to sha256 introduced in
       e44a4dc4b36c ("apparmor: switch SECURITY_APPARMOR_HASH from sha1 to sha256
    ")
    
    - adding of conditioanl that nests the conflicting code inside an if
      condition
      d61c57fde819 ("apparmor: make export of raw binary profile to userspace optional")
    
    AppArmor was putting the reference to i_private data on its end after
    removing the original entry from the file system. However the inode
    can and does live beyond that point and it is possible that some of
    the fs call back functions will be invoked after the reference has
    been put, which results in a race between freeing the data and
    accessing it through the fs.
    
    While the rawdata/loaddata is the most likely candidate to fail the
    race, as it has the fewest references. If properly crafted it might be
    possible to trigger a race for the other types stored in i_private.
    
    Fix this by moving the put of i_private referenced data to the correct
    place which is during inode eviction.
    
    Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix race on rawdata dereference [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:35 2026 -0700

    apparmor: fix race on rawdata dereference
    
    commit a0b7091c4de45a7325c8780e6934a894f92ac86b upstream.
    
    Backport for conflicts introdued by
        d61c57fde819 ("apparmor: make export of raw binary profile to userspace optional")
        which nests the conflicting code inside an if condition
    
    There is a race condition that leads to a use-after-free situation:
    because the rawdata inodes are not refcounted, an attacker can start
    open()ing one of the rawdata files, and at the same time remove the
    last reference to this rawdata (by removing the corresponding profile,
    for example), which frees its struct aa_loaddata; as a result, when
    seq_rawdata_open() is reached, i_private is a dangling pointer and
    freed memory is accessed.
    
    The rawdata inodes weren't refcounted to avoid a circular refcount and
    were supposed to be held by the profile rawdata reference.  However
    during profile removal there is a window where the vfs and profile
    destruction race, resulting in the use after free.
    
    Fix this by moving to a double refcount scheme. Where the profile
    refcount on rawdata is used to break the circular dependency. Allowing
    for freeing of the rawdata once all inode references to the rawdata
    are put.
    
    Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix side-effect bug in match_char() macro usage [+ + +]
Author: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Date:   Sun Apr 12 23:46:30 2026 -0700

    apparmor: fix side-effect bug in match_char() macro usage
    
    commit 8756b68edae37ff546c02091989a4ceab3f20abd upstream.
    
    The match_char() macro evaluates its character parameter multiple
    times when traversing differential encoding chains. When invoked
    with *str++, the string pointer advances on each iteration of the
    inner do-while loop, causing the DFA to check different characters
    at each iteration and therefore skip input characters.
    This results in out-of-bounds reads when the pointer advances past
    the input buffer boundary.
    
    [   94.984676] ==================================================================
    [   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760
    [   94.985655] Read of size 1 at addr ffff888100342000 by task file/976
    
    [   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)
    [   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [   94.986329] Call Trace:
    [   94.986341]  <TASK>
    [   94.986347]  dump_stack_lvl+0x5e/0x80
    [   94.986374]  print_report+0xc8/0x270
    [   94.986384]  ? aa_dfa_match+0x5ae/0x760
    [   94.986388]  kasan_report+0x118/0x150
    [   94.986401]  ? aa_dfa_match+0x5ae/0x760
    [   94.986405]  aa_dfa_match+0x5ae/0x760
    [   94.986408]  __aa_path_perm+0x131/0x400
    [   94.986418]  aa_path_perm+0x219/0x2f0
    [   94.986424]  apparmor_file_open+0x345/0x570
    [   94.986431]  security_file_open+0x5c/0x140
    [   94.986442]  do_dentry_open+0x2f6/0x1120
    [   94.986450]  vfs_open+0x38/0x2b0
    [   94.986453]  ? may_open+0x1e2/0x2b0
    [   94.986466]  path_openat+0x231b/0x2b30
    [   94.986469]  ? __x64_sys_openat+0xf8/0x130
    [   94.986477]  do_file_open+0x19d/0x360
    [   94.986487]  do_sys_openat2+0x98/0x100
    [   94.986491]  __x64_sys_openat+0xf8/0x130
    [   94.986499]  do_syscall_64+0x8e/0x660
    [   94.986515]  ? count_memcg_events+0x15f/0x3c0
    [   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   94.986540]  ? handle_mm_fault+0x1639/0x1ef0
    [   94.986551]  ? vma_start_read+0xf0/0x320
    [   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0
    [   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0
    [   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5
    [   94.986588]  ? irqentry_exit+0x3c/0x590
    [   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
    [   94.986597] RIP: 0033:0x7fda4a79c3ea
    
    Fix by extracting the character value before invoking match_char,
    ensuring single evaluation per outer loop.
    
    Fixes: 074c1cd798cb ("apparmor: dfa move character match into a macro")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix unprivileged local user can do privileged policy management [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:33 2026 -0700

    apparmor: fix unprivileged local user can do privileged policy management
    
    commit 6601e13e82841879406bf9f369032656f441a425 upstream.
    
    Backport for api changes introduced in
    - 90c436a64a6e ("apparmor: pass cred through to audit info.")
    - 92de220a7f33 ("apparmor: update policy capable checks to use a label")
    
    An unprivileged local user can load, replace, and remove profiles by
    opening the apparmorfs interfaces, via a confused deputy attack, by
    passing the opened fd to a privileged process, and getting the
    privileged process to write to the interface.
    
    This does require a privileged target that can be manipulated to do
    the write for the unprivileged process, but once such access is
    achieved full policy management is possible and all the possible
    implications that implies: removing confinement, DoS of system or
    target applications by denying all execution, by-passing the
    unprivileged user namespace restriction, to exploiting kernel bugs for
    a local privilege escalation.
    
    The policy management interface can not have its permissions simply
    changed from 0666 to 0600 because non-root processes need to be able
    to load policy to different policy namespaces.
    
    Instead ensure the task writing the interface has privileges that
    are a subset of the task that opened the interface. This is already
    done via policy for confined processes, but unconfined can delegate
    access to the opened fd, by-passing the usual policy check.
    
    Fixes: b7fd2c0340eac ("apparmor: add per policy ns .load, .replace, .remove interface files")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: fix: limit the number of levels of policy namespaces [+ + +]
Author: John Johansen <john.johansen@canonical.com>
Date:   Sun Apr 12 23:46:29 2026 -0700

    apparmor: fix: limit the number of levels of policy namespaces
    
    commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
    
    Currently the number of policy namespaces is not bounded relying on
    the user namespace limit. However policy namespaces aren't strictly
    tied to user namespaces and it is possible to create them and nest
    them arbitrarily deep which can be used to exhaust system resource.
    
    Hard cap policy namespaces to the same depth as user namespaces.
    
    Fixes: c88d4c7b049e8 ("AppArmor: core policy routines")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: replace recursive profile removal with iterative approach [+ + +]
Author: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Date:   Sun Apr 12 23:46:28 2026 -0700

    apparmor: replace recursive profile removal with iterative approach
    
    commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.
    
    The profile removal code uses recursion when removing nested profiles,
    which can lead to kernel stack exhaustion and system crashes.
    
    Reproducer:
      $ pf='a'; for ((i=0; i<1024; i++)); do
          echo -e "profile $pf { \n }" | apparmor_parser -K -a;
          pf="$pf//x";
      done
      $ echo -n a > /sys/kernel/security/apparmor/.remove
    
    Replace the recursive __aa_profile_list_release() approach with an
    iterative approach in __remove_profile(). The function repeatedly
    finds and removes leaf profiles until the entire subtree is removed,
    maintaining the same removal semantic without recursion.
    
    Fixes: c88d4c7b049e ("AppArmor: core policy routines")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

apparmor: validate DFA start states are in bounds in unpack_pdb [+ + +]
Author: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Date:   Sun Apr 12 23:46:26 2026 -0700

    apparmor: validate DFA start states are in bounds in unpack_pdb
    
    commit 9063d7e2615f4a7ab321de6b520e23d370e58816 upstream.
    
    Backport for conflicts caused by
      ad596ea74e74 ("apparmor: group dfa policydb unpacking")
      - rearrange and consolidated the unpack.
    
      b11e51dd7094 ("apparmor: test: make static symbols visible during kunit testing")
      - rename function and make it visible to kunit tests
    
    Start states are read from untrusted data and used as indexes into the
    DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
    access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
    the number of states in the DFA, this results in an out-of-bound read.
    
    ==================================================================
     BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
     Read of size 4 at addr ffff88811956fb90 by task su/1097
     ...
    
    Reject policies with out-of-bounds start states during unpacking
    to prevent the issue.
    
    Fixes: ad5ff3db53c6 ("AppArmor: Add ability to load extended policy")
    Reported-by: Qualys Security Advisory <qsa@qualys.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges [+ + +]
Author: Shawn Guo <shawnguo@kernel.org>
Date:   Fri Feb 27 15:22:10 2026 +0800

    arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
    
    commit 1af997cad473d505248df6d9577183bb91f69670 upstream.
    
    Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm:
    Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively
    changes zone_dma_bits from 30 to 32 for arm64 platforms that do not
    properly define dma-ranges in device tree.  It's unclear how Poplar reboot
    gets broken by this change exactly, but a dma-ranges limiting zone_dma to
    the first 1 GB fixes the regression.
    
    Fixes: 2f20182ed670 ("arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shawn Guo <shawnguo@kernel.org>
    Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity [+ + +]
Author: Shawn Guo <shawnguo@kernel.org>
Date:   Fri Feb 27 15:19:58 2026 +0800

    arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    
    commit c1f2b0f2b5e37b2c27540a175aea2755a3799433 upstream.
    
    The PCIe reset GPIO on Poplar is actually active low.  The active high
    worked before because kernel driver didn't respect the setting from DT.
    This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using
    gpiod API"), and thus PCIe on Poplar got brken since then.
    
    Fix the problem by correcting the polarity.
    
    Fixes: 32fa01761bd9 ("arm64: dts: hi3798cv200: enable PCIe support for poplar board")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shawn Guo <shawnguo@kernel.org>
    Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ARM: clean up the memset64() C wrapper [+ + +]
Author: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Date:   Wed Feb 25 12:35:09 2026 +0100

    ARM: clean up the memset64() C wrapper
    
    [ Upstream commit b52343d1cb47bb27ca32a3f4952cc2fd3cd165bf ]
    
    The current logic to split the 64-bit argument into its 32-bit halves is
    byte-order specific and a bit clunky.  Use a union instead which is
    easier to read and works in all cases.
    
    GCC still generates the same machine code.
    
    While at it, rename the arguments of the __memset64() prototype to
    actually reflect their semantics.
    
    Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Reported-by: Ben Hutchings <ben@decadent.org.uk> # for -stable
    Link: https://lore.kernel.org/all/1a11526ae3d8664f705b541b8d6ea57b847b49a8.camel@decadent.org.uk/
    Suggested-by: https://lore.kernel.org/all/aZonkWMwpbFhzDJq@casper.infradead.org/ # for -stable
    Link: https://lore.kernel.org/all/aZonkWMwpbFhzDJq@casper.infradead.org/
    Signed-off-by: Sasha Levin <sashal@kernel.org>
ARM: OMAP2+: add missing of_node_put before break and return [+ + +]
Author: Wang Qing <wangqing@vivo.com>
Date:   Mon Dec 13 01:42:24 2021 -0800

    ARM: OMAP2+: add missing of_node_put before break and return
    
    [ Upstream commit 883f464c1d23663047eda4f2bcf622365e2d0dd0 ]
    
    Fix following coccicheck warning:
    WARNING: Function "for_each_matching_node_and_match"
    should have of_node_put() before return.
    
    Early exits from for_each_matching_node_and_match should decrement the
    node reference counter.
    
    Signed-off-by: Wang Qing <wangqing@vivo.com>
    Message-Id: <1639388545-63615-1-git-send-email-wangqing@vivo.com>
    [tony@atomide.com: updated for omap_hwmod.c that was already patched]
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Stable-dep-of: 93a04ab480c8 ("ARM: omap2: Fix reference count leaks in omap_control_init()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ARM: omap2: Fix reference count leaks in omap_control_init() [+ + +]
Author: Wentao Liang <vulab@iscas.ac.cn>
Date:   Wed Dec 17 14:21:22 2025 +0000

    ARM: omap2: Fix reference count leaks in omap_control_init()
    
    [ Upstream commit 93a04ab480c8bbcb7d9004be139c538c8a0c1bc8 ]
    
    The of_get_child_by_name() function increments the reference count
    of child nodes, causing multiple reference leaks in omap_control_init():
    
    1. scm_conf node never released in normal/error paths
    2. clocks node leak when checking existence
    3. Missing scm_conf release before np in error paths
    
    Fix these leaks by adding proper of_node_put() calls and separate error
    handling.
    
    Fixes: e5b635742e98 ("ARM: OMAP2+: control: add syscon support for register accesses")
    Cc: stable@vger.kernel.org
    Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
    Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
    Link: https://patch.msgid.link/20251217142122.1861292-1-vulab@iscas.ac.cn
    Signed-off-by: Kevin Hilman <khilman@baylibre.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ASoC: adau1372: Fix clock leak on PLL lock failure [+ + +]
Author: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Date:   Wed Mar 25 22:07:04 2026 +0100

    ASoC: adau1372: Fix clock leak on PLL lock failure
    
    [ Upstream commit bfe6a264effcb6fe99ad7ceaf9e8c7439fc9555b ]
    
    adau1372_enable_pll() was a void function that logged a dev_err() on
    PLL lock timeout but did not propagate the error. As a result,
    adau1372_set_power() would continue with adau1372->enabled set to true
    despite the PLL being unlocked, and the mclk left enabled with no
    corresponding disable on the error path.
    
    Convert adau1372_enable_pll() to return int, using -ETIMEDOUT on lock
    timeout and propagating regmap errors directly. In adau1372_set_power(),
    check the return value and unwind in reverse order: restore regcache to
    cache-only mode, reassert GPIO power-down, and disable the clock before
    returning the error.
    
    Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
    Fixes: 6cd4c6459e47 ("ASoC: Add ADAU1372 audio CODEC support")
    Reviewed-by: Nuno Sá <nuno.sa@analog.com>
    Link: https://patch.msgid.link/20260325210704.76847-3-jihed.chaibi.dev@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: adau1372: Fix unchecked clk_prepare_enable() return value [+ + +]
Author: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Date:   Wed Mar 25 22:07:03 2026 +0100

    ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
    
    [ Upstream commit 326fe8104a4020d30080d37ac8b6b43893cdebca ]
    
    adau1372_set_power() calls clk_prepare_enable() but discards the return
    value. If the clock enable fails, the driver proceeds to access registers
    on unpowered hardware, potentially causing silent corruption.
    
    Make adau1372_set_power() return int and propagate the error from
    clk_prepare_enable(). Update adau1372_set_bias_level() to return the
    error directly for the STANDBY and OFF cases.
    
    Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
    Fixes: 6cd4c6459e47 ("ASoC: Add ADAU1372 audio CODEC support")
    Reviewed-by: Nuno Sá <nuno.sa@analog.com>
    Link: https://patch.msgid.link/20260325210704.76847-2-jihed.chaibi.dev@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition [+ + +]
Author: Chen Ni <nichen@iscas.ac.cn>
Date:   Tue Mar 10 10:42:46 2026 +0800

    ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
    
    [ Upstream commit 53f3a900e9a383d47af7253076e19f510c5708d0 ]
    
    The acp3x_5682_init() function did not check the return value of
    clk_get(), which could lead to dereferencing error pointers in
    rt5682_clk_enable().
    
    Fix this by:
    1. Changing clk_get() to the device-managed devm_clk_get().
    2. Adding proper IS_ERR() checks for both clock acquisitions.
    
    Fixes: 6b8e4e7db3cd ("ASoC: amd: Add machine driver for Raven based platform")
    Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
    Link: https://patch.msgid.link/20260310024246.2153827-1-nichen@iscas.ac.cn
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: core: Do not call link_exit() on uninitialized rtd objects [+ + +]
Author: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Date:   Fri Sep 29 12:32:43 2023 +0200

    ASoC: core: Do not call link_exit() on uninitialized rtd objects
    
    [ Upstream commit dd9f9cc1e6b9391140afa5cf27bb47c9e2a08d02 ]
    
    On init we have sequence:
    
            for_each_card_prelinks(card, i, dai_link) {
                    ret = snd_soc_add_pcm_runtime(card, dai_link);
    
            ret = init_some_other_things(...);
            if (ret)
                    goto probe_end:
    
            for_each_card_rtds(card, rtd) {
                    ret = soc_init_pcm_runtime(card, rtd);
    
    probe_end:
    
    while on exit:
            for_each_card_rtds(card, rtd)
                    snd_soc_link_exit(rtd);
    
    If init_some_other_things() step fails due to error we end up with
    not fully setup rtds and try to call snd_soc_link_exit on them, which
    depending on contents on .link_exit handler, can end up dereferencing
    NULL pointer.
    
    Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
    Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
    Link: https://lore.kernel.org/r/20230929103243.705433-2-amadeuszx.slawinski@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: core: Exit all links before removing their components [+ + +]
Author: Cezary Rojewski <cezary.rojewski@intel.com>
Date:   Thu Oct 27 10:58:40 2022 +0200

    ASoC: core: Exit all links before removing their components
    
    [ Upstream commit c7eb967d70446971413061effca3226578cb4dab ]
    
    Flows leading to link->init() and link->exit() are not symmetric.
    Currently the relevant part of card probe sequence goes as:
    
            for_each_card_rtds(card, rtd)
                    for_each_rtd_components(rtd, i, component)
                            component->probe()
            for_each_card_rtds(card, rtd)
                    for_each_rtd_dais(rtd, i, dai)
                            dai->probe()
            for_each_card_rtds(card, rtd)
                    rtd->init()
    
    On the other side, equivalent remove sequence goes as:
    
            for_each_card_rtds(card, rtd)
                    for_each_rtd_dais(rtd, i, dai)
                            dai->remove()
            for_each_card_rtds(card, rtd)
                    for_each_rtd_components(rtd, i, component)
                            component->remove()
            for_each_card_rtds(card, rtd)
                    rtd->exit()
    
    what can lead to errors as link->exit() may still operate on resources
    owned by its components despite the probability of them being freed
    during the component->remove().
    
    This change modifies the remove sequence to:
    
            for_each_card_rtds(card, rtd)
                    rtd->exit()
            for_each_card_rtds(card, rtd)
                    for_each_rtd_dais(rtd, i, dai)
                            dai->remove()
            for_each_card_rtds(card, rtd)
                    for_each_rtd_components(rtd, i, component)
                            component->remove()
    
    so code found in link->exit() is safe to touch any component stuff as
    component->remove() has not been called yet.
    
    Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
    Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
    Link: https://lore.kernel.org/r/20221027085840.1562698-1-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: detect empty DMI strings [+ + +]
Author: Casey Connolly <casey.connolly@linaro.org>
Date:   Fri Mar 6 18:47:07 2026 +0100

    ASoC: detect empty DMI strings
    
    [ Upstream commit a9683730e8b1d632674f81844ed03ddfbe4821c0 ]
    
    Some bootloaders like recent versions of U-Boot may install some DMI
    properties with empty values rather than not populate them. This manages
    to make its way through the validator and cleanup resulting in a rogue
    hyphen being appended to the card longname.
    
    Fixes: 4e01e5dbba96 ("ASoC: improve the DMI long card code in asoc-core")
    Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
    Link: https://patch.msgid.link/20260306174707.283071-2-casey.connolly@linaro.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() [+ + +]
Author: Mark Brown <broonie@kernel.org>
Date:   Thu Feb 5 00:25:37 2026 +0000

    ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
    
    [ Upstream commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 ]
    
    ALSA controls should return 1 if the value in the control changed but the
    control put operation fsl_easrc_iec958_put_bits() unconditionally returns
    0, causing ALSA to not generate any change events. This is detected by
    mixer-test with large numbers of messages in the form:
    
        No event generated for Context 3 IEC958 CS5
        Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0
    
    Add a suitable check.
    
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-1-39d4c766918b@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() [+ + +]
Author: Mark Brown <broonie@kernel.org>
Date:   Thu Feb 5 00:25:38 2026 +0000

    ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
    
    [ Upstream commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da ]
    
    ALSA controls should return 1 if the value in the control changed but the
    control put operation fsl_easrc_set_reg() only returns 0 or a negative
    error code, causing ALSA to not generate any change events. Add a suitable
    check by using regmap_update_bits_check() with the underlying regmap, this
    is more clearly and simply correct than trying to verify that one of the
    generic ops is exactly equivalent to this one.
    
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-2-39d4c766918b@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: Intel: catpt: Fix the device initialization [+ + +]
Author: Cezary Rojewski <cezary.rojewski@intel.com>
Date:   Fri Mar 20 11:12:17 2026 +0100

    ASoC: Intel: catpt: Fix the device initialization
    
    [ Upstream commit 5a184f1cb43a8e035251c635f5c47da5dc3e3049 ]
    
    The DMA mask shall be coerced before any buffer allocations for the
    device are done.  At the same time explain why DMA mask of 31 bits is
    used in the first place.
    
    Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Fixes: 7a10b66a5df9 ("ASoC: Intel: catpt: Device driver lifecycle")
    Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Link: https://patch.msgid.link/20260320101217.1243688-1-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() [+ + +]
Author: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date:   Mon Oct 18 11:05:44 2021 +0900

    ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt()
    
    [ Upstream commit 7db07e37e13cfd46039d82aed91092185eac6565 ]
    
    Do nothing if format was zero at snd_soc_runtime_set_dai_fmt().
    soc-core.c can be more simple code by this patch.
    
    Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Link: https://lore.kernel.org/r/87ee8jt7d3.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: soc-core: drop delayed_work_pending() check before flush [+ + +]
Author: matteo.cotifava <cotifavamatteo@gmail.com>
Date:   Mon Mar 9 22:54:11 2026 +0100

    ASoC: soc-core: drop delayed_work_pending() check before flush
    
    [ Upstream commit 3c99c9f0ed60582c1c9852b685d78d5d3a50de63 ]
    
    The delayed_work_pending() check before flush_delayed_work() in
    soc_free_pcm_runtime() is unnecessary and racy. flush_delayed_work()
    is safe to call unconditionally - it is a no-op when no work is
    pending. Remove the check.
    
    The original check was added by commit 9c9b65203492 ("ASoC: core:
    only flush inited work during free") but delayed_work_pending()
    followed by flush_delayed_work() has a time-of-check/time-of-use
    window where work can become pending between the two calls.
    
    Fixes: 9c9b65203492 ("ASoC: core: only flush inited work during free")
    Signed-off-by: Matteo Cotifava <cotifavamatteo@gmail.com>
    Link: https://patch.msgid.link/20260309215412.545628-2-cotifavamatteo@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: soc-core: flush delayed work before removing DAIs and widgets [+ + +]
Author: matteo.cotifava <cotifavamatteo@gmail.com>
Date:   Mon Mar 9 22:54:12 2026 +0100

    ASoC: soc-core: flush delayed work before removing DAIs and widgets
    
    [ Upstream commit 95bc5c225513fc3c4ce169563fb5e3929fbb938b ]
    
    When a sound card is unbound while a PCM stream is open, a
    use-after-free can occur in snd_soc_dapm_stream_event(), called from
    the close_delayed_work workqueue handler.
    
    During unbind, snd_soc_unbind_card() flushes delayed work and then
    calls soc_cleanup_card_resources(). Inside cleanup,
    snd_card_disconnect_sync() releases all PCM file descriptors, and
    the resulting PCM close path can call snd_soc_dapm_stream_stop()
    which schedules new delayed work with a pmdown_time timer delay.
    Since this happens after the flush in snd_soc_unbind_card(), the
    new work is not caught. soc_remove_link_components() then frees
    DAPM widgets before this work fires, leading to the use-after-free.
    
    The existing flush in soc_free_pcm_runtime() also cannot help as it
    runs after soc_remove_link_components() has already freed the widgets.
    
    Add a flush in soc_cleanup_card_resources() after
    snd_card_disconnect_sync() (after which no new PCM closes can
    schedule further delayed work) and before soc_remove_link_dais()
    and soc_remove_link_components() (which tear down the structures the
    delayed work accesses).
    
    Fixes: e894efef9ac7 ("ASoC: core: add support to card rebind")
    Signed-off-by: Matteo Cotifava <cotifavamatteo@gmail.com>
    Link: https://patch.msgid.link/20260309215412.545628-3-cotifavamatteo@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ata: libata-scsi: drop DPRINTK calls for cdb translation [+ + +]
Author: Hannes Reinecke <hare@suse.de>
Date:   Tue Dec 21 08:20:33 2021 +0100

    ata: libata-scsi: drop DPRINTK calls for cdb translation
    
    [ Upstream commit 1fe9fb71b2ffcedd794daacf4db2056a6cb5199e ]
    
    Drop DPRINTK calls for cdb translation as they are already covered
    by other traces, and also drop the DPRINTK calls in ata_scsi_hotplug().
    
    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
    Stable-dep-of: bb3a8154b1a1 ("ata: libata-scsi: refactor ata_scsi_translate()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ata: libata-scsi: refactor ata_scsi_translate() [+ + +]
Author: Damien Le Moal <dlemoal@kernel.org>
Date:   Wed Dec 17 14:05:25 2025 +0900

    ata: libata-scsi: refactor ata_scsi_translate()
    
    [ Upstream commit bb3a8154b1a1dc2c86d037482c0a2cf9186829ed ]
    
    Factor out of ata_scsi_translate() the code handling queued command
    deferral using the port qc_defer callback and issuing the queued
    command with ata_qc_issue() into the new function ata_scsi_qc_issue(),
    and simplify the goto used in ata_scsi_translate().
    While at it, also add a lockdep annotation to check that the port lock
    is held when ata_scsi_translate() is called.
    
    No functional changes.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Niklas Cassel <cassel@kernel.org>
    Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
    Reviewed-by: John Garry <john.g.garry@oracle.com>
    Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ata: libata: remove pointless VPRINTK() calls [+ + +]
Author: Hannes Reinecke <hare@suse.de>
Date:   Tue Dec 21 08:20:46 2021 +0100

    ata: libata: remove pointless VPRINTK() calls
    
    [ Upstream commit e1553351d747cbcd62db01d579dff916edcc782c ]
    
    Most of the information is already covered by tracepoints
    (if not downright pointless), so remove the VPRINTK() calls.
    And while we're at it, remove ata_scsi_dump_cdb(), too,
    as this information can be retrieved from scsi tracing.
    
    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
    Stable-dep-of: bb3a8154b1a1 ("ata: libata-scsi: refactor ata_scsi_translate()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Wed Feb 25 20:32:40 2026 +0800

    atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
    
    [ Upstream commit 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb ]
    
    syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
    This issue can be easily reproduced using the syzkaller reproducer.
    
    In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
    multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
    When the underlying VCC is closed, lec_vcc_close() iterates over all
    ARP entries and calls lec_arp_clear_vccs() for each matched entry.
    
    For example, when lec_vcc_close() iterates through the hlists in
    priv->lec_arp_empty_ones or other ARP tables:
    
    1. In the first iteration, for the first matched ARP entry sharing the VCC,
    lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
    and sets vcc->user_back to NULL.
    2. In the second iteration, for the next matched ARP entry sharing the same
    VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
    vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
    via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.
    
    Fix this by adding a null check for vpriv before dereferencing
    it. If vpriv is already NULL, it means the VCC has been cleared
    by a previous call, so we can safely skip the cleanup and just
    clear the entry's vcc/recv_vcc pointers.
    
    The entire cleanup block (including vcc_release_async()) is placed inside
    the vpriv guard because a NULL vpriv indicates the VCC has already been
    fully released by a prior iteration — repeating the teardown would
    redundantly set flags and trigger callbacks on an already-closing socket.
    
    The Fixes tag points to the initial commit because the entry->vcc path has
    been vulnerable since the original code. The entry->recv_vcc path was later
    added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back")
    with the same pattern, and both paths are fixed here.
    
    Reported-by: syzbot+72e3ea390c305de0e259@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/68c95a83.050a0220.3c6139.0e5c.GAE@google.com/T/
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Link: https://patch.msgid.link/20260225123250.189289-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

atm: lec: fix use-after-free in sock_def_readable() [+ + +]
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date:   Mon Mar 9 21:29:08 2026 +0530

    atm: lec: fix use-after-free in sock_def_readable()
    
    [ Upstream commit 922814879542c2e397b0e9641fd36b8202a8e555 ]
    
    A race condition exists between lec_atm_close() setting priv->lecd
    to NULL and concurrent access to priv->lecd in send_to_lecd(),
    lec_handle_bridge(), and lec_atm_send(). When the socket is freed
    via RCU while another thread is still using it, a use-after-free
    occurs in sock_def_readable() when accessing the socket's wait queue.
    
    The root cause is that lec_atm_close() clears priv->lecd without
    any synchronization, while callers dereference priv->lecd without
    any protection against concurrent teardown.
    
    Fix this by converting priv->lecd to an RCU-protected pointer:
    - Mark priv->lecd as __rcu in lec.h
    - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
      for safe pointer assignment
    - Use rcu_access_pointer() for NULL checks that do not dereference
      the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
      lecd_attach()
    - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
      lec_handle_bridge() and lec_atm_send() to safely access lecd
    - Use rcu_assign_pointer() followed by synchronize_rcu() in
      lec_atm_close() to ensure all readers have completed before
      proceeding. This is safe since lec_atm_close() is called from
      vcc_release() which holds lock_sock(), a sleeping lock.
    - Remove the manual sk_receive_queue drain from lec_atm_close()
      since vcc_destroy_socket() already drains it after lec_atm_close()
      returns.
    
    v2: Switch from spinlock + sock_hold/put approach to RCU to properly
        fix the race. The v1 spinlock approach had two issues pointed out
        by Eric Dumazet:
        1. priv->lecd was still accessed directly after releasing the
           lock instead of using a local copy.
        2. The spinlock did not prevent packets being queued after
           lec_atm_close() drains sk_receive_queue since timer and
           workqueue paths bypass netif_stop_queue().
    
    Note: Syzbot patch testing was attempted but the test VM terminated
        unexpectedly with "Connection to localhost closed by remote host",
        likely due to a QEMU AHCI emulation issue unrelated to this fix.
        Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
    
    Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
    Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1]
    Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260309155908.508768-1-kartikey406@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
batman-adv: Avoid double-rtnl_lock ELP metric worker [+ + +]
Author: Sven Eckelmann <sven@narfation.org>
Date:   Mon Feb 16 11:20:29 2026 +0100

    batman-adv: Avoid double-rtnl_lock ELP metric worker
    
    commit cfc83a3c71517b59c1047db57da31e26a9dc2f33 upstream.
    
    batadv_v_elp_get_throughput() might be called when the RTNL lock is already
    held. This could be problematic when the work queue item is cancelled via
    cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,
    an rtnl_lock() would cause a deadlock.
    
    To avoid this, rtnl_trylock() was used in this function to skip the
    retrieval of the ethtool information in case the RTNL lock was already
    held.
    
    But for cfg80211 interfaces, batadv_get_real_netdev() was called - which
    also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must
    also be used instead and the lockless version __batadv_get_real_netdev()
    has to be called.
    
    Cc: stable@vger.kernel.org
    Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker")
    Reported-by: Christian Schmidbauer <github@grische.xyz>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Tested-by: Sören Skaarup <freifunk_nordm4nn@gmx.de>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

batman-adv: avoid OGM aggregation when skb tailroom is insufficient [+ + +]
Author: Yang Yang <n05ec@lzu.edu.cn>
Date:   Fri Mar 20 11:15:40 2026 +0100

    batman-adv: avoid OGM aggregation when skb tailroom is insufficient
    
    commit 0d4aef630be9d5f9c1227d07669c26c4383b5ad0 upstream.
    
    When OGM aggregation state is toggled at runtime, an existing forwarded
    packet may have been allocated with only packet_len bytes, while a later
    packet can still be selected for aggregation. Appending in this case can
    hit skb_put overflow conditions.
    
    Reject aggregation when the target skb tailroom cannot accommodate the new
    packet. The caller then falls back to creating a new forward packet
    instead of appending.
    
    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Cc: stable@vger.kernel.org
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Ao Zhou <n05ec@lzu.edu.cn>
    Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    [ Adjust context ]
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

batman-adv: reject oversized global TT response buffers [+ + +]
Author: Ruide Cao <caoruide123@gmail.com>
Date:   Thu Apr 2 23:12:31 2026 +0800

    batman-adv: reject oversized global TT response buffers
    
    commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream.
    
    batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
    global TT response in 16-bit temporaries. When a remote originator
    advertises a large enough global TT, the TT payload length plus the VLAN
    header offset can exceed 65535 and wrap before kmalloc().
    
    The full-table response path still uses the original TT payload length when
    it fills tt_change, so the wrapped allocation is too small and
    batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
    before the later packet-size check runs.
    
    Fix this by rejecting TT responses whose TVLV value length cannot fit in
    the 16-bit TVLV payload length field.
    
    Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
    Cc: stable@vger.kernel.org
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Co-developed-by: Yuan Tan <yuantan098@gmail.com>
    Signed-off-by: Yuan Tan <yuantan098@gmail.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Tested-by: Ren Wei <enjou1224z@gmail.com>
    Signed-off-by: Ruide Cao <caoruide123@gmail.com>
    Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Bluetooth: btusb: clamp SCO altsetting table indices [+ + +]
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date:   Wed Mar 25 08:42:45 2026 +0800

    Bluetooth: btusb: clamp SCO altsetting table indices
    
    [ Upstream commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc ]
    
    btusb_work() maps the number of active SCO links to USB alternate
    settings through a three-entry lookup table when CVSD traffic uses
    transparent voice settings. The lookup currently indexes alts[] with
    data->sco_num - 1 without first constraining sco_num to the number of
    available table entries.
    
    While the table only defines alternate settings for up to three SCO
    links, data->sco_num comes from hci_conn_num() and is used directly.
    Cap the lookup to the last table entry before indexing it so the
    driver keeps selecting the highest supported alternate setting without
    reading past alts[].
    
    Fixes: baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
    Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: hci_ll: Fix firmware leak on error path [+ + +]
Author: Anas Iqbal <mohd.abd.6602@gmail.com>
Date:   Sun Mar 15 10:51:37 2026 +0000

    Bluetooth: hci_ll: Fix firmware leak on error path
    
    [ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ]
    
    Smatch reports:
    
    drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
    'fw' from request_firmware() not released on lines: 544.
    
    In download_firmware(), if request_firmware() succeeds but the returned
    firmware content is invalid (no data or zero size), the function returns
    without releasing the firmware, resulting in a resource leak.
    
    Fix this by calling release_firmware() before returning when
    request_firmware() succeeded but the firmware content is invalid.
    
    Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support")
    Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: HIDP: Fix possible UAF [+ + +]
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Thu Mar 5 10:17:47 2026 -0500

    Bluetooth: HIDP: Fix possible UAF
    
    [ Upstream commit dbf666e4fc9bdd975a61bf682b3f75cb0145eedd ]
    
    This fixes the following trace caused by not dropping l2cap_conn
    reference when user->remove callback is called:
    
    [   97.809249] l2cap_conn_free: freeing conn ffff88810a171c00
    [   97.809907] CPU: 1 UID: 0 PID: 1419 Comm: repro_standalon Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
    [   97.809935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
    [   97.809947] Call Trace:
    [   97.809954]  <TASK>
    [   97.809961]  dump_stack_lvl (lib/dump_stack.c:122)
    [   97.809990]  l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
    [   97.810017]  l2cap_conn_del (./include/linux/kref.h:66 net/bluetooth/l2cap_core.c:1821 net/bluetooth/l2cap_core.c:1798)
    [   97.810055]  l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7347 (discriminator 1) net/bluetooth/l2cap_core.c:7340 (discriminator 1))
    [   97.810086]  ? __pfx_l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7341)
    [   97.810117]  hci_conn_hash_flush (./include/net/bluetooth/hci_core.h:2152 (discriminator 2) net/bluetooth/hci_conn.c:2644 (discriminator 2))
    [   97.810148]  hci_dev_close_sync (net/bluetooth/hci_sync.c:5360)
    [   97.810180]  ? __pfx_hci_dev_close_sync (net/bluetooth/hci_sync.c:5285)
    [   97.810212]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810242]  ? up_write (./arch/x86/include/asm/atomic64_64.h:87 (discriminator 5) ./include/linux/atomic/atomic-arch-fallback.h:2852 (discriminator 5) ./include/linux/atomic/atomic-long.h:268 (discriminator 5) ./include/linux/atomic/atomic-instrumented.h:3391 (discriminator 5) kernel/locking/rwsem.c:1385 (discriminator 5) kernel/locking/rwsem.c:1643 (discriminator 5))
    [   97.810267]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810290]  ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
    [   97.810320]  hci_unregister_dev (net/bluetooth/hci_core.c:504 net/bluetooth/hci_core.c:2716)
    [   97.810346]  vhci_release (drivers/bluetooth/hci_vhci.c:691)
    [   97.810375]  ? __pfx_vhci_release (drivers/bluetooth/hci_vhci.c:678)
    [   97.810404]  __fput (fs/file_table.c:470)
    [   97.810430]  task_work_run (kernel/task_work.c:235)
    [   97.810451]  ? __pfx_task_work_run (kernel/task_work.c:201)
    [   97.810472]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810495]  ? do_raw_spin_unlock (./include/asm-generic/qspinlock.h:128 (discriminator 5) kernel/locking/spinlock_debug.c:142 (discriminator 5))
    [   97.810527]  do_exit (kernel/exit.c:972)
    [   97.810547]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810574]  ? __pfx_do_exit (kernel/exit.c:897)
    [   97.810594]  ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
    [   97.810616]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810639]  ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
    [   97.810664]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810688]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
    [   97.810721]  do_group_exit (kernel/exit.c:1093)
    [   97.810745]  get_signal (kernel/signal.c:3007 (discriminator 1))
    [   97.810772]  ? security_file_permission (./arch/x86/include/asm/jump_label.h:37 security/security.c:2366)
    [   97.810803]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810826]  ? vfs_read (fs/read_write.c:555)
    [   97.810854]  ? __pfx_get_signal (kernel/signal.c:2800)
    [   97.810880]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810905]  ? __pfx_vfs_read (fs/read_write.c:555)
    [   97.810932]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.810960]  arch_do_signal_or_restart (arch/x86/kernel/signal.c:337 (discriminator 1))
    [   97.810990]  ? __pfx_arch_do_signal_or_restart (arch/x86/kernel/signal.c:334)
    [   97.811021]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.811055]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.811078]  ? ksys_read (fs/read_write.c:707)
    [   97.811106]  ? __pfx_ksys_read (fs/read_write.c:707)
    [   97.811137]  exit_to_user_mode_loop (kernel/entry/common.c:66 kernel/entry/common.c:98)
    [   97.811169]  ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
    [   97.811192]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.811215]  ? trace_hardirqs_off (./include/trace/events/preemptirq.h:36 (discriminator 33) kernel/trace/trace_preemptirq.c:95 (discriminator 33) kernel/trace/trace_preemptirq.c:90 (discriminator 33))
    [   97.811240]  do_syscall_64 (./include/linux/irq-entry-common.h:226 ./include/linux/irq-entry-common.h:256 ./include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100)
    [   97.811268]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   97.811292]  ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3))
    [   97.811318]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
    [   97.811338] RIP: 0033:0x445cfe
    [   97.811352] Code: Unable to access opcode bytes at 0x445cd4.
    
    Code starting with the faulting instruction
    ===========================================
    [   97.811360] RSP: 002b:00007f65c41c6dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    [   97.811378] RAX: fffffffffffffe00 RBX: 00007f65c41c76c0 RCX: 0000000000445cfe
    [   97.811391] RDX: 0000000000000400 RSI: 00007f65c41c6e40 RDI: 0000000000000004
    [   97.811403] RBP: 00007f65c41c7250 R08: 0000000000000000 R09: 0000000000000000
    [   97.811415] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffe8
    [   97.811428] R13: 0000000000000000 R14: 00007fff780a8c00 R15: 00007f65c41c76c0
    [   97.811453]  </TASK>
    [   98.402453] ==================================================================
    [   98.403560] BUG: KASAN: use-after-free in __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
    [   98.404541] Read of size 8 at addr ffff888113ee40a8 by task khidpd_00050004/1430
    [   98.405361]
    [   98.405563] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
    [   98.405588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
    [   98.405600] Call Trace:
    [   98.405607]  <TASK>
    [   98.405614]  dump_stack_lvl (lib/dump_stack.c:122)
    [   98.405641]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
    [   98.405667]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.405691]  ? __virt_addr_valid (arch/x86/mm/physaddr.c:55)
    [   98.405724]  ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
    [   98.405748]  kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)
    [   98.405778]  ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
    [   98.405807]  __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
    [   98.405832]  ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
    [   98.405859]  ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
    [   98.405888]  ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
    [   98.405915]  ? __pfx___mutex_lock (kernel/locking/mutex.c:775)
    [   98.405939]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.405963]  ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
    [   98.405984]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
    [   98.406015]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406038]  ? lock_release (kernel/locking/lockdep.c:5536 kernel/locking/lockdep.c:5889 kernel/locking/lockdep.c:5875)
    [   98.406061]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406085]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194)
    [   98.406107]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406130]  ? __timer_delete_sync (kernel/time/timer.c:1592)
    [   98.406158]  ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
    [   98.406186]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406210]  l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
    [   98.406263]  hidp_session_thread (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/linux/kref.h:64 net/bluetooth/hidp/core.c:996 net/bluetooth/hidp/core.c:1305)
    [   98.406293]  ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
    [   98.406323]  ? kthread (kernel/kthread.c:433)
    [   98.406340]  ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
    [   98.406370]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406393]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
    [   98.406424]  ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
    [   98.406453]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406476]  ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
    [   98.406499]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406523]  ? kthread (kernel/kthread.c:433)
    [   98.406539]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406565]  ? kthread (kernel/kthread.c:433)
    [   98.406581]  ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
    [   98.406610]  kthread (kernel/kthread.c:467)
    [   98.406627]  ? __pfx_kthread (kernel/kthread.c:412)
    [   98.406645]  ret_from_fork (arch/x86/kernel/process.c:164)
    [   98.406674]  ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
    [   98.406704]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.406728]  ? __pfx_kthread (kernel/kthread.c:412)
    [   98.406747]  ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
    [   98.406774]  </TASK>
    [   98.406780]
    [   98.433693] The buggy address belongs to the physical page:
    [   98.434405] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888113ee7c40 pfn:0x113ee4
    [   98.435557] flags: 0x200000000000000(node=0|zone=2)
    [   98.436198] raw: 0200000000000000 ffffea0004244308 ffff8881f6f3ebc0 0000000000000000
    [   98.437195] raw: ffff888113ee7c40 0000000000000000 00000000ffffffff 0000000000000000
    [   98.438115] page dumped because: kasan: bad access detected
    [   98.438951]
    [   98.439211] Memory state around the buggy address:
    [   98.439871]  ffff888113ee3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [   98.440714]  ffff888113ee4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [   98.441580] >ffff888113ee4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [   98.442458]                                   ^
    [   98.443011]  ffff888113ee4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [   98.443889]  ffff888113ee4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [   98.444768] ==================================================================
    [   98.445719] Disabling lock debugging due to kernel taint
    [   98.448074] l2cap_conn_free: freeing conn ffff88810c22b400
    [   98.450012] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Tainted: G    B               7.0.0-rc1-dirty #14 PREEMPT(lazy)
    [   98.450040] Tainted: [B]=BAD_PAGE
    [   98.450047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
    [   98.450059] Call Trace:
    [   98.450065]  <TASK>
    [   98.450071]  dump_stack_lvl (lib/dump_stack.c:122)
    [   98.450099]  l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
    [   98.450125]  l2cap_conn_put (net/bluetooth/l2cap_core.c:1822)
    [   98.450154]  session_free (net/bluetooth/hidp/core.c:990)
    [   98.450181]  hidp_session_thread (net/bluetooth/hidp/core.c:1307)
    [   98.450213]  ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
    [   98.450271]  ? kthread (kernel/kthread.c:433)
    [   98.450293]  ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
    [   98.450339]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.450368]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
    [   98.450406]  ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
    [   98.450442]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.450471]  ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
    [   98.450499]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.450528]  ? kthread (kernel/kthread.c:433)
    [   98.450547]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.450578]  ? kthread (kernel/kthread.c:433)
    [   98.450598]  ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
    [   98.450637]  kthread (kernel/kthread.c:467)
    [   98.450657]  ? __pfx_kthread (kernel/kthread.c:412)
    [   98.450680]  ret_from_fork (arch/x86/kernel/process.c:164)
    [   98.450715]  ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
    [   98.450752]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
    [   98.450782]  ? __pfx_kthread (kernel/kthread.c:412)
    [   98.450804]  ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
    [   98.450836]  </TASK>
    
    Fixes: b4f34d8d9d26 ("Bluetooth: hidp: add new session-management helpers")
    Reported-by: soufiane el hachmi <kilwa10@gmail.com>
    Tested-by: soufiane el hachmi <kilwa10@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ [+ + +]
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Sat Mar 21 21:27:39 2026 -0400

    Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
    
    [ Upstream commit 5b3e2052334f2ff6d5200e952f4aa66994d09899 ]
    
    Currently the code attempts to accept requests regardless of the
    command identifier which may cause multiple requests to be marked
    as pending (FLAG_DEFER_SETUP) which can cause more than
    L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer
    causing an overflow.
    
    The spec is quite clear that the same identifier shall not be used on
    subsequent requests:
    
    'Within each signaling channel a different Identifier shall be used
    for each successive request or indication.'
    https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d
    
    So this attempts to check if there are any channels pending with the
    same identifier and rejects if any are found.
    
    Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    [ adapted variable names ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Fri Mar 20 20:23:10 2026 +0900

    Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
    
    [ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
    
    l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED
    state to support L2CAP reconfiguration (e.g. MTU changes). However,
    since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from
    the initial configuration, the reconfiguration path falls through to
    l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and
    retrans_list without freeing the previous allocations and sets
    chan->sdu to NULL without freeing the existing skb. This leaks all
    previously allocated ERTM resources.
    
    Additionally, l2cap_parse_conf_req() does not validate the minimum
    value of remote_mps derived from the RFC max_pdu_size option. A zero
    value propagates to l2cap_segment_sdu() where pdu_len becomes zero,
    causing the while loop to never terminate since len is never
    decremented, exhausting all available memory.
    
    Fix the double-init by skipping l2cap_ertm_init() and
    l2cap_chan_ready() when the channel is already in BT_CONNECTED state,
    while still allowing the reconfiguration parameters to be updated
    through l2cap_parse_conf_req(). Also add a pdu_len zero check in
    l2cap_segment_sdu() as a safeguard.
    
    Fixes: 96298f640104 ("Bluetooth: L2CAP: handle l2cap config request during open state")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb [+ + +]
Author: Helen Koike <koike@igalia.com>
Date:   Thu Mar 19 08:58:01 2026 -0300

    Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
    
    [ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
    
    Before using sk pointer, check if it is null.
    
    Fix the following:
    
     KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
     CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
     Workqueue: events l2cap_info_timeout
     RIP: 0010:kasan_byte_accessible+0x12/0x30
     Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
     veth0_macvtap: entered promiscuous mode
     RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
     RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
     RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
     RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
     R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
     R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
     FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
     PKRU: 55555554
     Call Trace:
      <TASK>
      __kasan_check_byte+0x12/0x40
      lock_acquire+0x79/0x2e0
      lock_sock_nested+0x48/0x100
      ? l2cap_sock_ready_cb+0x46/0x160
      l2cap_sock_ready_cb+0x46/0x160
      l2cap_conn_start+0x779/0xff0
      ? __pfx_l2cap_conn_start+0x10/0x10
      ? l2cap_info_timeout+0x60/0xa0
      ? __pfx___mutex_lock+0x10/0x10
      l2cap_info_timeout+0x68/0xa0
      ? process_scheduled_works+0xa8d/0x18c0
      process_scheduled_works+0xb6e/0x18c0
      ? __pfx_process_scheduled_works+0x10/0x10
      ? assign_work+0x3d5/0x5e0
      worker_thread+0xa53/0xfc0
      kthread+0x388/0x470
      ? __pfx_worker_thread+0x10/0x10
      ? __pfx_kthread+0x10/0x10
      ret_from_fork+0x51e/0xb90
      ? __pfx_ret_from_fork+0x10/0x10
     veth1_macvtap: entered promiscuous mode
      ? __switch_to+0xc7d/0x1450
      ? __pfx_kthread+0x10/0x10
      ret_from_fork_asm+0x1a/0x30
      </TASK>
     Modules linked in:
     ---[ end trace 0000000000000000 ]---
     batman_adv: batadv0: Interface activated: batadv_slave_0
     batman_adv: batadv0: Interface activated: batadv_slave_1
     netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
     netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
     netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
     netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
     RIP: 0010:kasan_byte_accessible+0x12/0x30
     Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
     ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
     RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
     RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
     RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
     RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
     R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
     R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
     FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
     PKRU: 55555554
     Kernel panic - not syncing: Fatal exception
    
    Fixes: 54a59aa2b562 ("Bluetooth: Add l2cap_chan->ops->ready()")
    Signed-off-by: Helen Koike <koike@igalia.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() [+ + +]
Author: Lukas Johannes Möller <research@johannes-moeller.dev>
Date:   Tue Mar 10 21:59:46 2026 +0000

    Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
    
    commit 15145675690cab2de1056e7ed68e59cbd0452529 upstream.
    
    l2cap_ecred_reconf_rsp() casts the incoming data to struct
    l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
    result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
    with result at offset 0).
    
    This causes two problems:
    
     - The sizeof(*rsp) length check requires 8 bytes instead of the
       correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
       with -EPROTO.
    
     - rsp->result reads from offset 6 instead of offset 0, returning
       wrong data when the packet is large enough to pass the check.
    
    Fix by using the correct type.  Also pass the already byte-swapped
    result variable to BT_DBG instead of the raw __le16 field.
    
    Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
    Cc: stable@vger.kernel.org
    Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access [+ + +]
Author: Lukas Johannes Möller <research@johannes-moeller.dev>
Date:   Tue Mar 10 21:59:47 2026 +0000

    Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
    
    commit dd815e6e3918dc75a49aaabac36e4f024d675101 upstream.
    
    l2cap_information_rsp() checks that cmd_len covers the fixed
    l2cap_info_rsp header (type + result, 4 bytes) but then reads
    rsp->data without verifying that the payload is present:
    
     - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads
       4 bytes past the header (needs cmd_len >= 8).
    
     - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header
       (needs cmd_len >= 5).
    
    A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an
    out-of-bounds read of adjacent skb data.
    
    Guard each data access with the required payload length check.  If the
    payload is too short, skip the read and let the state machine complete
    with safe defaults (feat_mask and remote_fixed_chan remain zero from
    kzalloc), so the info timer cleanup and l2cap_conn_start() still run
    and the connection is not stalled.
    
    Fixes: 4e8402a3f884 ("[Bluetooth] Retrieve L2CAP features mask on connection setup")
    Cc: stable@vger.kernel.org
    Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Fri Mar 13 05:22:39 2026 +0900

    Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
    
    [ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
    
    l2cap_ecred_data_rcv() reads the SDU length field from skb->data using
    get_unaligned_le16() without first verifying that skb contains at least
    L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads
    past the valid data in the skb.
    
    The ERTM reassembly path correctly calls pskb_may_pull() before reading
    the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the
    same validation to the Enhanced Credit Based Flow Control data path.
    
    Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU [+ + +]
Author: Christian Eggers <ceggers@arri.de>
Date:   Wed Feb 25 18:07:25 2026 +0100

    Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
    
    [ Upstream commit e1d9a66889867c232657a9b6f25d451d7c3ab96f ]
    
    Core 6.0, Vol 3, Part A, 3.4.3:
    "If the SDU length field value exceeds the receiver's MTU, the receiver
    shall disconnect the channel..."
    
    This fixes L2CAP/LE/CFC/BV-26-C (running together with 'l2test -r -P
    0x0027 -V le_public -I 100').
    
    Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
    Signed-off-by: Christian Eggers <ceggers@arri.de>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU [+ + +]
Author: Christian Eggers <ceggers@arri.de>
Date:   Wed Feb 25 18:07:27 2026 +0100

    Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
    
    [ Upstream commit b6a2bf43aa37670432843bc73ae2a6288ba4d6f8 ]
    
    Core 6.0, Vol 3, Part A, 3.4.3:
    "... If the sum of the payload sizes for the K-frames exceeds the
    specified SDU length, the receiver shall disconnect the channel."
    
    This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
    0x0027 -V le_public').
    
    Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
    Signed-off-by: Christian Eggers <ceggers@arri.de>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: MGMT: validate LTK enc_size on load [+ + +]
Author: Keenan Dong <keenanat2000@gmail.com>
Date:   Sat Mar 28 16:46:47 2026 +0800

    Bluetooth: MGMT: validate LTK enc_size on load
    
    [ Upstream commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ]
    
    Load Long Term Keys stores the user-provided enc_size and later uses
    it to size fixed-size stack operations when replying to LE LTK
    requests. An enc_size larger than the 16-byte key buffer can therefore
    overflow the reply stack buffer.
    
    Reject oversized enc_size values while validating the management LTK
    record so invalid keys never reach the stored key state.
    
    Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
    Reported-by: Keenan Dong <keenanat2000@gmail.com>
    Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: qca: fix ROM version reading on WCN3998 chips [+ + +]
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Date:   Wed Mar 11 01:02:57 2026 +0200

    Bluetooth: qca: fix ROM version reading on WCN3998 chips
    
    [ Upstream commit 99b2c531e0e797119ae1b9195a8764ee98b00e65 ]
    
    WCN3998 uses a bit different format for rom version:
    
    [    5.479978] Bluetooth: hci0: setting up wcn399x
    [    5.633763] Bluetooth: hci0: QCA Product ID   :0x0000000a
    [    5.645350] Bluetooth: hci0: QCA SOC Version  :0x40010224
    [    5.650906] Bluetooth: hci0: QCA ROM Version  :0x00001001
    [    5.665173] Bluetooth: hci0: QCA Patch Version:0x00006699
    [    5.679356] Bluetooth: hci0: QCA controller version 0x02241001
    [    5.691109] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv
    [    6.680102] Bluetooth: hci0: QCA Downloading qca/crnv21.bin
    [    6.842948] Bluetooth: hci0: QCA setup on UART is completed
    
    Fixes: 523760b7ff88 ("Bluetooth: hci_qca: Added support for WCN3998")
    Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
    Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Fri Mar 13 05:26:16 2026 +0900

    Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
    
    [ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
    
    sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately
    releases the lock without holding a reference to the socket. A concurrent
    close() can free the socket between the lock release and the subsequent
    sk->sk_state access, resulting in a use-after-free.
    
    Other functions in the same file (sco_sock_timeout(), sco_conn_del())
    correctly use sco_sock_hold() to safely hold a reference under the lock.
    
    Fix by using sco_sock_hold() to take a reference before releasing the
    lock, and adding sock_put() on all exit paths.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: SMP: derive legacy responder STK authentication from MITM state [+ + +]
Author: Oleh Konko <security@1seal.org>
Date:   Tue Mar 31 11:52:13 2026 +0000

    Bluetooth: SMP: derive legacy responder STK authentication from MITM state
    
    commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream.
    
    The legacy responder path in smp_random() currently labels the stored
    STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
    That reflects what the local service requested, not what the pairing
    flow actually achieved.
    
    For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
    and the resulting STK should remain unauthenticated even if the local
    side requested HIGH security. Use the established MITM state when
    storing the responder STK so the key metadata matches the pairing result.
    
    This also keeps the legacy path aligned with the Secure Connections code,
    which already treats JUST_WORKS/JUST_CFM as unauthenticated.
    
    Fixes: fff3490f4781 ("Bluetooth: Fix setting correct authentication information for SMP STK")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleh Konko <security@1seal.org>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: SMP: force responder MITM requirements before building the pairing response [+ + +]
Author: Oleh Konko <security@1seal.org>
Date:   Tue Mar 31 11:52:12 2026 +0000

    Bluetooth: SMP: force responder MITM requirements before building the pairing response
    
    commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream.
    
    smp_cmd_pairing_req() currently builds the pairing response from the
    initiator auth_req before enforcing the local BT_SECURITY_HIGH
    requirement. If the initiator omits SMP_AUTH_MITM, the response can
    also omit it even though the local side still requires MITM.
    
    tk_request() then sees an auth value without SMP_AUTH_MITM and may
    select JUST_CFM, making method selection inconsistent with the pairing
    policy the responder already enforces.
    
    When the local side requires HIGH security, first verify that MITM can
    be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
    response in both rsp.auth_req and auth. This keeps the responder auth bits
    and later method selection aligned.
    
    Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP")
    Cc: stable@vger.kernel.org
    Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
    Signed-off-by: Oleh Konko <security@1seal.org>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy [+ + +]
Author: Christian Eggers <ceggers@arri.de>
Date:   Wed Feb 25 18:07:28 2026 +0100

    Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
    
    [ Upstream commit 0e4d4dcc1a6e82cc6f9abf32193558efa7e1613d ]
    
    The last test step ("Test with Invalid public key X and Y, all set to
    0") expects to get an "DHKEY check failed" instead of "unspecified".
    
    Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
    Signed-off-by: Christian Eggers <ceggers@arri.de>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states [+ + +]
Author: Hangbin Liu <liuhangbin@gmail.com>
Date:   Wed Mar 4 15:13:54 2026 +0800

    bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
    
    [ Upstream commit 3348be7978f450ede0c308a4e8416ac716cf1015 ]
    
    Before the fixed commit, we check slave->new_link during commit
    state, which values are only BOND_LINK_{NOCHANGE, UP, DOWN}. After
    the commit, we start using slave->link_new_state, which state also could
    be BOND_LINK_{FAIL, BACK}.
    
    For example, when we set updelay/downdelay, after a failover,
    the slave->link_new_state could be set to BOND_LINK_{FAIL, BACK} in
    bond_miimon_inspect(). And later in bond_miimon_commit(), it will treat
    it as invalid and print an error, which would cause confusion for users.
    
    [  106.440254] bond0: (slave veth2): link status down for interface, disabling it in 200 ms
    [  106.440265] bond0: (slave veth2): invalid new link 1 on slave
    [  106.648276] bond0: (slave veth2): link status definitely down, disabling slave
    [  107.480271] bond0: (slave veth2): link status up, enabling it in 200 ms
    [  107.480288] bond0: (slave veth2): invalid new link 3 on slave
    [  107.688302] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
    
    Let's handle BOND_LINK_{FAIL, BACK} as valid link states.
    
    Fixes: 1899bb325149 ("bonding: fix state transition issue in link monitoring")
    Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
    Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-2-f72eb2e454d0@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
bpf: Fix regsafe() for pointers to packet [+ + +]
Author: Alexei Starovoitov <ast@kernel.org>
Date:   Tue Mar 31 13:42:28 2026 -0700

    bpf: Fix regsafe() for pointers to packet
    
    [ Upstream commit a8502a79e832b861e99218cbd2d8f4312d62e225 ]
    
    In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N
    regsafe() may return true which may lead to current state with
    valid packet range not being explored. Fix the bug.
    
    Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.")
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: Amery Hung <ameryhung@gmail.com>
    Acked-by: Eduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

bpf: Fix stack-out-of-bounds write in devmap [+ + +]
Author: Kohei Enju <kohei@enjuk.jp>
Date:   Wed Feb 25 05:34:44 2026 +0000

    bpf: Fix stack-out-of-bounds write in devmap
    
    [ Upstream commit b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 ]
    
    get_upper_ifindexes() iterates over all upper devices and writes their
    indices into an array without checking bounds.
    
    Also the callers assume that the max number of upper devices is
    MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,
    but that assumption is not correct and the number of upper devices could
    be larger than MAX_NEST_DEV (e.g., many macvlans), causing a
    stack-out-of-bounds write.
    
    Add a max parameter to get_upper_ifindexes() to avoid the issue.
    When there are too many upper devices, return -EOVERFLOW and abort the
    redirect.
    
    To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with
    an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.
    Then send a packet to the device to trigger the XDP redirect path.
    
    Reported-by: syzbot+10cc7f13760b31bd2e61@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/698c4ce3.050a0220.340abe.000b.GAE@google.com/T/
    Fixes: aeea1b86f936 ("bpf, devmap: Exclude XDP broadcast to master device")
    Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Signed-off-by: Kohei Enju <kohei@enjuk.jp>
    Link: https://lore.kernel.org/r/20260225053506.4738-1-kohei@enjuk.jp
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

bpf: Forget ranges when refining tnum after JSET [+ + +]
Author: Paul Chaignon <paul.chaignon@gmail.com>
Date:   Thu Jul 10 20:20:53 2025 +0200

    bpf: Forget ranges when refining tnum after JSET
    
    commit 6279846b9b2532e1b04559ef8bd0dec049f29383 upstream.
    
    Syzbot reported a kernel warning due to a range invariant violation on
    the following BPF program.
    
      0: call bpf_get_netns_cookie
      1: if r0 == 0 goto <exit>
      2: if r0 & Oxffffffff goto <exit>
    
    The issue is on the path where we fall through both jumps.
    
    That path is unreachable at runtime: after insn 1, we know r0 != 0, but
    with the sign extension on the jset, we would only fallthrough insn 2
    if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to
    figure this out, so the verifier walks all branches. The verifier then
    refines the register bounds using the second condition and we end
    up with inconsistent bounds on this unreachable path:
    
      1: if r0 == 0 goto <exit>
        r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)
      2: if r0 & 0xffffffff goto <exit>
        r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)
        r0 after reg_bounds_sync:  u64=[0x1, 0] var_off=(0, 0)
    
    Improving the range refinement for JSET to cover all cases is tricky. We
    also don't expect many users to rely on JSET given LLVM doesn't generate
    those instructions. So instead of improving the range refinement for
    JSETs, Eduard suggested we forget the ranges whenever we're narrowing
    tnums after a JSET. This patch implements that approach.
    
    Reported-by: syzbot+c711ce17dd78e5d4fdcf@syzkaller.appspotmail.com
    Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
    Acked-by: Yonghong Song <yonghong.song@linux.dev>
    Acked-by: Eduard Zingerman <eddyz87@gmail.com>
    Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
    Link: https://lore.kernel.org/r/9d4fd6432a095d281f815770608fdcd16028ce0b.1752171365.git.paul.chaignon@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    [ shung-hsi.yu: no detection or kernel warning for invariant violation before
      6.8, but the same umin=1,umax=0 state can occur when jset is preceed by r0 < 1.
      Changes were made to adapt to older range refinement logic before commit
      67420501e868 ("bpf: generalize reg_set_min_max() to handle non-const register
      comparisons"). ]
    Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

bpf: reject direct access to nullable PTR_TO_BUF pointers [+ + +]
Author: Qi Tang <tpluszz77@gmail.com>
Date:   Thu Apr 2 17:29:22 2026 +0800

    bpf: reject direct access to nullable PTR_TO_BUF pointers
    
    [ Upstream commit b0db1accbc7395657c2b79db59fa9fae0d6656f3 ]
    
    check_mem_access() matches PTR_TO_BUF via base_type() which strips
    PTR_MAYBE_NULL, allowing direct dereference without a null check.
    
    Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL.
    On stop callbacks these are NULL, causing a kernel NULL dereference.
    
    Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the
    existing PTR_TO_BTF_ID pattern.
    
    Fixes: 20b2aff4bc15 ("bpf: Introduce MEM_RDONLY flag")
    Signed-off-by: Qi Tang <tpluszz77@gmail.com>
    Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
    Link: https://lore.kernel.org/r/20260402092923.38357-2-tpluszz77@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

bpf: Release module BTF IDR before module unload [+ + +]
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Date:   Thu Mar 12 13:53:07 2026 -0700

    bpf: Release module BTF IDR before module unload
    
    [ Upstream commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 ]
    
    Gregory reported in [0] that the global_map_resize test when run in
    repeatedly ends up failing during program load. This stems from the fact
    that BTF reference has not dropped to zero after the previous run's
    module is unloaded, and the older module's BTF is still discoverable and
    visible. Later, in libbpf, load_module_btfs() will find the ID for this
    stale BTF, open its fd, and then it will be used during program load
    where later steps taking module reference using btf_try_get_module()
    fail since the underlying module for the BTF is gone.
    
    Logically, once a module is unloaded, it's associated BTF artifacts
    should become hidden. The BTF object inside the kernel may still remain
    alive as long its reference counts are alive, but it should no longer be
    discoverable.
    
    To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case
    for the module unload to free the BTF associated IDR entry, and disable
    its discovery once module unload returns to user space. If a race
    happens during unload, the outcome is non-deterministic anyway. However,
    user space should be able to rely on the guarantee that once it has
    synchronously established a successful module unload, no more stale
    artifacts associated with this module can be obtained subsequently.
    
    Note that we must be careful to not invoke btf_free_id() in btf_put()
    when btf_is_module() is true now. There could be a window where the
    module unload drops a non-terminal reference, frees the IDR, but the
    same ID gets reused and the second unconditional btf_free_id() ends up
    releasing an unrelated entry.
    
    To avoid a special case for btf_is_module() case, set btf->id to zero to
    make btf_free_id() idempotent, such that we can unconditionally invoke it
    from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is
    an invalid IDR, the idr_remove() should be a noop.
    
    Note that we can be sure that by the time we reach final btf_put() for
    btf_is_module() case, the btf_free_id() is already done, since the
    module itself holds the BTF reference, and it will call this function
    for the BTF before dropping its own reference.
    
      [0]: https://lore.kernel.org/bpf/cover.1773170190.git.grbell@redhat.com
    
    Fixes: 36e68442d1af ("bpf: Load and verify kernel module BTFs")
    Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
    Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
    Reported-by: Gregory Bell <grbell@redhat.com>
    Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
    Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
    Link: https://lore.kernel.org/r/20260312205307.1346991-1-memxor@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
bridge: br_nd_send: linearize skb before parsing ND options [+ + +]
Author: Yang Yang <n05ec@lzu.edu.cn>
Date:   Thu Mar 26 03:44:39 2026 +0000

    bridge: br_nd_send: linearize skb before parsing ND options
    
    [ Upstream commit a01aee7cafc575bb82f5529e8734e7052f9b16ea ]
    
    br_nd_send() parses neighbour discovery options from ns->opt[] and
    assumes that these options are in the linear part of request.
    
    Its callers only guarantee that the ICMPv6 header and target address
    are available, so the option area can still be non-linear. Parsing
    ns->opt[] in that case can access data past the linear buffer.
    
    Linearize request before option parsing and derive ns from the linear
    network header.
    
    Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
    Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Link: https://patch.msgid.link/20260326034441.2037420-2-n05ec@lzu.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

bridge: br_nd_send: validate ND option lengths [+ + +]
Author: Yang Yang <n05ec@lzu.edu.cn>
Date:   Thu Mar 26 03:44:40 2026 +0000

    bridge: br_nd_send: validate ND option lengths
    
    commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream.
    
    br_nd_send() walks ND options according to option-provided lengths.
    A malformed option can make the parser advance beyond the computed
    option span or use a too-short source LLADDR option payload.
    
    Validate option lengths against the remaining NS option area before
    advancing, and only read source LLADDR when the option is large enough
    for an Ethernet address.
    
    Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
    Cc: stable@vger.kernel.org
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
    Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
btrfs: abort transaction on failure to update root in the received subvol ioctl [+ + +]
Author: Filipe Manana <fdmanana@suse.com>
Date:   Fri Feb 27 00:02:33 2026 +0000

    btrfs: abort transaction on failure to update root in the received subvol ioctl
    
    commit 0f475ee0ebce5c9492b260027cd95270191675fa upstream.
    
    If we failed to update the root we don't abort the transaction, which is
    wrong since we already used the transaction to remove an item from the
    uuid tree.
    
    Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree")
    CC: stable@vger.kernel.org # 3.12+
    Reviewed-by: Anand Jain <asj@kernel.org>
    Signed-off-by: Filipe Manana <fdmanana@suse.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

btrfs: don't take device_list_mutex when querying zone info [+ + +]
Author: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Date:   Tue Mar 3 11:53:46 2026 +0100

    btrfs: don't take device_list_mutex when querying zone info
    
    [ Upstream commit 77603ab10429fe713a03345553ca8dbbfb1d91c6 ]
    
    Shin'ichiro reported sporadic hangs when running generic/013 in our CI
    system. When enabling lockdep, there is a lockdep splat when calling
    btrfs_get_dev_zone_info_all_devices() in the mount path that can be
    triggered by i.e. generic/013:
    
      ======================================================
      WARNING: possible circular locking dependency detected
      7.0.0-rc1+ #355 Not tainted
      ------------------------------------------------------
      mount/1043 is trying to acquire lock:
      ffff8881020b5470 (&vblk->vdev_mutex){+.+.}-{4:4}, at: virtblk_report_zones+0xda/0x430
    
      but task is already holding lock:
      ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
    
      which lock already depends on the new lock.
    
      the existing dependency chain (in reverse order) is:
    
      -> #4 (&fs_devs->device_list_mutex){+.+.}-{4:4}:
             __mutex_lock+0xa3/0x1360
             btrfs_create_pending_block_groups+0x1f4/0x9d0
             __btrfs_end_transaction+0x3e/0x2e0
             btrfs_zoned_reserve_data_reloc_bg+0x2f8/0x390
             open_ctree+0x1934/0x23db
             btrfs_get_tree.cold+0x105/0x26c
             vfs_get_tree+0x28/0xb0
             __do_sys_fsconfig+0x324/0x680
             do_syscall_64+0x92/0x4f0
             entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
      -> #3 (btrfs_trans_num_extwriters){++++}-{0:0}:
             join_transaction+0xc2/0x5c0
             start_transaction+0x17c/0xbc0
             btrfs_zoned_reserve_data_reloc_bg+0x2b4/0x390
             open_ctree+0x1934/0x23db
             btrfs_get_tree.cold+0x105/0x26c
             vfs_get_tree+0x28/0xb0
             __do_sys_fsconfig+0x324/0x680
             do_syscall_64+0x92/0x4f0
             entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
      -> #2 (btrfs_trans_num_writers){++++}-{0:0}:
             lock_release+0x163/0x4b0
             __btrfs_end_transaction+0x1c7/0x2e0
             btrfs_dirty_inode+0x6f/0xd0
             touch_atime+0xe5/0x2c0
             btrfs_file_mmap_prepare+0x65/0x90
             __mmap_region+0x4b9/0xf00
             mmap_region+0xf7/0x120
             do_mmap+0x43d/0x610
             vm_mmap_pgoff+0xd6/0x190
             ksys_mmap_pgoff+0x7e/0xc0
             do_syscall_64+0x92/0x4f0
             entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
      -> #1 (&mm->mmap_lock){++++}-{4:4}:
             __might_fault+0x68/0xa0
             _copy_to_user+0x22/0x70
             blkdev_copy_zone_to_user+0x22/0x40
             virtblk_report_zones+0x282/0x430
             blkdev_report_zones_ioctl+0xfd/0x130
             blkdev_ioctl+0x20f/0x2c0
             __x64_sys_ioctl+0x86/0xd0
             do_syscall_64+0x92/0x4f0
             entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
      -> #0 (&vblk->vdev_mutex){+.+.}-{4:4}:
             __lock_acquire+0x1522/0x2680
             lock_acquire+0xd5/0x2f0
             __mutex_lock+0xa3/0x1360
             virtblk_report_zones+0xda/0x430
             blkdev_report_zones_cached+0x162/0x190
             btrfs_get_dev_zones+0xdc/0x2e0
             btrfs_get_dev_zone_info+0x219/0xe80
             btrfs_get_dev_zone_info_all_devices+0x62/0x90
             open_ctree+0x1200/0x23db
             btrfs_get_tree.cold+0x105/0x26c
             vfs_get_tree+0x28/0xb0
             __do_sys_fsconfig+0x324/0x680
             do_syscall_64+0x92/0x4f0
             entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
      other info that might help us debug this:
    
      Chain exists of:
        &vblk->vdev_mutex --> btrfs_trans_num_extwriters --> &fs_devs->device_list_mutex
    
       Possible unsafe locking scenario:
    
             CPU0                    CPU1
             ----                    ----
        lock(&fs_devs->device_list_mutex);
                                     lock(btrfs_trans_num_extwriters);
                                     lock(&fs_devs->device_list_mutex);
        lock(&vblk->vdev_mutex);
    
       *** DEADLOCK ***
    
      3 locks held by mount/1043:
       #0: ffff88811063e878 (&fc->uapi_mutex){+.+.}-{4:4}, at: __do_sys_fsconfig+0x2ae/0x680
       #1: ffff88810cb9f0e8 (&type->s_umount_key#31/1){+.+.}-{4:4}, at: alloc_super+0xc0/0x3e0
       #2: ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
    
      stack backtrace:
      CPU: 2 UID: 0 PID: 1043 Comm: mount Not tainted 7.0.0-rc1+ #355 PREEMPT(full)
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025
      Call Trace:
       <TASK>
       dump_stack_lvl+0x5b/0x80
       print_circular_bug.cold+0x18d/0x1d8
       check_noncircular+0x10d/0x130
       __lock_acquire+0x1522/0x2680
       ? vmap_small_pages_range_noflush+0x3ef/0x820
       lock_acquire+0xd5/0x2f0
       ? virtblk_report_zones+0xda/0x430
       ? lock_is_held_type+0xcd/0x130
       __mutex_lock+0xa3/0x1360
       ? virtblk_report_zones+0xda/0x430
       ? virtblk_report_zones+0xda/0x430
       ? __pfx_copy_zone_info_cb+0x10/0x10
       ? virtblk_report_zones+0xda/0x430
       virtblk_report_zones+0xda/0x430
       ? __pfx_copy_zone_info_cb+0x10/0x10
       blkdev_report_zones_cached+0x162/0x190
       ? __pfx_copy_zone_info_cb+0x10/0x10
       btrfs_get_dev_zones+0xdc/0x2e0
       btrfs_get_dev_zone_info+0x219/0xe80
       btrfs_get_dev_zone_info_all_devices+0x62/0x90
       open_ctree+0x1200/0x23db
       btrfs_get_tree.cold+0x105/0x26c
       ? rcu_is_watching+0x18/0x50
       vfs_get_tree+0x28/0xb0
       __do_sys_fsconfig+0x324/0x680
       do_syscall_64+0x92/0x4f0
       entry_SYSCALL_64_after_hwframe+0x76/0x7e
      RIP: 0033:0x7f615e27a40e
      RSP: 002b:00007fff11b18fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
      RAX: ffffffffffffffda RBX: 000055572e92ab10 RCX: 00007f615e27a40e
      RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
      RBP: 00007fff11b19100 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 000055572e92bc40 R14: 00007f615e3faa60 R15: 000055572e92bd08
       </TASK>
    
    Don't hold the device_list_mutex while calling into
    btrfs_get_dev_zone_info() in btrfs_get_dev_zone_info_all_devices() to
    mitigate the issue. This is safe, as no other thread can touch the device
    list at the moment of execution.
    
    Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

btrfs: fix incorrect key offset in error message in check_dev_extent_item() [+ + +]
Author: Mark Harmstone <mark@harmstone.com>
Date:   Tue Feb 17 10:21:44 2026 +0000

    btrfs: fix incorrect key offset in error message in check_dev_extent_item()
    
    [ Upstream commit 511dc8912ae3e929c1a182f5e6b2326516fd42a0 ]
    
    Fix the error message in check_dev_extent_item(), when an overlapping
    stripe is encountered. For dev extents, objectid is the disk number and
    offset the physical address, so prev_key->objectid should actually be
    prev_key->offset.
    
    (I can't take any credit for this one - this was discovered by Chris and
    his friend Claude.)
    
    Reported-by: Chris Mason <clm@fb.com>
    Fixes: 008e2512dc56 ("btrfs: tree-checker: add dev extent item checks")
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: Mark Harmstone <mark@harmstone.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

btrfs: fix lost error when running device stats on multiple devices fs [+ + +]
Author: Filipe Manana <fdmanana@suse.com>
Date:   Wed Mar 18 16:17:59 2026 +0000

    btrfs: fix lost error when running device stats on multiple devices fs
    
    [ Upstream commit 1c37d896b12dfd0d4c96e310b0033c6676933917 ]
    
    Whenever we get an error updating the device stats item for a device in
    btrfs_run_dev_stats() we allow the loop to go to the next device, and if
    updating the stats item for the next device succeeds, we end up losing
    the error we had from the previous device.
    
    Fix this by breaking out of the loop once we get an error and make sure
    it's returned to the caller. Since we are in the transaction commit path
    (and in the critical section actually), returning the error will result
    in a transaction abort.
    
    Fixes: 733f4fbbc108 ("Btrfs: read device stats on mount, write modified ones during commit")
    Signed-off-by: Filipe Manana <fdmanana@suse.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

btrfs: fix super block offset in error message in btrfs_validate_super() [+ + +]
Author: Mark Harmstone <mark@harmstone.com>
Date:   Tue Feb 17 17:35:42 2026 +0000

    btrfs: fix super block offset in error message in btrfs_validate_super()
    
    [ Upstream commit b52fe51f724385b3ed81e37e510a4a33107e8161 ]
    
    Fix the superblock offset mismatch error message in
    btrfs_validate_super(): we changed it so that it considers all the
    superblocks, but the message still assumes we're only looking at the
    first one.
    
    The change from %u to %llu is because we're changing from a constant to
    a u64.
    
    Fixes: 069ec957c35e ("btrfs: Refactor btrfs_check_super_valid")
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: Mark Harmstone <mark@harmstone.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

btrfs: reject root items with drop_progress and zero drop_level [+ + +]
Author: ZhengYuan Huang <gality369@gmail.com>
Date:   Thu Mar 12 08:14:43 2026 +0800

    btrfs: reject root items with drop_progress and zero drop_level
    
    [ Upstream commit b17b79ff896305fd74980a5f72afec370ee88ca4 ]
    
    [BUG]
    When recovering relocation at mount time, merge_reloc_root() and
    btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against
    an impossible state: a non-zero drop_progress combined with a zero
    drop_level in a root_item, which can be triggered:
    
    ------------[ cut here ]------------
    kernel BUG at fs/btrfs/relocation.c:1545!
    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
    CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary)
    Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
    Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2
    RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545
    Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000
    Call Trace:
     merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861
     btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195
     btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130
     open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640
     btrfs_fill_super fs/btrfs/super.c:987 [inline]
     btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
     btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
     btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128
     vfs_get_tree+0x9a/0x370 fs/super.c:1758
     fc_mount fs/namespace.c:1199 [inline]
     do_new_mount_fc fs/namespace.c:3642 [inline]
     do_new_mount fs/namespace.c:3718 [inline]
     path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
     do_mount fs/namespace.c:4041 [inline]
     __do_sys_mount fs/namespace.c:4229 [inline]
     __se_sys_mount fs/namespace.c:4206 [inline]
     __x64_sys_mount+0x282/0x320 fs/namespace.c:4206
     ...
    RIP: 0033:0x7f969c9a8fde
    Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f
    ---[ end trace 0000000000000000 ]---
    
    The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic
    metadata fuzzing tool that corrupts btrfs metadata at runtime.
    
    [CAUSE]
    A non-zero drop_progress.objectid means an interrupted
    btrfs_drop_snapshot() left a resume point on disk, and in that case
    drop_level must be greater than 0 because the checkpoint is only
    saved at internal node levels.
    
    Although this invariant is enforced when the kernel writes the root
    item, it is not validated when the root item is read back from disk.
    That allows on-disk corruption to provide an invalid state with
    drop_progress.objectid != 0 and drop_level == 0.
    
    When relocation recovery later processes such a root item,
    merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The
    same invalid metadata can also trigger the corresponding BUG_ON() in
    btrfs_drop_snapshot().
    
    [FIX]
    Fix this by validating the root_item invariant in tree-checker when
    reading root items from disk: if drop_progress.objectid is non-zero,
    drop_level must also be non-zero. Reject such malformed metadata with
    -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot()
    and triggers the BUG_ON.
    
    After the fix, the same corruption is correctly rejected by tree-checker
    and the BUG_ON is no longer triggered.
    
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

btrfs: tree-checker: fix misleading root drop_level error message [+ + +]
Author: ZhengYuan Huang <gality369@gmail.com>
Date:   Thu Mar 12 08:33:21 2026 +0800

    btrfs: tree-checker: fix misleading root drop_level error message
    
    [ Upstream commit fc1cd1f18c34f91e78362f9629ab9fd43b9dcab9 ]
    
    Fix tree-checker error message to report "invalid root drop_level"
    instead of the misleading "invalid root level".
    
    Fixes: 259ee7754b67 ("btrfs: tree-checker: Add ROOT_ITEM check")
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
can: bcm: fix locking for bcm_op runtime updates [+ + +]
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Wed Feb 18 11:58:06 2026 +0100

    can: bcm: fix locking for bcm_op runtime updates
    
    [ Upstream commit c35636e91e392e1540949bbc67932167cb48bc3a ]
    
    Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
    added a locking for some variables that can be modified at runtime when
    updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().
    
    Usually the RX_SETUP only handles and filters incoming traffic with one
    exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is
    sent when a specific RTR frame is received. Therefore the rx bcm_op uses
    bcm_can_tx() which uses the bcm_tx_lock that was only initialized in
    bcm_tx_setup(). Add the missing spin_lock_init() when allocating the
    bcm_op in bcm_rx_setup() to handle the RTR case properly.
    
    Fixes: c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
    Reported-by: syzbot+5b11eccc403dd1cea9f8@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-can/699466e4.a70a0220.2c38d7.00ff.GAE@google.com/
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://patch.msgid.link/20260218-bcm_spin_lock_init-v1-1-592634c8a5b5@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 17:51:17 2026 +0100

    can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
    
    commit 38a01c9700b0dcafe97dfa9dc7531bf4a245deff upstream.
    
    When looking at the data in a USB urb, the actual_length is the size of
    the buffer passed to the driver, not the transfer_buffer_length which is
    set by the driver as the max size of the buffer.
    
    When parsing the messages in ems_usb_read_bulk_callback() properly check
    the size both at the beginning of parsing the message to make sure it is
    big enough for the expected structure, and at the end of the message to
    make sure we don't overflow past the end of the buffer for the next
    message.
    
    Cc: Vincent Mailhol <mailhol@kernel.org>
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Cc: stable@kernel.org
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/2026022316-answering-strainer-a5db@gregkh
    Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

can: gs_usb: gs_usb_receive_bulk_callback(): fix error message [+ + +]
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Fri Apr 3 09:36:15 2026 +0800

    can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    
    [ Upstream commit 494fc029f662c331e06b7c2031deff3c64200eed ]
    
    Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback():
    unanchor URL on usb_submit_urb() error") a failing resubmit URB will print
    an info message.
    
    In the case of a short read where netdev has not yet been assigned,
    initialize as NULL to avoid dereferencing an undefined value. Also report
    the error value of the failed resubmit.
    
    Fixes: 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error")
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Closes: https://lore.kernel.org/all/20260119181904.1209979-1-kuba@kernel.org/
    Link: https://patch.msgid.link/20260120-gs_usb-fix-error-message-v1-1-6be04de572bc@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Ruohan Lan <ruohanlan@aliyun.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak [+ + +]
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Fri Apr 3 09:36:13 2026 +0800

    can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
    
    [ Upstream commit 7352e1d5932a0e777e39fa4b619801191f57e603 ]
    
    In gs_can_open(), the URBs for USB-in transfers are allocated, added to the
    parent->rx_submitted anchor and submitted. In the complete callback
    gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In
    gs_can_close() the URBs are freed by calling
    usb_kill_anchored_urbs(parent->rx_submitted).
    
    However, this does not take into account that the USB framework unanchors
    the URB before the complete function is called. This means that once an
    in-URB has been completed, it is no longer anchored and is ultimately not
    released in gs_can_close().
    
    Fix the memory leak by anchoring the URB in the
    gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
    
    [ The variable usbcan was renamed to parent in
    commit b6980ad3a90c ("can: gs_usb: uniformly use "parent" as variable name for struct gs_usb")
    introduced in v6.6. To backport to v5.15, replace parent with usbcan. ]
    
    Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Ruohan Lan <ruohanlan@aliyun.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error [+ + +]
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Fri Apr 3 09:36:14 2026 +0800

    can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
    
    [ Upstream commit 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7 ]
    
    In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix
    URB memory leak"), the URB was re-anchored before usb_submit_urb() in
    gs_usb_receive_bulk_callback() to prevent a leak of this URB during
    cleanup.
    
    However, this patch did not take into account that usb_submit_urb() could
    fail. The URB remains anchored and
    usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops
    infinitely since the anchor list never becomes empty.
    
    To fix the bug, unanchor the URB when an usb_submit_urb() error occurs,
    also print an info message.
    
    Fixes: 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak")
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Closes: https://lore.kernel.org/all/20260110223836.3890248-1-kuba@kernel.org/
    Link: https://patch.msgid.link/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Ruohan Lan <ruohanlan@aliyun.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: gw: fix OOB heap access in cgw_csum_crc8_rel() [+ + +]
Author: Ali Norouzi <ali.norouzi@keysight.com>
Date:   Thu Mar 19 16:47:44 2026 +0100

    can: gw: fix OOB heap access in cgw_csum_crc8_rel()
    
    commit b9c310d72783cc2f30d103eed83920a5a29c671a upstream.
    
    cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():
    
        int from = calc_idx(crc8->from_idx, cf->len);
        int to   = calc_idx(crc8->to_idx,   cf->len);
        int res  = calc_idx(crc8->result_idx, cf->len);
    
        if (from < 0 || to < 0 || res < 0)
            return;
    
    However, the loop and the result write then use the raw s8 fields directly
    instead of the computed variables:
    
        for (i = crc8->from_idx; ...)        /* BUG: raw negative index */
        cf->data[crc8->result_idx] = ...;    /* BUG: raw negative index */
    
    With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,
    calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with
    i = -64, reading cf->data[-64], and the write goes to cf->data[-64].
    This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the
    start of the canfd_frame on the heap.
    
    The companion function cgw_csum_xor_rel() uses `from`/`to`/`res`
    correctly throughout; fix cgw_csum_crc8_rel() to match.
    
    Confirmed with KASAN on linux-7.0-rc2:
      BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0
      Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62
    
    To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
    
    Fixes: 456a8a646b25 ("can: gw: add support for CAN FD frames")
    Cc: stable@vger.kernel.org
    Reported-by: Ali Norouzi <ali.norouzi@keysight.com>
    Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Ali Norouzi <ali.norouzi@keysight.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-1-c45d52c6d2d8@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value [+ + +]
Author: Wenyuan Li <2063309626@qq.com>
Date:   Tue Mar 10 13:08:44 2026 +0800

    can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
    
    [ Upstream commit 47bba09b14fa21712398febf36cb14fd4fc3bded ]
    
    In hi3110_open(), the return value of hi3110_power_enable() is not checked.
    If power enable fails, the device may not function correctly, while the
    driver still returns success.
    
    Add a check for the return value and propagate the error accordingly.
    
    Signed-off-by: Wenyuan Li <2063309626@qq.com>
    Link: https://patch.msgid.link/tencent_B5E2E7528BB28AA8A2A56E16C49BD58B8B07@qq.com
    Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver")
    [mkl: adjust subject, commit message and jump label]
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: mcp251x: fix deadlock in error path of mcp251x_open [+ + +]
Author: Alban Bedel <alban.bedel@lht.dlh.de>
Date:   Mon Feb 9 15:47:05 2026 +0100

    can: mcp251x: fix deadlock in error path of mcp251x_open
    
    [ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ]
    
    The mcp251x_open() function call free_irq() in its error path with the
    mpc_lock mutex held. But if an interrupt already occurred the
    interrupt handler will be waiting for the mpc_lock and free_irq() will
    deadlock waiting for the handler to finish.
    
    This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can:
    mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but
    for the error path.
    
    To solve this issue move the call to free_irq() after the lock is
    released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ
    handler will exit right away once it acquired the lock.
    
    Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
    Link: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de
    Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.")
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: statistics: add missing atomic access in hot path [+ + +]
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Wed Mar 18 18:34:13 2026 +0100

    can: statistics: add missing atomic access in hot path
    
    [ Upstream commit 46eee1661aa9b49966e6c43d07126fe408edda57 ]
    
    Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path")
    fixed a KCSAN issue in can_receive() but missed to convert the 'matches'
    variable used in can_rcv_filter().
    
    Fixes: 80b5f90158d1 ("can: statistics: use atomic access in hot path")
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://patch.msgid.link/20260318173413.28235-1-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

can: ucan: Fix infinite loop from zero-length messages [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 17:30:20 2026 +0100

    can: ucan: Fix infinite loop from zero-length messages
    
    commit 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 upstream.
    
    If a broken ucan device gets a message with the message length field set
    to 0, then the driver will loop for forever in
    ucan_read_bulk_callback(), hanging the system.  If the length is 0, just
    skip the message and go on to the next one.
    
    This has been fixed in the kvaser_usb driver in the past in commit
    0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in
    command parsers"), so there must be some broken devices out there like
    this somewhere.
    
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Cc: Vincent Mailhol <mailhol@kernel.org>
    Cc: stable@kernel.org
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/2026022319-huff-absurd-6a18@gregkh
    Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices")
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

can: usb: etas_es58x: correctly anchor the urb in the read bulk callback [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 17:39:20 2026 +0100

    can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
    
    commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream.
    
    When submitting an urb, that is using the anchor pattern, it needs to be
    anchored before submitting it otherwise it could be leaked if
    usb_kill_anchored_urbs() is called.  This logic is correctly done
    elsewhere in the driver, except in the read bulk callback so do that
    here also.
    
    Cc: Vincent Mailhol <mailhol@kernel.org>
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Cc: stable@kernel.org
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
    Tested-by: Vincent Mailhol <mailhol@kernel.org>
    Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh
    Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
cdc-acm: new quirk for EPSON HMD [+ + +]
Author: Oliver Neukum <oneukum@suse.com>
Date:   Tue Mar 17 09:41:10 2026 +0100

    cdc-acm: new quirk for EPSON HMD
    
    commit f97e96c303d689708f7f713d8f3afcc31f1237e9 upstream.
    
    This device has a union descriptor that is just garbage
    and needs a custom descriptor.
    In principle this could be done with a (conditionally
    activated) heuristic. That would match more devices
    without a need for defining a new quirk. However,
    this always carries the risk that the heuristics
    does the wrong thing and leads to more breakage.
    Defining the quirk and telling it exactly what to do
    is the safe and conservative approach.
    
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260317084139.1461008-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ceph: fix i_nlink underrun during async unlink [+ + +]
Author: Max Kellermann <max.kellermann@ionos.com>
Date:   Fri Sep 5 23:15:30 2025 +0200

    ceph: fix i_nlink underrun during async unlink
    
    commit ce0123cbb4a40a2f1bbb815f292b26e96088639f upstream.
    
    During async unlink, we drop the `i_nlink` counter before we receive
    the completion (that will eventually update the `i_nlink`) because "we
    assume that the unlink will succeed".  That is not a bad idea, but it
    races against deletions by other clients (or against the completion of
    our own unlink) and can lead to an underrun which emits a WARNING like
    this one:
    
     WARNING: CPU: 85 PID: 25093 at fs/inode.c:407 drop_nlink+0x50/0x68
     Modules linked in:
     CPU: 85 UID: 3221252029 PID: 25093 Comm: php-cgi8.1 Not tainted 6.14.11-cm4all1-ampere #655
     Hardware name: Supermicro ARS-110M-NR/R12SPD-A, BIOS 1.1b 10/17/2023
     pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : drop_nlink+0x50/0x68
     lr : ceph_unlink+0x6c4/0x720
     sp : ffff80012173bc90
     x29: ffff80012173bc90 x28: ffff086d0a45aaf8 x27: ffff0871d0eb5680
     x26: ffff087f2a64a718 x25: 0000020000000180 x24: 0000000061c88647
     x23: 0000000000000002 x22: ffff07ff9236d800 x21: 0000000000001203
     x20: ffff07ff9237b000 x19: ffff088b8296afc0 x18: 00000000f3c93365
     x17: 0000000000070000 x16: ffff08faffcbdfe8 x15: ffff08faffcbdfec
     x14: 0000000000000000 x13: 45445f65645f3037 x12: 34385f6369706f74
     x11: 0000a2653104bb20 x10: ffffd85f26d73290 x9 : ffffd85f25664f94
     x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000002
     x5 : 0000000000000081 x4 : 0000000000000481 x3 : 0000000000000000
     x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff08727d3f91e8
     Call trace:
      drop_nlink+0x50/0x68 (P)
      vfs_unlink+0xb0/0x2e8
      do_unlinkat+0x204/0x288
      __arm64_sys_unlinkat+0x3c/0x80
      invoke_syscall.constprop.0+0x54/0xe8
      do_el0_svc+0xa4/0xc8
      el0_svc+0x18/0x58
      el0t_64_sync_handler+0x104/0x130
      el0t_64_sync+0x154/0x158
    
    In ceph_unlink(), a call to ceph_mdsc_submit_request() submits the
    CEPH_MDS_OP_UNLINK to the MDS, but does not wait for completion.
    
    Meanwhile, between this call and the following drop_nlink() call, a
    worker thread may process a CEPH_CAP_OP_IMPORT, CEPH_CAP_OP_GRANT or
    just a CEPH_MSG_CLIENT_REPLY (the latter of which could be our own
    completion).  These will lead to a set_nlink() call, updating the
    `i_nlink` counter to the value received from the MDS.  If that new
    `i_nlink` value happens to be zero, it is illegal to decrement it
    further.  But that is exactly what ceph_unlink() will do then.
    
    The WARNING can be reproduced this way:
    
    1. Force async unlink; only the async code path is affected.  Having
       no real clue about Ceph internals, I was unable to find out why the
       MDS wouldn't give me the "Fxr" capabilities, so I patched
       get_caps_for_async_unlink() to always succeed.
    
       (Note that the WARNING dump above was found on an unpatched kernel,
       without this kludge - this is not a theoretical bug.)
    
    2. Add a sleep call after ceph_mdsc_submit_request() so the unlink
       completion gets handled by a worker thread before drop_nlink() is
       called.  This guarantees that the `i_nlink` is already zero before
       drop_nlink() runs.
    
    The solution is to skip the counter decrement when it is already zero,
    but doing so without a lock is still racy (TOCTOU).  Since
    ceph_fill_inode() and handle_cap_grant() both hold the
    `ceph_inode_info.i_ceph_lock` spinlock while set_nlink() runs, this
    seems like the proper lock to protect the `i_nlink` updates.
    
    I found prior art in NFS and SMB (using `inode.i_lock`) and AFS (using
    `afs_vnode.cb_lock`).  All three have the zero check as well.
    
    Cc: stable@vger.kernel.org
    Fixes: 2ccb45462aea ("ceph: perform asynchronous unlink if we have sufficient caps")
    Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
    Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
cgroup: fix race between task migration and iteration [+ + +]
Author: Qingye Zhao <zhaoqingye@honor.com>
Date:   Wed Feb 11 09:24:04 2026 +0000

    cgroup: fix race between task migration and iteration
    
    commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream.
    
    When a task is migrated out of a css_set, cgroup_migrate_add_task()
    first moves it from cset->tasks to cset->mg_tasks via:
    
        list_move_tail(&task->cg_list, &cset->mg_tasks);
    
    If a css_task_iter currently has it->task_pos pointing to this task,
    css_set_move_task() calls css_task_iter_skip() to keep the iterator
    valid. However, since the task has already been moved to ->mg_tasks,
    the iterator is advanced relative to the mg_tasks list instead of the
    original tasks list. As a result, remaining tasks on cset->tasks, as
    well as tasks queued on cset->mg_tasks, can be skipped by iteration.
    
    Fix this by calling css_set_skip_task_iters() before unlinking
    task->cg_list from cset->tasks. This advances all active iterators to
    the next task on cset->tasks, so iteration continues correctly even
    when a task is concurrently being migrated.
    
    This race is hard to hit in practice without instrumentation, but it
    can be reproduced by artificially slowing down cgroup_procs_show().
    For example, on an Android device a temporary
    /sys/kernel/cgroup/cgroup_test knob can be added to inject a delay
    into cgroup_procs_show(), and then:
    
      1) Spawn three long-running tasks (PIDs 101, 102, 103).
      2) Create a test cgroup and move the tasks into it.
      3) Enable a large delay via /sys/kernel/cgroup/cgroup_test.
      4) In one shell, read cgroup.procs from the test cgroup.
      5) Within the delay window, in another shell migrate PID 102 by
         writing it to a different cgroup.procs file.
    
    Under this setup, cgroup.procs can intermittently show only PID 101
    while skipping PID 103. Once the migration completes, reading the
    file again shows all tasks as expected.
    
    Note that this change does not allow removing the existing
    css_set_skip_task_iters() call in css_set_move_task(). The new call
    in cgroup_migrate_add_task() only handles iterators that are racing
    with migration while the task is still on cset->tasks. Iterators may
    also start after the task has been moved to cset->mg_tasks. If we
    dropped css_set_skip_task_iters() from css_set_move_task(), such
    iterators could keep task_pos pointing to a migrating task, causing
    css_task_iter_advance() to malfunction on the destination css_set,
    up to and including crashes or infinite loops.
    
    The race window between migration and iteration is very small, and
    css_task_iter is not on a hot path. In the worst case, when an
    iterator is positioned on the first thread of the migrating process,
    cgroup_migrate_add_task() may have to skip multiple tasks via
    css_set_skip_task_iters(). However, this only happens when migration
    and iteration actually race, so the performance impact is negligible
    compared to the correctness fix provided here.
    
    Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()")
    Cc: stable@vger.kernel.org # v5.2+
    Signed-off-by: Qingye Zhao <zhaoqingye@honor.com>
    Reviewed-by: Michal Koutný <mkoutny@suse.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
clk: tegra: tegra124-emc: fix device leak on set_rate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Nov 21 17:40:03 2025 +0100

    clk: tegra: tegra124-emc: fix device leak on set_rate()
    
    [ Upstream commit da61439c63d34ae6503d080a847f144d587e3a48 ]
    
    Make sure to drop the reference taken when looking up the EMC device and
    its driver data on first set_rate().
    
    Note that holding a reference to a device does not prevent its driver
    data from going away so there is no point in keeping the reference.
    
    Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
    Fixes: 6d6ef58c2470 ("clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver")
    Cc: stable@vger.kernel.org      # 4.2: 6d6ef58c2470
    Cc: Mikko Perttunen <mperttunen@nvidia.com>
    Cc: Miaoqian Lin <linmq006@gmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Stephen Boyd <sboyd@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
comedi: dt2815: add hardware detection to prevent crash [+ + +]
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date:   Mon Mar 9 16:18:59 2026 +0530

    comedi: dt2815: add hardware detection to prevent crash
    
    commit 93853512f565e625df2397f0d8050d6aafd7c3ad upstream.
    
    The dt2815 driver crashes when attached to I/O ports without actual
    hardware present. This occurs because syzkaller or users can attach
    the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
    
    When no hardware exists at the specified port, inb() operations return
    0xff (floating bus), but outb() operations can trigger page faults due
    to undefined behavior, especially under race conditions:
    
      BUG: unable to handle page fault for address: 000000007fffff90
      #PF: supervisor write access in kernel mode
      #PF: error_code(0x0002) - not-present page
      RIP: 0010:dt2815_attach+0x6e0/0x1110
    
    Add hardware detection by reading the status register before attempting
    any write operations. If the read returns 0xff, assume no hardware is
    present and fail the attach with -ENODEV. This prevents crashes from
    outb() operations on non-existent hardware.
    
    Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
    Cc: stable <stable@kernel.org>
    Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
    Tested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
    Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
    Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/]
    Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/
    Link: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

comedi: me4000: Fix potential overrun of firmware buffer [+ + +]
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Thu Feb 5 13:39:49 2026 +0000

    comedi: me4000: Fix potential overrun of firmware buffer
    
    commit 3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7 upstream.
    
    `me4000_xilinx_download()` loads the firmware that was requested by
    `request_firmware()`.  It is possible for it to overrun the source
    buffer because it blindly trusts the file format.  It reads a data
    stream length from the first 4 bytes into variable `file_length` and
    reads the data stream contents of length `file_length` from offset 16
    onwards.
    
    Add a test to ensure that the supplied firmware is long enough to
    contain the header and the data stream.  On failure, log an error and
    return `-EINVAL`.
    
    Note: The firmware loading was totally broken before commit ac584af59945
    ("staging: comedi: me4000: fix firmware downloading"), but that is the
    most sensible target for this fix.
    
    Fixes: ac584af59945 ("staging: comedi: me4000: fix firmware downloading")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://patch.msgid.link/20260205133949.71722-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

comedi: me_daq: Fix potential overrun of firmware buffer [+ + +]
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Thu Feb 5 14:01:30 2026 +0000

    comedi: me_daq: Fix potential overrun of firmware buffer
    
    commit cc797d4821c754c701d9714b58bea947e31dbbe0 upstream.
    
    `me2600_xilinx_download()` loads the firmware that was requested by
    `request_firmware()`.  It is possible for it to overrun the source
    buffer because it blindly trusts the file format.  It reads a data
    stream length from the first 4 bytes into variable `file_length` and
    reads the data stream contents of length `file_length` from offset 16
    onwards.  Although it checks that the supplied firmware is at least 16
    bytes long, it does not check that it is long enough to contain the data
    stream.
    
    Add a test to ensure that the supplied firmware is long enough to
    contain the header and the data stream.  On failure, log an error and
    return `-EINVAL`.
    
    Fixes: 85acac61096f9 ("Staging: comedi: add me_daq driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://patch.msgid.link/20260205140130.76697-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

comedi: ni_atmio16d: Fix invalid clean-up after failed attach [+ + +]
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Wed Jan 28 15:00:10 2026 +0000

    comedi: ni_atmio16d: Fix invalid clean-up after failed attach
    
    commit 101ab946b79ad83b36d5cfd47de587492a80acf0 upstream.
    
    If the driver's COMEDI "attach" handler function (`atmio16d_attach()`)
    returns an error, the COMEDI core will call the driver's "detach"
    handler function (`atmio16d_detach()`) to clean up.  This calls
    `reset_atmio16d()` unconditionally, but depending on where the error
    occurred in the attach handler, the device may not have been
    sufficiently initialized to call `reset_atmio16d()`.  It uses
    `dev->iobase` as the I/O port base address and `dev->private` as the
    pointer to the COMEDI device's private data structure.  `dev->iobase`
    may still be set to its initial value of 0, which would result in
    undesired writes to low I/O port addresses.  `dev->private` may still be
    `NULL`, which would result in null pointer dereferences.
    
    Fix `atmio16d_detach()` by checking that `dev->private` is valid
    (non-null) before calling `reset_atmio16d()`.  This implies that
    `dev->iobase` was set correctly since that is set up before
    `dev->private`.
    
    Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://patch.msgid.link/20260128150011.5006-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

comedi: Reinit dev->spinlock between attachments to low-level drivers [+ + +]
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Wed Feb 25 13:24:27 2026 +0000

    comedi: Reinit dev->spinlock between attachments to low-level drivers
    
    commit 4b9a9a6d71e3e252032f959fb3895a33acb5865c upstream.
    
    `struct comedi_device` is the main controlling structure for a COMEDI
    device created by the COMEDI subsystem.  It contains a member `spinlock`
    containing a spin-lock that is initialized by the COMEDI subsystem, but
    is reserved for use by a low-level driver attached to the COMEDI device
    (at least since commit 25436dc9d84f ("Staging: comedi: remove RT
    code")).
    
    Some COMEDI devices (those created on initialization of the COMEDI
    subsystem when the "comedi.comedi_num_legacy_minors" parameter is
    non-zero) can be attached to different low-level drivers over their
    lifetime using the `COMEDI_DEVCONFIG` ioctl command.  This can result in
    inconsistent lock states being reported when there is a mismatch in the
    spin-lock locking levels used by each low-level driver to which the
    COMEDI device has been attached.  Fix it by reinitializing
    `dev->spinlock` before calling the low-level driver's `attach` function
    pointer if `CONFIG_LOCKDEP` is enabled.
    
    Reported-by: syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=cc9f7f4a7df09f53c4a4
    Fixes: ed9eccbe8970 ("Staging: add comedi core")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://patch.msgid.link/20260225132427.86578-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
cpufreq: conservative: Reset requested_freq on limits change [+ + +]
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Fri Mar 20 15:08:14 2026 +0530

    cpufreq: conservative: Reset requested_freq on limits change
    
    commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 upstream.
    
    A recently reported issue highlighted that the cached requested_freq
    is not guaranteed to stay in sync with policy->cur. If the platform
    changes the actual CPU frequency after the governor sets one (e.g.
    due to platform-specific frequency scaling) and a re-sync occurs
    later, policy->cur may diverge from requested_freq.
    
    This can lead to incorrect behavior in the conservative governor.
    For example, the governor may assume the CPU is already running at
    the maximum frequency and skip further increases even though there
    is still headroom.
    
    Avoid this by resetting the cached requested_freq to policy->cur on
    detecting a change in policy limits.
    
    Reported-by: Lifeng Zheng <zhenglifeng1@huawei.com>
    Tested-by: Lifeng Zheng <zhenglifeng1@huawei.com>
    Link: https://lore.kernel.org/all/20260210115458.3493646-1-zhenglifeng1@huawei.com/
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
    Cc: All applicable <stable@vger.kernel.org>
    Link: https://patch.msgid.link/d846a141a98ac0482f20560fcd7525c0f0ec2f30.1773999467.git.viresh.kumar@linaro.org
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
crypto: af-alg - fix NULL pointer dereference in scatterwalk [+ + +]
Author: Norbert Szetei <norbert@doyensec.com>
Date:   Wed Mar 25 18:26:13 2026 +0100

    crypto: af-alg - fix NULL pointer dereference in scatterwalk
    
    [ Upstream commit 62397b493e14107ae82d8b80938f293d95425bcb ]
    
    The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
    when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
    exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
    sendmsg() allocates a new SGL and chains it, but fails to clear the end
    marker on the previous SGL's last data entry.
    
    This causes the crypto scatterwalk to hit a premature end, returning NULL
    on sg_next() and leading to a kernel panic during dereference.
    
    Fix this by explicitly unmarking the end of the previous SGL when
    performing sg_chain() in af_alg_alloc_tsgl().
    
    Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
    Signed-off-by: Norbert Szetei <norbert@doyensec.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
device property: Allow secondary lookup in fwnode_get_next_child_node() [+ + +]
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date:   Tue Feb 10 14:58:22 2026 +0100

    device property: Allow secondary lookup in fwnode_get_next_child_node()
    
    commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 upstream.
    
    When device_get_child_node_count() got split to the fwnode and device
    respective APIs, the fwnode didn't inherit the ability to traverse over
    the secondary fwnode. Hence any user, that switches from device to fwnode
    API misses this feature. In particular, this was revealed by the commit
    1490cbb9dbfd ("device property: Split fwnode_get_child_node_count()")
    that effectively broke the GPIO enumeration on Intel Galileo boards.
    Fix this by moving the secondary lookup from device to fwnode API.
    
    Note, in general no device_*() API should go into the depth of the fwnode
    implementation.
    
    Fixes: 114dbb4fa7c4 ("drivers property: When no children in primary, try secondary")
    Cc: stable@vger.kernel.org
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
    Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Link: https://patch.msgid.link/20260210135822.47335-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Danilo Krummrich <dakr@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
dma-buf: Include ioctl.h in UAPI header [+ + +]
Author: Isaac J. Manjarres <isaacmanjarres@google.com>
Date:   Mon Mar 2 16:23:09 2026 -0800

    dma-buf: Include ioctl.h in UAPI header
    
    [ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]
    
    include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define
    its ioctl commands. However, it does not include ioctl.h itself. So,
    if userspace source code tries to include the dma-buf.h file without
    including ioctl.h, it can result in build failures.
    
    Therefore, include ioctl.h in the dma-buf UAPI header.
    
    Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
    Reviewed-by: T.J. Mercier <tjmercier@google.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Link: https://lore.kernel.org/r/20260303002309.1401849-1-isaacmanjarres@google.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
dma-mapping: add missing `inline` for `dma_free_attrs` [+ + +]
Author: Miguel Ojeda <ojeda@kernel.org>
Date:   Wed Mar 25 02:55:48 2026 +0100

    dma-mapping: add missing `inline` for `dma_free_attrs`
    
    [ Upstream commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 ]
    
    Under an UML build for an upcoming series [1], I got `-Wstatic-in-inline`
    for `dma_free_attrs`:
    
          BINDGEN rust/bindings/bindings_generated.rs - due to target missing
        In file included from rust/helpers/helpers.c:59:
        rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline]
           17 |         dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs);
              |         ^
        rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage
           12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size,
              | ^
              | static
    
    The issue is that `dma_free_attrs` was not marked `inline` when it was
    introduced alongside the rest of the stubs.
    
    Thus mark it.
    
    Fixes: ed6ccf10f24b ("dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA")
    Closes: https://lore.kernel.org/rust-for-linux/20260322194616.89847-1-ojeda@kernel.org/ [1]
    Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Link: https://lore.kernel.org/r/20260325015548.70912-1-ojeda@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
dmaengine: idxd: Fix freeing the allocated ida too late [+ + +]
Author: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Date:   Wed Jan 21 10:34:35 2026 -0800

    dmaengine: idxd: Fix freeing the allocated ida too late
    
    [ Upstream commit c311f5e9248471a950f0a524c2fd736414d98900 ]
    
    It can happen that when the cdev .release() is called, the driver
    already called ida_destroy(). Move ida_free() to the _del() path.
    
    We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI
    unbind.
    
    Fixes: 04922b7445a1 ("dmaengine: idxd: fix cdev setup and free device lifetime issues")
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API [+ + +]
Author: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date:   Tue Dec 19 20:33:50 2023 +0100

    dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
    
    [ Upstream commit 1075ee66a8c19bfa375b19c236fd6a22a867f138 ]
    
    ida_alloc() and ida_free() should be preferred to the deprecated
    ida_simple_get() and ida_simple_remove().
    
    This is less verbose.
    
    Note that the upper limit of ida_simple_get() is exclusive, but the one of
    ida_alloc_range() is inclusive. Sothis change allows one more device.
    
    MINORMASK is ((1U << MINORBITS) - 1), so allowing MINORMASK as a maximum value
    makes sense. It is also consistent with other "ida_.*MINORMASK" and
    "ida_*MINOR()" usages.
    
    Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
    Acked-by: Lijun Pan <lijun.pan@intel.com>
    Link: https://lore.kernel.org/r/ac991f5f42112fa782a881d391d447529cbc4a23.1702967302.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: c311f5e92484 ("dmaengine: idxd: Fix freeing the allocated ida too late")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock [+ + +]
Author: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Date:   Wed Apr 1 12:16:58 2026 -0400

    dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
    
    [ Upstream commit 89a8567d84bde88cb7cdbbac2ab2299c4f991490 ]
    
    Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the
    CHCTRL register. To avoid concurrency issues when configuring
    functionalities exposed by this registers, take the virtual channel lock.
    All other CHCTRL updates were already protected by the same lock.
    
    Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before
    accessing CHCTRL registers but this does not ensure race-free access.
    Remove the local IRQ disable/enable code as well.
    
    Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
    Cc: stable@vger.kernel.org
    Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://patch.msgid.link/20260316133252.240348-3-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    [ replaced scoped_guard(spinlock_irqsave, ...) ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dmaengine: sh: rz-dmac: Protect the driver specific lists [+ + +]
Author: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Date:   Tue Mar 31 20:45:24 2026 -0400

    dmaengine: sh: rz-dmac: Protect the driver specific lists
    
    [ Upstream commit abb863e6213dc41a58ef8bb3289b7e77460dabf3 ]
    
    The driver lists (ld_free, ld_queue) are used in
    rz_dmac_free_chan_resources(), rz_dmac_terminate_all(),
    rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under
    the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg()
    and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since
    these functions also check whether the lists are empty and update or
    remove list entries.
    
    Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
    Cc: stable@vger.kernel.org
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://patch.msgid.link/20260316133252.240348-2-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    [ replaced scoped_guard(spinlock_irqsave) with explicit spin_lock_irqsave/spin_unlock_irqrestore calls ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dmaengine: xilinx: xilinx_dma: Fix dma_device directions [+ + +]
Author: Marek Vasut <marex@nabladev.com>
Date:   Mon Mar 16 23:16:54 2026 +0100

    dmaengine: xilinx: xilinx_dma: Fix dma_device directions
    
    [ Upstream commit e9cc95397bb7da13fe8a5b53a2f23cfaf9018ade ]
    
    Unlike chan->direction , struct dma_device .directions field is a
    bitfield. Turn chan->direction into a bitfield to make it compatible
    with struct dma_device .directions .
    
    Fixes: 7e01511443c3 ("dmaengine: xilinx_dma: Set dma_device directions")
    Signed-off-by: Marek Vasut <marex@nabladev.com>
    Link: https://patch.msgid.link/20260316221728.160139-1-marex@nabladev.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA [+ + +]
Author: Marek Vasut <marex@nabladev.com>
Date:   Mon Mar 16 23:18:57 2026 +0100

    dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
    
    [ Upstream commit f61d145999d61948a23cd436ebbfa4c3b9ab8987 ]
    
    The cyclic DMA calculation is currently entirely broken and reports
    residue only for the first segment. The problem is twofold.
    
    First, when the first descriptor finishes, it is moved from active_list
    to done_list, but it is never returned back into the active_list. The
    xilinx_dma_tx_status() expects the descriptor to be in the active_list
    to report any meaningful residue information, which never happens after
    the first descriptor finishes. Fix this up in xilinx_dma_start_transfer()
    and if the descriptor is cyclic, lift it from done_list and place it back
    into active_list list.
    
    Second, the segment .status fields of the descriptor remain dirty. Once
    the DMA did one pass on the descriptor, the .status fields are populated
    with data by the DMA, but the .status fields are not cleared before reuse
    during the next cyclic DMA round. The xilinx_dma_get_residue() recognizes
    that as if the descriptor was complete and had 0 residue, which is bogus.
    Reinitialize the status field before placing the descriptor back into the
    active_list.
    
    Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine")
    Signed-off-by: Marek Vasut <marex@nabladev.com>
    Link: https://patch.msgid.link/20260316221943.160375-1-marex@nabladev.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction [+ + +]
Author: Marek Vasut <marex@nabladev.com>
Date:   Mon Mar 16 23:25:24 2026 +0100

    dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
    
    [ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
    
    The segment .control and .status fields both contain top bits which are
    not part of the buffer size, the buffer size is located only in the bottom
    max_buffer_len bits. To avoid interference from those top bits, mask out
    the size using max_buffer_len first, and only then subtract the values.
    
    Fixes: a575d0b4e663 ("dmaengine: xilinx_dma: Introduce xilinx_dma_get_residue")
    Signed-off-by: Marek Vasut <marex@nabladev.com>
    Link: https://patch.msgid.link/20260316222530.163815-1-marex@nabladev.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA [+ + +]
Author: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Date:   Wed Mar 11 07:34:46 2026 +0200

    dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
    
    [ Upstream commit a17ce4bc6f4f9acf77ba416c36791a15602e53aa ]
    
    A single AXIDMA controller can have one or two channels. When it has two
    channels, the reset for both are tied together: resetting one channel
    resets the other as well. This creates a problem where resetting one
    channel will reset the registers for both channels, including clearing
    interrupt enable bits for the other channel, which can then lead  to
    timeouts as the driver is waiting for an interrupt which never comes.
    
    The driver currently has a probe-time work around for this: when a
    channel is created, the driver also resets and enables the
    interrupts. With two channels the reset for the second channel will
    clear the interrupt enables for the first one. The work around in the
    driver is just to manually enable the interrupts again in
    xilinx_dma_alloc_chan_resources().
    
    This workaround only addresses the probe-time issue. When channels are
    reset at runtime (e.g., in xilinx_dma_terminate_all() or during error
    recovery), there's no corresponding mechanism to restore the other
    channel's interrupt enables. This leads to one channel having its
    interrupts disabled while the driver expects them to work, causing
    timeouts and DMA failures.
    
    A proper fix is a complicated matter, as we should not reset the other
    channel when it's operating normally. So, perhaps, there should be some
    kind of synchronization for a common reset, which is not trivial to
    implement. To add to the complexity, the driver also supports other DMA
    types, like VDMA, CDMA and MCDMA, which don't have a shared reset.
    
    However, when the two-channel AXIDMA is used in the (assumably) normal
    use case, providing DMA for a single memory-to-memory device, the common
    reset is a bit smaller issue: when something bad happens on one channel,
    or when one channel is terminated, the assumption is that we also want
    to terminate the other channel. And thus resetting both at the same time
    is "ok".
    
    With that line of thinking we can implement a bit better work around
    than just the current probe time work around: let's enable the
    AXIDMA interrupts at xilinx_dma_start_transfer() instead.
    This ensures interrupts are enabled whenever a transfer starts,
    regardless of any prior resets that may have cleared them.
    
    This approach is also more logical: enable interrupts only when needed
    for a transfer, rather than at resource allocation time, and, I think,
    all the other DMA types should also use this model, but I'm reluctant to
    do such changes as I cannot test them.
    
    The reset function still enables interrupts even though it's not needed
    for AXIDMA anymore, but it's common code for all DMA types (VDMA, CDMA,
    MCDMA), so leave it unchanged to avoid affecting other variants.
    
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
    Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine")
    Link: https://patch.msgid.link/20260311-xilinx-dma-fix-v2-1-a725abb66e3c@ideasonboard.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: xilinx_dma: Program interrupt delay timeout [+ + +]
Author: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Date:   Mon Aug 7 11:21:46 2023 +0530

    dmaengine: xilinx_dma: Program interrupt delay timeout
    
    [ Upstream commit 84b798fedf3fa8f0ab0c096593ba817abc454fe5 ]
    
    Program IRQDelay for AXI DMA. The interrupt timeout mechanism causes
    the DMA engine to generate an interrupt after the delay time period
    has expired. It enables dmaengine to respond in real-time even though
    interrupt coalescing is configured. It also remove the placeholder
    for delay interrupt and merge it with frame completion interrupt.
    Since by default interrupt delay timeout is disabled this feature
    addition has no functional impact on VDMA, MCDMA and CDMA IP's.
    
    Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
    Link: https://lore.kernel.org/r/1691387509-2113129-8-git-send-email-radhey.shyam.pandey@amd.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: a17ce4bc6f4f ("dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
dpaa2-switch: do not clear any interrupts automatically [+ + +]
Author: Ioana Ciornei <ioana.ciornei@nxp.com>
Date:   Tue Dec 19 13:59:30 2023 +0200

    dpaa2-switch: do not clear any interrupts automatically
    
    [ Upstream commit f6da276479c63ca29774bc331a537b92f0550c45 ]
    
    The DPSW object has multiple event sources multiplexed over the same
    IRQ. The driver has the capability to configure only some of these
    events to trigger the IRQ.
    
    The dpsw_get_irq_status() can clear events automatically based on the
    value stored in the 'status' variable passed to it. We don't want that
    to happen because we could get into a situation when we are clearing
    more events than we actually handled.
    
    Just resort to manually clearing the events that we handled. Also, since
    status is not used on the out path we remove its initialization to zero.
    
    This change does not have a user-visible effect because the dpaa2-switch
    driver enables and handles all the DPSW events which exist at the
    moment.
    
    Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler [+ + +]
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Thu Feb 26 21:58:12 2026 -0800

    dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
    
    [ Upstream commit 74badb9c20b1a9c02a95c735c6d3cd6121679c93 ]
    
    Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ
    handler") introduces a range check for if_id to avoid an out-of-bounds
    access. If an out-of-bounds if_id is detected, the interrupt status is
    not cleared. This may result in an interrupt storm.
    
    Clear the interrupt status after detecting an out-of-bounds if_id to avoid
    the problem.
    
    Found by an experimental AI code review agent at Google.
    
    Fixes: 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler")
    Cc: Junrui Luo <moonafterrain@outlook.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Link: https://patch.msgid.link/20260227055812.1777915-1-linux@roeck-us.net
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() [+ + +]
Author: Lars Ellenberg <lars.ellenberg@linbit.com>
Date:   Thu Feb 19 15:20:12 2026 +0100

    drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
    
    commit ab140365fb62c0bdab22b2f516aff563b2559e3b upstream.
    
    Even though we check that we "should" be able to do lc_get_cumulative()
    while holding the device->al_lock spinlock, it may still fail,
    if some other code path decided to do lc_try_lock() with bad timing.
    
    If that happened, we logged "LOGIC BUG for enr=...",
    but still did not return an error.
    
    The rest of the code now assumed that this request has references
    for the relevant activity log extents.
    
    The implcations are that during an active resync, mutual exclusivity of
    resync versus application IO is not guaranteed. And a potential crash
    at this point may not realizs that these extents could have been target
    of in-flight IO and would need to be resynced just in case.
    
    Also, once the request completes, it will give up activity log references it
    does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().
    
    Fix:
    
    Do not crash the kernel for a condition that is harmless during normal
    operation: also catch "e->refcnt == 0", not only "e == NULL"
    when being noisy about "al_complete_io() called on inactive extent %u\n".
    
    And do not try to be smart and "guess" whether something will work, then
    be surprised when it does not.
    Deal with the fact that it may or may not work.  If it does not, remember a
    possible "partially in activity log" state (only possible for requests that
    cross extent boundaries), and return an error code from
    drbd_al_begin_io_nonblock().
    
    A latter call for the same request will then resume from where we left off.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
    Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
driver: iio: add missing checks on iio_info's callback access [+ + +]
Author: Julien Stephan <jstephan@baylibre.com>
Date:   Thu May 30 11:22:46 2024 +0200

    driver: iio: add missing checks on iio_info's callback access
    
    commit c4ec8dedca961db056ec85cb7ca8c9f7e2e92252 upstream.
    
    Some callbacks from iio_info structure are accessed without any check, so
    if a driver doesn't implement them trying to access the corresponding
    sysfs entries produce a kernel oops such as:
    
    [ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute
    [...]
    [ 2203.783416] Call trace:
    [ 2203.783429]  iio_read_channel_info_avail from dev_attr_show+0x18/0x48
    [ 2203.789807]  dev_attr_show from sysfs_kf_seq_show+0x90/0x120
    [ 2203.794181]  sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4
    [ 2203.798555]  seq_read_iter from vfs_read+0x238/0x2a0
    [ 2203.802236]  vfs_read from ksys_read+0xa4/0xd4
    [ 2203.805385]  ksys_read from ret_fast_syscall+0x0/0x54
    [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0)
    [ 2203.812880] dfa0:                   00000003 b6f10f80 00000003 b6eab000 00020000 00000000
    [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000
    [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0
    [ 2203.830363] Code: bad PC value
    [ 2203.832695] ---[ end trace 0000000000000000 ]---
    
    Reviewed-by: Nuno Sa <nuno.sa@analog.com>
    Signed-off-by: Julien Stephan <jstephan@baylibre.com>
    Link: https://lore.kernel.org/r/20240530-iio-core-fix-segfault-v3-1-8b7cd2a03773@baylibre.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Charles Xu <charles_xu@189.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink [+ + +]
Author: Natalie Vock <natalie.vock@gmx.de>
Date:   Mon Mar 9 10:49:54 2026 -0400

    drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
    
    [ Upstream commit 28dfe4317541e57fe52f9a290394cd29c348228b ]
    
    This can be called while preemption is disabled, for example by
    dcn32_internal_validate_bw which is called with the FPU active.
    
    Fixes "BUG: scheduling while atomic" messages I encounter on my Navi31
    machine.
    
    Signed-off-by: Natalie Vock <natalie.vock@gmx.de>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit b42dae2ebc5c84a68de63ec4ffdfec49362d53f1)
    Cc: stable@vger.kernel.org
    [ Context ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu: Fix use-after-free race in VM acquire [+ + +]
Author: Alysa Liu <Alysa.Liu@amd.com>
Date:   Thu Feb 5 11:21:45 2026 -0500

    drm/amdgpu: Fix use-after-free race in VM acquire
    
    commit 2c1030f2e84885cc58bffef6af67d5b9d2e7098f upstream.
    
    Replace non-atomic vm->process_info assignment with cmpxchg()
    to prevent race when parent/child processes sharing a drm_file
    both try to acquire the same VM after fork().
    
    Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
    Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/ast: dp501: Fix initialization of SCU2C [+ + +]
Author: Thomas Zimmermann <tzimmermann@suse.de>
Date:   Fri Mar 27 14:32:53 2026 +0100

    drm/ast: dp501: Fix initialization of SCU2C
    
    commit 2f42c1a6161646cbd29b443459fd635d29eda634 upstream.
    
    Ast's DP501 initialization reads the register SCU2C at offset 0x1202c
    and tries to set it to source data from VGA. But writes the update to
    offset 0x0, with unknown results. Write the result to SCU instead.
    
    The bug only happens in ast_init_analog(). There's similar code in
    ast_init_dvo(), which works correctly.
    
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Fixes: 83c6620bae3f ("drm/ast: initial DP501 support (v0.2)")
    Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
    Cc: Dave Airlie <airlied@redhat.com>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: Jocelyn Falempe <jfalempe@redhat.com>
    Cc: dri-devel@lists.freedesktop.org
    Cc: <stable@vger.kernel.org> # v3.16+
    Link: https://patch.msgid.link/20260327133532.79696-2-tzimmermann@suse.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/exynos: vidi: fix to avoid directly dereferencing user pointer [+ + +]
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Mon Jan 19 17:25:52 2026 +0900

    drm/exynos: vidi: fix to avoid directly dereferencing user pointer
    
    commit d4c98c077c7fb2dfdece7d605e694b5ea2665085 upstream.
    
    In vidi_connection_ioctl(), vidi->edid(user pointer) is directly
    dereferenced in the kernel.
    
    This allows arbitrary kernel memory access from the user space, so instead
    of directly accessing the user pointer in the kernel, we should modify it
    to copy edid to kernel memory using copy_from_user() and use it.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free [+ + +]
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Mon Jan 19 17:25:53 2026 +0900

    drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
    
    commit 52b330799e2d6f825ae2bb74662ec1b10eb954bb upstream.
    
    Exynos Virtual Display driver performs memory alloc/free operations
    without lock protection, which easily causes concurrency problem.
    
    For example, use-after-free can occur in race scenario like this:
    ```
            CPU0                            CPU1                            CPU2
            ----                            ----                            ----
      vidi_connection_ioctl()
        if (vidi->connection) // true
          drm_edid = drm_edid_alloc(); // alloc drm_edid
          ...
          ctx->raw_edid = drm_edid;
          ...
                                                                    drm_mode_getconnector()
                                                                      drm_helper_probe_single_connector_modes()
                                                                        vidi_get_modes()
                                                                          if (ctx->raw_edid) // true
                                                                            drm_edid_dup(ctx->raw_edid);
                                                                              if (!drm_edid) // false
                                                                              ...
                                    vidi_connection_ioctl()
                                      if (vidi->connection) // false
                                        drm_edid_free(ctx->raw_edid); // free drm_edid
                                        ...
                                                                              drm_edid_alloc(drm_edid->edid)
                                                                                kmemdup(edid); // UAF!!
                                                                                ...
    ```
    
    To prevent these vulns, at least in vidi_context, member variables related
    to memory alloc/free should be protected with ctx->lock.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() [+ + +]
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Mon Jan 19 17:25:51 2026 +0900

    drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
    
    commit d3968a0d85b211e197f2f4f06268a7031079e0d0 upstream.
    
    vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
    obtain a struct vidi_context pointer. However, drm_dev->dev is the
    exynos-drm master device, and the driver_data contained therein is not
    the vidi component device, but a completely different device.
    
    This can lead to various bugs, ranging from null pointer dereferences and
    garbage value accesses to, in unlucky cases, out-of-bounds errors,
    use-after-free errors, and more.
    
    To resolve this issue, we need to store/delete the vidi device pointer in
    exynos_drm_private->vidi_dev during bind/unbind, and then read this
    exynos_drm_private->vidi_dev within ioctl() to obtain the correct
    struct vidi_context pointer.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads [+ + +]
Author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Date:   Mon Mar 16 16:19:19 2026 -0700

    drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
    
    [ Upstream commit 08441f10f4dc09fdeb64529953ac308abc79dd38 ]
    
    When reading exactly 512 bytes with burst read enabled, the
    extra_byte_added path breaks out of the inner do-while without
    decrementing len. The outer while(len) then re-enters and gmbus_wait()
    times out since all data has been delivered. Decrement len before the
    break so the outer loop terminates correctly.
    
    Fixes: d5dc0f43f268 ("drm/i915/gmbus: Enable burst read")
    Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
    Reviewed-by: Jani Nikula <jani.nikula@intel.com>
    Link: https://patch.msgid.link/20260316231920.135438-2-samasth.norway.ananda@oracle.com
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    (cherry picked from commit 4ab0f09ee73fc853d00466682635f67c531f909c)
    Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drm/i915/gt: Check set_default_submission() before deferencing [+ + +]
Author: Rahul Bukte <rahul.bukte@sony.com>
Date:   Tue Feb 3 10:18:39 2026 +0530

    drm/i915/gt: Check set_default_submission() before deferencing
    
    [ Upstream commit 0162ab3220bac870e43e229e6e3024d1a21c3f26 ]
    
    When the i915 driver firmware binaries are not present, the
    set_default_submission pointer is not set. This pointer is
    dereferenced during suspend anyways.
    
    Add a check to make sure it is set before dereferencing.
    
    [   23.289926] PM: suspend entry (deep)
    [   23.293558] Filesystems sync: 0.000 seconds
    [   23.298010] Freezing user space processes
    [   23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
    [   23.309766] OOM killer disabled.
    [   23.313027] Freezing remaining freezable tasks
    [   23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
    [   23.342038] serial 00:05: disabled
    [   23.345719] serial 00:02: disabled
    [   23.349342] serial 00:01: disabled
    [   23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
    [   23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
    [   23.361635] ata1.00: Entering standby power mode
    [   23.368863] ata2.00: Entering standby power mode
    [   23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [   23.452194] #PF: supervisor instruction fetch in kernel mode
    [   23.457896] #PF: error_code(0x0010) - not-present page
    [   23.463065] PGD 0 P4D 0
    [   23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
    [   23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S      W           6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
    [   23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
    [   23.496511] Workqueue: async async_run_entry_fn
    [   23.501087] RIP: 0010:0x0
    [   23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
    [   23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
    [   23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
    [   23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
    [   23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
    [   23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
    [   23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
    [   23.551457] FS:  0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
    [   23.559588] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
    [   23.572539] PKRU: 55555554
    [   23.575281] Call Trace:
    [   23.577770]  <TASK>
    [   23.579905]  intel_engines_reset_default_submission+0x42/0x60
    [   23.585695]  __intel_gt_unset_wedged+0x191/0x200
    [   23.590360]  intel_gt_unset_wedged+0x20/0x40
    [   23.594675]  gt_sanitize+0x15e/0x170
    [   23.598290]  i915_gem_suspend_late+0x6b/0x180
    [   23.602692]  i915_drm_suspend_late+0x35/0xf0
    [   23.607008]  ? __pfx_pci_pm_suspend_late+0x10/0x10
    [   23.611843]  dpm_run_callback+0x78/0x1c0
    [   23.615817]  device_suspend_late+0xde/0x2e0
    [   23.620037]  async_suspend_late+0x18/0x30
    [   23.624082]  async_run_entry_fn+0x25/0xa0
    [   23.628129]  process_one_work+0x15b/0x380
    [   23.632182]  worker_thread+0x2a5/0x3c0
    [   23.635973]  ? __pfx_worker_thread+0x10/0x10
    [   23.640279]  kthread+0xf6/0x1f0
    [   23.643464]  ? __pfx_kthread+0x10/0x10
    [   23.647263]  ? __pfx_kthread+0x10/0x10
    [   23.651045]  ret_from_fork+0x131/0x190
    [   23.654837]  ? __pfx_kthread+0x10/0x10
    [   23.658634]  ret_from_fork_asm+0x1a/0x30
    [   23.662597]  </TASK>
    [   23.664826] Modules linked in:
    [   23.667914] CR2: 0000000000000000
    [   23.671271] ------------[ cut here ]------------
    
    Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
    Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
    Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
    Link: https://patch.msgid.link/20260203044839.1555147-1-suraj.kandpal@intel.com
    (cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)
    Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc")
    Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat [+ + +]
Author: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Date:   Wed Apr 1 12:10:07 2026 +0200

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
    
    commit 4c71fd099513bfa8acab529b626e1f0097b76061 upstream.
    
    A use-after-free / refcount underflow is possible when the heartbeat
    worker and intel_engine_park_heartbeat() race to release the same
    engine->heartbeat.systole request.
    
    The heartbeat worker reads engine->heartbeat.systole and calls
    i915_request_put() on it when the request is complete, but clears
    the pointer in a separate, non-atomic step. Concurrently, a request
    retirement on another CPU can drop the engine wakeref to zero, triggering
    __engine_park() -> intel_engine_park_heartbeat(). If the heartbeat
    timer is pending at that point, cancel_delayed_work() returns true and
    intel_engine_park_heartbeat() reads the stale non-NULL systole pointer
    and calls i915_request_put() on it again, causing a refcount underflow:
    
    ```
    <4> [487.221889] Workqueue: i915-unordered engine_retire [i915]
    <4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0
    ...
    <4> [487.222707] Call Trace:
    <4> [487.222711]  <TASK>
    <4> [487.222716]  intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]
    <4> [487.223115]  intel_engine_park_heartbeat+0x25/0x40 [i915]
    <4> [487.223566]  __engine_park+0xb9/0x650 [i915]
    <4> [487.223973]  ____intel_wakeref_put_last+0x2e/0xb0 [i915]
    <4> [487.224408]  __intel_wakeref_put_last+0x72/0x90 [i915]
    <4> [487.224797]  intel_context_exit_engine+0x7c/0x80 [i915]
    <4> [487.225238]  intel_context_exit+0xf1/0x1b0 [i915]
    <4> [487.225695]  i915_request_retire.part.0+0x1b9/0x530 [i915]
    <4> [487.226178]  i915_request_retire+0x1c/0x40 [i915]
    <4> [487.226625]  engine_retire+0x122/0x180 [i915]
    <4> [487.227037]  process_one_work+0x239/0x760
    <4> [487.227060]  worker_thread+0x200/0x3f0
    <4> [487.227068]  ? __pfx_worker_thread+0x10/0x10
    <4> [487.227075]  kthread+0x10d/0x150
    <4> [487.227083]  ? __pfx_kthread+0x10/0x10
    <4> [487.227092]  ret_from_fork+0x3d4/0x480
    <4> [487.227099]  ? __pfx_kthread+0x10/0x10
    <4> [487.227107]  ret_from_fork_asm+0x1a/0x30
    <4> [487.227141]  </TASK>
    ```
    
    Fix this by replacing the non-atomic pointer read + separate clear with
    xchg() in both racing paths. xchg() is a single indivisible hardware
    instruction that atomically reads the old pointer and writes NULL. This
    guarantees only one of the two concurrent callers obtains the non-NULL
    pointer and performs the put, the other gets NULL and skips it.
    
    Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15880
    Fixes: 058179e72e09 ("drm/i915/gt: Replace hangcheck by heartbeats")
    Cc: <stable@vger.kernel.org> # v5.5+
    Signed-off-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
    Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
    Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
    Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
    Link: https://lore.kernel.org/r/d4c1c14255688dd07cc8044973c4f032a8d1559e.1775038106.git.sebastian.brzezinka@intel.com
    (cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)
    Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/ioc32: stop speculation on the drm_compat_ioctl path [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Mar 24 17:42:51 2026 +0100

    drm/ioc32: stop speculation on the drm_compat_ioctl path
    
    commit f8995c2df519f382525ca4bc90553ad2ec611067 upstream.
    
    The drm compat ioctl path takes a user controlled pointer, and then
    dereferences it into a table of function pointers, the signature method
    of spectre problems.  Fix this up by calling array_index_nospec() on the
    index to the function pointer list.
    
    Fixes: 505b5240329b ("drm/ioctl: Fix Spectre v1 vulnerabilities")
    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    Cc: Maxime Ripard <mripard@kernel.org>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: David Airlie <airlied@gmail.com>
    Cc: Simona Vetter <simona@ffwll.ch>
    Cc: stable <stable@kernel.org>
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
    Acked-by: Maxime Ripard <mripard@kernel.org>
    Reviewed-by: Simona Vetter <simona@ffwll.ch>
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/radeon: apply state adjust rules to some additional HAINAN vairants [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Sep 25 10:44:06 2023 -0400

    drm/radeon: apply state adjust rules to some additional HAINAN vairants
    
    commit 86650ee2241ff84207eaa298ab318533f3c21a38 upstream.
    
    They need a similar workaround.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 87327658c848f56eac166cb382b57b83bf06c5ac)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/tegra: dsi: fix device leak on probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Nov 21 17:42:01 2025 +0100

    drm/tegra: dsi: fix device leak on probe
    
    [ Upstream commit bfef062695570842cf96358f2f46f4c6642c6689 ]
    
    Make sure to drop the reference taken when looking up the companion
    (ganged) device and its driver data during probe().
    
    Note that holding a reference to a device does not prevent its driver
    data from going away so there is no point in keeping the reference.
    
    Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
    Fixes: 221e3638feb8 ("drm/tegra: Fix reference leak in tegra_dsi_ganged_probe")
    Cc: stable@vger.kernel.org      # 3.19: 221e3638feb8
    Cc: Thierry Reding <treding@nvidia.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Thierry Reding <treding@nvidia.com>
    Link: https://patch.msgid.link/20251121164201.13188-1-johan@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning [+ + +]
Author: Frank Li <Frank.Li@nxp.com>
Date:   Mon Mar 2 16:59:55 2026 -0500

    dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
    
    [ Upstream commit 398c0c8bbc8f5a9d2f43863275a427a9d3720b6f ]
    
    Change additionalProperties to unevaluatedProperties because it refs to
    /schemas/input/matrix-keymap.yaml.
    
    Fix below CHECK_DTBS warnings:
    arch/arm/boot/dts/nxp/imx/imx6dl-victgo.dtb: keypad@70 (holtek,ht16k33): 'keypad,num-columns', 'keypad,num-rows' do not match any of the regexes: '^pinctrl-[0-9]+$'
            from schema $id: http://devicetree.org/schemas/auxdisplay/holtek,ht16k33.yaml#
    
    Fixes: f12b457c6b25c ("dt-bindings: auxdisplay: ht16k33: Convert to json-schema")
    Acked-by: Rob Herring (Arm) <robh@kernel.org>
    Signed-off-by: Frank Li <Frank.Li@nxp.com>
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
e1000/e1000e: Fix leak in DMA error cleanup [+ + +]
Author: Matt Vollrath <tactii@gmail.com>
Date:   Tue Feb 24 18:28:33 2026 -0500

    e1000/e1000e: Fix leak in DMA error cleanup
    
    [ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ]
    
    If an error is encountered while mapping TX buffers, the driver should
    unmap any buffers already mapped for that skb.
    
    Because count is incremented after a successful mapping, it will always
    match the correct number of unmappings needed when dma_error is reached.
    Decrementing count before the while loop in dma_error causes an
    off-by-one error. If any mapping was successful before an unsuccessful
    mapping, exactly one DMA mapping would leak.
    
    In these commits, a faulty while condition caused an infinite loop in
    dma_error:
    Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e
    driver")
    Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")
    
    Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of
    unsigned in *_tx_map()") fixed the infinite loop, but introduced the
    off-by-one error.
    
    This issue may still exist in the igbvf driver, but I did not address it
    in this patch.
    
    Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
    Assisted-by: Claude:claude-4.6-opus
    Signed-off-by: Matt Vollrath <tactii@gmail.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
erofs: add GFP_NOIO in the bio completion if needed [+ + +]
Author: Jiucheng Xu <jiucheng.xu@amlogic.com>
Date:   Wed Mar 11 17:11:31 2026 +0800

    erofs: add GFP_NOIO in the bio completion if needed
    
    commit c23df30915f83e7257c8625b690a1cece94142a0 upstream.
    
    The bio completion path in the process context (e.g. dm-verity)
    will directly call into decompression rather than trigger another
    workqueue context for minimal scheduling latencies, which can
    then call vm_map_ram() with GFP_KERNEL.
    
    Due to insufficient memory, vm_map_ram() may generate memory
    swapping I/O, which can cause submit_bio_wait to deadlock
    in some scenarios.
    
    Trimmed down the call stack, as follows:
    
    f2fs_submit_read_io
      submit_bio                      //bio_list is initialized.
        mmc_blk_mq_recovery
          z_erofs_endio
            vm_map_ram
              __pte_alloc_kernel
                __alloc_pages_direct_reclaim
                  shrink_folio_list
                    __swap_writepage
                      submit_bio_wait  //bio_list is non-NULL, hang!!!
    
    Use memalloc_noio_{save,restore}() to wrap up this path.
    
    Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
    Reviewed-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
esp: fix skb leak with espintcp and async crypto [+ + +]
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Tue Feb 24 00:05:14 2026 +0100

    esp: fix skb leak with espintcp and async crypto
    
    [ Upstream commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 ]
    
    When the TX queue for espintcp is full, esp_output_tail_tcp will
    return an error and not free the skb, because with synchronous crypto,
    the common xfrm output code will drop the packet for us.
    
    With async crypto (esp_output_done), we need to drop the skb when
    esp_output_tail_tcp returns an error.
    
    Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
eventpoll: Fix integer overflow in ep_loop_check_proc() [+ + +]
Author: Jann Horn <jannh@google.com>
Date:   Mon Feb 23 20:59:33 2026 +0100

    eventpoll: Fix integer overflow in ep_loop_check_proc()
    
    commit fdcfce93073d990ed4b71752e31ad1c1d6e9d58b upstream.
    
    If a recursive call to ep_loop_check_proc() hits the `result = INT_MAX`,
    an integer overflow will occur in the calling ep_loop_check_proc() at
    `result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1)`,
    breaking the recursion depth check.
    
    Fix it by using a different placeholder value that can't lead to an
    overflow.
    
    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jann Horn <jannh@google.com>
    Link: https://patch.msgid.link/20260223-epoll-int-overflow-v1-1-452f35132224@google.com
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ext4: always allocate blocks only from groups inode can use [+ + +]
Author: Jan Kara <jack@suse.cz>
Date:   Wed Feb 25 15:09:09 2026 -0500

    ext4: always allocate blocks only from groups inode can use
    
    [ Upstream commit 4865c768b563deff1b6a6384e74a62f143427b42 ]
    
    For filesystems with more than 2^32 blocks inodes using indirect block
    based format cannot use blocks beyond the 32-bit limit.
    ext4_mb_scan_groups_linear() takes care to not select these unsupported
    groups for such inodes however other functions selecting groups for
    allocation don't. So far this is harmless because the other selection
    functions are used only with mb_optimize_scan and this is currently
    disabled for inodes with indirect blocks however in the following patch
    we want to enable mb_optimize_scan regardless of inode format.
    
    Reviewed-by: Baokun Li <libaokun1@huawei.com>
    Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Acked-by: Pedro Falcato <pfalcato@suse.de>
    Cc: stable@kernel.org
    Link: https://patch.msgid.link/20260114182836.14120-3-jack@suse.cz
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    [ Drop a few hunks not needed in older trees ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: always drain queued discard work in ext4_mb_release() [+ + +]
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Fri Mar 27 02:13:15 2026 -0400

    ext4: always drain queued discard work in ext4_mb_release()
    
    commit 9ee29d20aab228adfb02ca93f87fb53c56c2f3af upstream.
    
    While reviewing recent ext4 patch[1], Sashiko raised the following
    concern[2]:
    
    > If the filesystem is initially mounted with the discard option,
    > deleting files will populate sbi->s_discard_list and queue
    > s_discard_work. If it is then remounted with nodiscard, the
    > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is
    > neither cancelled nor flushed.
    
    [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/
    [2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev
    
    The concern was valid, but it had nothing to do with the patch[1].
    One of the problems with Sashiko in its current (early) form is that
    it will detect pre-existing issues and report it as a problem with the
    patch that it is reviewing.
    
    In practice, it would be hard to hit deliberately (unless you are a
    malicious syzkaller fuzzer), since it would involve mounting the file
    system with -o discard, and then deleting a large number of files,
    remounting the file system with -o nodiscard, and then immediately
    unmounting the file system before the queued discard work has a change
    to drain on its own.
    
    Fix it because it's a real bug, and to avoid Sashiko from raising this
    concern when analyzing future patches to mballoc.c.
    
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Fixes: 55cdd0af2bc5 ("ext4: get discard out of jbd2 commit kthread contex")
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() [+ + +]
Author: Ye Bin <yebin10@huawei.com>
Date:   Mon Mar 2 21:46:19 2026 +0800

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
    
    commit 46066e3a06647c5b186cc6334409722622d05c44 upstream.
    
    There's issue as follows:
    ...
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117
    EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
    
    EXT4-fs (mmcblk0p1): error count since last fsck: 1
    EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760
    EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
    ...
    
    According to the log analysis, blocks are always requested from the
    corrupted block group. This may happen as follows:
    ext4_mb_find_by_goal
      ext4_mb_load_buddy
       ext4_mb_load_buddy_gfp
         ext4_mb_init_cache
          ext4_read_block_bitmap_nowait
          ext4_wait_block_bitmap
           ext4_validate_block_bitmap
            if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
             return -EFSCORRUPTED; // There's no logs.
     if (err)
      return err;  // Will return error
    ext4_lock_group(ac->ac_sb, group);
      if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
       goto out;
    
    After commit 9008a58e5dce ("ext4: make the bitmap read routines return
    real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group
    as corrupt on block bitmap error") is no real solution for allocating
    blocks from corrupted block groups. This is because if
    'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then
    'ext4_mb_load_buddy()' may return an error. This means that the block
    allocation will fail.
    Therefore, check block group if corrupted when ext4_mb_load_buddy()
    returns error.
    
    Fixes: 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error")
    Fixes: 9008a58e5dce ("ext4: make the bitmap read routines return real error codes")
    Signed-off-by: Ye Bin <yebin10@huawei.com>
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Andreas Dilger <adilger@dilger.ca>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260302134619.3145520-1-yebin@huaweicloud.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: convert inline data to extents when truncate exceeds inline size [+ + +]
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date:   Sat Feb 7 10:06:07 2026 +0530

    ext4: convert inline data to extents when truncate exceeds inline size
    
    commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 upstream.
    
    Add a check in ext4_setattr() to convert files from inline data storage
    to extent-based storage when truncate() grows the file size beyond the
    inline capacity. This prevents the filesystem from entering an
    inconsistent state where the inline data flag is set but the file size
    exceeds what can be stored inline.
    
    Without this fix, the following sequence causes a kernel BUG_ON():
    
    1. Mount filesystem with inode that has inline flag set and small size
    2. truncate(file, 50MB) - grows size but inline flag remains set
    3. sendfile() attempts to write data
    4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
    
    The crash occurs because ext4_write_inline_data() expects inline storage
    to accommodate the write, but the actual inline capacity (~60 bytes for
    i_block + ~96 bytes for xattrs) is far smaller than the file size and
    write request.
    
    The fix checks if the new size from setattr exceeds the inode's actual
    inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to
    extent-based storage before proceeding with the size change.
    
    This addresses the root cause by ensuring the inline data flag and file
    size remain consistent during truncate operations.
    
    Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f
    Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
    Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
    Link: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O [+ + +]
Author: Zhang Yi <yi.zhang@huawei.com>
Date:   Tue Feb 24 22:06:46 2026 -0500

    ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
    
    [ Upstream commit feaf2a80e78f89ee8a3464126077ba8683b62791 ]
    
    When allocating blocks during within-EOF DIO and writeback with
    dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an
    existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was
    set when calling ext4_split_convert_extents(), which may potentially
    result in stale data issues.
    
    Assume we have an unwritten extent, and then DIO writes the second half.
    
       [UUUUUUUUUUUUUUUU] on-disk extent        U: unwritten extent
       [UUUUUUUUUUUUUUUU] extent status tree
                |<-   ->| ----> dio write this range
    
    First, ext4_iomap_alloc() call ext4_map_blocks() with
    EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and
    EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and
    call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the
    above flags set.
    
    Then, ext4_split_convert_extents() calls ext4_split_extent() with
    EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2
    flags set, and it calls ext4_split_extent_at() to split the second half
    with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT
    and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at()
    failed to insert extent since a temporary lack -ENOSPC. It zeroes out
    the first half but convert the entire on-disk extent to written since
    the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten
    in the extent status tree.
    
       [0000000000SSSSSS]  data                S: stale data, 0: zeroed
       [WWWWWWWWWWWWWWWW]  on-disk extent      W: written extent
       [WWWWWWWWWWUUUUUU]  extent status tree
    
    Finally, if the DIO failed to write data to the disk, the stale data in
    the second half will be exposed once the cached extent entry is gone.
    
    Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting
    an unwritten extent before submitting I/O, and make
    ext4_split_convert_extents() to zero out the entire extent range
    to zero for this case, and also mark the extent in the extent status
    tree for consistency.
    
    Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate")
    Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
    Reviewed-by: Baokun Li <libaokun1@huawei.com>
    Cc: stable@kernel.org
    Message-ID: <20251129103247.686136-4-yi.zhang@huaweicloud.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    [ different function signatures ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: drop extent cache when splitting extent fails [+ + +]
Author: Zhang Yi <yi.zhang@huawei.com>
Date:   Wed Feb 25 08:46:56 2026 -0500

    ext4: drop extent cache when splitting extent fails
    
    [ Upstream commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 ]
    
    When the split extent fails, we might leave some extents still being
    processed and return an error directly, which will result in stale
    extent entries remaining in the extent status tree. So drop all of the
    remaining potentially stale extents if the splitting fails.
    
    Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Baokun Li <libaokun1@huawei.com>
    Cc: stable@kernel.org
    Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
    Message-ID: <20251129103247.686136-8-yi.zhang@huaweicloud.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    [ bring error handling pattern closer to upstream ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix dirtyclusters double decrement on fs shutdown [+ + +]
Author: Brian Foster <bfoster@redhat.com>
Date:   Wed Feb 25 09:52:32 2026 -0500

    ext4: fix dirtyclusters double decrement on fs shutdown
    
    [ Upstream commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 ]
    
    fstests test generic/388 occasionally reproduces a warning in
    ext4_put_super() associated with the dirty clusters count:
    
      WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]
    
    Tracing the failure shows that the warning fires due to an
    s_dirtyclusters_counter value of -1. IOW, this appears to be a
    spurious decrement as opposed to some sort of leak. Further tracing
    of the dirty cluster count deltas and an LLM scan of the resulting
    output identified the cause as a double decrement in the error path
    between ext4_mb_mark_diskspace_used() and the caller
    ext4_mb_new_blocks().
    
    First, note that generic/388 is a shutdown vs. fsstress test and so
    produces a random set of operations and shutdown injections. In the
    problematic case, the shutdown triggers an error return from the
    ext4_handle_dirty_metadata() call(s) made from
    ext4_mb_mark_context(). The changed value is non-zero at this point,
    so ext4_mb_mark_diskspace_used() does not exit after the error
    bubbles up from ext4_mb_mark_context(). Instead, the former
    decrements both cluster counters and returns the error up to
    ext4_mb_new_blocks(). The latter falls into the !ar->len out path
    which decrements the dirty clusters counter a second time, creating
    the inconsistency.
    
    To avoid this problem and simplify ownership of the cluster
    reservation in this codepath, lift the counter reduction to a single
    place in the caller. This makes it more clear that
    ext4_mb_new_blocks() is responsible for acquiring cluster
    reservation (via ext4_claim_free_clusters()) in the !delalloc case
    as well as releasing it, regardless of whether it ends up consumed
    or returned due to failure.
    
    Fixes: 0087d9fb3f29 ("ext4: Fix s_dirty_blocks_counter if block allocation failed with nodelalloc")
    Signed-off-by: Brian Foster <bfoster@redhat.com>
    Reviewed-by: Baokun Li <libaokun1@huawei.com>
    Link: https://patch.msgid.link/20260113171905.118284-1-bfoster@redhat.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    [ Drop mballoc-test changes ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths [+ + +]
Author: Baokun Li <libaokun@linux.alibaba.com>
Date:   Mon Mar 23 14:08:36 2026 +0800

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
    
    commit ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 upstream.
    
    During code review, Joseph found that ext4_fc_replay_inode() calls
    ext4_get_fc_inode_loc() to get the inode location, which holds a
    reference to iloc.bh that must be released via brelse().
    
    However, several error paths jump to the 'out' label without
    releasing iloc.bh:
    
     - ext4_handle_dirty_metadata() failure
     - sync_dirty_buffer() failure
     - ext4_mark_inode_used() failure
     - ext4_iget() failure
    
    Fix this by introducing an 'out_brelse' label placed just before
    the existing 'out' label to ensure iloc.bh is always released.
    
    Additionally, make ext4_fc_replay_inode() propagate errors
    properly instead of always returning 0.
    
    Reported-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
    Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
    Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260323060836.3452660-1-libaokun@linux.alibaba.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix the might_sleep() warnings in kvfree() [+ + +]
Author: Zqiang <qiang.zhang@linux.dev>
Date:   Thu Apr 2 13:14:20 2026 -0400

    ext4: fix the might_sleep() warnings in kvfree()
    
    [ Upstream commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa ]
    
    Use the kvfree() in the RCU read critical section can trigger
    the following warnings:
    
    EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.
    
    WARNING: suspicious RCU usage
    
    ./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    
    Call Trace:
     <TASK>
     dump_stack_lvl+0xbb/0xd0
     dump_stack+0x14/0x20
     lockdep_rcu_suspicious+0x15a/0x1b0
     __might_resched+0x375/0x4d0
     ? put_object.part.0+0x2c/0x50
     __might_sleep+0x108/0x160
     vfree+0x58/0x910
     ? ext4_group_desc_free+0x27/0x270
     kvfree+0x23/0x40
     ext4_group_desc_free+0x111/0x270
     ext4_put_super+0x3c8/0xd40
     generic_shutdown_super+0x14c/0x4a0
     ? __pfx_shrinker_free+0x10/0x10
     kill_block_super+0x40/0x90
     ext4_kill_sb+0x6d/0xb0
     deactivate_locked_super+0xb4/0x180
     deactivate_super+0x7e/0xa0
     cleanup_mnt+0x296/0x3e0
     __cleanup_mnt+0x16/0x20
     task_work_run+0x157/0x250
     ? __pfx_task_work_run+0x10/0x10
     ? exit_to_user_mode_loop+0x6a/0x550
     exit_to_user_mode_loop+0x102/0x550
     do_syscall_64+0x44a/0x500
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
     </TASK>
    
    BUG: sleeping function called from invalid context at mm/vmalloc.c:3441
    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount
    preempt_count: 1, expected: 0
    CPU: 3 UID: 0 PID: 556 Comm: umount
    Call Trace:
     <TASK>
     dump_stack_lvl+0xbb/0xd0
     dump_stack+0x14/0x20
     __might_resched+0x275/0x4d0
     ? put_object.part.0+0x2c/0x50
     __might_sleep+0x108/0x160
     vfree+0x58/0x910
     ? ext4_group_desc_free+0x27/0x270
     kvfree+0x23/0x40
     ext4_group_desc_free+0x111/0x270
     ext4_put_super+0x3c8/0xd40
     generic_shutdown_super+0x14c/0x4a0
     ? __pfx_shrinker_free+0x10/0x10
     kill_block_super+0x40/0x90
     ext4_kill_sb+0x6d/0xb0
     deactivate_locked_super+0xb4/0x180
     deactivate_super+0x7e/0xa0
     cleanup_mnt+0x296/0x3e0
     __cleanup_mnt+0x16/0x20
     task_work_run+0x157/0x250
     ? __pfx_task_work_run+0x10/0x10
     ? exit_to_user_mode_loop+0x6a/0x550
     exit_to_user_mode_loop+0x102/0x550
     do_syscall_64+0x44a/0x500
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    The above scenarios occur in initialization failures and teardown
    paths, there are no parallel operations on the resources released
    by kvfree(), this commit therefore remove rcu_read_lock/unlock() and
    use rcu_access_pointer() instead of rcu_dereference() operations.
    
    Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access")
    Fixes: df3da4ea5a0f ("ext4: fix potential race between s_group_info online resizing and access")
    Signed-off-by: Zqiang <qiang.zhang@linux.dev>
    Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
    Link: https://patch.msgid.link/20260319094545.19291-1-qiang.zhang@linux.dev
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    [ adapted fix to inlined teardown code ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix use-after-free in update_super_work when racing with umount [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Thu Apr 2 12:37:40 2026 -0400

    ext4: fix use-after-free in update_super_work when racing with umount
    
    [ Upstream commit d15e4b0a418537aafa56b2cb80d44add83e83697 ]
    
    Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount
    filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work
    to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups
    reads during unmount. However, this introduced a use-after-free because
    update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which
    accesses the kobject's kernfs_node after it has been freed by kobject_del()
    in ext4_unregister_sysfs():
    
      update_super_work                ext4_put_super
      -----------------                --------------
                                       ext4_unregister_sysfs(sb)
                                         kobject_del(&sbi->s_kobj)
                                           __kobject_del()
                                             sysfs_remove_dir()
                                               kobj->sd = NULL
                                             sysfs_put(sd)
                                               kernfs_put()  // RCU free
      ext4_notify_error_sysfs(sbi)
        sysfs_notify(&sbi->s_kobj)
          kn = kobj->sd              // stale pointer
          kernfs_get(kn)             // UAF on freed kernfs_node
                                       ext4_journal_destroy()
                                         flush_work(&sbi->s_sb_upd_work)
    
    Instead of reordering the teardown sequence, fix this by making
    ext4_notify_error_sysfs() detect that sysfs has already been torn down
    by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call
    in that case. A dedicated mutex (s_error_notify_mutex) serializes
    ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()
    to prevent TOCTOU races where the kobject could be deleted between the
    state_in_sysfs check and the sysfs_notify() call.
    
    Fixes: b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem")
    Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
    Suggested-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260319120336.157873-1-jiayuan.chen@linux.dev
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    [ adapted mutex_init placement ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: make recently_deleted() properly work with lazy itable initialization [+ + +]
Author: Jan Kara <jack@suse.cz>
Date:   Mon Feb 16 17:48:43 2026 +0100

    ext4: make recently_deleted() properly work with lazy itable initialization
    
    commit bd060afa7cc3e0ad30afa9ecc544a78638498555 upstream.
    
    recently_deleted() checks whether inode has been used in the near past.
    However this can give false positive result when inode table is not
    initialized yet and we are in fact comparing to random garbage (or stale
    itable block of a filesystem before mkfs). Ultimately this results in
    uninitialized inodes being skipped during inode allocation and possibly
    they are never initialized and thus e2fsck complains.  Verify if the
    inode has been initialized before checking for dtime.
    
    Signed-off-by: Jan Kara <jack@suse.cz>
    Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
    Link: https://patch.msgid.link/20260216164848.3074-3-jack@suse.cz
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: publish jinode after initialization [+ + +]
Author: Li Chen <me@linux.beauty>
Date:   Thu Apr 2 20:36:15 2026 -0400

    ext4: publish jinode after initialization
    
    [ Upstream commit 1aec30021edd410b986c156f195f3d23959a9d11 ]
    
    ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
    It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
    allowing a reader to observe a non-NULL jinode with i_vfs_inode
    still unset.
    
    The fast commit flush path can then pass this jinode to
    jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
    may crash.
    
    Below is the crash I observe:
    ```
    BUG: unable to handle page fault for address: 000000010beb47f4
    PGD 110e51067 P4D 110e51067 PUD 0
    Oops: Oops: 0000 [#1] SMP NOPTI
    CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
    RIP: 0010:xas_find_marked+0x3d/0x2e0
    Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
    RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
    RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
    RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
    RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
    R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
    R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
    FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
    PKRU: 55555554
    Call Trace:
    <TASK>
    filemap_get_folios_tag+0x87/0x2a0
    __filemap_fdatawait_range+0x5f/0xd0
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? __schedule+0x3e7/0x10c0
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? preempt_count_sub+0x5f/0x80
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? cap_safe_nice+0x37/0x70
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? preempt_count_sub+0x5f/0x80
    ? srso_alias_return_thunk+0x5/0xfbef5
    filemap_fdatawait_range_keep_errors+0x12/0x40
    ext4_fc_commit+0x697/0x8b0
    ? ext4_file_write_iter+0x64b/0x950
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? preempt_count_sub+0x5f/0x80
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? vfs_write+0x356/0x480
    ? srso_alias_return_thunk+0x5/0xfbef5
    ? preempt_count_sub+0x5f/0x80
    ext4_sync_file+0xf7/0x370
    do_fsync+0x3b/0x80
    ? syscall_trace_enter+0x108/0x1d0
    __x64_sys_fdatasync+0x16/0x20
    do_syscall_64+0x62/0x2c0
    entry_SYSCALL_64_after_hwframe+0x76/0x7e
    ...
    ```
    
    Fix this by initializing the jbd2_inode first.
    Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after
    initialization. Readers use READ_ONCE() to fetch the pointer.
    
    Fixes: a361293f5fede ("jbd2: Fix oops in jbd2_journal_file_inode()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Li Chen <me@linux.beauty>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260225082617.147957-1-me@linux.beauty
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    [ adapted READ_ONCE(jinode) wrapping to split ext4_fc_submit_inode_data_all() and ext4_fc_wait_inode_data_all() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: reject mount if bigalloc with s_first_data_block != 0 [+ + +]
Author: Helen Koike <koike@igalia.com>
Date:   Tue Mar 17 11:23:10 2026 -0300

    ext4: reject mount if bigalloc with s_first_data_block != 0
    
    commit 3822743dc20386d9897e999dbb990befa3a5b3f8 upstream.
    
    bigalloc with s_first_data_block != 0 is not supported, reject mounting
    it.
    
    Signed-off-by: Helen Koike <koike@igalia.com>
    Suggested-by: Theodore Ts'o <tytso@mit.edu>
    Reported-by: syzbot+b73703b873a33d8eb8f6@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=b73703b873a33d8eb8f6
    Link: https://patch.msgid.link/20260317142325.135074-1-koike@igalia.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fbcon: check return value of con2fb_acquire_newinfo() [+ + +]
Author: Andrey Vatoropin <a.vatoropin@crpt.ru>
Date:   Wed Dec 17 09:11:05 2025 +0000

    fbcon: check return value of con2fb_acquire_newinfo()
    
    [ Upstream commit 011a0502801c8536f64141a2b61362c14f456544 ]
    
    If fbcon_open() fails when called from con2fb_acquire_newinfo() then
    info->fbcon_par pointer remains NULL which is later dereferenced.
    
    Add check for return value of the function con2fb_acquire_newinfo() to
    avoid it.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes")
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

fbcon: Extract fbcon_open/release helpers [+ + +]
Author: Simona Vetter <simona.vetter@ffwll.ch>
Date:   Tue Apr 5 23:03:27 2022 +0200

    fbcon: Extract fbcon_open/release helpers
    
    [ Upstream commit bd6026a8c4e6b7edf4bafcb71da885b284b8f4fd ]
    
    There's two minor behaviour changes in here:
    - in error paths we now consistently call fb_ops->fb_release
    - fb_release really can't fail (fbmem.c ignores it too) and there's no
      reasonable cleanup we can do anyway.
    
    Note that everything in fbcon.c is protected by the big console_lock()
    lock (especially all the global variables), so the minor changes in
    ordering of setup/cleanup do not matter.
    
    v2: Explain a bit better why this is all correct (Sam)
    
    Acked-by: Sam Ravnborg <sam@ravnborg.org>
    Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Claudio Suarez <cssk@net-c.es>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: Du Cheng <ducheng2@gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-10-daniel.vetter@ffwll.ch
    Stable-dep-of: 011a0502801c ("fbcon: check return value of con2fb_acquire_newinfo()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

fbcon: move more common code into fb_open() [+ + +]
Author: Simona Vetter <simona.vetter@ffwll.ch>
Date:   Tue Apr 5 23:03:29 2022 +0200

    fbcon: move more common code into fb_open()
    
    [ Upstream commit d443d93864726ad68c0a741d1e7b03934a9af143 ]
    
    No idea why con2fb_acquire_newinfo() initializes much less than
    fbcon_startup(), but so be it. From a quick look most of the
    un-initialized stuff should be fairly harmless, but who knows.
    
    Note that the error handling for the con2fb_acquire_newinfo() failure
    case was very strange: Callers updated con2fb_map to the new value
    before calling this function, but upon error con2fb_acquire_newinfo
    reset it to the old value. Since I removed the call to fbcon_release
    anyway that strange error path was sticking out like a sore thumb,
    hence I removed it. Which also allows us to remove the oldidx
    parameter from that function.
    
    v2: Explain what's going on with oldidx and error paths (Sam)
    
    v3: Drop unused variable (0day)
    
    v4: Rebased over bisect fix in previous patch, unchagend end result.
    
    Acked-by: Sam Ravnborg <sam@ravnborg.org> (v2)
    Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: kernel test robot <lkp@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: Claudio Suarez <cssk@net-c.es>
    Cc: Du Cheng <ducheng2@gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-12-daniel.vetter@ffwll.ch
    Stable-dep-of: 011a0502801c ("fbcon: check return value of con2fb_acquire_newinfo()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

fbcon: Set fb_display[i]->mode to NULL when the mode is released [+ + +]
Author: Quanmin Yan <yanquanmin1@huawei.com>
Date:   Tue Mar 31 11:01:48 2026 +0800

    fbcon: Set fb_display[i]->mode to NULL when the mode is released
    
    [ Upstream commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 ]
    
    Recently, we discovered the following issue through syzkaller:
    
    BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
    Read of size 4 at addr ff11000001b3c69c by task syz.xxx
    ...
    Call Trace:
     <TASK>
     dump_stack_lvl+0xab/0xe0
     print_address_description.constprop.0+0x2c/0x390
     print_report+0xb9/0x280
     kasan_report+0xb8/0xf0
     fb_mode_is_equal+0x285/0x2f0
     fbcon_mode_deleted+0x129/0x180
     fb_set_var+0xe7f/0x11d0
     do_fb_ioctl+0x6a0/0x750
     fb_ioctl+0xe0/0x140
     __x64_sys_ioctl+0x193/0x210
     do_syscall_64+0x5f/0x9c0
     entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    Based on experimentation and analysis, during framebuffer unregistration,
    only the memory of fb_info->modelist is freed, without setting the
    corresponding fb_display[i]->mode to NULL for the freed modes. This leads
    to UAF issues during subsequent accesses. Here's an example of reproduction
    steps:
    1. With /dev/fb0 already registered in the system, load a kernel module
       to register a new device /dev/fb1;
    2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
    3. Switch console from fb to VGA (to allow normal rmmod of the ko);
    4. Unload the kernel module, at this point fb1's modelist is freed, leaving
       a wild pointer in fb_display[];
    5. Trigger the bug via system calls through fb0 attempting to delete a mode
       from fb0.
    
    Add a check in do_unregister_framebuffer(): if the mode to be freed exists
    in fb_display[], set the corresponding mode pointer to NULL.
    
    [ The context change is due to the commit 2c0c19b681d5
    ("fbdev: fbmem: Fix double free of 'fb_info->pixmap.addr'") in v5.16
    which is irrelevant to the logic of this patch. ]
    
    Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
    Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Cc: stable@vger.kernel.org
    Signed-off-by: Johnny Hao <johnny_haocn@sina.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

fbcon: Use delayed work for cursor [+ + +]
Author: Simona Vetter <simona.vetter@ffwll.ch>
Date:   Tue Apr 5 23:03:24 2022 +0200

    fbcon: Use delayed work for cursor
    
    [ Upstream commit 3b0fb6ab25dda03f6077bf8fce9407bb0d4db6ea ]
    
    Allows us to delete a bunch of hand-rolled stuff using a timer plus a
    separate work). Also to simplify the code we initialize the
    cursor_work completely when we allocate the fbcon_ops structure,
    instead of trying to cope with console re-initialization.
    
    The motiviation here is that fbcon code stops using the fb_info.queue,
    which helps with locking issues around cleanup and all that in a later
    patch.
    
    Also note that this allows us to ditch the hand-rolled work cleanup in
    fbcon_exit - we already call fbcon_del_cursor_timer, which takes care
    of everything. Plus this was racy anyway.
    
    v2:
    - Only INIT_DELAYED_WORK when kzalloc succeeded (Tetsuo)
    - Explain that we replace both the timer and a work with the combined
      delayed_work (Javier)
    
    Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
    Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
    Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Claudio Suarez <cssk@net-c.es>
    Cc: Du Cheng <ducheng2@gmail.com>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-7-daniel.vetter@ffwll.ch
    Stable-dep-of: 011a0502801c ("fbcon: check return value of con2fb_acquire_newinfo()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
firmware: arm_scpi: Fix device_node reference leak in probe path [+ + +]
Author: Felix Gu <ustc.gu@gmail.com>
Date:   Wed Jan 21 21:08:19 2026 +0800

    firmware: arm_scpi: Fix device_node reference leak in probe path
    
    [ Upstream commit 879c001afbac3df94160334fe5117c0c83b2cf48 ]
    
    A device_node reference obtained from the device tree is not released
    on all error paths in the arm_scpi probe path. Specifically, a node
    returned by of_parse_phandle() could be leaked when the probe failed
    after the node was acquired. The probe function returns early and
    the shmem reference is not released.
    
    Use __free(device_node) scope-based cleanup to automatically release
    the reference when the variable goes out of scope.
    
    Fixes: ed7ecb883901 ("firmware: arm_scpi: Add compatibility checks for shmem node")
    Signed-off-by: Felix Gu <ustc.gu@gmail.com>
    Message-Id: <20260121-arm_scpi_2-v2-1-702d7fa84acb@gmail.com>
    Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
futex: Clear stale exiting pointer in futex_lock_pi() retry path [+ + +]
Author: Davidlohr Bueso <dave@stgolabs.net>
Date:   Wed Mar 25 17:17:59 2026 -0700

    futex: Clear stale exiting pointer in futex_lock_pi() retry path
    
    commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream.
    
    Fuzzying/stressing futexes triggered:
    
        WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
    
    When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
    and stores a refcounted task pointer in 'exiting'.
    
    After wait_for_owner_exiting() consumes that reference, the local pointer
    is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
    different error, the bogus pointer is passed to wait_for_owner_exiting().
    
      CPU0                       CPU1                      CPU2
      futex_lock_pi(uaddr)
      // acquires the PI futex
      exit()
        futex_cleanup_begin()
          futex_state = EXITING;
                                 futex_lock_pi(uaddr)
                                   futex_lock_pi_atomic()
                                     attach_to_pi_owner()
                                       // observes EXITING
                                       *exiting = owner;  // takes ref
                                       return -EBUSY
                                   wait_for_owner_exiting(-EBUSY, owner)
                                     put_task_struct();   // drops ref
                                   // exiting still points to owner
                                   goto retry;
                                   futex_lock_pi_atomic()
                                     lock_pi_update_atomic()
                                       cmpxchg(uaddr)
                                            *uaddr ^= WAITERS // whatever
                                       // value changed
                                     return -EAGAIN;
                                   wait_for_owner_exiting(-EAGAIN, exiting) // stale
                                     WARN_ON_ONCE(exiting)
    
    Fix this by resetting upon retry, essentially aligning it with requeue_pi.
    
    Fixes: 3ef240eaff36 ("futex: Prevent exit livelock")
    Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
    Signed-off-by: Thomas Gleixner <tglx@kernel.org>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
gpiolib: cdev: fix uninitialised kfifo [+ + +]
Author: Kent Gibson <warthog618@gmail.com>
Date:   Thu Apr 9 15:22:14 2026 +0800

    gpiolib: cdev: fix uninitialised kfifo
    
    [ Upstream commit ee0166b637a5e376118e9659e5b4148080f1d27e ]
    
    If a line is requested with debounce, and that results in debouncing
    in software, and the line is subsequently reconfigured to enable edge
    detection then the allocation of the kfifo to contain edge events is
    overlooked.  This results in events being written to and read from an
    uninitialised kfifo.  Read events are returned to userspace.
    
    Initialise the kfifo in the case where the software debounce is
    already active.
    
    Fixes: 65cff7046406 ("gpiolib: cdev: support setting debounce")
    Signed-off-by: Kent Gibson <warthog618@gmail.com>
    Link: https://lore.kernel.org/r/20240510065342.36191-1-warthog618@gmail.com
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Robert Garcia <rob_garcia@163.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Feb 19 15:33:54 2026 +0100

    HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
    
    commit ecfa6f34492c493a9a1dc2900f3edeb01c79946b upstream.
    
    In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at
    raw event handle"), we handle the fact that raw event callbacks
    can happen even for a HID device that has not been "claimed" causing a
    crash if a broken device were attempted to be connected to the system.
    
    Fix up the remaining in-tree HID drivers that forgot to add this same
    check to resolve the same issue.
    
    Cc: Jiri Kosina <jikos@kernel.org>
    Cc: Benjamin Tissoires <bentiss@kernel.org>
    Cc: Bastien Nocera <hadess@hadess.net>
    Cc: linux-input@vger.kernel.org
    Cc: stable <stable@kernel.org>
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

HID: asus: avoid memory leak in asus_report_fixup() [+ + +]
Author: Günther Noack <gnoack@google.com>
Date:   Thu Feb 19 16:43:38 2026 +0100

    HID: asus: avoid memory leak in asus_report_fixup()
    
    [ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]
    
    The asus_report_fixup() function was returning a newly allocated
    kmemdup()-allocated buffer, but never freeing it.  Switch to
    devm_kzalloc() to ensure the memory is managed and freed automatically
    when the device is removed.
    
    The caller of report_fixup() does not take ownership of the returned
    pointer, but it is permitted to return a pointer whose lifetime is at
    least that of the input buffer.
    
    Also fix a harmless out-of-bounds read by copying only the original
    descriptor size.
    
    Assisted-by: Gemini-CLI:Google Gemini 3
    Signed-off-by: Günther Noack <gnoack@google.com>
    Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

HID: magicmouse: avoid memory leak in magicmouse_report_fixup() [+ + +]
Author: Günther Noack <gnoack@google.com>
Date:   Thu Feb 19 16:43:37 2026 +0100

    HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
    
    [ Upstream commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c ]
    
    The magicmouse_report_fixup() function was returning a
    newly kmemdup()-allocated buffer, but never freeing it.
    
    The caller of report_fixup() does not take ownership of the returned
    pointer, but it *is* permitted to return a sub-portion of the input
    rdesc, whose lifetime is managed by the caller.
    
    Assisted-by: Gemini-CLI:Google Gemini 3
    Signed-off-by: Günther Noack <gnoack@google.com>
    Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 [+ + +]
Author: Julius Lehmann <lehmanju@devpi.de>
Date:   Sat Feb 14 20:34:21 2026 +0100

    HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
    
    [ Upstream commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b ]
    
    Battery reporting does not work for the Apple Magic Trackpad 2 if it is
    connected via USB. The current hid descriptor fixup code checks for a
    hid descriptor length of exactly 83 bytes. If the hid descriptor is
    larger, which is the case for newer apple mice, the fixup is not
    applied.
    
    This fix checks for hid descriptor sizes greater/equal 83 bytes which
    applies the fixup for newer devices as well.
    
    Signed-off-by: Julius Lehmann <lehmanju@devpi.de>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

HID: mcp2221: cancel last I2C command on read error [+ + +]
Author: Romain Sioen <romain.sioen@microchip.com>
Date:   Fri Feb 6 17:32:58 2026 +0100

    HID: mcp2221: cancel last I2C command on read error
    
    [ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]
    
    When an I2C SMBus read operation fails, the MCP2221 internal state machine
    may not reset correctly, causing subsequent transactions to fail.
    
    By adding a short delay and explicitly cancelling the last command,
    we ensure the device is ready for the next operation.
    
    Fix an issue where i2cdetect was not able to detect all devices correctly
    on the bus.
    
    Signed-off-by: Romain Sioen <romain.sioen@microchip.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

HID: multitouch: Check to ensure report responses match the request [+ + +]
Author: Lee Jones <lee@kernel.org>
Date:   Fri Feb 27 16:30:25 2026 +0000

    HID: multitouch: Check to ensure report responses match the request
    
    [ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]
    
    It is possible for a malicious (or clumsy) device to respond to a
    specific report's feature request using a completely different report
    ID.  This can cause confusion in the HID core resulting in nasty
    side-effects such as OOB writes.
    
    Add a check to ensure that the report ID in the response, matches the
    one that was requested.  If it doesn't, omit reporting the raw event and
    return early.
    
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq [+ + +]
Author: Benoît Sevens <bsevens@google.com>
Date:   Tue Mar 3 13:58:28 2026 +0000

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
    
    [ Upstream commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 ]
    
    The wacom_intuos_bt_irq() function processes Bluetooth HID reports
    without sufficient bounds checking. A maliciously crafted short report
    can trigger an out-of-bounds read when copying data into the wacom
    structure.
    
    Specifically, report 0x03 requires at least 22 bytes to safely read
    the processed data and battery status, while report 0x04 (which
    falls through to 0x03) requires 32 bytes.
    
    Add explicit length checks for these report IDs and log a warning if
    a short report is received.
    
    Signed-off-by: Benoît Sevens <bsevens@google.com>
    Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
hwmon: (adm1177) fix sysfs ABI violation and current unit conversion [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Wed Mar 25 05:13:06 2026 +0000

    hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
    
    [ Upstream commit bf08749a6abb6d1959bfdc0edc32c640df407558 ]
    
    The adm1177 driver exposes the current alert threshold through
    hwmon_curr_max_alarm. This violates the hwmon sysfs ABI, where
    *_alarm attributes are read-only status flags and writable thresholds
    must use currN_max.
    
    The driver also stores the threshold internally in microamps, while
    currN_max is defined in milliamps. Convert the threshold accordingly
    on both the read and write paths.
    
    Widen the cached threshold and related calculations to 64 bits so
    that small shunt resistor values do not cause truncation or overflow.
    Also use 64-bit arithmetic for the mA/uA conversions, clamp writes
    to the range the hardware can represent, and propagate failures from
    adm1177_write_alert_thr() instead of silently ignoring them.
    
    Update the hwmon documentation to reflect the attribute rename and
    the correct units returned by the driver.
    
    Fixes: 09b08ac9e8d5 ("hwmon: (adm1177) Add ADM1177 Hot Swap Controller and Digital Power Monitor driver")
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Acked-by: Nuno Sá <nuno.sa@analog.com>
    Link: https://lore.kernel.org/r/20260325051246.28262-1-sanman.pradhan@hpe.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race [+ + +]
Author: Gui-Dong Han <hanguidong02@gmail.com>
Date:   Tue Feb 3 20:14:43 2026 +0800

    hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
    
    [ Upstream commit 007be4327e443d79c9dd9e56dc16c36f6395d208 ]
    
    Simply copying shared data to a local variable cannot prevent data
    races. The compiler is allowed to optimize away the local copy and
    re-read the shared memory, causing a Time-of-Check Time-of-Use (TOCTOU)
    issue if the data changes between the check and the usage.
    
    To enforce the use of the local variable, use READ_ONCE() when reading
    the shared data and WRITE_ONCE() when updating it. Apply these macros to
    the three identified locations (curr_sense, adc, and fault) where local
    variables are used for error validation, ensuring the value remains
    consistent.
    
    Reported-by: Ben Hutchings <ben@decadent.org.uk>
    Closes: https://lore.kernel.org/all/6fe17868327207e8b850cf9f88b7dc58b2021f73.camel@decadent.org.uk/
    Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles")
    Fixes: b8d5acdcf525 ("hwmon: (max16065) Use local variable to avoid TOCTOU")
    Cc: stable@vger.kernel.org
    Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
    Link: https://lore.kernel.org/r/20260203121443.5482-1-hanguidong02@gmail.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

hwmon: (occ) Fix division by zero in occ_show_power_1() [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Thu Mar 26 22:45:23 2026 +0000

    hwmon: (occ) Fix division by zero in occ_show_power_1()
    
    commit 39e2a5bf970402a8530a319cf06122e216ba57b8 upstream.
    
    In occ_show_power_1() case 1, the accumulator is divided by
    update_tag without checking for zero. If no samples have been
    collected yet (e.g. during early boot when the sensor block is
    included but hasn't been updated), update_tag is zero, causing
    a kernel divide-by-zero crash.
    
    The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by
    zero issue") only addressed occ_get_powr_avg() used by
    occ_show_power_2() and occ_show_power_a0(). This separate code
    path in occ_show_power_1() was missed.
    
    Fix this by reusing the existing occ_get_powr_avg() helper, which
    already handles the zero-sample case and uses mul_u64_u32_div()
    to multiply before dividing for better precision. Move the helper
    above occ_show_power_1() so it is visible at the call site.
    
    Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260326224510.294619-2-sanman.pradhan@hpe.com
    [groeck: Fix alignment problems reported by checkpatch]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

hwmon: (occ) Fix missing newline in occ_show_extended() [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Thu Mar 26 22:45:29 2026 +0000

    hwmon: (occ) Fix missing newline in occ_show_extended()
    
    [ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
    
    In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
    is set, the sysfs_emit format string "%u" is missing the trailing
    newline that the sysfs ABI expects. The else branch correctly uses
    "%4phN\n", and all other show functions in this file include the
    trailing newline.
    
    Add the missing "\n" for consistency and correct sysfs output.
    
    Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Wed Mar 18 19:40:19 2026 +0000

    hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
    
    commit 86259558e422b250aa6aa57163a6d759074573f5 upstream.
    
    isl68137_avs_enable_show_page() uses the return value of
    pmbus_read_byte_data() without checking for errors. If the I2C transaction
    fails, a negative error code is passed through bitwise operations,
    producing incorrect output.
    
    Add an error check to propagate the return value if it is negative.
    Additionally, modernize the callback by replacing sprintf()
    with sysfs_emit().
    
    Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260318193952.47908-2-sanman.pradhan@hpe.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Wed Mar 4 15:51:17 2026 -0800

    hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
    
    commit 25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43 upstream.
    
    The q54sj108a2_debugfs_read function suffers from a stack buffer overflow
    due to incorrect arguments passed to bin2hex(). The function currently
    passes 'data' as the destination and 'data_char' as the source.
    
    Because bin2hex() converts each input byte into two hex characters, a
    32-byte block read results in 64 bytes of output. Since 'data' is only
    34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end
    of the buffer onto the stack.
    
    Additionally, the arguments were swapped: it was reading from the
    zero-initialized 'data_char' and writing to 'data', resulting in
    all-zero output regardless of the actual I2C read.
    
    Fix this by:
    1. Expanding 'data_char' to 66 bytes to safely hold the hex output.
    2. Correcting the bin2hex() argument order and using the actual read count.
    3. Using a pointer to select the correct output buffer for the final
       simple_read_from_buffer call.
    
    Fixes: d014538aa385 ("hwmon: (pmbus) Driver for Delta power supplies Q54SJ108A2")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260304235116.1045-1-sanman.p211993@gmail.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

hwmon: (pxe1610) Check return value of page-select write in probe [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Sun Mar 29 17:09:48 2026 +0000

    hwmon: (pxe1610) Check return value of page-select write in probe
    
    [ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
    
    pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
    the return value. If the write fails, subsequent register reads operate
    on an indeterminate page, leading to silent misconfiguration.
    
    Check the return value and propagate the error using dev_err_probe(),
    which also handles -EPROBE_DEFER correctly without log spam.
    
    Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
    [groeck: Fix "Fixes" SHA]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() [+ + +]
Author: Sanman Pradhan <psanman@juniper.net>
Date:   Mon Mar 30 15:56:40 2026 +0000

    hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
    
    [ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
    
    tps53676_identify() uses strncmp() to compare the device ID buffer
    against a byte sequence containing embedded non-printable bytes
    (\x53\x67\x60). strncmp() is semantically wrong for binary data
    comparison; use memcmp() instead.
    
    Additionally, the buffer from i2c_smbus_read_block_data() is not
    NUL-terminated, so printing it with "%s" in the error path is
    undefined behavior and may read past the buffer. Use "%*ph" to
    hex-dump the actual bytes returned.
    
    Per the datasheet, the expected device ID is the 6-byte sequence
    54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
    including the trailing NUL.
    
    Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
    Signed-off-by: Sanman Pradhan <psanman@juniper.net>
    Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
i2c: cp2615: fix serial string NULL-deref at probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Mar 23 09:19:10 2026 -0400

    i2c: cp2615: fix serial string NULL-deref at probe
    
    [ Upstream commit aa79f996eb41e95aed85a1bd7f56bcd6a3842008 ]
    
    The cp2615 driver uses the USB device serial string as the i2c adapter
    name but does not make sure that the string exists.
    
    Verify that the device has a serial number before accessing it to avoid
    triggering a NULL-pointer dereference (e.g. with malicious devices).
    
    Fixes: 4a7695429ead ("i2c: cp2615: add i2c driver for Silicon Labs' CP2615 Digital Audio Bridge")
    Cc: stable@vger.kernel.org      # 5.13
    Cc: Bence Csókás <bence98@sch.bme.hu>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: Bence Csókás <bence98@sch.bme.hu>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Link: https://lore.kernel.org/r/20260309075016.25612-1-johan@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i2c: cp2615: replace deprecated strncpy with strscpy [+ + +]
Author: Justin Stitt <justinstitt@google.com>
Date:   Mon Mar 23 09:19:09 2026 -0400

    i2c: cp2615: replace deprecated strncpy with strscpy
    
    [ Upstream commit e2def33f9ee1b1a8cda4ec5cde69840b5708f068 ]
    
    `strncpy` is deprecated for use on NUL-terminated destination strings [1].
    
    We should prefer more robust and less ambiguous string interfaces.
    
    We expect name to be NUL-terminated based on its numerous uses with
    functions that expect NUL-terminated strings.
    
    For example in i2c-core-base.c +1533:
    | dev_dbg(&adap->dev, "adapter [%s] registered\n", adap->name);
    
    NUL-padding is not required as `adap` is already zero-alloacted with:
    | adap = devm_kzalloc(&usbif->dev, sizeof(struct i2c_adapter), GFP_KERNEL);
    
    With the above in mind, a suitable replacement is `strscpy` [2] due to
    the fact that it guarantees NUL-termination on the destination buffer
    without unnecessarily NUL-padding.
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
    Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]
    Link: https://github.com/KSPP/linux/issues/90
    Signed-off-by: Justin Stitt <justinstitt@google.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Wolfram Sang <wsa@kernel.org>
    Stable-dep-of: aa79f996eb41 ("i2c: cp2615: fix serial string NULL-deref at probe")
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i2c: fsi: Fix a potential leak in fsi_i2c_probe() [+ + +]
Author: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date:   Sun Mar 1 17:21:01 2026 +0100

    i2c: fsi: Fix a potential leak in fsi_i2c_probe()
    
    commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed upstream.
    
    In the commit in Fixes:, when the code has been updated to use an explicit
    for loop, instead of for_each_available_child_of_node(), the assumption
    that a reference to a device_node structure would be released at each
    iteration has been broken.
    
    Now, an explicit of_node_put() is needed to release the reference.
    
    Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports")
    Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Cc: <stable@vger.kernel.org> # v5.3+
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor [+ + +]
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Mar 6 09:24:46 2026 +0200

    i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
    
    commit ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb upstream.
    
    The internal control command descriptor used for no-op commands includes a
    Transaction ID (TID) field, but the no-op command constructed in
    hci_dma_dequeue_xfer() omitted it.  As a result, the hardware receives a
    no-op descriptor without the expected TID.
    
    This bug has gone unnoticed because the TID is currently not validated in
    the no-op completion path, but the descriptor format requires it to be
    present.
    
    Add the missing TID field when generating a no-op descriptor so that its
    layout matches the defined command structure.
    
    Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Link: https://patch.msgid.link/20260306072451.11131-10-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort [+ + +]
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Mar 6 09:24:47 2026 +0200

    i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
    
    commit b6d586431ae20d5157ee468d0ef62ad26798ef13 upstream.
    
    The DMA dequeue path attempts to restart the ring after aborting an
    in-flight transfer, but the current sequence is incomplete. The controller
    must be brought out of the aborted state and the ring control registers
    must be programmed in the correct order: first clearing ABORT, then
    re-enabling the ring and asserting RUN_STOP to resume operation.
    
    Add the missing controller resume step and update the ring control writes
    so that the ring is restarted using the proper sequence.
    
    Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Link: https://patch.msgid.link/20260306072451.11131-11-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors [+ + +]
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Mar 6 09:24:38 2026 +0200

    i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
    
    commit 4167b8914463132654e01e16259847d097f8a7f7 upstream.
    
    The MIPI I3C HCI driver currently returns -ETIME for various timeout
    conditions, while other I3C master drivers consistently use -ETIMEDOUT
    for the same class of errors.  Align the HCI driver with the rest of the
    subsystem by replacing all uses of -ETIME with -ETIMEDOUT.
    
    Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Link: https://patch.msgid.link/20260306072451.11131-2-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
i40e: fix src IP mask checks and memcpy argument names in cloud filter [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Mon Nov 10 11:13:38 2025 -0800

    i40e: fix src IP mask checks and memcpy argument names in cloud filter
    
    [ Upstream commit e809085f492842ce7a519c9ef72d40f4bca89c13 ]
    
    Fix following issues in the IPv4 and IPv6 cloud filter handling logic in
    both the add and delete paths:
    
    - The source-IP mask check incorrectly compares mask.src_ip[0] against
      tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely
      goes unnoticed because the check is in an "else if" path that only
      executes when dst_ip is not set, most cloud filter use cases focus on
      destination-IP matching, and the buggy condition can accidentally
      evaluate true in some cases.
    
    - memcpy() for the IPv4 source address incorrectly uses
      ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although
      both arrays are the same size.
    
    - The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE
      (tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and
      sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size.
    
    - In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing
      dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent
      explicit, even though both fields are struct in6_addr.
    
    Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() [+ + +]
Author: Jason Gunthorpe <jgg@ziepe.ca>
Date:   Mon Feb 16 11:02:48 2026 -0400

    IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
    
    commit 117942ca43e2e3c3d121faae530989931b7f67e1 upstream.
    
    Fix a user triggerable leak on the system call failure path.
    
    Cc: stable@vger.kernel.org
    Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation")
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Link: https://patch.msgid.link/2-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ice: fix retry for AQ command 0x06EE [+ + +]
Author: Jakub Staniszewski <jakub.staniszewski@linux.intel.com>
Date:   Tue Jan 13 20:38:17 2026 +0100

    ice: fix retry for AQ command 0x06EE
    
    commit fb4903b3354aed4a2301180cf991226f896c87ed upstream.
    
    Executing ethtool -m can fail reporting a netlink I/O error while firmware
    link management holds the i2c bus used to communicate with the module.
    
    According to Intel(R) Ethernet Controller E810 Datasheet Rev 2.8 [1]
    Section 3.3.10.4 Read/Write SFF EEPROM (0x06EE)
    request should to be retried upon receiving EBUSY from firmware.
    
    Commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool")
    implemented it only for part of ice_get_module_eeprom(), leaving all other
    calls to ice_aq_sff_eeprom() vulnerable to returning early on getting
    EBUSY without retrying.
    
    Remove the retry loop from ice_get_module_eeprom() and add Admin Queue
    (AQ) command with opcode 0x06EE to the list of commands that should be
    retried on receiving EBUSY from firmware.
    
    Cc: stable@vger.kernel.org
    Fixes: e9c9692c8a81 ("ice: Reimplement module reads used by ethtool")
    Signed-off-by: Jakub Staniszewski <jakub.staniszewski@linux.intel.com>
    Co-developed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
    Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Link: https://www.intel.com/content/www/us/en/content-details/613875/intel-ethernet-controller-e810-datasheet.html [1]
    Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
icmp: fix NULL pointer dereference in icmp_tag_validation() [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Wed Mar 18 21:06:01 2026 +0800

    icmp: fix NULL pointer dereference in icmp_tag_validation()
    
    [ Upstream commit 614aefe56af8e13331e50220c936fc0689cf5675 ]
    
    icmp_tag_validation() unconditionally dereferences the result of
    rcu_dereference(inet_protos[proto]) without checking for NULL.
    The inet_protos[] array is sparse -- only about 15 of 256 protocol
    numbers have registered handlers. When ip_no_pmtu_disc is set to 3
    (hardened PMTU mode) and the kernel receives an ICMP Fragmentation
    Needed error with a quoted inner IP header containing an unregistered
    protocol number, the NULL dereference causes a kernel panic in
    softirq context.
    
     Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
     KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
     RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)
     Call Trace:
      <IRQ>
      icmp_rcv (net/ipv4/icmp.c:1527)
      ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
      ip_local_deliver_finish (net/ipv4/ip_input.c:242)
      ip_local_deliver (net/ipv4/ip_input.c:262)
      ip_rcv (net/ipv4/ip_input.c:573)
      __netif_receive_skb_one_core (net/core/dev.c:6164)
      process_backlog (net/core/dev.c:6628)
      handle_softirqs (kernel/softirq.c:561)
      </IRQ>
    
    Add a NULL check before accessing icmp_strict_tag_validation. If the
    protocol has no registered handler, return false since it cannot
    perform strict tag validation.
    
    Fixes: 8ed1dc44d3e9 ("ipv4: introduce hardened ip_no_pmtu_disc mode")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Link: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
igc: fix missing update of skb->tail in igc_xmit_frame() [+ + +]
Author: Kohei Enju <kohei@enjuk.jp>
Date:   Sat Feb 14 19:46:32 2026 +0000

    igc: fix missing update of skb->tail in igc_xmit_frame()
    
    [ Upstream commit 0ffba246652faf4a36aedc66059c2f94e4c83ea5 ]
    
    igc_xmit_frame() misses updating skb->tail when the packet size is
    shorter than the minimum one.
    Use skb_put_padto() in alignment with other Intel Ethernet drivers.
    
    Fixes: 0507ef8a0372 ("igc: Add transmit and receive fastpath and interrupt handlers")
    Signed-off-by: Kohei Enju <kohei@enjuk.jp>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer [+ + +]
Author: Nuno Sa <nuno.sa@analog.com>
Date:   Thu Apr 9 14:51:47 2026 +0800

    iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
    
    [ Upstream commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd ]
    
    The AD7923 was updated to support devices with 8 channels, but the size
    of tx_buf and ring_xfer was not increased accordingly, leading to a
    potential buffer overflow in ad7923_update_scan_mode().
    
    Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928")
    Cc: stable@vger.kernel.org
    Signed-off-by: Nuno Sa <nuno.sa@analog.com>
    Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
    Link: https://patch.msgid.link/20241029134637.2261336-1-quzicheng@huawei.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    [ Context change fixed. ]
    Signed-off-by: Robert Garcia <rob_garcia@163.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

iio: chemical: bme680: Fix measurement wait duration calculation [+ + +]
Author: Chris Spencer <spencercw@gmail.com>
Date:   Thu Feb 5 14:55:45 2026 +0000

    iio: chemical: bme680: Fix measurement wait duration calculation
    
    commit f55b9510cd9437da3a0efa08b089caeb47595ff1 upstream.
    
    This function refers to the Bosch BME680 API as the source of the
    calculation, but one of the constants does not match the Bosch
    implementation. This appears to be a simple transposition of two digits,
    resulting in a wait time that is too short. This can cause the following
    'device measurement cycle incomplete' check to occasionally fail, returning
    EBUSY to user space.
    
    Adjust the constant to match the Bosch implementation and resolve the EBUSY
    errors.
    
    Fixes: 4241665e6ea0 ("iio: chemical: bme680: Fix sensor data read operation")
    Link: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L521
    Signed-off-by: Chris Spencer <spencercw@gmail.com>
    Acked-by: Vasileios Amoiridis <vassilisamir@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() [+ + +]
Author: Antoniu Miclaus <antoniu.miclaus@analog.com>
Date:   Thu Feb 12 14:46:07 2026 +0200

    iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
    
    commit 216345f98cae7fcc84f49728c67478ac00321c87 upstream.
    
    sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead
    of the intended __be32 element size (4 bytes). Use sizeof(*meas) to
    correctly match the buffer element type.
    
    Fixes: 8f3f13085278 ("iio: sps30: separate core and interface specific code")
    Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
    Acked-by: Tomasz Duszynski <tduszyns@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() [+ + +]
Author: Antoniu Miclaus <antoniu.miclaus@analog.com>
Date:   Thu Feb 12 14:46:08 2026 +0200

    iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
    
    commit c3914ce1963c4db25e186112c90fa5d2361e9e0a upstream.
    
    sizeof(num) evaluates to sizeof(size_t) which is 8 bytes on 64-bit,
    but the buffer elements are only 4 bytes. The same function already
    uses sizeof(*meas) on line 312, making the mismatch evident. Use
    sizeof(*meas) consistently.
    
    Fixes: b2e171f5a5c6 ("iio: sps30: add support for serial interface")
    Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
    Acked-by: Tomasz Duszynski <tduszyns@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: dac: ad5770r: fix error return in ad5770r_read_raw() [+ + +]
Author: Antoniu Miclaus <antoniu.miclaus@analog.com>
Date:   Thu Mar 12 13:20:24 2026 +0200

    iio: dac: ad5770r: fix error return in ad5770r_read_raw()
    
    commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
    
    Return the error code from regmap_bulk_read() instead of 0 so
    that I/O failures are properly propagated.
    
    Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
    Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: dac: ds4424: reject -128 RAW value [+ + +]
Author: Oleksij Rempel <o.rempel@pengutronix.de>
Date:   Wed Feb 4 15:00:33 2026 +0100

    iio: dac: ds4424: reject -128 RAW value
    
    commit 5187e03b817c26c1c3bcb2645a612ea935c4be89 upstream.
    
    The DS442x DAC uses sign-magnitude encoding, so -128 cannot be represented
    in hardware (7-bit magnitude).
    
    Previously, passing -128 resulted in a truncated value that programmed
    0mA (magnitude 0) instead of the expected maximum negative current,
    effectively failing silently.
    
    Reject -128 to avoid producing the wrong current.
    
    Fixes: d632a2bd8ffc ("iio: dac: ds4422/ds4424 dac driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050-core: fix pm_runtime error handling [+ + +]
Author: Antoniu Miclaus <antoniu.miclaus@analog.com>
Date:   Mon Feb 16 11:57:56 2026 +0200

    iio: gyro: mpu3050-core: fix pm_runtime error handling
    
    commit acc3949aab3e8094641a9c7c2768de1958c88378 upstream.
    
    The return value of pm_runtime_get_sync() is not checked, allowing
    the driver to access hardware that may fail to resume. The device
    usage count is also unconditionally incremented. Use
    pm_runtime_resume_and_get() which propagates errors and avoids
    incrementing the usage count on failure.
    
    In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()
    failure since postdisable does not run when preenable fails.
    
    Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Reviewed-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050-i2c: fix pm_runtime error handling [+ + +]
Author: Antoniu Miclaus <antoniu.miclaus@analog.com>
Date:   Mon Feb 16 11:57:55 2026 +0200

    iio: gyro: mpu3050-i2c: fix pm_runtime error handling
    
    commit 91f950b4cbb1aa9ea4eb3999f1463e8044b717fb upstream.
    
    The return value of pm_runtime_get_sync() is not checked, and the
    function always returns success. This allows I2C mux operations to
    proceed even when the device fails to resume.
    
    Use pm_runtime_resume_and_get() and propagate its return value to
    properly handle resume failures.
    
    Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050: Fix incorrect free_irq() variable [+ + +]
Author: Ethan Tidmore <ethantidmore06@gmail.com>
Date:   Tue Feb 24 16:48:15 2026 -0600

    iio: gyro: mpu3050: Fix incorrect free_irq() variable
    
    commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
    
    The handler for the IRQ part of this driver is mpu3050->trig but,
    in the teardown free_irq() is called with handler mpu3050.
    
    Use correct IRQ handler when calling free_irq().
    
    Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Reviewed-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050: Fix irq resource leak [+ + +]
Author: Ethan Tidmore <ethantidmore06@gmail.com>
Date:   Tue Feb 24 16:48:16 2026 -0600

    iio: gyro: mpu3050: Fix irq resource leak
    
    commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
    
    The interrupt handler is setup but only a few lines down if
    iio_trigger_register() fails the function returns without properly
    releasing the handler.
    
    Add cleanup goto to resolve resource leak.
    
    Detected by Smatch:
    drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
    'irq' from request_threaded_irq() not released on lines: 1124.
    
    Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Reviewed-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050: Fix out-of-sequence free_irq() [+ + +]
Author: Ethan Tidmore <ethantidmore06@gmail.com>
Date:   Tue Feb 24 16:48:18 2026 -0600

    iio: gyro: mpu3050: Fix out-of-sequence free_irq()
    
    commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
    
    The triggered buffer is initialized before the IRQ is requested. The
    removal path currently calls iio_triggered_buffer_cleanup() before
    free_irq(). This violates the expected LIFO.
    
    Place free_irq() in the correct location relative to
    iio_triggered_buffer_cleanup().
    
    Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Suggested-by: Jonathan Cameron <jic23@kernel.org>
    Reviewed-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: gyro: mpu3050: Move iio_device_register() to correct location [+ + +]
Author: Ethan Tidmore <ethantidmore06@gmail.com>
Date:   Tue Feb 24 16:48:17 2026 -0600

    iio: gyro: mpu3050: Move iio_device_register() to correct location
    
    commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
    
    iio_device_register() should be at the end of the probe function to
    prevent race conditions.
    
    Place iio_device_register() at the end of the probe function and place
    iio_device_unregister() accordingly.
    
    Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
    Suggested-by: Jonathan Cameron <jic23@kernel.org>
    Reviewed-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: imu: inv_icm42600: fix odr switch to the same value [+ + +]
Author: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Date:   Fri Jan 30 16:38:47 2026 +0100

    iio: imu: inv_icm42600: fix odr switch to the same value
    
    commit c9f3a593137d862d424130343e77d4b5260a4f5a upstream.
    
    ODR switch is done in 2 steps when FIFO is on : change the ODR register
    value and acknowledge change when reading the FIFO ODR change flag.
    When we are switching to the same odr value, we end up waiting for a
    FIFO ODR flag that is never happening.
    
    Fix the issue by doing nothing and exiting properly when we are
    switching to the same ODR value.
    
    Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
    Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only [+ + +]
Author: Francesco Lavra <flavra@baylibre.com>
Date:   Wed Feb 25 11:06:00 2026 +0100

    iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
    
    commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
    
    The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and
    disabling the hardware FIFO, checks the contents of the hw->settings->batch
    array at index sensor->id, and then sets the current ODR value in sensor
    registers that depend on whether the register address is set in the above
    array element. This logic is valid for internal sensors only, i.e. the
    accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:
    st_lsm6dsx: add i2c embedded controller support"), this function is called
    also when configuring the hardware FIFO for external sensors (i.e. sensors
    accessed through the sensor hub functionality), which can result in
    unrelated device registers being written.
    
    Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does
    not touch any registers unless it is called for internal sensors.
    
    Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
    Signed-off-by: Francesco Lavra <flavra@baylibre.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: light: vcnl4035: fix scan buffer on big-endian [+ + +]
Author: David Lechner <dlechner@baylibre.com>
Date:   Sat Mar 14 17:18:10 2026 -0500

    iio: light: vcnl4035: fix scan buffer on big-endian
    
    commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
    
    Rework vcnl4035_trigger_consumer_handler() so that we are not passing
    what should be a u16 value as an int * to regmap_read(). This won't
    work on bit endian systems.
    
    Instead, add a new unsigned int variable to pass to regmap_read(). Then
    copy that value into the buffer struct.
    
    The buffer array is replaced with a struct since there is only one value
    being read. This allows us to use the correct u16 data type and has a
    side-effect of simplifying the alignment specification.
    
    Also fix the endianness of the scan format from little-endian to CPU
    endianness. Since we are using regmap to read the value, it will be
    CPU-endian.
    
    Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
    Signed-off-by: David Lechner <dlechner@baylibre.com>
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iio: potentiometer: mcp4131: fix double application of wiper shift [+ + +]
Author: Lukas Schmid <lukas.schmid@netcube.li>
Date:   Mon Feb 2 21:15:35 2026 +0100

    iio: potentiometer: mcp4131: fix double application of wiper shift
    
    commit 85e4614524dca6c0a43874f475a17de2b9725648 upstream.
    
    The MCP4131 wiper address is shifted twice when preparing the SPI
    command in mcp4131_write_raw().
    
    The address is already shifted when assigned to the local variable
    "address", but is then shifted again when written to data->buf[0].
    This results in an incorrect command being sent to the device and
    breaks wiper writes to the second channel.
    
    Remove the second shift and use the pre-shifted address directly
    when composing the SPI transfer.
    
    Fixes: 22d199a53910 ("iio: potentiometer: add driver for Microchip MCP413X/414X/415X/416X/423X/424X/425X/426X")
    Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>#
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
indirect_call_wrapper: do not reevaluate function pointer [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Feb 27 17:26:03 2026 +0000

    indirect_call_wrapper: do not reevaluate function pointer
    
    [ Upstream commit 710f5c76580306cdb9ec51fac8fcf6a8faff7821 ]
    
    We have an increasing number of READ_ONCE(xxx->function)
    combined with INDIRECT_CALL_[1234]() helpers.
    
    Unfortunately this forces INDIRECT_CALL_[1234]() to read
    xxx->function many times, which is not what we wanted.
    
    Fix these macros so that xxx->function value is not reloaded.
    
    $ scripts/bloat-o-meter -t vmlinux.0 vmlinux
    add/remove: 0/0 grow/shrink: 1/65 up/down: 122/-1084 (-962)
    Function                                     old     new   delta
    ip_push_pending_frames                        59     181    +122
    ip6_finish_output                            687     681      -6
    __udp_enqueue_schedule_skb                  1078    1072      -6
    ioam6_output                                2319    2312      -7
    xfrm4_rcv_encap_finish2                       64      56      -8
    xfrm4_output                                 297     289      -8
    vrf_ip_local_out                             278     270      -8
    vrf_ip6_local_out                            278     270      -8
    seg6_input_finish                             64      56      -8
    rpl_output                                   700     692      -8
    ipmr_forward_finish                          124     116      -8
    ip_forward_finish                            143     135      -8
    ip6mr_forward2_finish                        100      92      -8
    ip6_forward_finish                            73      65      -8
    input_action_end_bpf                        1091    1083      -8
    dst_input                                     52      44      -8
    __xfrm6_output                               801     793      -8
    __xfrm4_output                                83      75      -8
    bpf_input                                    500     491      -9
    __tcp_check_space                            530     521      -9
    input_action_end_dt6                         291     280     -11
    vti6_tnl_xmit                               1634    1622     -12
    bpf_xmit                                    1203    1191     -12
    rpl_input                                    497     483     -14
    rawv6_send_hdrinc                           1355    1341     -14
    ndisc_send_skb                              1030    1016     -14
    ipv6_srh_rcv                                1377    1363     -14
    ip_send_unicast_reply                       1253    1239     -14
    ip_rcv_finish                                226     212     -14
    ip6_rcv_finish                               300     286     -14
    input_action_end_x_core                      205     191     -14
    input_action_end_x                           355     341     -14
    input_action_end_t                           205     191     -14
    input_action_end_dx6_finish                  127     113     -14
    input_action_end_dx4_finish                  373     359     -14
    input_action_end_dt4                         426     412     -14
    input_action_end_core                        186     172     -14
    input_action_end_b6_encap                    292     278     -14
    input_action_end_b6                          198     184     -14
    igmp6_send                                  1332    1318     -14
    ip_sublist_rcv                               864     848     -16
    ip6_sublist_rcv                             1091    1075     -16
    ipv6_rpl_srh_rcv                            1937    1920     -17
    xfrm_policy_queue_process                   1246    1228     -18
    seg6_output_core                             903     885     -18
    mld_sendpack                                 856     836     -20
    NF_HOOK                                      756     736     -20
    vti_tunnel_xmit                             1447    1426     -21
    input_action_end_dx6                         664     642     -22
    input_action_end                            1502    1480     -22
    sock_sendmsg_nosec                           134     111     -23
    ip6mr_forward2                               388     364     -24
    sock_recvmsg_nosec                           134     109     -25
    seg6_input_core                              836     810     -26
    ip_send_skb                                  172     146     -26
    ip_local_out                                 140     114     -26
    ip6_local_out                                140     114     -26
    __sock_sendmsg                               162     136     -26
    __ip_queue_xmit                             1196    1170     -26
    __ip_finish_output                           405     379     -26
    ipmr_queue_fwd_xmit                          373     346     -27
    sock_recvmsg                                 173     145     -28
    ip6_xmit                                    1635    1607     -28
    xfrm_output_resume                          1418    1389     -29
    ip_build_and_send_pkt                        625     591     -34
    dst_output                                   504     432     -72
    Total: Before=25217686, After=25216724, chg -0.00%
    
    Fixes: 283c16a2dfd3 ("indirect call wrappers: helpers to speed-up indirect calls of builtin")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
    Link: https://patch.msgid.link/20260227172603.1700433-1-edumazet@google.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table [+ + +]
Author: Christoffer Sandberg <cs@tuxedo.de>
Date:   Mon Feb 23 15:20:45 2026 +0100

    Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
    
    commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
    
    The device occasionally wakes up from suspend with missing input on the
    internal keyboard and the following suspend attempt results in an instant
    wake-up. The quirks fix both issues for this device.
    
    Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
    Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
    Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: synaptics-rmi4 - fix a locking bug in an error path [+ + +]
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Mon Feb 23 15:05:15 2026 -0800

    Input: synaptics-rmi4 - fix a locking bug in an error path
    
    commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
    
    Lock f54->data_mutex when entering the function statement since jumping
    to the 'error' label when checking report_size fails causes that mutex
    to be unlocked.
    
    This bug has been detected by the Clang thread-safety checker.
    
    Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: uinput - fix circular locking dependency with ff-core [+ + +]
Author: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Date:   Tue Apr 7 12:50:31 2026 +0500

    Input: uinput - fix circular locking dependency with ff-core
    
    commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 upstream.
    
    A lockdep circular locking dependency warning can be triggered
    reproducibly when using a force-feedback gamepad with uinput (for
    example, playing ELDEN RING under Wine with a Flydigi Vader 5
    controller):
    
      ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
    
    The cycle is caused by four lock acquisition paths:
    
    1. ff upload: input_ff_upload() holds ff->mutex and calls
       uinput_dev_upload_effect() -> uinput_request_submit() ->
       uinput_request_send(), which acquires udev->mutex.
    
    2. device create: uinput_ioctl_handler() holds udev->mutex and calls
       uinput_create_device() -> input_register_device(), which acquires
       input_mutex.
    
    3. device register: input_register_device() holds input_mutex and
       calls kbd_connect() -> input_register_handle(), which acquires
       dev->mutex.
    
    4. evdev release: evdev_release() calls input_flush_device() under
       dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
    
    Fix this by introducing a new state_lock spinlock to protect
    udev->state and udev->dev access in uinput_request_send() instead of
    acquiring udev->mutex.  The function only needs to atomically check
    device state and queue an input event into the ring buffer via
    uinput_dev_event() -- both operations are safe under a spinlock
    (ktime_get_ts64() and wake_up_interruptible() do not sleep).  This
    breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
    the lock ordering and cannot form cycles with mutexes.
    
    To keep state transitions visible to uinput_request_send(), protect
    writes to udev->state in uinput_create_device() and
    uinput_destroy_device() with the same state_lock spinlock.
    
    Additionally, move init_completion(&request->done) from
    uinput_request_send() to uinput_request_submit() before
    uinput_request_reserve_slot().  Once the slot is allocated,
    uinput_flush_requests() may call complete() on it at any time from
    the destroy path, so the completion must be initialised before the
    request becomes visible.
    
    Lock ordering after the fix:
    
      ff->mutex -> state_lock (spinlock, leaf)
      udev->mutex -> state_lock (spinlock, leaf)
      udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
    
    Fixes: ff462551235d ("Input: uinput - switch to the new FF interface")
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/
    Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
    Link: https://patch.msgid.link/20260407075031.38351-1-mikhail.v.gavrilov@gmail.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: uinput - take event lock when submitting FF request "event" [+ + +]
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date:   Tue Apr 7 22:16:27 2026 -0700

    Input: uinput - take event lock when submitting FF request "event"
    
    commit ff14dafde15c11403fac61367a34fea08926e9ee upstream.
    
    To avoid racing with FF playback events and corrupting device's event
    queue take event_lock spinlock when calling uinput_dev_event() when
    submitting a FF upload or erase "event".
    
    Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
    Link: https://patch.msgid.link/adXkf6MWzlB8LA_s@google.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: xpad - add support for Razer Wolverine V3 Pro [+ + +]
Author: Zoltan Illes <zoliviragh@gmail.com>
Date:   Fri Apr 3 22:03:42 2026 -0700

    Input: xpad - add support for Razer Wolverine V3 Pro
    
    commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
    
    Add device IDs for the Razer Wolverine V3 Pro controller in both
    wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
    
    The controller uses the Xbox 360 protocol (vendor-specific class,
    subclass 93, protocol 1) on interface 0 with an identical 20-byte
    input report layout, so no additional processing is needed.
    
    Signed-off-by: Zoltan Illes <zoliviragh@gmail.com>
    Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop [+ + +]
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Jan 20 07:42:50 2026 -0700

    io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
    
    commit 10dc959398175736e495f71c771f8641e1ca1907 upstream.
    
    Currently this is checked before running the pending work. Normally this
    is quite fine, as work items either end up blocking (which will create a
    new worker for other items), or they complete fairly quickly. But syzbot
    reports an issue where io-wq takes seemingly forever to exit, and with a
    bit of debugging, this turns out to be because it queues a bunch of big
    (2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't
    support ->read_iter(), loop_rw_iter() ends up handling them. Each read
    returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of
    these pending, processing the whole chain can take a long time. Easily
    longer than the syzbot uninterruptible sleep timeout of 140 seconds.
    This then triggers a complaint off the io-wq exit path:
    
    INFO: task syz.4.135:6326 blocked for more than 143 seconds.
          Not tainted syzkaller #0
          Blocked by coredump.
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    task:syz.4.135       state:D stack:26824 pid:6326  tgid:6324  ppid:5957   task_flags:0x400548 flags:0x00080000
    Call Trace:
     <TASK>
     context_switch kernel/sched/core.c:5256 [inline]
     __schedule+0x1139/0x6150 kernel/sched/core.c:6863
     __schedule_loop kernel/sched/core.c:6945 [inline]
     schedule+0xe7/0x3a0 kernel/sched/core.c:6960
     schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
     do_wait_for_common kernel/sched/completion.c:100 [inline]
     __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
     io_wq_exit_workers io_uring/io-wq.c:1328 [inline]
     io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356
     io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203
     io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651
     io_uring_files_cancel include/linux/io_uring.h:19 [inline]
     do_exit+0x2ce/0x2bd0 kernel/exit.c:911
     do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
     get_signal+0x2671/0x26d0 kernel/signal.c:3034
     arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337
     __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
     exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
     __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
     syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
     syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
     syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
     do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7fa02738f749
    RSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
    RAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749
    RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098
    RBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
    R13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98
    
    There's really nothing wrong here, outside of processing these reads
    will take a LONG time. However, we can speed up the exit by checking the
    IO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will
    exit the ring after queueing up all of these reads. Then once the first
    item is processed, io-wq will simply cancel the rest. That should avoid
    syzbot running into this complaint again.
    
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/all/68a2decc.050a0220.e29e5.0099.GAE@google.com/
    Reported-by: syzbot+4eb282331cab6d5b6588@syzkaller.appspotmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    [ Minor conflict resolved. ]
    Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
io_uring/poll: correctly handle io_poll_add() return value on update [+ + +]
Author: Jens Axboe <axboe@kernel.dk>
Date:   Fri Mar 13 15:50:21 2026 -0600

    io_uring/poll: correctly handle io_poll_add() return value on update
    
    Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream.
    
    When the core of io_uring was updated to handle completions
    consistently and with fixed return codes, the POLL_REMOVE opcode
    with updates got slightly broken. If a POLL_ADD is pending and
    then POLL_REMOVE is used to update the events of that request, if that
    update causes the POLL_ADD to now trigger, then that completion is lost
    and a CQE is never posted.
    
    Additionally, ensure that if an update does cause an existing POLL_ADD
    to complete, that the completion value isn't always overwritten with
    -ECANCELED. For that case, whatever io_poll_add() set the value to
    should just be retained.
    
    Cc: stable@vger.kernel.org
    Fixes: 97b388d70b53 ("io_uring: handle completions in the core")
    Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
    Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
io_uring/tctx: work around xa_store() allocation error issue [+ + +]
Author: Jens Axboe <axboe@kernel.dk>
Date:   Fri Nov 29 07:20:28 2024 -0700

    io_uring/tctx: work around xa_store() allocation error issue
    
    commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 upstream.
    
    syzbot triggered the following WARN_ON:
    
    WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
    
    which is the
    
    WARN_ON_ONCE(!xa_empty(&tctx->xa));
    
    sanity check in __io_uring_free() when a io_uring_task is going through
    its final put. The syzbot test case includes injecting memory allocation
    failures, and it very much looks like xa_store() can fail one of its
    memory allocations and end up with ->head being non-NULL even though no
    entries exist in the xarray.
    
    Until this issue gets sorted out, work around it by attempting to
    iterate entries in our xarray, and WARN_ON_ONCE() if one is found.
    
    Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.com/
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    [ Modify the function in io_uring.c because it's located here in v5.15. ]
    Signed-off-by: Robert Garcia <rob_garcia@163.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry [+ + +]
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Date:   Mon Mar 16 15:16:39 2026 +0800

    iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
    
    commit fe89277c9ceb0d6af0aa665bcf24a41d8b1b79cd upstream.
    
    During the qi_check_fault process after an IOMMU ITE event, requests at
    odd-numbered positions in the queue are set to QI_ABORT, only satisfying
    single-request submissions. However, qi_submit_sync now supports multiple
    simultaneous submissions, and can't guarantee that the wait_desc will be
    at an odd-numbered position. Therefore, if an item times out, IOMMU can't
    re-initiate the request, resulting in an infinite polling wait.
    
    This modifies the process by setting the status of all requests already
    fetched by IOMMU and recorded as QI_IN_USE status (including wait_desc
    requests) to QI_ABORT, thus enabling multiple requests to be resubmitted.
    
    Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
    Tested-by: Shuai Xue <xueshuai@linux.alibaba.com>
    Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
    Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
    Link: https://lore.kernel.org/r/20260306101516.3885775-1-guanghuifeng@linux.alibaba.com
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per  qi_submit_sync()")
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ionic: fix persistent MAC address override on PF [+ + +]
Author: Mohammad Heib <mheib@redhat.com>
Date:   Tue Mar 17 19:08:06 2026 +0200

    ionic: fix persistent MAC address override on PF
    
    [ Upstream commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed ]
    
    The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes
    the ionic firmware to update the LIF's identity in its persistent state.
    Since the firmware state is maintained across host warm boots and driver
    reloads, any MAC change on the Physical Function (PF) becomes "sticky.
    
    This is problematic because it causes ethtool -P to report the
    user-configured MAC as the permanent factory address, which breaks
    system management tools that rely on a stable hardware identity.
    
    While Virtual Functions (VFs) need this hardware-level programming to
    properly handle MAC assignments in guest environments, the PF should
    maintain standard transient behavior. This patch gates the
    ionic_program_mac call using is_virtfn so that PF MAC changes remain
    local to the netdev filters and do not overwrite the firmware's
    permanent identity block.
    
    Fixes: 19058be7c48c ("ionic: VF initial random MAC address if no assigned mac")
    Signed-off-by: Mohammad Heib <mheib@redhat.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Brett Creeley <brett.creeley@amd.com>
    Link: https://patch.msgid.link/20260317170806.35390-1-mheib@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ip6_tunnel: clear skb2->cb[] in ip4ip6_err() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Mar 26 15:51:38 2026 +0000

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
    
    [ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ]
    
    Oskar Kjos reported the following problem.
    
    ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
    by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
    IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
    as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
    at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
    value. __ip_options_echo() then reads optlen from attacker-controlled
    packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
    a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
    
    To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
    
    Also add minimal IPv4 header validation (version == 4, ihl >= 5).
    
    Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
    Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Link: https://patch.msgid.link/20260326155138.2429480-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ip6_tunnel: Fix usage of skb_vlan_inet_prepare() [+ + +]
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon Feb 23 19:43:18 2026 +0100

    ip6_tunnel: Fix usage of skb_vlan_inet_prepare()
    
    Backports of commit 81c734dae203 "ip6_tunnel: use
    skb_vlan_inet_prepare() in __ip6_tnl_rcv()" broke IPv6 tunnelling in
    stable branches 5.10-6.12 inclusive.  This is because the return value
    of skb_vlan_inet_prepare() had the opposite sense (0 for error rather
    than for success) before commit 9990ddf47d416 "net: tunnel: make
    skb_vlan_inet_prepare() return drop reasons".
    
    For branches including commit c504e5c2f964 "net: skb: introduce
    kfree_skb_reason()" etc. (i.e. 6.1 and newer) it was simple to
    backport commit 9990ddf47d416, but for 5.10 and 5.15 that doesn't seem
    to be practical.
    
    So just reverse the sense of the return value test here.
    
    Fixes: f9c5c5b791d3 ("ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()")
    Fixes: 64c71d60a21a ("ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()")
    Signed-off-by: Ben Hutchings <benh@debian.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ipv6: avoid overflows in ip6_datagram_send_ctl() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Apr 1 15:47:21 2026 +0000

    ipv6: avoid overflows in ip6_datagram_send_ctl()
    
    [ Upstream commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e ]
    
    Yiming Qian reported :
    <quote>
     I believe I found a locally triggerable kernel bug in the IPv6 sendmsg
     ancillary-data path that can panic the kernel via `skb_under_panic()`
     (local DoS).
    
     The core issue is a mismatch between:
    
     - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type
     `__u16`) and
     - a pointer to the *last* provided destination-options header (`opt->dst1opt`)
    
     when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.
    
     - `include/net/ipv6.h`:
       - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).
     (lines 291-307, especially 298)
     - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:
       - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`
     without rejecting duplicates. (lines 909-933)
     - `net/ipv6/ip6_output.c:__ip6_append_data()`:
       - Uses `opt->opt_flen + opt->opt_nflen` to compute header
     sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)
     - `net/ipv6/ip6_output.c:__ip6_make_skb()`:
       - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero.
     (lines 1930-1934)
     - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:
       - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the
     pointed-to header). (lines 1179-1185 and 1206-1211)
    
     1. `opt_flen` is a 16-bit accumulator:
    
     - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.
    
     2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs
     and increments `opt_flen` each time:
    
     - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:
       - It computes `len = ((hdr->hdrlen + 1) << 3);`
       - It checks `CAP_NET_RAW` using `ns_capable(net->user_ns,
     CAP_NET_RAW)`. (line 922)
       - Then it does:
         - `opt->opt_flen += len;` (line 927)
         - `opt->dst1opt = hdr;` (line 928)
    
     There is no duplicate rejection here (unlike the legacy
     `IPV6_2292DSTOPTS` path which rejects duplicates at
     `net/ipv6/datagram.c:901-904`).
    
     If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps
     while `dst1opt` still points to a large (2048-byte)
     destination-options header.
    
     In the attached PoC (`poc.c`):
    
     - 32 cmsgs with `hdrlen=255` => `len = (255+1)*8 = 2048`
     - 1 cmsg with `hdrlen=0` => `len = 8`
     - Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8`
     - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.
    
     3. The transmit path sizes headers using the wrapped `opt_flen`:
    
    - In `net/ipv6/ip6_output.c:1463-1465`:
      - `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +
     opt->opt_nflen : 0) + ...;`
    
     With wrapped `opt_flen`, `headersize`/headroom decisions underestimate
     what will be pushed later.
    
     4. When building the final skb, the actual push length comes from
     `dst1opt` and is not limited by wrapped `opt_flen`:
    
     - In `net/ipv6/ip6_output.c:1930-1934`:
       - `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);`
     - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes
     `dst1opt` via `ipv6_push_exthdr()`.
     - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:
       - `skb_push(skb, ipv6_optlen(opt));`
       - `memcpy(h, opt, ipv6_optlen(opt));`
    
     With insufficient headroom, `skb_push()` underflows and triggers
     `skb_under_panic()` -> `BUG()`:
    
     - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)
     - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)
    
     - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target
     netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`).
     - Root (or any task with `CAP_NET_RAW`) can trigger this without user
     namespaces.
     - An unprivileged `uid=1000` user can trigger this if unprivileged
     user namespaces are enabled and it can create a userns+netns to obtain
     namespaced `CAP_NET_RAW` (the attached PoC does this).
    
     - Local denial of service: kernel BUG/panic (system crash).
     - Reproducible with a small userspace PoC.
    </quote>
    
    This patch does not reject duplicated options, as this might break
    some user applications.
    
    Instead, it makes sure to adjust opt_flen and opt_nflen to correctly
    reflect the size of the current option headers, preventing the overflows
    and the potential for panics.
    
    This applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR.
    
    Specifically:
    
    When a new IPV6_DSTOPTS is processed, the length of the old opt->dst1opt
    is subtracted from opt->opt_flen before adding the new length.
    
    When a new IPV6_HOPOPTS is processed, the length of the old opt->dst0opt
    is subtracted from opt->opt_nflen.
    
    When a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed,
    the length of the old opt->srcrt is subtracted from opt->opt_nflen.
    
    In the special case within IPV6_2292RTHDR handling where dst1opt is moved
    to dst0opt, the length of the old opt->dst0opt is subtracted from
    opt->opt_nflen before the new one is added.
    
    Fixes: 333fad5364d6 ("[IPV6]: Support several new sockopt / ancillary data in Advanced API (RFC3542).")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Closes: https://lore.kernel.org/netdev/CAL_bE8JNzawgr5OX5m+3jnQDHry2XxhQT5=jThW1zDPtUikRYA@mail.gmail.com/
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260401154721.3740056-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Sun Mar 1 11:45:48 2026 -0800

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
    
    [ Upstream commit 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a ]
    
    l3mdev_master_dev_rcu() can return NULL when the slave device is being
    un-slaved from a VRF. All other callers deal with this, but we lost
    the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
    with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
    device with address").
    
      KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
      RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
      Call Trace:
       ip6_pol_route (net/ipv6/route.c:2318)
       fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
       ip6_route_output_flags (net/ipv6/route.c:2607)
       vrf_process_v6_outbound (drivers/net/vrf.c:437)
    
    I was tempted to rework the un-slaving code to clear the flag first
    and insert synchronize_rcu() before we remove the upper. But looks like
    the explicit fallback to loopback_dev is an established pattern.
    And I guess avoiding the synchronize_rcu() is nice, too.
    
    Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://patch.msgid.link/20260301194548.927324-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Mar 26 20:26:08 2026 +0000

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
    
    [ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ]
    
    Sashiko AI-review observed:
    
      In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet
      where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2
      and passed to icmp6_send(), it uses IP6CB(skb2).
    
      IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso
      offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm
      at offset 18.
    
      If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao
      would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called
      and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
    
      This would scan the inner, attacker-controlled IPv6 packet starting at that
      offset, potentially returning a fake TLV without checking if the remaining
      packet length can hold the full 18-byte struct ipv6_destopt_hao.
    
      Could mip6_addr_swap() then perform a 16-byte swap that extends past the end
      of the packet data into skb_shared_info?
    
      Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and
      ip6ip6_err() to prevent this?
    
    This patch implements the first suggestion.
    
    I am not sure if ip6ip6_err() needs to be changed.
    A separate patch would be better anyway.
    
    Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error")
    Reported-by: Ido Schimmel <idosch@nvidia.com>
    Closes: https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Oskar Kjos <oskar.kjos@hotmail.com>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Link: https://patch.msgid.link/20260326202608.2976021-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ipv6: prevent possible UaF in addrconf_permanent_addr() [+ + +]
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Fri Mar 27 10:52:57 2026 +0100

    ipv6: prevent possible UaF in addrconf_permanent_addr()
    
    [ Upstream commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 ]
    
    The mentioned helper try to warn the user about an exceptional
    condition, but the message is delivered too late, accessing the ipv6
    after its possible deletion.
    
    Reorder the statement to avoid the possible UaF; while at it, place the
    warning outside the idev->lock as it needs no protection.
    
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Closes: https://sashiko.dev/#/patchset/8c8bfe2e1a324e501f0e15fef404a77443fd8caf.1774365668.git.pabeni%40redhat.com
    Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional")
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Link: https://patch.msgid.link/ef973c3a8cb4f8f1787ed469f3e5391b9fe95aa0.1774601542.git.pabeni@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports [+ + +]
Author: Marc Zyngier <maz@kernel.org>
Date:   Fri Feb 6 15:48:16 2026 +0000

    irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
    
    commit ce9e40a9a5e5cff0b1b0d2fa582b3d71a8ce68e8 upstream.
    
    The ITS driver blindly assumes that EventIDs are in abundant supply, to the
    point where it never checks how many the hardware actually supports.
    
    It turns out that some pretty esoteric integrations make it so that only a
    few bits are available, all the way down to a single bit.
    
    Enforce the advertised limitation at the point of allocating the device
    structure, and hope that the endpoint driver can deal with such limitation.
    
    Fixes: 84a6a2e7fc18d ("irqchip: GICv3: ITS: device allocation and configuration")
    Signed-off-by: Marc Zyngier <maz@kernel.org>
    Signed-off-by: Thomas Gleixner <tglx@kernel.org>
    Reviewed-by: Robin Murphy <robin.murphy@arm.com>
    Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260206154816.3582887-1-maz@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
jbd2: gracefully abort on checkpointing state corruptions [+ + +]
Author: Milos Nikic <nikic.milos@gmail.com>
Date:   Tue Mar 10 21:15:48 2026 -0700

    jbd2: gracefully abort on checkpointing state corruptions
    
    commit bac3190a8e79beff6ed221975e0c9b1b5f2a21da upstream.
    
    This patch targets two internal state machine invariants in checkpoint.c
    residing inside functions that natively return integer error codes.
    
    - In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely
    corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE
    and a graceful journal abort, returning -EFSCORRUPTED.
    
    - In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for
    an unexpected buffer_jwrite state. If the warning triggers, we
    explicitly drop the just-taken get_bh() reference and call __flush_batch()
    to safely clean up any previously queued buffers in the j_chkpt_bhs array,
    preventing a memory leak before returning -EFSCORRUPTED.
    
    Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
    Reviewed-by: Andreas Dilger <adilger@dilger.ca>
    Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260311041548.159424-1-nikic.milos@gmail.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths [+ + +]
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Tue Feb 24 21:35:05 2026 -0500

    ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
    
    [ Upstream commit a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8 ]
    
    There are two places where ksmbd_vfs_kern_path_end_removing() needs to be
    called in order to balance what the corresponding successful call to
    ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and
    put the taken references.  Otherwise there might be potential deadlocks
    and unbalanced locks which are caught like:
    
    BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596
         last function: handle_ksmbd_work
    2 locks held by kworker/5:21/7596:
     #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660
     #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660
    CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
    Workqueue: ksmbd-io handle_ksmbd_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x44/0x5b
     process_one_work.cold+0x57/0x5c
     worker_thread+0x82/0x600
     kthread+0x153/0x190
     ret_from_fork+0x22/0x30
     </TASK>
    
    Found by Linux Verification Center (linuxtesting.org).
    
    Fixes: d5fc1400a34b ("smb/server: avoid deadlock when linking with ReplaceIfExists")
    Cc: stable@vger.kernel.org
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    [ ksmbd_vfs_kern_path_end_removing() call -> ksmbd_vfs_kern_path_unlock() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: Fix dangling pointer in krb_authenticate [+ + +]
Author: Sean Heelan <seanheelan@gmail.com>
Date:   Mon Mar 2 15:52:47 2026 +0800

    ksmbd: Fix dangling pointer in krb_authenticate
    
    [ Upstream commit 1e440d5b25b7efccb3defe542a73c51005799a5f ]
    
    krb_authenticate frees sess->user and does not set the pointer
    to NULL. It calls ksmbd_krb5_authenticate to reinitialise
    sess->user but that function may return without doing so. If
    that happens then smb2_sess_setup, which calls krb_authenticate,
    will be accessing free'd memory when it later uses sess->user.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Heelan <seanheelan@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Leon Chen <leonchen.oss@139.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Sat Jan 24 10:55:46 2026 +0900

    ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
    
    [ Upstream commit 010eb01ce23b34b50531448b0da391c7f05a72af ]
    
    The problem occurs when a signed request fails smb2 signature verification
    check. In __process_request(), if check_sign_req() returns an error,
    set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called.
    set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting
    next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain
    is lost. Consequently, is_chained_smb2_message() continues to point to
    the same request header instead of advancing. If the header's NextCommand
    field is non-zero, the function returns true, causing __handle_ksmbd_work()
    to repeatedly process the same failed request in an infinite loop.
    This results in the kernel log being flooded with "bad smb2 signature"
    messages and high CPU usage.
    
    This patch fixes the issue by changing the return value from
    SERVER_HANDLER_CONTINUE to SERVER_HANDLER_ABORT. This ensures that
    the processing loop terminates immediately rather than attempting to
    continue from an invalidated offset.
    
    Reported-by: tianshuo han <hantianshuo233@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: fix null pointer dereference error in generate_encryptionkey [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Wed Feb 25 18:33:45 2026 +0800

    ksmbd: fix null pointer dereference error in generate_encryptionkey
    
    [ Upstream commit 9b493ab6f35178afd8d619800df9071992f715de ]
    
    If client send two session setups with krb5 authenticate to ksmbd,
    null pointer dereference error in generate_encryptionkey could happen.
    sess->Preauth_HashValue is set to NULL if session is valid.
    So this patch skip generate encryption key if session is valid.
    
    Cc: stable@vger.kernel.org
    Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27654
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Alva Lan <alvalan9@foxmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: fix potencial OOB in get_file_all_info() for compound requests [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Mon Mar 30 15:10:37 2026 -0400

    ksmbd: fix potencial OOB in get_file_all_info() for compound requests
    
    [ Upstream commit beef2634f81f1c086208191f7228bce1d366493d ]
    
    When a compound request consists of QUERY_DIRECTORY + QUERY_INFO
    (FILE_ALL_INFORMATION) and the first command consumes nearly the entire
    max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()
    with PATH_MAX, causing out-of-bounds write beyond the response buffer.
    In get_file_all_info(), there was a missing validation check for
    the client-provided OutputBufferLength before copying the filename into
    FileName field of the smb2_file_all_info structure.
    If the filename length exceeds the available buffer space, it could lead to
    potential buffer overflows or memory corruption during smbConvertToUTF16
    conversion. This calculating the actual free buffer size using
    smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is
    insufficient and updating smbConvertToUTF16 to use the actual filename
    length (clamped by PATH_MAX) to ensure a safe copy operation.
    
    Cc: stable@vger.kernel.org
    Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
    Reported-by: Asim Viladi Oglu Manizada <manizada@pm.me>
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    [ adapted variable declarations ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: Fix refcount leak when invalid session is found on session lookup [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Fri Feb 27 11:16:01 2026 +0800

    ksmbd: Fix refcount leak when invalid session is found on session lookup
    
    [ Upstream commit cafb57f7bdd57abba87725eb4e82bbdca4959644 ]
    
    When a session is found but its state is not SMB2_SESSION_VALID, It
    indicates that no valid session was found, but it is missing to decrement
    the reference count acquired by the session lookup, which results in
    a reference count leak. This patch fixes the issue by explicitly calling
    ksmbd_user_session_put to release the reference to the session.
    
    Cc: stable@vger.kernel.org
    Reported-by: Alexandre <roger.andersen@protonmail.com>
    Reported-by: Stanislas Polu <spolu@dust.tt>
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Li hongliang <1468888505@139.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: fix use-after-free of share_conf in compound request [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Thu Mar 12 17:17:02 2026 +0900

    ksmbd: fix use-after-free of share_conf in compound request
    
    [ Upstream commit c33615f995aee80657b9fdfbc4ee7f49c2bd733d ]
    
    smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
    validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_state ==
    TREE_CONNECTED on the initial lookup path, but the compound reuse path
    bypasses this check entirely.
    
    If a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state
    to TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(),
    subsequent commands dereference the freed share_conf through
    work->tcon->share_conf.
    
    KASAN report:
    
    [    4.144653] ==================================================================
    [    4.145059] BUG: KASAN: slab-use-after-free in smb2_write+0xc74/0xe70
    [    4.145415] Read of size 4 at addr ffff88810430c194 by task kworker/1:1/44
    [    4.145772]
    [    4.145867] CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted 7.0.0-rc3+ #60 PREEMPTLAZY
    [    4.145871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [    4.145875] Workqueue: ksmbd-io handle_ksmbd_work
    [    4.145888] Call Trace:
    [    4.145892]  <TASK>
    [    4.145894]  dump_stack_lvl+0x64/0x80
    [    4.145910]  print_report+0xce/0x660
    [    4.145919]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
    [    4.145928]  ? smb2_write+0xc74/0xe70
    [    4.145931]  kasan_report+0xce/0x100
    [    4.145934]  ? smb2_write+0xc74/0xe70
    [    4.145937]  smb2_write+0xc74/0xe70
    [    4.145939]  ? __pfx_smb2_write+0x10/0x10
    [    4.145942]  ? _raw_spin_unlock+0xe/0x30
    [    4.145945]  ? ksmbd_smb2_check_message+0xeb2/0x24c0
    [    4.145948]  ? smb2_tree_disconnect+0x31c/0x480
    [    4.145951]  handle_ksmbd_work+0x40f/0x1080
    [    4.145953]  process_one_work+0x5fa/0xef0
    [    4.145962]  ? assign_work+0x122/0x3e0
    [    4.145964]  worker_thread+0x54b/0xf70
    [    4.145967]  ? __pfx_worker_thread+0x10/0x10
    [    4.145970]  kthread+0x346/0x470
    [    4.145976]  ? recalc_sigpending+0x19b/0x230
    [    4.145980]  ? __pfx_kthread+0x10/0x10
    [    4.145984]  ret_from_fork+0x4fb/0x6c0
    [    4.145992]  ? __pfx_ret_from_fork+0x10/0x10
    [    4.145995]  ? __switch_to+0x36c/0xbe0
    [    4.145999]  ? __pfx_kthread+0x10/0x10
    [    4.146003]  ret_from_fork_asm+0x1a/0x30
    [    4.146013]  </TASK>
    [    4.146014]
    [    4.149858] Allocated by task 44:
    [    4.149953]  kasan_save_stack+0x33/0x60
    [    4.150061]  kasan_save_track+0x14/0x30
    [    4.150169]  __kasan_kmalloc+0x8f/0xa0
    [    4.150274]  ksmbd_share_config_get+0x1dd/0xdd0
    [    4.150401]  ksmbd_tree_conn_connect+0x7e/0x600
    [    4.150529]  smb2_tree_connect+0x2e6/0x1000
    [    4.150645]  handle_ksmbd_work+0x40f/0x1080
    [    4.150761]  process_one_work+0x5fa/0xef0
    [    4.150873]  worker_thread+0x54b/0xf70
    [    4.150978]  kthread+0x346/0x470
    [    4.151071]  ret_from_fork+0x4fb/0x6c0
    [    4.151176]  ret_from_fork_asm+0x1a/0x30
    [    4.151286]
    [    4.151332] Freed by task 44:
    [    4.151418]  kasan_save_stack+0x33/0x60
    [    4.151526]  kasan_save_track+0x14/0x30
    [    4.151634]  kasan_save_free_info+0x3b/0x60
    [    4.151751]  __kasan_slab_free+0x43/0x70
    [    4.151861]  kfree+0x1ca/0x430
    [    4.151952]  __ksmbd_tree_conn_disconnect+0xc8/0x190
    [    4.152088]  smb2_tree_disconnect+0x1cd/0x480
    [    4.152211]  handle_ksmbd_work+0x40f/0x1080
    [    4.152326]  process_one_work+0x5fa/0xef0
    [    4.152438]  worker_thread+0x54b/0xf70
    [    4.152545]  kthread+0x346/0x470
    [    4.152638]  ret_from_fork+0x4fb/0x6c0
    [    4.152743]  ret_from_fork_asm+0x1a/0x30
    [    4.152853]
    [    4.152900] The buggy address belongs to the object at ffff88810430c180
    [    4.152900]  which belongs to the cache kmalloc-96 of size 96
    [    4.153226] The buggy address is located 20 bytes inside of
    [    4.153226]  freed 96-byte region [ffff88810430c180, ffff88810430c1e0)
    [    4.153549]
    [    4.153596] The buggy address belongs to the physical page:
    [    4.153750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810430ce80 pfn:0x10430c
    [    4.154000] flags: 0x100000000000200(workingset|node=0|zone=2)
    [    4.154160] page_type: f5(slab)
    [    4.154251] raw: 0100000000000200 ffff888100041280 ffff888100040110 ffff888100040110
    [    4.154461] raw: ffff88810430ce80 0000000800200009 00000000f5000000 0000000000000000
    [    4.154668] page dumped because: kasan: bad access detected
    [    4.154820]
    [    4.154866] Memory state around the buggy address:
    [    4.155002]  ffff88810430c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [    4.155196]  ffff88810430c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [    4.155391] >ffff88810430c180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
    [    4.155587]                          ^
    [    4.155693]  ffff88810430c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [    4.155891]  ffff88810430c280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [    4.156087] ==================================================================
    
    Add the same t_state validation to the compound reuse path, consistent
    with ksmbd_tree_conn_lookup().
    
    Fixes: 5005bcb42191 ("ksmbd: validate session id and tree id in the compound request")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Mon Mar 30 10:40:42 2026 -0400

    ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
    
    [ Upstream commit 0e55f63dd08f09651d39e1b709a91705a8a0ddcb ]
    
    After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"),
    response buffer management was changed to use dynamic iov array.
    In the new design, smb2_calc_max_out_buf_len() expects the second
    argument (hdr2_len) to be the offset of ->Buffer field in the
    response structure, not a hardcoded magic number.
    Fix the remaining call sites to use the correct offsetof() value.
    
    Cc: stable@vger.kernel.org
    Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    [ adapted `req->CtlCode` field access to `req->CntCode` ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE [+ + +]
Author: Sean Christopherson <seanjc@google.com>
Date:   Tue Mar 31 20:19:21 2026 -0400

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
    
    [ Upstream commit aad885e774966e97b675dfe928da164214a71605 ]
    
    When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
    existing SPTE (if it's shadow-present).  While commit a54aa15c6bda3 was
    right about it being impossible to convert a shadow-present SPTE to an
    MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
    memory that are outside the scope of KVM.
    
    E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
    to emulted MMIO and then the guest hits a relevant page fault, KVM will
    install the MMIO SPTE without first zapping the shadow-present SPTE.
    
      ------------[ cut here ]------------
      is_shadow_present_pte(*sptep)
      WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292
      Modules linked in: kvm_intel kvm irqbypass
      CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
      RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]
      Call Trace:
       <TASK>
       mmu_set_spte+0x237/0x440 [kvm]
       ept_page_fault+0x535/0x7f0 [kvm]
       kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]
       kvm_mmu_page_fault+0x8d/0x620 [kvm]
       vmx_handle_exit+0x18c/0x5a0 [kvm_intel]
       kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]
       kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
       __x64_sys_ioctl+0x8a/0xd0
       do_syscall_64+0xb5/0x730
       entry_SYSCALL_64_after_hwframe+0x4b/0x53
      RIP: 0033:0x47fa3f
       </TASK>
      ---[ end trace 0000000000000000 ]---
    
    Reported-by: Alexander Bulekov <bkov@amazon.com>
    Debugged-by: Alexander Bulekov <bkov@amazon.com>
    Suggested-by: Fred Griffoul <fgriffo@amazon.co.uk>
    Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    [ replaced `kvm_flush_remote_tlbs_gfn()` with `kvm_flush_remote_tlbs_with_address()` and omitted `pf_mmio_spte_created` stat counter ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
l2tp: do not use sock_hold() in pppol2tp_session_get_sock() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Aug 26 13:44:35 2025 +0000

    l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
    
    commit 9b8c88f875c04d4cb9111bd5dd9291c7e9691bf5 upstream.
    
    pppol2tp_session_get_sock() is using RCU, it must be ready
    for sk_refcnt being zero.
    
    Commit ee40fb2e1eb5 ("l2tp: protect sock pointer of
    struct pppol2tp_session with RCU") was correct because it
    had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit.
    
    pppol2tp_recv() can use pppol2tp_session_get_sock() as well.
    
    Fixes: c5cbaef992d6 ("l2tp: refactor ppp socket/session relationship")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: James Chapman <jchapman@katalix.com>
    Reviewed-by: Guillaume Nault <gnault@redhat.com>
    Link: https://patch.msgid.link/20250826134435.1683435-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Qingfang Deng <dqfext@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
lib/bootconfig: check bounds before writing in __xbc_open_brace() [+ + +]
Author: Josh Law <objecting@objecting.org>
Date:   Thu Mar 12 19:11:42 2026 +0000

    lib/bootconfig: check bounds before writing in __xbc_open_brace()
    
    commit 560f763baa0f2c9a44da4294c06af071405ac46f upstream.
    
    The bounds check for brace_index happens after the array write.
    While the current call pattern prevents an actual out-of-bounds
    access (the previous call would have returned an error), the
    write-before-check pattern is fragile and would become a real
    out-of-bounds write if the error return were ever not propagated.
    
    Move the bounds check before the array write so the function is
    self-contained and safe regardless of caller behavior.
    
    Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/
    
    Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
    Cc: stable@vger.kernel.org
    Signed-off-by: Josh Law <objecting@objecting.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/bootconfig: check xbc_init_node() return in override path [+ + +]
Author: Josh Law <objecting@objecting.org>
Date:   Thu Mar 19 08:43:05 2026 +0900

    lib/bootconfig: check xbc_init_node() return in override path
    
    [ Upstream commit bb288d7d869e86d382f35a0e26242c5ccb05ca82 ]
    
    The ':=' override path in xbc_parse_kv() calls xbc_init_node() to
    re-initialize an existing value node but does not check the return
    value. If xbc_init_node() fails (data offset out of range), parsing
    silently continues with stale node data.
    
    Add the missing error check to match the xbc_add_node() call path
    which already checks for failure.
    
    In practice, a bootconfig using ':=' to override a value near the
    32KB data limit could silently retain the old value, meaning a
    security-relevant boot parameter override (e.g., a trace filter or
    debug setting) would not take effect as intended.
    
    Link: https://lore.kernel.org/all/20260318155847.78065-2-objecting@objecting.org/
    
    Fixes: e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key")
    Signed-off-by: Josh Law <objecting@objecting.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error [+ + +]
Author: Josh Law <objecting@objecting.org>
Date:   Thu Mar 12 19:11:41 2026 +0000

    lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
    
    commit 39ebc8d7f561e1b64eca87353ef9b18e2825e591 upstream.
    
    __xbc_open_brace() pushes entries with post-increment
    (open_brace[brace_index++]), so brace_index always points one past
    the last valid entry.  xbc_verify_tree() reads open_brace[brace_index]
    to report which brace is unclosed, but this is one past the last
    pushed entry and contains stale/zero data, causing the error message
    to reference the wrong node.
    
    Use open_brace[brace_index - 1] to correctly identify the unclosed
    brace.  brace_index is known to be > 0 here since we are inside the
    if (brace_index) guard.
    
    Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/
    
    Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
    Cc: stable@vger.kernel.org
    Signed-off-by: Josh Law <objecting@objecting.org>
    Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() [+ + +]
Author: Josh Law <objecting@objecting.org>
Date:   Thu Mar 12 19:11:43 2026 +0000

    lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
    
    commit 1120a36bb1e9b9e22de75ecb4ef0b998f73a97f1 upstream.
    
    snprintf() returns the number of characters that would have been
    written excluding the NUL terminator.  Output is truncated when the
    return value is >= the buffer size, not just > the buffer size.
    
    When ret == size, the current code takes the non-truncated path,
    advancing buf by ret and reducing size to 0.  This is wrong because
    the output was actually truncated (the last character was replaced by
    NUL).  Fix by using >= so the truncation path is taken correctly.
    
    Link: https://lore.kernel.org/all/20260312191143.28719-4-objecting@objecting.org/
    
    Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Josh Law <objecting@objecting.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
lib/crypto: chacha: Zeroize permuted_state before it leaves scope [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Wed Mar 25 20:29:20 2026 -0700

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope
    
    commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream.
    
    Since the ChaCha permutation is invertible, the local variable
    'permuted_state' is sufficient to compute the original 'state', and thus
    the key, even after the permutation has been done.
    
    While the kernel is quite inconsistent about zeroizing secrets on the
    stack (and some prominent userspace crypto libraries don't bother at all
    since it's not guaranteed to work anyway), the kernel does try to do it
    as a best practice, especially in cases involving the RNG.
    
    Thus, explicitly zeroize 'permuted_state' before it goes out of scope.
    
    Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation")
    Cc: stable@vger.kernel.org
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
libceph: admit message frames only in CEPH_CON_S_OPEN state [+ + +]
Author: Ilya Dryomov <idryomov@gmail.com>
Date:   Sun Mar 8 17:57:23 2026 +0100

    libceph: admit message frames only in CEPH_CON_S_OPEN state
    
    commit a5a373705081d7cc6363e16990e2361b0b362314 upstream.
    
    Similar checks are performed for all control frames, but an early check
    for message frames was missing.  process_message() is already set up to
    terminate the loop in case the state changes while con->ops->dispatch()
    handler is being executed.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Reviewed-by: Alex Markuze <amarkuze@redhat.com>
    Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() [+ + +]
Author: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Date:   Tue Mar 10 15:28:15 2026 +0100

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
    
    commit b282c43ed156ae15ea76748fc15cd5c39dc9ab72 upstream.
    
    This patch fixes an out-of-bounds access in ceph_handle_auth_reply()
    that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In
    ceph_handle_auth_reply(), the value of the payload_len field of such a
    message is stored in a variable of type int. A value greater than
    INT_MAX leads to an integer overflow and is interpreted as a negative
    value. This leads to decrementing the pointer address by this value and
    subsequently accessing it because ceph_decode_need() only checks that
    the memory access does not exceed the end address of the allocation.
    
    This patch fixes the issue by changing the data type of payload_len to
    u32. Additionally, the data type of result_msg_len is changed to u32,
    as it is also a variable holding a non-negative length.
    
    Also, an additional layer of sanity checks is introduced, ensuring that
    directly after reading it from the message, payload_len and
    result_msg_len are not greater than the overall segment length.
    
    BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]
    Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262
    
    CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Workqueue: ceph-msgr ceph_con_workfn [libceph]
    Call Trace:
     <TASK>
     dump_stack_lvl+0x76/0xa0
     print_report+0xd1/0x620
     ? __pfx__raw_spin_lock_irqsave+0x10/0x10
     ? kasan_complete_mode_report_info+0x72/0x210
     kasan_report+0xe7/0x130
     ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
     ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
     __asan_report_load_n_noabort+0xf/0x20
     ceph_handle_auth_reply+0x642/0x7a0 [libceph]
     mon_dispatch+0x973/0x23d0 [libceph]
     ? apparmor_socket_recvmsg+0x6b/0xa0
     ? __pfx_mon_dispatch+0x10/0x10 [libceph]
     ? __kasan_check_write+0x14/0x30i
     ? mutex_unlock+0x7f/0xd0
     ? __pfx_mutex_unlock+0x10/0x10
     ? __pfx_do_recvmsg+0x10/0x10 [libceph]
     ceph_con_process_message+0x1f1/0x650 [libceph]
     process_message+0x1e/0x450 [libceph]
     ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]
     ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]
     ? save_fpregs_to_fpstate+0xb0/0x230
     ? raw_spin_rq_unlock+0x17/0xa0
     ? finish_task_switch.isra.0+0x13b/0x760
     ? __switch_to+0x385/0xda0
     ? __kasan_check_write+0x14/0x30
     ? mutex_lock+0x8d/0xe0
     ? __pfx_mutex_lock+0x10/0x10
     ceph_con_workfn+0x248/0x10c0 [libceph]
     process_one_work+0x629/0xf80
     ? __kasan_check_write+0x14/0x30
     worker_thread+0x87f/0x1570
     ? __pfx__raw_spin_lock_irqsave+0x10/0x10
     ? __pfx_try_to_wake_up+0x10/0x10
     ? kasan_print_address_stack_frame+0x1f7/0x280
     ? __pfx_worker_thread+0x10/0x10
     kthread+0x396/0x830
     ? __pfx__raw_spin_lock_irq+0x10/0x10
     ? __pfx_kthread+0x10/0x10
     ? __kasan_check_write+0x14/0x30
     ? recalc_sigpending+0x180/0x210
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x3f7/0x610
     ? __pfx_ret_from_fork+0x10/0x10
     ? __switch_to+0x385/0xda0
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    
    [ idryomov: replace if statements with ceph_decode_need() for
      payload_len and result_msg_len ]
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
    Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

libceph: prevent potential out-of-bounds reads in process_message_header() [+ + +]
Author: Ilya Dryomov <idryomov@gmail.com>
Date:   Sun Mar 8 17:38:00 2026 +0100

    libceph: prevent potential out-of-bounds reads in process_message_header()
    
    commit 69fb5d91bba44ecf7eb80530b85fa4fb028921d5 upstream.
    
    If the message frame is (maliciously) corrupted in a way that the
    length of the control segment ends up being less than the size of the
    message header or a different frame is made to look like a message
    frame, out-of-bounds reads may ensue in process_message_header().
    
    Perform an explicit bounds check before decoding the message header.
    
    Cc: stable@vger.kernel.org
    Reported-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Reviewed-by: Alex Markuze <amarkuze@redhat.com>
    Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

libceph: reject preamble if control segment is empty [+ + +]
Author: Ilya Dryomov <idryomov@gmail.com>
Date:   Sun Mar 8 20:01:27 2026 +0100

    libceph: reject preamble if control segment is empty
    
    commit c4c22b846eceff05b1129b8844a80310e55a7f87 upstream.
    
    While head_onwire_len() has a branch to handle ctrl_len == 0 case,
    prepare_read_control() always sets up a kvec for the CRC meaning that
    a non-empty control segment is effectively assumed.  All frames that
    clients deal with meet that assumption, so let's make it official and
    treat the preamble with an empty control segment as malformed.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Reviewed-by: Alex Markuze <amarkuze@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

libceph: Use u32 for non-negative values in ceph_monmap_decode() [+ + +]
Author: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Date:   Thu Feb 26 16:07:31 2026 +0100

    libceph: Use u32 for non-negative values in ceph_monmap_decode()
    
    commit 770444611f047dbfd4517ec0bc1b179d40c2f346 upstream.
    
    This patch fixes unnecessary implicit conversions that change signedness
    of blob_len and num_mon in ceph_monmap_decode().
    Currently blob_len and num_mon are (signed) int variables. They are used
    to hold values that are always non-negative and get assigned in
    ceph_decode_32_safe(), which is meant to assign u32 values. Both
    variables are subsequently used as unsigned values, and the value of
    num_mon is further assigned to monmap->num_mon, which is of type u32.
    Therefore, both variables should be of type u32. This is especially
    relevant for num_mon. If the value read from the incoming message is
    very large, it is interpreted as a negative value, and the check for
    num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to
    allocate a very large chunk of memory for monmap, which will most likely
    fail. In this case, an unnecessary attempt to allocate memory is
    performed, and -ENOMEM is returned instead of -EINVAL.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
    Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Linux: Linux 5.15.203 [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Apr 18 10:33:39 2026 +0200

    Linux 5.15.203
    
    Link: https://lore.kernel.org/r/20260413155830.386096114@linuxfoundation.org
    Tested-by: Brett A C Sheffield <bacs@librecast.net>
    Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Vijayendra Suman <vijayendra.suman@oracle.com>
    Tested-by: Mark Brown <broonie@kernel.org>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Barry K. Nathan <barryn@pobox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen [+ + +]
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Feb 24 11:51:16 2026 -0700

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
    
    commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 upstream.
    
    dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the
    DVR device.  dvb_ringbuffer_init() calls init_waitqueue_head(), which
    reinitializes the waitqueue list head to empty.
    
    Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the
    same DVR device share it), this orphans any existing waitqueue entries
    from io_uring poll or epoll, leaving them with stale prev/next pointers
    while the list head is reset to {self, self}.
    
    The waitqueue and spinlock in dvr_buffer are already properly
    initialized once in dvb_dmxdev_init().  The open path only needs to
    reset the buffer data pointer, size, and read/write positions.
    
    Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct
    assignment of data/size and a call to dvb_ringbuffer_reset(), which
    properly resets pread, pwrite, and error with correct memory ordering
    without touching the waitqueue or spinlock.
    
    Cc: stable@vger.kernel.org
    Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer")
    Reported-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com
    Tested-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: dvb-net: fix OOB access in ULE extension header tables [+ + +]
Author: Ariel Silver <arielsilver77@gmail.com>
Date:   Sat Feb 21 15:26:00 2026 +0100

    media: dvb-net: fix OOB access in ULE extension header tables
    
    commit 24d87712727a5017ad142d63940589a36cd25647 upstream.
    
    The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
    in handle_one_ule_extension() are declared with 255 elements (valid
    indices 0-254), but the index htype is derived from network-controlled
    data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
    htype equals 255, an out-of-bounds read occurs on the function pointer
    table, and the OOB value may be called as a function pointer.
    
    Add a bounds check on htype against the array size before either table
    is accessed. Out-of-range values now cause the SNDU to be discarded.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Ariel Silver <arielsilver77@gmail.com>
    Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex [+ + +]
Author: Yuchan Nam <entropy1110@gmail.com>
Date:   Fri Mar 6 21:52:23 2026 +0900

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
    
    commit bef4f4a88b73e4cc550d25f665b8a9952af22773 upstream.
    
    MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)
    queue teardown paths. This can race request object cleanup against vb2
    queue cancellation and lead to use-after-free reports.
    
    We already serialize request queueing against STREAMON/OFF with
    req_queue_mutex. Extend that serialization to REQBUFS, and also take
    the same mutex in media_request_ioctl_reinit() so REINIT is in the
    same exclusion domain.
    
    This keeps request cleanup and queue cancellation from running in
    parallel for request-capable devices.
    
    Fixes: 6093d3002eab ("media: vb2: keep a reference to the request until dqbuf")
    Cc: stable@vger.kernel.org
    Signed-off-by: Yuchan Nam <entropy1110@gmail.com>
    Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID [+ + +]
Author: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Date:   Wed Aug 20 16:08:16 2025 +0000

    media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    
    [ Upstream commit 0e2ee70291e64a30fe36960c85294726d34a103e ]
    
    Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
    unique ID.
    
    ```
    Each Unit and Terminal within the video function is assigned a unique
    identification number, the Unit ID (UID) or Terminal ID (TID), contained in
    the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
    reserved for undefined ID,
    ```
    
    If we add a new entity with id 0 or a duplicated ID, it will be marked
    as UVC_INVALID_ENTITY_ID.
    
    In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require
    entities to have a non-zero unique ID"), we ignored all the invalid units,
    this broke a lot of non-compatible cameras. Hopefully we are more lucky
    this time.
    
    This also prevents some syzkaller reproducers from triggering warnings due
    to a chain of entities referring to themselves. In one particular case, an
    Output Unit is connected to an Input Unit, both with the same ID of 1. But
    when looking up for the source ID of the Output Unit, that same entity is
    found instead of the input entity, which leads to such warnings.
    
    In another case, a backward chain was considered finished as the source ID
    was 0. Later on, that entity was found, but its pads were not valid.
    
    Here is a sample stack trace for one of those cases.
    
    [   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
    [   20.830206] usb 1-1: Using ep0 maxpacket: 8
    [   20.833501] usb 1-1: config 0 descriptor??
    [   21.038518] usb 1-1: string descriptor 0 read error: -71
    [   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
    [   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
    [   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
    [   21.042218] ------------[ cut here ]------------
    [   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
    [   21.043195] Modules linked in:
    [   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
    [   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
    [   21.044639] Workqueue: usb_hub_wq hub_event
    [   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
    [   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
    [   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
    [   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
    [   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
    [   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
    [   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
    [   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
    [   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
    [   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
    [   21.051136] PKRU: 55555554
    [   21.051331] Call Trace:
    [   21.051480]  <TASK>
    [   21.051611]  ? __warn+0xc4/0x210
    [   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
    [   21.052252]  ? report_bug+0x11b/0x1a0
    [   21.052540]  ? trace_hardirqs_on+0x31/0x40
    [   21.052901]  ? handle_bug+0x3d/0x70
    [   21.053197]  ? exc_invalid_op+0x1a/0x50
    [   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
    [   21.053924]  ? media_create_pad_link+0x91/0x2e0
    [   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
    [   21.054834]  ? media_create_pad_link+0x91/0x2e0
    [   21.055131]  ? _raw_spin_unlock+0x1e/0x40
    [   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
    [   21.055837]  uvc_mc_register_entities+0x358/0x400
    [   21.056144]  uvc_register_chains+0x1fd/0x290
    [   21.056413]  uvc_probe+0x380e/0x3dc0
    [   21.056676]  ? __lock_acquire+0x5aa/0x26e0
    [   21.056946]  ? find_held_lock+0x33/0xa0
    [   21.057196]  ? kernfs_activate+0x70/0x80
    [   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
    [   21.057811]  ? find_held_lock+0x33/0xa0
    [   21.058047]  ? usb_match_dynamic_id+0x55/0x70
    [   21.058330]  ? lock_release+0x124/0x260
    [   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
    [   21.058997]  usb_probe_interface+0x1ba/0x330
    [   21.059399]  really_probe+0x1ba/0x4c0
    [   21.059662]  __driver_probe_device+0xb2/0x180
    [   21.059944]  driver_probe_device+0x5a/0x100
    [   21.060170]  __device_attach_driver+0xe9/0x160
    [   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
    [   21.060872]  bus_for_each_drv+0xa9/0x100
    [   21.061312]  __device_attach+0xed/0x190
    [   21.061812]  device_initial_probe+0xe/0x20
    [   21.062229]  bus_probe_device+0x4d/0xd0
    [   21.062590]  device_add+0x308/0x590
    [   21.062912]  usb_set_configuration+0x7b6/0xaf0
    [   21.063403]  usb_generic_driver_probe+0x36/0x80
    [   21.063714]  usb_probe_device+0x7b/0x130
    [   21.063936]  really_probe+0x1ba/0x4c0
    [   21.064111]  __driver_probe_device+0xb2/0x180
    [   21.064577]  driver_probe_device+0x5a/0x100
    [   21.065019]  __device_attach_driver+0xe9/0x160
    [   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
    [   21.065820]  bus_for_each_drv+0xa9/0x100
    [   21.066094]  __device_attach+0xed/0x190
    [   21.066535]  device_initial_probe+0xe/0x20
    [   21.066992]  bus_probe_device+0x4d/0xd0
    [   21.067250]  device_add+0x308/0x590
    [   21.067501]  usb_new_device+0x347/0x610
    [   21.067817]  hub_event+0x156b/0x1e30
    [   21.068060]  ? process_scheduled_works+0x48b/0xaf0
    [   21.068337]  process_scheduled_works+0x5a3/0xaf0
    [   21.068668]  worker_thread+0x3cf/0x560
    [   21.068932]  ? kthread+0x109/0x1b0
    [   21.069133]  kthread+0x197/0x1b0
    [   21.069343]  ? __pfx_worker_thread+0x10/0x10
    [   21.069598]  ? __pfx_kthread+0x10/0x10
    [   21.069908]  ret_from_fork+0x32/0x40
    [   21.070169]  ? __pfx_kthread+0x10/0x10
    [   21.070424]  ret_from_fork_asm+0x1a/0x30
    [   21.070737]  </TASK>
    
    Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
    Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
    Reported-by: Youngjun Lee <yjjuny.lee@samsung.com>
    Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
    Cc: stable@vger.kernel.org
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
    Co-developed-by: Ricardo Ribalda <ribalda@chromium.org>
    Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Reviewed-by: Hans de Goede <hansg@kernel.org>
    Signed-off-by: Hans de Goede <hansg@kernel.org>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

media: uvcvideo: Use heuristic to find stream entity [+ + +]
Author: Ricardo Ribalda <ribalda@chromium.org>
Date:   Tue Oct 21 10:36:17 2025 +0000

    media: uvcvideo: Use heuristic to find stream entity
    
    [ Upstream commit 758dbc756aad429da11c569c0d067f7fd032bcf7 ]
    
    Some devices, like the Grandstream GUV3100 webcam, have an invalid UVC
    descriptor where multiple entities share the same ID, this is invalid
    and makes it impossible to make a proper entity tree without heuristics.
    
    We have recently introduced a change in the way that we handle invalid
    entities that has caused a regression on broken devices.
    
    Implement a new heuristic to handle these devices properly.
    
    Reported-by: Angel4005 <ooara1337@gmail.com>
    Closes: https://lore.kernel.org/linux-media/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=DaA@mail.gmail.com/
    Fixes: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
    Reviewed-by: Hans de Goede <hansg@kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
memory: mtk-smi: Convert to platform remove callback returning void [+ + +]
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Sun Dec 17 15:29:33 2023 +0100

    memory: mtk-smi: Convert to platform remove callback returning void
    
    [ Upstream commit 08c1aeaa45ce0fd18912e92c6705586c8aa5240f ]
    
    The .remove() callback for a platform driver returns an int which makes
    many driver authors wrongly assume it's possible to do error handling by
    returning an error code. However the value returned is ignored (apart
    from emitting a warning) and this typically results in resource leaks.
    
    To improve here there is a quest to make the remove callback return
    void. In the first step of this quest all drivers are converted to
    .remove_new(), which already returns void. Eventually after all drivers
    are converted, .remove_new() will be renamed to .remove().
    
    Trivially convert this driver from always returning zero in the remove
    callback to the void returning variant.
    
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Link: https://lore.kernel.org/r/5c35a33cfdc359842e034ddd2e9358f10e91fa1f.1702822744.git.u.kleine-koenig@pengutronix.de
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Stable-dep-of: 9dae65913b32 ("memory: mtk-smi: fix device leak on larb probe")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

memory: mtk-smi: fix device leak on larb probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Nov 21 17:46:23 2025 +0100

    memory: mtk-smi: fix device leak on larb probe
    
    [ Upstream commit 9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6 ]
    
    Make sure to drop the reference taken when looking up the SMI device
    during larb probe on late probe failure (e.g. probe deferral) and on
    driver unbind.
    
    Fixes: cc8bbe1a8312 ("memory: mediatek: Add SMI driver")
    Fixes: 038ae37c510f ("memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common")
    Cc: stable@vger.kernel.org      # 4.6: 038ae37c510f
    Cc: stable@vger.kernel.org      # 4.6
    Cc: Yong Wu <yong.wu@mediatek.com>
    Cc: Miaoqian Lin <linmq006@gmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://patch.msgid.link/20251121164624.13685-3-johan@kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
mfd: omap-usb-host: Convert to platform remove callback returning void [+ + +]
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Thu Nov 23 17:56:38 2023 +0100

    mfd: omap-usb-host: Convert to platform remove callback returning void
    
    [ Upstream commit 418d1e74f8597e0b2d5d0d6e1be8f1f47e68f0a4 ]
    
    The .remove() callback for a platform driver returns an int which makes
    many driver authors wrongly assume it's possible to do error handling by
    returning an error code. However the value returned is ignored (apart
    from emitting a warning) and this typically results in resource leaks.
    
    To improve here there is a quest to make the remove callback return
    void. In the first step of this quest all drivers are converted to
    .remove_new(), which already returns void. Eventually after all drivers
    are converted, .remove_new() will be renamed to .remove().
    
    Trivially convert this driver from always returning zero in the remove
    callback to the void returning variant.
    
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Link: https://lore.kernel.org/r/20231123165627.492259-11-u.kleine-koenig@pengutronix.de
    Signed-off-by: Lee Jones <lee@kernel.org>
    Stable-dep-of: 24804ba508a3 ("mfd: omap-usb-host: Fix OF populate on driver rebind")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mfd: omap-usb-host: Fix OF populate on driver rebind [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Dec 19 12:07:14 2025 +0100

    mfd: omap-usb-host: Fix OF populate on driver rebind
    
    [ Upstream commit 24804ba508a3e240501c521685a1c4eb9f574f8e ]
    
    Since commit c6e126de43e7 ("of: Keep track of populated platform
    devices") child devices will not be created by of_platform_populate()
    if the devices had previously been deregistered individually so that the
    OF_POPULATED flag is still set in the corresponding OF nodes.
    
    Switch to using of_platform_depopulate() instead of open coding so that
    the child devices are created if the driver is rebound.
    
    Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
    Cc: stable@vger.kernel.org      # 3.16
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
    Link: https://patch.msgid.link/20251219110714.23919-1-johan@kernel.org
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mfd: qcom-pm8xxx: Convert to platform remove callback returning void [+ + +]
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Thu Nov 23 17:56:41 2023 +0100

    mfd: qcom-pm8xxx: Convert to platform remove callback returning void
    
    [ Upstream commit 19ea1d3953017518d85db35b69b5aea9bc64d630 ]
    
    The .remove() callback for a platform driver returns an int which makes
    many driver authors wrongly assume it's possible to do error handling by
    returning an error code. However the value returned is ignored (apart
    from emitting a warning) and this typically results in resource leaks.
    
    To improve here there is a quest to make the remove callback return
    void. In the first step of this quest all drivers are converted to
    .remove_new(), which already returns void. Eventually after all drivers
    are converted, .remove_new() will be renamed to .remove().
    
    Trivially convert this driver from always returning zero in the remove
    callback to the void returning variant.
    
    Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Link: https://lore.kernel.org/r/20231123165627.492259-14-u.kleine-koenig@pengutronix.de
    Signed-off-by: Lee Jones <lee@kernel.org>
    Stable-dep-of: 27a8acea47a9 ("mfd: qcom-pm8xxx: Fix OF populate on driver rebind")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mfd: qcom-pm8xxx: Fix OF populate on driver rebind [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Dec 19 12:09:47 2025 +0100

    mfd: qcom-pm8xxx: Fix OF populate on driver rebind
    
    [ Upstream commit 27a8acea47a93fea6ad0e2df4c20a9b51490e4d9 ]
    
    Since commit c6e126de43e7 ("of: Keep track of populated platform
    devices") child devices will not be created by of_platform_populate()
    if the devices had previously been deregistered individually so that the
    OF_POPULATED flag is still set in the corresponding OF nodes.
    
    Switch to using of_platform_depopulate() instead of open coding so that
    the child devices are created if the driver is rebound.
    
    Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
    Cc: stable@vger.kernel.org      # 3.16
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251219110947.24101-1-johan@kernel.org
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mfd: qcom-pm8xxx: switch away from using chained IRQ handlers [+ + +]
Author: Dmitry Baryshkov <lumag@kernel.org>
Date:   Sun Sep 26 02:43:33 2021 +0300

    mfd: qcom-pm8xxx: switch away from using chained IRQ handlers
    
    [ Upstream commit d3546ccdce4bc07fcf0648bfe865dbcd6d961afc ]
    
    PM8xxx PMIC family uses GPIO as parent IRQ. Using it together with the
    irq_set_chained_handler_and_data() results in warnings from the GPIOLIB
    (see 461c1a7d4733 ("gpiolib: override irq_enable/disable"))
    as in this path the IRQ resources are not allocated (and thus the
    corresponding GPIO is not marked as used for the IRQ. Use request_irq so
    that the IRQ resources are proprely setup.
    
    [ 0.803271] ------------[ cut here ]------------
    [ 0.803338] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3207 gpiochip_enable_irq+0xa4/0xa8
    [ 0.803470] Modules linked in:
    [ 0.803542] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6-next-20210820-postmarketos-qcom-apq8064+ #1
    [ 0.803645] Hardware name: Generic DT based system
    [ 0.803710] Backtrace:
    [ 0.803777] [<c0e3493c>] (dump_backtrace) from [<c0e34d00>] (show_stack+0x20/0x24)
    [ 0.803911] r7:00000c87 r6:c07062dc r5:60000093 r4:c11d0f54
    [ 0.803980] [<c0e34ce0>] (show_stack) from [<c0e38314>] (dump_stack_lvl+0x48/0x54)
    [ 0.804097] [<c0e382cc>] (dump_stack_lvl) from [<c0e38338>] (dump_stack+0x18/0x1c)
    [ 0.804217] r5:00000009 r4:c11fe208
    [ 0.804274] [<c0e38320>] (dump_stack) from [<c03219c8>] (__warn+0xfc/0x114)
    [ 0.804387] [<c03218cc>] (__warn) from [<c0e35334>] (warn_slowpath_fmt+0x74/0xd0)
    [ 0.804509] r7:c07062dc r6:00000c87 r5:c11fe208 r4:00000000
    [ 0.804577] [<c0e352c4>] (warn_slowpath_fmt) from [<c07062dc>] (gpiochip_enable_irq+0xa4/0xa8)
    [ 0.804716] r8:c27b6200 r7:c27aec00 r6:c27aec18 r5:cf77a448 r4:c02225f0
    [ 0.804789] [<c0706238>] (gpiochip_enable_irq) from [<c0706348>] (gpiochip_irq_enable+0x28/0x38)
    [ 0.804921] r5:cf77a448 r4:c27aec18
    [ 0.804977] [<c0706320>] (gpiochip_irq_enable) from [<c03897a0>] (irq_enable+0x48/0x78)
    [ 0.805111] r5:00000000 r4:c27aec00
    [ 0.805167] [<c0389758>] (irq_enable) from [<c0389850>] (__irq_startup+0x80/0xbc)
    [ 0.805286] r5:00000000 r4:c27aec00
    [ 0.805343] [<c03897d0>] (__irq_startup) from [<c038996c>] (irq_startup+0xe0/0x18c)
    [ 0.805468] r7:c27aec00 r6:00000001 r5:00000000 r4:c27aec00
    [ 0.805535] [<c038988c>] (irq_startup) from [<c0389a54>] (irq_activate_and_startup+0x3c/0x74)
    [ 0.805669] r7:c27aec00 r6:00000001 r5:c27aec00 r4:00000000
    [ 0.805736] [<c0389a18>] (irq_activate_and_startup) from [<c0389b58>] (__irq_do_set_handler+0xcc/0x1c0)
    [ 0.805875] r7:c27aec00 r6:c0383710 r5:c08a16b0 r4:00000001
    [ 0.805943] [<c0389a8c>] (__irq_do_set_handler) from [<c0389d80>] (irq_set_chained_handler_and_data+0x60/0x98)
    [ 0.806087] r7:c27b5c10 r6:c27aed40 r5:c08a16b0 r4:c27aec00
    [ 0.806154] [<c0389d20>] (irq_set_chained_handler_and_data) from [<c08a1660>] (pm8xxx_probe+0x1fc/0x24c)
    [ 0.806298] r6:0000003a r5:0000003a r4:c27b5c00
    [ 0.806359] [<c08a1464>] (pm8xxx_probe) from [<c0871420>] (platform_probe+0x6c/0xc8)
    [ 0.806495] r10:c2507080 r9:e8bea2cc r8:c165e0e0 r7:c165e0e0 r6:c15f08f8 r5:c27b5c10
    [ 0.806582] r4:00000000
    [ 0.806632] [<c08713b4>] (platform_probe) from [<c086e280>] (really_probe+0xe8/0x460)
    [ 0.806769] r7:c165e0e0 r6:c15f08f8 r5:00000000 r4:c27b5c10
    [ 0.806837] [<c086e198>] (really_probe) from [<c086e6a8>] (__driver_probe_device+0xb0/0x22c)
    [ 0.806975] r7:c27b5c10 r6:cf70fba4 r5:c15f08f8 r4:c27b5c10
    [ 0.807042] [<c086e5f8>] (__driver_probe_device) from [<c086e868>] (driver_probe_device+0x44/0xe0)
    [ 0.807188] r9:e8bea2cc r8:00000000 r7:c27b5c10 r6:cf70fba4 r5:c16ae4b4 r4:c16ae4b0
    [ 0.807271] [<c086e824>] (driver_probe_device) from [<c086ecd8>] (__device_attach_driver+0xb4/0x12c)
    [ 0.807421] r9:e8bea2cc r8:c15eec08 r7:c27b5c10 r6:cf70fba4 r5:c15f08f8 r4:00000001
    [ 0.807506] [<c086ec24>] (__device_attach_driver) from [<c086c06c>] (bus_for_each_drv+0x94/0xe4)
    [ 0.807651] r7:c16ae484 r6:c086ec24 r5:cf70fba4 r4:00000000
    [ 0.807718] [<c086bfd8>] (bus_for_each_drv) from [<c086e0e0>] (__device_attach+0x104/0x19c)
    [ 0.807852] r6:00000001 r5:c27b5c54 r4:c27b5c10
    [ 0.807913] [<c086dfdc>] (__device_attach) from [<c086eef4>] (device_initial_probe+0x1c/0x20)
    [ 0.808050] r6:c27b5c10 r5:c15ef1b0 r4:c27b5c10
    [ 0.808111] [<c086eed8>] (device_initial_probe) from [<c086d00c>] (bus_probe_device+0x94/0x9c)
    [ 0.808240] [<c086cf78>] (bus_probe_device) from [<c086a60c>] (device_add+0x404/0x8f4)
    [ 0.808370] r7:c16ae484 r6:c251ba10 r5:00000000 r4:c27b5c10
    [ 0.808439] [<c086a208>] (device_add) from [<c0a82f50>] (of_device_add+0x44/0x4c)
    [ 0.808581] r10:c144c854 r9:00000001 r8:e8bea314 r7:c251ba10 r6:00000000 r5:00000000
    [ 0.808669] r4:c27b5c00
    [ 0.808718] [<c0a82f0c>] (of_device_add) from [<c0a836cc>] (of_platform_device_create_pdata+0xa0/0xc8)
    [ 0.808850] [<c0a8362c>] (of_platform_device_create_pdata) from [<c0a83908>] (of_platform_bus_create+0x1f0/0x514)
    [ 0.809005] r9:00000001 r8:c251ba10 r7:00000000 r6:00000000 r5:00000000 r4:e8bea2b0
    [ 0.809086] [<c0a83718>] (of_platform_bus_create) from [<c0a83e04>] (of_platform_populate+0x98/0x128)
    [ 0.809233] r10:c144c854 r9:00000001 r8:c251ba10 r7:00000000 r6:00000000 r5:e8bea170
    [ 0.809321] r4:e8bea2b0
    [ 0.809371] [<c0a83d6c>] (of_platform_populate) from [<c0a83f20>] (devm_of_platform_populate+0x60/0xa8)
    [ 0.809521] r9:0000011d r8:c165e0e0 r7:e8bea170 r6:c2c34f40 r5:c2cac140 r4:c251ba10
    [ 0.809604] [<c0a83ec0>] (devm_of_platform_populate) from [<c08a212c>] (ssbi_probe+0x138/0x16c)
    [ 0.809738] r6:c2c34f40 r5:c251ba10 r4:ff822700
    [ 0.809800] [<c08a1ff4>] (ssbi_probe) from [<c0871420>] (platform_probe+0x6c/0xc8)
    [ 0.809923] r7:c165e0e0 r6:c15f0a80 r5:c251ba10 r4:00000000
    [ 0.809989] [<c08713b4>] (platform_probe) from [<c086e280>] (really_probe+0xe8/0x460)
    [ 0.810120] r7:c165e0e0 r6:c15f0a80 r5:00000000 r4:c251ba10
    [ 0.810187] [<c086e198>] (really_probe) from [<c086e6a8>] (__driver_probe_device+0xb0/0x22c)
    [ 0.810325] r7:c251ba10 r6:c15f0a80 r5:c15f0a80 r4:c251ba10
    [ 0.810393] [<c086e5f8>] (__driver_probe_device) from [<c086e868>] (driver_probe_device+0x44/0xe0)
    [ 0.810539] r9:0000011d r8:00000000 r7:c251ba10 r6:c15f0a80 r5:c16ae4b4 r4:c16ae4b0
    [ 0.810623] [<c086e824>] (driver_probe_device) from [<c086ee2c>] (__driver_attach+0xdc/0x188)
    [ 0.810766] r9:0000011d r8:c144c834 r7:00000000 r6:c15f0a80 r5:c251ba10 r4:00000000
    [ 0.810849] [<c086ed50>] (__driver_attach) from [<c086bf60>] (bus_for_each_dev+0x88/0xd4)
    [ 0.810985] r7:00000000 r6:c086ed50 r5:c15f0a80 r4:00000000
    [ 0.811052] [<c086bed8>] (bus_for_each_dev) from [<c086dad4>] (driver_attach+0x2c/0x30)
    [ 0.811182] r6:c15ef1b0 r5:c2c34e80 r4:c15f0a80
    [ 0.811243] [<c086daa8>] (driver_attach) from [<c086d2dc>] (bus_add_driver+0x180/0x21c)
    [ 0.811364] [<c086d15c>] (bus_add_driver) from [<c086fa6c>] (driver_register+0x84/0x118)
    [ 0.811492] r7:00000000 r6:ffffe000 r5:c1428210 r4:c15f0a80
    [ 0.811558] [<c086f9e8>] (driver_register) from [<c0871174>] (__platform_driver_register+0x2c/0x34)
    [ 0.811683] r5:c1428210 r4:c16524a0
    [ 0.811739] [<c0871148>] (__platform_driver_register) from [<c1428234>] (ssbi_driver_init+0x24/0x28)
    [ 0.811868] [<c1428210>] (ssbi_driver_init) from [<c0302394>] (do_one_initcall+0x68/0x2c8)
    [ 0.811990] [<c030232c>] (do_one_initcall) from [<c140147c>] (kernel_init_freeable+0x1dc/0x23c)
    [ 0.812135] r7:cf7b0400 r6:c130339c r5:00000007 r4:c147f6a0
    [ 0.812204] [<c14012a0>] (kernel_init_freeable) from [<c0e40e60>] (kernel_init+0x20/0x138)
    [ 0.812345] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c0e40e40
    [ 0.812433] r4:00000000
    [ 0.812483] [<c0e40e40>] (kernel_init) from [<c0300150>] (ret_from_fork+0x14/0x24)
    [ 0.812596] Exception stack(0xcf70ffb0 to 0xcf70fff8)
    [ 0.812684] ffa0: 00000000 00000000 00000000 00000000
    [ 0.812809] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    [ 0.812923] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
    [ 0.813008] r5:c0e40e40 r4:00000000
    [ 0.813075] ---[ end trace ad2443eee078d094 ]---
    
    Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Tested-by: David Heidelberg <david@ixit.cz> # on Nexus 7 (deb)
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Link: https://lore.kernel.org/r/20210925234333.2430755-1-dmitry.baryshkov@linaro.org
    Stable-dep-of: 27a8acea47a9 ("mfd: qcom-pm8xxx: Fix OF populate on driver rebind")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
MIPS: Fix the GCC version check for `__multi3' workaround [+ + +]
Author: Maciej W. Rozycki <macro@orcam.me.uk>
Date:   Mon Mar 30 02:54:09 2026 +0100

    MIPS: Fix the GCC version check for `__multi3' workaround
    
    commit ec8bf18814915460d9c617b556bf024efef26613 upstream.
    
    It was only GCC 10 that fixed a MIPS64r6 code generation issue with a
    `__multi3' libcall inefficiently produced to perform 64-bit widening
    multiplication while suitable machine instructions exist to do such a
    calculation.  The fix went in with GCC commit 48b2123f6336 ("re PR
    target/82981 (unnecessary __multi3 call for mips64r6 linux kernel)").
    
    Adjust our code accordingly, removing build failures such as:
    
    mips64-linux-ld: lib/math/div64.o: in function `mul_u64_add_u64_div_u64':
    div64.c:(.text+0x84): undefined reference to `__multi3'
    
    with the GCC versions affected.
    
    Fixes: ebabcf17bcd7 ("MIPS: Implement __multi3 for GCC7 MIPS64r6 builds")
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202601140146.hMLODc6v-lkp@intel.com/
    Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
    Cc: stable@vger.kernel.org # v4.15+
    Reviewed-by: David Laight <david.laight.linux@gmail.com.
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/huge_memory: fix folio isn't locked in softleaf_to_folio() [+ + +]
Author: Jinjiang Tu <tujinjiang@huawei.com>
Date:   Tue Mar 31 10:25:47 2026 -0400

    mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
    
    [ Upstream commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 ]
    
    On arm64 server, we found folio that get from migration entry isn't locked
    in softleaf_to_folio().  This issue triggers when mTHP splitting and
    zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
    in softleaf_to_folio().  The race is as follows:
    
            CPU0                                             CPU1
    
    deferred_split_scan()                              zap_nonpresent_ptes()
      lock folio
      split_folio()
        unmap_folio()
          change ptes to migration entries
        __split_folio_to_order()                         softleaf_to_folio()
          set flags(including PG_locked) for tail pages    folio = pfn_folio(softleaf_to_pfn(entry))
          smp_wmb()                                        VM_WARN_ON_ONCE(!folio_test_locked(folio))
          prep_compound_page() for tail pages
    
    In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
    are visible before the tail page becomes non-compound.  smp_wmb() should
    be paired with smp_rmb() in softleaf_to_folio(), which is missed.  As a
    result, if zap_nonpresent_ptes() accesses migration entry that stores tail
    pfn, softleaf_to_folio() may see the updated compound_head of tail page
    before page->flags.
    
    This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
    because of the race between folio split and zap_nonpresent_ptes()
    leading to a folio incorrectly undergoing modification without a folio
    lock being held.
    
    This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further
    swapops predicates"), which in merged in v6.19-rc1.
    
    To fix it, add missing smp_rmb() if the softleaf entry is migration entry
    in softleaf_to_folio() and softleaf_to_page().
    
    [tujinjiang@huawei.com: update function name and comments]
      Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com
    Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com
    Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()")
    Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
    Acked-by: David Hildenbrand (Arm) <david@kernel.org>
    Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
    Cc: Barry Song <baohua@kernel.org>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Mike Rapoport <rppt@kernel.org>
    Cc: Nanyong Sun <sunnanyong@huawei.com>
    Cc: Ryan Roberts <ryan.roberts@arm.com>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: Vlastimil Babka <vbabka@kernel.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ adapted fix from leafops.h softleaf_to_page()/softleaf_to_folio() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count [+ + +]
Author: Jane Chu <jane.chu@oracle.com>
Date:   Mon Sep 15 18:45:20 2025 -0600

    mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
    
    commit 14967a9c7d247841b0312c48dcf8cd29e55a4cc8 upstream.
    
    commit 59d9094df3d79 ("mm: hugetlb: independent PMD page table shared
    count") introduced ->pt_share_count dedicated to hugetlb PMD share count
    tracking, but omitted fixing copy_hugetlb_page_range(), leaving the
    function relying on page_count() for tracking that no longer works.
    
    When lazy page table copy for hugetlb is disabled, that is, revert commit
    bcd51a3c679d ("hugetlb: lazy page table copies in fork()") fork()'ing with
    hugetlb PMD sharing quickly lockup -
    
    [  239.446559] watchdog: BUG: soft lockup - CPU#75 stuck for 27s!
    [  239.446611] RIP: 0010:native_queued_spin_lock_slowpath+0x7e/0x2e0
    [  239.446631] Call Trace:
    [  239.446633]  <TASK>
    [  239.446636]  _raw_spin_lock+0x3f/0x60
    [  239.446639]  copy_hugetlb_page_range+0x258/0xb50
    [  239.446645]  copy_page_range+0x22b/0x2c0
    [  239.446651]  dup_mmap+0x3e2/0x770
    [  239.446654]  dup_mm.constprop.0+0x5e/0x230
    [  239.446657]  copy_process+0xd17/0x1760
    [  239.446660]  kernel_clone+0xc0/0x3e0
    [  239.446661]  __do_sys_clone+0x65/0xa0
    [  239.446664]  do_syscall_64+0x82/0x930
    [  239.446668]  ? count_memcg_events+0xd2/0x190
    [  239.446671]  ? syscall_trace_enter+0x14e/0x1f0
    [  239.446676]  ? syscall_exit_work+0x118/0x150
    [  239.446677]  ? arch_exit_to_user_mode_prepare.constprop.0+0x9/0xb0
    [  239.446681]  ? clear_bhb_loop+0x30/0x80
    [  239.446684]  ? clear_bhb_loop+0x30/0x80
    [  239.446686]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    There are two options to resolve the potential latent issue:
      1. warn against PMD sharing in copy_hugetlb_page_range(),
      2. fix it.
    This patch opts for the second option.
    While at it, simplify the comment, the details are not actually relevant
    anymore.
    
    Link: https://lkml.kernel.org/r/20250916004520.1604530-1-jane.chu@oracle.com
    Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
    Signed-off-by: Jane Chu <jane.chu@oracle.com>
    Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
    Acked-by: Oscar Salvador <osalvador@suse.de>
    Acked-by: David Hildenbrand <david@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Liu Shixin <liushixin2@huawei.com>
    Cc: Muchun Song <muchun.song@linux.dev>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ David: We don't have ptdesc and the wrappers, so work directly on the
      page->pt_share_count. CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING is still
      called CONFIG_ARCH_WANT_HUGE_PMD_SHARE. ]
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather [+ + +]
Author: David Hildenbrand (Red Hat) <david@kernel.org>
Date:   Tue Dec 23 22:40:37 2025 +0100

    mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
    
    commit 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 upstream.
    
    As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix
    huge_pmd_unshare() vs GUP-fast race") we can end up in some situations
    where we perform so many IPI broadcasts when unsharing hugetlb PMD page
    tables that it severely regresses some workloads.
    
    In particular, when we fork()+exit(), or when we munmap() a large
    area backed by many shared PMD tables, we perform one IPI broadcast per
    unshared PMD table.
    
    There are two optimizations to be had:
    
    (1) When we process (unshare) multiple such PMD tables, such as during
        exit(), it is sufficient to send a single IPI broadcast (as long as
        we respect locking rules) instead of one per PMD table.
    
        Locking prevents that any of these PMD tables could get reused before
        we drop the lock.
    
    (2) When we are not the last sharer (> 2 users including us), there is
        no need to send the IPI broadcast. The shared PMD tables cannot
        become exclusive (fully unshared) before an IPI will be broadcasted
        by the last sharer.
    
        Concurrent GUP-fast could walk into a PMD table just before we
        unshared it. It could then succeed in grabbing a page from the
        shared page table even after munmap() etc succeeded (and supressed
        an IPI). But there is not difference compared to GUP-fast just
        sleeping for a while after grabbing the page and re-enabling IRQs.
    
        Most importantly, GUP-fast will never walk into page tables that are
        no-longer shared, because the last sharer will issue an IPI
        broadcast.
    
        (if ever required, checking whether the PUD changed in GUP-fast
         after grabbing the page like we do in the PTE case could handle
         this)
    
    So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather
    infrastructure so we can implement these optimizations and demystify the
    code at least a bit. Extend the mmu_gather infrastructure to be able to
    deal with our special hugetlb PMD table sharing implementation.
    
    To make initialization of the mmu_gather easier when working on a single
    VMA (in particular, when dealing with hugetlb), provide
    tlb_gather_mmu_vma().
    
    We'll consolidate the handling for (full) unsharing of PMD tables in
    tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track
    in "struct mmu_gather" whether we had (full) unsharing of PMD tables.
    
    Because locking is very special (concurrent unsharing+reuse must be
    prevented), we disallow deferring flushing to tlb_finish_mmu() and instead
    require an explicit earlier call to tlb_flush_unshared_tables().
    
    From hugetlb code, we call huge_pmd_unshare_flush() where we make sure
    that the expected lock protecting us from concurrent unsharing+reuse is
    still held.
    
    Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that
    tlb_flush_unshared_tables() was properly called earlier.
    
    Document it all properly.
    
    Notes about tlb_remove_table_sync_one() interaction with unsharing:
    
    There are two fairly tricky things:
    
    (1) tlb_remove_table_sync_one() is a NOP on architectures without
        CONFIG_MMU_GATHER_RCU_TABLE_FREE.
    
        Here, the assumption is that the previous TLB flush would send an
        IPI to all relevant CPUs. Careful: some architectures like x86 only
        send IPIs to all relevant CPUs when tlb->freed_tables is set.
    
        The relevant architectures should be selecting
        MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable
        kernels and it might have been problematic before this patch.
    
        Also, the arch flushing behavior (independent of IPIs) is different
        when tlb->freed_tables is set. Do we have to enlighten them to also
        take care of tlb->unshared_tables? So far we didn't care, so
        hopefully we are fine. Of course, we could be setting
        tlb->freed_tables as well, but that might then unnecessarily flush
        too much, because the semantics of tlb->freed_tables are a bit
        fuzzy.
    
        This patch changes nothing in this regard.
    
    (2) tlb_remove_table_sync_one() is not a NOP on architectures with
        CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync.
    
        Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB)
        we still issue IPIs during TLB flushes and don't actually need the
        second tlb_remove_table_sync_one().
    
        This optimized can be implemented on top of this, by checking e.g., in
        tlb_remove_table_sync_one() whether we really need IPIs. But as
        described in (1), it really must honor tlb->freed_tables then to
        send IPIs to all relevant CPUs.
    
    Notes on TLB flushing changes:
    
    (1) Flushing for non-shared PMD tables
    
        We're converting from flush_hugetlb_tlb_range() to
        tlb_remove_huge_tlb_entry(). Given that we properly initialize the
        MMU gather in tlb_gather_mmu_vma() to be hugetlb aware, similar to
        __unmap_hugepage_range(), that should be fine.
    
    (2) Flushing for shared PMD tables
    
        We're converting from various things (flush_hugetlb_tlb_range(),
        tlb_flush_pmd_range(), flush_tlb_range()) to tlb_flush_pmd_range().
    
        tlb_flush_pmd_range() achieves the same that
        tlb_remove_huge_tlb_entry() would achieve in these scenarios.
        Note that tlb_remove_huge_tlb_entry() also calls
        __tlb_remove_tlb_entry(), however that is only implemented on
        powerpc, which does not support PMD table sharing.
    
        Similar to (1), tlb_gather_mmu_vma() should make sure that TLB
        flushing keeps on working as expected.
    
    Further, note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a
    concern, as we are holding the i_mmap_lock the whole time, preventing
    concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed
    separately as a cleanup later.
    
    There are plenty more cleanups to be had, but they have to wait until
    this is fixed.
    
    [david@kernel.org: fix kerneldoc]
      Link: https://lkml.kernel.org/r/f223dd74-331c-412d-93fc-69e360a5006c@kernel.org
    Link: https://lkml.kernel.org/r/20251223214037.580860-5-david@kernel.org
    Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race")
    Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
    Reported-by: "Uschakow, Stanislav" <suschako@amazon.de>
    Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/
    Tested-by: Laurence Oberman <loberman@redhat.com>
    Acked-by: Harry Yoo <harry.yoo@oracle.com>
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Lance Yang <lance.yang@linux.dev>
    Cc: Liu Shixin <liushixin2@huawei.com>
    Cc: Oscar Salvador <osalvador@suse.de>
    Cc: Rik van Riel <riel@surriel.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ David: We don't have ptdesc and the wrappers, so work directly on
      page->pt_share_count and pass "struct page" instead of "struct ptdesc".
      CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING is still called
      CONFIG_ARCH_WANT_HUGE_PMD_SHARE and is set even without
      CONFIG_HUGETLB_PAGE. We don't have 550a7d60bd5e ("mm, hugepages: add
      mremap() support for hugepage backed vma"), so move_hugetlb_page_tables()
      does not exist. We don't have 40549ba8f8e0 ("hugetlb: use new vma_lock
      for pmd sharing synchronization") so changes in mm/rmap.c looks quite
      different. We don't have 4ddb4d91b82f ("hugetlb: do not update address
      in huge_pmd_unshare"), so huge_pmd_unshare() still gets a pointer to
      an address. Some smaller contextual stuff. ]
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/hugetlb: fix hugetlb_pmd_shared() [+ + +]
Author: David Hildenbrand (Red Hat) <david@kernel.org>
Date:   Tue Dec 23 22:40:34 2025 +0100

    mm/hugetlb: fix hugetlb_pmd_shared()
    
    commit ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216 upstream.
    
    Patch series "mm/hugetlb: fixes for PMD table sharing (incl.  using
    mmu_gather)", v3.
    
    One functional fix, one performance regression fix, and two related
    comment fixes.
    
    I cleaned up my prototype I recently shared [1] for the performance fix,
    deferring most of the cleanups I had in the prototype to a later point.
    While doing that I identified the other things.
    
    The goal of this patch set is to be backported to stable trees "fairly"
    easily. At least patch #1 and #4.
    
    Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing
    Patch #2 + #3 are simple comment fixes that patch #4 interacts with.
    Patch #4 is a fix for the reported performance regression due to excessive
    IPI broadcasts during fork()+exit().
    
    The last patch is all about TLB flushes, IPIs and mmu_gather.
    Read: complicated
    
    There are plenty of cleanups in the future to be had + one reasonable
    optimization on x86. But that's all out of scope for this series.
    
    Runtime tested, with a focus on fixing the performance regression using
    the original reproducer [2] on x86.
    
    
    This patch (of 4):
    
    We switched from (wrongly) using the page count to an independent shared
    count.  Now, shared page tables have a refcount of 1 (excluding
    speculative references) and instead use ptdesc->pt_share_count to identify
    sharing.
    
    We didn't convert hugetlb_pmd_shared(), so right now, we would never
    detect a shared PMD table as such, because sharing/unsharing no longer
    touches the refcount of a PMD table.
    
    Page migration, like mbind() or migrate_pages() would allow for migrating
    folios mapped into such shared PMD tables, even though the folios are not
    exclusive.  In smaps we would account them as "private" although they are
    "shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the
    pagemap interface.
    
    Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().
    
    Link: https://lkml.kernel.org/r/20251223214037.580860-1-david@kernel.org
    Link: https://lkml.kernel.org/r/20251223214037.580860-2-david@kernel.org
    Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [1]
    Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [2]
    Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
    Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
    Reviewed-by: Rik van Riel <riel@surriel.com>
    Reviewed-by: Lance Yang <lance.yang@linux.dev>
    Tested-by: Lance Yang <lance.yang@linux.dev>
    Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
    Tested-by: Laurence Oberman <loberman@redhat.com>
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Acked-by: Oscar Salvador <osalvador@suse.de>
    Cc: Liu Shixin <liushixin2@huawei.com>
    Cc: "Uschakow, Stanislav" <suschako@amazon.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ David: We don't have ptdesc and the wrappers, so work directly on
      page->pt_share_count. ]
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/hugetlb: fix two comments related to huge_pmd_unshare() [+ + +]
Author: David Hildenbrand (Red Hat) <david@kernel.org>
Date:   Tue Dec 23 22:40:35 2025 +0100

    mm/hugetlb: fix two comments related to huge_pmd_unshare()
    
    commit 3937027caecb4f8251e82dd857ba1d749bb5a428 upstream.
    
    Ever since we stopped using the page count to detect shared PMD page
    tables, these comments are outdated.
    
    The only reason we have to flush the TLB early is because once we drop the
    i_mmap_rwsem, the previously shared page table could get freed (to then
    get reallocated and used for other purpose).  So we really have to flush
    the TLB before that could happen.
    
    So let's simplify the comments a bit.
    
    The "If we unshared PMDs, the TLB flush was not recorded in mmu_gather."
    part introduced as in commit a4a118f2eead ("hugetlbfs: flush TLBs
    correctly after huge_pmd_unshare") was confusing: sure it is recorded in
    the mmu_gather, otherwise tlb_flush_mmu_tlbonly() wouldn't do anything.
    So let's drop that comment while at it as well.
    
    We'll centralize these comments in a single helper as we rework the code
    next.
    
    Link: https://lkml.kernel.org/r/20251223214037.580860-3-david@kernel.org
    Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
    Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
    Reviewed-by: Rik van Riel <riel@surriel.com>
    Tested-by: Laurence Oberman <loberman@redhat.com>
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Acked-by: Oscar Salvador <osalvador@suse.de>
    Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
    Cc: Liu Shixin <liushixin2@huawei.com>
    Cc: Lance Yang <lance.yang@linux.dev>
    Cc: "Uschakow, Stanislav" <suschako@amazon.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/hugetlb: make detecting shared pte more reliable [+ + +]
Author: Miaohe Lin <linmiaohe@huawei.com>
Date:   Tue Aug 16 21:05:53 2022 +0800

    mm/hugetlb: make detecting shared pte more reliable
    
    commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546 upstream.
    
    If the pagetables are shared, we shouldn't copy or take references.  Since
    src could have unshared and dst shares with another vma, huge_pte_none()
    is thus used to determine whether dst_pte is shared.  But this check isn't
    reliable.  A shared pte could have pte none in pagetable in fact.  The
    page count of ptep page should be checked here in order to reliably
    determine whether pte is shared.
    
    [lukas.bulwahn@gmail.com: remove unused local variable dst_entry in copy_hugetlb_page_range()]
      Link: https://lkml.kernel.org/r/20220822082525.26071-1-lukas.bulwahn@gmail.com
    Link: https://lkml.kernel.org/r/20220816130553.31406-7-linmiaohe@huawei.com
    Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
    Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
    Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
    Cc: Muchun Song <songmuchun@bytedance.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/rmap: fix two comments related to huge_pmd_unshare() [+ + +]
Author: David Hildenbrand (Red Hat) <david@kernel.org>
Date:   Tue Dec 23 22:40:36 2025 +0100

    mm/rmap: fix two comments related to huge_pmd_unshare()
    
    commit a8682d500f691b6dfaa16ae1502d990aeb86e8be upstream.
    
    PMD page table unsharing no longer touches the refcount of a PMD page
    table.  Also, it is not about dropping the refcount of a "PMD page" but
    the "PMD page table".
    
    Let's just simplify by saying that the PMD page table was unmapped,
    consequently also unmapping the folio that was mapped into this page.
    
    This code should be deduplicated in the future.
    
    Link: https://lkml.kernel.org/r/20251223214037.580860-4-david@kernel.org
    Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
    Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
    Reviewed-by: Rik van Riel <riel@surriel.com>
    Tested-by: Laurence Oberman <loberman@redhat.com>
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Acked-by: Oscar Salvador <osalvador@suse.de>
    Cc: Liu Shixin <liushixin2@huawei.com>
    Cc: Harry Yoo <harry.yoo@oracle.com>
    Cc: Lance Yang <lance.yang@linux.dev>
    Cc: "Uschakow, Stanislav" <suschako@amazon.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ David: We don't have 40549ba8f8e0 ("hugetlb: use new vma_lock
      for pmd sharing synchronization") so there are some contextual
      differences. ]
    Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/tracing: rss_stat: ensure curr is false from kthread context [+ + +]
Author: Kalesh Singh <kaleshsingh@google.com>
Date:   Thu Feb 19 15:36:56 2026 -0800

    mm/tracing: rss_stat: ensure curr is false from kthread context
    
    commit 079c24d5690262e83ee476e2a548e416f3237511 upstream.
    
    The rss_stat trace event allows userspace tools, like Perfetto [1], to
    inspect per-process RSS metric changes over time.
    
    The curr field was introduced to rss_stat in commit e4dcad204d3a
    ("rss_stat: add support to detect RSS updates of external mm").  Its
    intent is to indicate whether the RSS update is for the mm_struct of the
    current execution context; and is set to false when operating on a remote
    mm_struct (e.g., via kswapd or a direct reclaimer).
    
    However, an issue arises when a kernel thread temporarily adopts a user
    process's mm_struct.  Kernel threads do not have their own mm_struct and
    normally have current->mm set to NULL.  To operate on user memory, they
    can "borrow" a memory context using kthread_use_mm(), which sets
    current->mm to the user process's mm.
    
    This can be observed, for example, in the USB Function Filesystem (FFS)
    driver.  The ffs_user_copy_worker() handles AIO completions and uses
    kthread_use_mm() to copy data to a user-space buffer.  If a page fault
    occurs during this copy, the fault handler executes in the kthread's
    context.
    
    At this point, current is the kthread, but current->mm points to the user
    process's mm.  Since the rss_stat event (from the page fault) is for that
    same mm, the condition current->mm == mm becomes true, causing curr to be
    incorrectly set to true when the trace event is emitted.
    
    This is misleading because it suggests the mm belongs to the kthread,
    confusing userspace tools that track per-process RSS changes and
    corrupting their mm_id-to-process association.
    
    Fix this by ensuring curr is always false when the trace event is emitted
    from a kthread context by checking for the PF_KTHREAD flag.
    
    Link: https://lkml.kernel.org/r/20260219233708.1971199-1-kaleshsingh@google.com
    Link: https://perfetto.dev/ [1]
    Fixes: e4dcad204d3a ("rss_stat: add support to detect RSS updates of external mm")
    Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
    Acked-by: Zi Yan <ziy@nvidia.com>
    Acked-by: SeongJae Park <sj@kernel.org>
    Reviewed-by: Pedro Falcato <pfalcato@suse.de>
    Cc: "David Hildenbrand (Arm)" <david@kernel.org>
    Cc: Joel Fernandes <joel@joelfernandes.org>
    Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: <stable@vger.kernel.org>    [5.10+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mmc: core: Avoid bitfield RMW for claim/retune flags [+ + +]
Author: Penghe Geng <pgeng@nvidia.com>
Date:   Thu Feb 19 15:29:54 2026 -0500

    mmc: core: Avoid bitfield RMW for claim/retune flags
    
    commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 upstream.
    
    Move claimed and retune control flags out of the bitfield word to
    avoid unrelated RMW side effects in asynchronous contexts.
    
    The host->claimed bit shared a word with retune flags. Writes to claimed
    in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite
    other bits when concurrent updates happen in other contexts, triggering
    spurious WARN_ON(!host->claimed). Convert claimed, can_retune,
    retune_now and retune_paused to bool to remove shared-word coupling.
    
    Fixes: 6c0cedd1ef952 ("mmc: core: Introduce host claiming by context")
    Fixes: 1e8e55b67030c ("mmc: block: Add CQE support")
    Cc: stable@vger.kernel.org
    Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
    Signed-off-by: Penghe Geng <pgeng@nvidia.com>
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() [+ + +]
Author: Felix Gu <ustc.gu@gmail.com>
Date:   Tue Jan 20 22:26:46 2026 +0800

    mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
    
    commit af12e64ae0661546e8b4f5d30d55c5f53a11efe7 upstream.
    
    When calling of_parse_phandle_with_args(), the caller is responsible
    to call of_node_put() to release the reference of device node.
    In of_get_dml_pipe_index(), it does not release the reference.
    
    Fixes: 9cb15142d0e3 ("mmc: mmci: Add qcom dml support to the driver.")
    Signed-off-by: Felix Gu <gu_0233@qq.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: sdhci-pci-gli: fix GL9750 DMA write corruption [+ + +]
Author: Matthew Schwartz <matthew.schwartz@linux.dev>
Date:   Mon Mar 2 13:07:17 2026 -0800

    mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
    
    commit 2b76e0cc7803e5ab561c875edaba7f6bbd87fbb0 upstream.
    
    The GL9750 SD host controller has intermittent data corruption during
    DMA write operations. The GM_BURST register's R_OSRC_Lmt field
    (bits 17:16), which limits outstanding DMA read requests from system
    memory, is not being cleared during initialization. The Windows driver
    sets R_OSRC_Lmt to zero, limiting requests to the smallest unit.
    
    Clear R_OSRC_Lmt to match the Windows driver behavior. This eliminates
    write corruption verified with f3write/f3read tests while maintaining
    DMA performance.
    
    Cc: stable@vger.kernel.org
    Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support")
    Closes: https://lore.kernel.org/linux-mmc/33d12807-5c72-41ce-8679-57aa11831fad@linux.dev/
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
    Reviewed-by: Ben Chuang <ben.chuang@genesyslogic.com.tw>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: sdhci: fix timing selection for 1-bit bus width [+ + +]
Author: Luke Wang <ziniu.wang_1@nxp.com>
Date:   Wed Mar 11 17:50:06 2026 +0800

    mmc: sdhci: fix timing selection for 1-bit bus width
    
    commit 5e3486e64094c28a526543f1e8aa0d5964b7f02d upstream.
    
    When 1-bit bus width is used with HS200/HS400 capabilities set,
    mmc_select_hs200() returns 0 without actually switching. This
    causes mmc_select_timing() to skip mmc_select_hs(), leaving eMMC
    in legacy mode (26MHz) instead of High Speed SDR (52MHz).
    
    Per JEDEC eMMC spec section 5.3.2, 1-bit mode supports High Speed
    SDR. Drop incompatible HS200/HS400/UHS/DDR caps early so timing
    selection falls through to mmc_select_hs() correctly.
    
    Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure")
    Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: vub300: fix NULL-deref on disconnect [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Mar 27 11:52:05 2026 +0100

    mmc: vub300: fix NULL-deref on disconnect
    
    commit dff34ef879c5e73298443956a8b391311ba78d57 upstream.
    
    Make sure to deregister the controller before dropping the reference to
    the driver data on disconnect to avoid NULL-pointer dereferences or
    use-after-free.
    
    Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
    Cc: stable@vger.kernel.org # 3.0+
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
module: Fix kernel panic when a symbol st_shndx is out of bounds [+ + +]
Author: Ihor Solodrai <ihor.solodrai@linux.dev>
Date:   Tue Dec 30 10:32:08 2025 -0800

    module: Fix kernel panic when a symbol st_shndx is out of bounds
    
    [ Upstream commit f9d69d5e7bde2295eb7488a56f094ac8f5383b92 ]
    
    The module loader doesn't check for bounds of the ELF section index in
    simplify_symbols():
    
           for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
                    const char *name = info->strtab + sym[i].st_name;
    
                    switch (sym[i].st_shndx) {
                    case SHN_COMMON:
    
                    [...]
    
                    default:
                            /* Divert to percpu allocation if a percpu var. */
                            if (sym[i].st_shndx == info->index.pcpu)
                                    secbase = (unsigned long)mod_percpu(mod);
                            else
      /** HERE --> **/              secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
                            sym[i].st_value += secbase;
                            break;
                    }
            }
    
    A symbol with an out-of-bounds st_shndx value, for example 0xffff
    (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:
    
      BUG: unable to handle page fault for address: ...
      RIP: 0010:simplify_symbols+0x2b2/0x480
      ...
      Kernel panic - not syncing: Fatal exception
    
    This can happen when module ELF is legitimately using SHN_XINDEX or
    when it is corrupted.
    
    Add a bounds check in simplify_symbols() to validate that st_shndx is
    within the valid range before using it.
    
    This issue was discovered due to a bug in llvm-objcopy, see relevant
    discussion for details [1].
    
    [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/
    
    Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
    Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
    Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
    Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
mptcp: fix slab-use-after-free in __inet_lookup_established [+ + +]
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date:   Mon Apr 6 11:15:10 2026 +0800

    mptcp: fix slab-use-after-free in __inet_lookup_established
    
    commit 9b55b253907e7431210483519c5ad711a37dafa1 upstream.
    
    The ehash table lookups are lockless and rely on
    SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
    during RCU read-side critical sections. Both tcp_prot and
    tcpv6_prot have their slab caches created with this flag
    via proto_register().
    
    However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into
    tcpv6_prot_override during inet_init() (fs_initcall, level 5),
    before inet6_init() (module_init/device_initcall, level 6) has
    called proto_register(&tcpv6_prot). At that point,
    tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab
    remains NULL permanently.
    
    This causes MPTCP v6 subflow child sockets to be allocated via
    kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab
    cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so
    when these sockets are freed without SOCK_RCU_FREE (which is
    cleared for child sockets by design), the memory can be
    immediately reused. Concurrent ehash lookups under
    rcu_read_lock can then access freed memory, triggering a
    slab-use-after-free in __inet_lookup_established.
    
    Fix this by splitting the IPv6-specific initialization out of
    mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called
    from mptcp_proto_v6_init() before protocol registration. This
    ensures tcpv6_prot_override.slab correctly inherits the
    SLAB_TYPESAFE_BY_RCU slab cache.
    
    Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260406031512.189159-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: avoid sending RM_ADDR over same subflow [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Mar 9 12:06:22 2026 -0400

    mptcp: pm: avoid sending RM_ADDR over same subflow
    
    [ Upstream commit fb8d0bccb221080630efcd9660c9f9349e53cc9e ]
    
    RM_ADDR are sent over an active subflow, the first one in the subflows
    list. There is then a high chance the initial subflow is picked. With
    the in-kernel PM, when an endpoint is removed, a RM_ADDR is sent, then
    linked subflows are closed. This is done for each active MPTCP
    connection.
    
    MPTCP endpoints are likely removed because the attached network is no
    longer available or usable. In this case, it is better to avoid sending
    this RM_ADDR over the subflow that is going to be removed, but prefer
    sending it over another active and non stale subflow, if any.
    
    This modification avoids situations where the other end is not notified
    when a subflow is no longer usable: typically when the endpoint linked
    to the initial subflow is removed, especially on the server side.
    
    Fixes: 8dd5efb1f91b ("mptcp: send ack for rm_addr")
    Cc: stable@vger.kernel.org
    Reported-by: Frank Lorenz <lorenz-frank@web.de>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/612
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-2-4b5462b6f016@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ pm.c => pm_netlink.c + replaced subflow_get_local_id() with subflow->local_id ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mtd: Avoid boot crash in RedBoot partition table parser [+ + +]
Author: Finn Thain <fthain@linux-m68k.org>
Date:   Mon Feb 16 18:01:30 2026 +1100

    mtd: Avoid boot crash in RedBoot partition table parser
    
    commit 8e2f8020270af7777d49c2e7132260983e4fc566 upstream.
    
    Given CONFIG_FORTIFY_SOURCE=y and a recent compiler,
    commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when
    available") produces the warning below and an oops.
    
        Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000
        ------------[ cut here ]------------
        WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1
        memcmp: detected buffer overflow: 15 byte read of buffer size 14
        Modules linked in:
        CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE
    
    As Kees said, "'names' is pointing to the final 'namelen' many bytes
    of the allocation ... 'namelen' could be basically any length at all.
    This fortify warning looks legit to me -- this code used to be reading
    beyond the end of the allocation."
    
    Since the size of the dynamic allocation is calculated with strlen()
    we can use strcmp() instead of memcmp() and remain within bounds.
    
    Cc: Kees Cook <kees@kernel.org>
    Cc: stable@vger.kernel.org
    Cc: linux-hardening@vger.kernel.org
    Link: https://lore.kernel.org/all/202602151911.AD092DFFCD@keescook/
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Suggested-by: Kees Cook <kees@kernel.org>
    Signed-off-by: Finn Thain <fthain@linux-m68k.org>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: rawnand: brcmnand: skip DMA during panic write [+ + +]
Author: Kamal Dasu <kamal.dasu@broadcom.com>
Date:   Thu Mar 5 15:21:57 2026 -0500

    mtd: rawnand: brcmnand: skip DMA during panic write
    
    [ Upstream commit da9ba4dcc01e7cf52b7676f0ee9607b8358c2171 ]
    
    When oops_panic_write is set, the driver disables interrupts and
    switches to PIO polling mode but still falls through into the DMA
    path. DMA cannot be used reliably in panic context, so make the
    DMA path an else branch to ensure only PIO is used during panic
    writes.
    
    Fixes: c1ac2dc34b51 ("mtd: rawnand: brcmnand: When oops in progress use pio and interrupt polling")
    Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
    Reviewed-by: William Zhang <william.zhang@broadcom.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() [+ + +]
Author: Chen Ni <nichen@iscas.ac.cn>
Date:   Mon Feb 9 15:56:18 2026 +0800

    mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
    
    commit 0410e1a4c545c769c59c6eda897ad5d574d0c865 upstream.
    
    Fix wrong variable used for error checking after dma_alloc_coherent()
    call. The function checks cdns_ctrl->dma_cdma_desc instead of
    cdns_ctrl->cdma_desc, which could lead to incorrect error handling.
    
    Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem")
    Cc: stable@vger.kernel.org
    Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
    Reviewed-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: rawnand: pl353: make sure optimal timings are applied [+ + +]
Author: Olivier Sobrie <olivier@sobrie.be>
Date:   Tue Mar 17 18:18:07 2026 +0100

    mtd: rawnand: pl353: make sure optimal timings are applied
    
    commit b9465b04de4b90228de03db9a1e0d56b00814366 upstream.
    
    Timings of the nand are adjusted by pl35x_nfc_setup_interface() but
    actually applied by the pl35x_nand_select_target() function.
    If there is only one nand chip, the pl35x_nand_select_target() will only
    apply the timings once since the test at its beginning will always be true
    after the first call to this function. As a result, the hardware will
    keep using the default timings set at boot to detect the nand chip, not
    the optimal ones.
    
    With this patch, we program directly the new timings when
    pl35x_nfc_setup_interface() is called.
    
    Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
    Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: rawnand: serialize lock/unlock against other NAND operations [+ + +]
Author: Kamal Dasu <kamal.dasu@broadcom.com>
Date:   Thu Mar 5 14:49:06 2026 -0500

    mtd: rawnand: serialize lock/unlock against other NAND operations
    
    [ Upstream commit bab2bc6e850a697a23b9e5f0e21bb8c187615e95 ]
    
    nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
    without holding the NAND device lock. On controllers that implement
    SET_FEATURES via multiple low-level PIO commands, these can race with
    concurrent UBI/UBIFS background erase/write operations that hold the
    device lock, resulting in cmd_pending conflicts on the NAND controller.
    
    Add nand_get_device()/nand_release_device() around the lock/unlock
    operations to serialize them against all other NAND controller access.
    
    Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation")
    Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
    Reviewed-by: William Zhang <william.zhang@broadcom.com>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/mlx5: Avoid "No data available" when FW version queries fail [+ + +]
Author: Saeed Mahameed <saeedm@nvidia.com>
Date:   Mon Mar 30 22:40:14 2026 +0300

    net/mlx5: Avoid "No data available" when FW version queries fail
    
    [ Upstream commit 10dc35f6a443d488f219d1a1e3fb8f8dac422070 ]
    
    Avoid printing the misleading "kernel answers: No data available" devlink
    output when querying firmware or pending firmware version fails
    (e.g. MLX5 fw state errors / flash failures).
    
    FW can fail on loading the pending flash image and get its version due
    to various reasons, examples:
    
    mlxfw: Firmware flash failed: key not applicable, err (7)
    mlx5_fw_image_pending: can't read pending fw version while fw state is 1
    
    and the resulting:
    $ devlink dev info
    kernel answers: No data available
    
    Instead, just report 0 or 0xfff.. versions in case of failure to indicate
    a problem, and let other information be shown.
    
    after the fix:
    $ devlink dev info
    pci/0000:00:06.0:
      driver mlx5_core
      serial_number xxx...
      board.serial_number MT2225300179
      versions:
          fixed:
            fw.psid MT_0000000436
          running:
            fw.version 22.41.0188
            fw 22.41.0188
          stored:
            fw.version 255.255.65535
            fw 255.255.65535
    
    Fixes: 9c86b07e3069 ("net/mlx5: Added fw version query command")
    Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
    Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Link: https://patch.msgid.link/20260330194015.53585-3-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery [+ + +]
Author: Gal Pressman <gal@nvidia.com>
Date:   Thu Mar 5 16:26:32 2026 +0200

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
    
    [ Upstream commit 1633111d69053512d099658d4a05fc736fab36b0 ]
    
    In case of a TX error CQE, a recovery flow is triggered,
    mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,
    desyncing the DMA FIFO producer and consumer.
    
    After recovery, the producer pushes new DMA entries at the old
    dma_fifo_pc, while the consumer reads from position 0.
    This causes us to unmap stale DMA addresses from before the recovery.
    
    The DMA FIFO is a purely software construct with no HW counterpart.
    At the point of reset, all WQEs have been flushed so dma_fifo_cc is
    already equal to dma_fifo_pc. There is no need to reset either counter,
    similar to how skb_fifo pc/cc are untouched.
    
    Remove the 'dma_fifo_cc = 0' reset.
    
    This fixes the following WARNING:
        WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
        Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
        CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
        Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
        RIP: 0010:iommu_dma_unmap_page+0x79/0x90
        Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00
        Call Trace:
         <IRQ>
         ? __warn+0x7d/0x110
         ? iommu_dma_unmap_page+0x79/0x90
         ? report_bug+0x16d/0x180
         ? handle_bug+0x4f/0x90
         ? exc_invalid_op+0x14/0x70
         ? asm_exc_invalid_op+0x16/0x20
         ? iommu_dma_unmap_page+0x79/0x90
         ? iommu_dma_unmap_page+0x2e/0x90
         dma_unmap_page_attrs+0x10d/0x1b0
         mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]
         mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]
         mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]
         __napi_poll+0x24/0x190
         net_rx_action+0x32a/0x3b0
         ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]
         ? notifier_call_chain+0x35/0xa0
         handle_softirqs+0xc9/0x270
         irq_exit_rcu+0x71/0xd0
         common_interrupt+0x7f/0xa0
         </IRQ>
         <TASK>
         asm_common_interrupt+0x22/0x40
    
    Fixes: db75373c91b0 ("net/mlx5e: Recover Send Queue (SQ) from error state")
    Signed-off-by: Gal Pressman <gal@nvidia.com>
    Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Link: https://patch.msgid.link/20260305142634.1813208-4-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Wed Mar 11 15:06:02 2026 +0800

    net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
    
    [ Upstream commit e1f0a18c9564cdb16523c802e2c6fe5874e3d944 ]
    
    syzkaller reported a bug [1], and the reproducer is available at [2].
    
    ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN,
    TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects
    calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING
    (-ECONNREFUSED), but lacks a check for TCP_SYN_SENT.
    
    When rose_connect() is called a second time while the first connection
    attempt is still in progress (TCP_SYN_SENT), it overwrites
    rose->neighbour via rose_get_neigh(). If that returns NULL, the socket
    is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL.
    When the socket is subsequently closed, rose_release() sees
    ROSE_STATE_1 and calls rose_write_internal() ->
    rose_transmit_link(skb, NULL), causing a NULL pointer dereference.
    
    Per connect(2), a second connect() while a connection is already in
    progress should return -EALREADY. Add this missing check for
    TCP_SYN_SENT to complete the state validation in rose_connect().
    
    [1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271
    [2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot+d00f90e0af54102fb271@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0027.GAE@google.com/T/
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260311070611.76913-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/sched: cls_flow: fix NULL pointer dereference on shared blocks [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Mon Mar 30 22:02:16 2026 -0700

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks
    
    [ Upstream commit 1a280dd4bd1d616a01d6ffe0de284c907b555504 ]
    
    flow_change() calls tcf_block_q() and dereferences q->handle to derive
    a default baseclass.  Shared blocks leave block->q NULL, causing a NULL
    deref when a flow filter without a fully qualified baseclass is created
    on a shared block.
    
    Check tcf_block_shared() before accessing block->q and return -EINVAL
    for shared blocks.  This avoids the null-deref shown below:
    
    =======================================================================
    KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
    RIP: 0010:flow_change (net/sched/cls_flow.c:508)
    Call Trace:
     tc_new_tfilter (net/sched/cls_api.c:2432)
     rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)
     [...]
    =======================================================================
    
    Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/sched: cls_fw: fix NULL pointer dereference on shared blocks [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Mon Mar 30 22:02:15 2026 -0700

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks
    
    [ Upstream commit faeea8bbf6e958bf3c00cb08263109661975987c ]
    
    The old-method path in fw_classify() calls tcf_block_q() and
    dereferences q->handle.  Shared blocks leave block->q NULL, causing a
    NULL deref when an empty cls_fw filter is attached to a shared block
    and a packet with a nonzero major skb mark is classified.
    
    Reject the configuration in fw_change() when the old method (no
    TCA_OPTIONS) is used on a shared block, since fw_classify()'s
    old-method path needs block->q which is NULL for shared blocks.
    
    The fixed null-ptr-deref calling stack:
     KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
     RIP: 0010:fw_classify (net/sched/cls_fw.c:81)
     Call Trace:
      tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)
      tc_run (net/core/dev.c:4401)
      __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)
    
    Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://patch.msgid.link/20260331050217.504278-1-xmei5@asu.edu
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/sched: ets: fix divide by zero in the offload path [+ + +]
Author: Davide Caratti <dcaratti@redhat.com>
Date:   Tue Feb 24 21:28:32 2026 +0100

    net/sched: ets: fix divide by zero in the offload path
    
    commit e35626f610f3d2b7953ccddf6a77453da22b3a9e upstream.
    
    Offloading ETS requires computing each class' WRR weight: this is done by
    averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned
    int, the same integer size as the individual DRR quanta, can overflow and
    even cause division by zero, like it happened in the following splat:
    
     Oops: divide error: 0000 [#1] SMP PTI
     CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G            E       6.19.0-virtme #45 PREEMPT(full)
     Tainted: [E]=UNSIGNED_MODULE
     Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
     RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
     Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
     RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
     RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
     RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
     RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
     R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
     R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
     FS:  00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
     Call Trace:
      <TASK>
      ets_qdisc_change+0x870/0xf40 [sch_ets]
      qdisc_create+0x12b/0x540
      tc_modify_qdisc+0x6d7/0xbd0
      rtnetlink_rcv_msg+0x168/0x6b0
      netlink_rcv_skb+0x5c/0x110
      netlink_unicast+0x1d6/0x2b0
      netlink_sendmsg+0x22e/0x470
      ____sys_sendmsg+0x38a/0x3c0
      ___sys_sendmsg+0x99/0xe0
      __sys_sendmsg+0x8a/0xf0
      do_syscall_64+0x111/0xf80
      entry_SYSCALL_64_after_hwframe+0x77/0x7f
     RIP: 0033:0x7f440b81c77e
     Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
     RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
     RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e
     RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003
     RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000
     R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8
     R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980
      </TASK>
     Modules linked in: sch_ets(E) netdevsim(E)
     ---[ end trace 0000000000000000 ]---
     RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
     Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
     RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
     RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
     RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
     RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
     R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
     R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
     FS:  00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
     Kernel panic - not syncing: Fatal exception
     Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
     ---[ end Kernel panic - not syncing: Fatal exception ]---
    
    Fix this using 64-bit integers for 'q_sum' and 'q_psum'.
    
    Cc: stable@vger.kernel.org
    Fixes: d35eb52bd2ac ("net: sch_ets: Make the ETS qdisc offloadable")
    Signed-off-by: Davide Caratti <dcaratti@redhat.com>
    Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Reviewed-by: Petr Machata <petrm@nvidia.com>
    Link: https://patch.msgid.link/28504887df314588c7255e9911769c36f751edee.1771964872.git.dcaratti@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks [+ + +]
Author: Victor Nogueira <victor@mojatatu.com>
Date:   Wed Feb 25 10:43:48 2026 -0300

    net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
    
    commit 11cb63b0d1a0685e0831ae3c77223e002ef18189 upstream.
    
    As Paolo said earlier [1]:
    
    "Since the blamed commit below, classify can return TC_ACT_CONSUMED while
    the current skb being held by the defragmentation engine. As reported by
    GangMin Kim, if such packet is that may cause a UaF when the defrag engine
    later on tries to tuch again such packet."
    
    act_ct was never meant to be used in the egress path, however some users
    are attaching it to egress today [2]. Attempting to reach a middle
    ground, we noticed that, while most qdiscs are not handling
    TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we
    address the issue by only allowing act_ct to bind to clsact/ingress
    qdiscs and shared blocks. That way it's still possible to attach act_ct to
    egress (albeit only with clsact).
    
    [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/
    [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/
    
    Reported-by: GangMin Kim <km.kim1503@gmail.com>
    Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags")
    CC: stable@vger.kernel.org
    Signed-off-by: Victor Nogueira <victor@mojatatu.com>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Thu Mar 26 13:43:09 2026 -0700

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
    
    [ Upstream commit 4576100b8cd03118267513cafacde164b498b322 ]
    
    m2sm() converts a u32 slope to a u64 scaled value.  For large inputs
    (e.g. m1=4000000000), the result can reach 2^32.  rtsc_min() stores
    the difference of two such u64 values in a u32 variable `dsm` and
    uses it as a divisor.  When the difference is exactly 2^32 the
    truncation yields zero, causing a divide-by-zero oops in the
    concave-curve intersection path:
    
      Oops: divide error: 0000
      RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601)
      Call Trace:
       init_ed (net/sched/sch_hfsc.c:629)
       hfsc_enqueue (net/sched/sch_hfsc.c:1569)
       [...]
    
    Widen `dsm` to u64 and replace do_div() with div64_u64() so the full
    difference is preserved.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://patch.msgid.link/20260326204310.1549327-1-xmei5@asu.edu
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Wed Mar 4 12:42:18 2026 +0800

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
    
    [ Upstream commit 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 ]
    
    teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit
    through slave devices, but does not update skb->dev to the slave device
    beforehand.
    
    When a gretap tunnel is a TEQL slave, the transmit path reaches
    iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0
    master) and later calls iptunnel_xmit_stats(dev, pkt_len). This
    function does:
    
        get_cpu_ptr(dev->tstats)
    
    Since teql_master_setup() does not set dev->pcpu_stat_type to
    NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats
    for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes
    NULL + __per_cpu_offset[cpu], resulting in a page fault.
    
     BUG: unable to handle page fault for address: ffff8880e6659018
     #PF: supervisor write access in kernel mode
     #PF: error_code(0x0002) - not-present page
     PGD 68bc067 P4D 68bc067 PUD 0
     Oops: Oops: 0002 [#1] SMP KASAN PTI
     RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)
     Call Trace:
      <TASK>
      ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
      __gre_xmit (net/ipv4/ip_gre.c:478)
      gre_tap_xmit (net/ipv4/ip_gre.c:779)
      teql_master_xmit (net/sched/sch_teql.c:319)
      dev_hard_start_xmit (net/core/dev.c:3887)
      sch_direct_xmit (net/sched/sch_generic.c:347)
      __dev_queue_xmit (net/core/dev.c:4802)
      neigh_direct_output (net/core/neighbour.c:1660)
      ip_finish_output2 (net/ipv4/ip_output.c:237)
      __ip_finish_output.part.0 (net/ipv4/ip_output.c:315)
      ip_mc_output (net/ipv4/ip_output.c:369)
      ip_send_skb (net/ipv4/ip_output.c:1508)
      udp_send_skb (net/ipv4/udp.c:1195)
      udp_sendmsg (net/ipv4/udp.c:1485)
      inet_sendmsg (net/ipv4/af_inet.c:859)
      __sys_sendto (net/socket.c:2206)
    
    Fix this by setting skb->dev = slave before calling
    netdev_start_xmit(), so that tunnel xmit functions see the correct
    slave device with properly allocated tstats.
    
    Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Link: https://patch.msgid.link/20260304044216.3517851-3-bestswngs@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer [+ + +]
Author: Qi Tang <tpluszz77@gmail.com>
Date:   Wed Mar 18 14:48:47 2026 +0800

    net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
    
    [ Upstream commit 24dd586bb4cbba1889a50abe74143817a095c1c9 ]
    
    smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
    the pointer in pipe_buffer.private.  The pipe_buf_operations for these
    buffers used .get = generic_pipe_buf_get, which only increments the page
    reference count when tee(2) duplicates a pipe buffer.  The smc_spd_priv
    pointer itself was not handled, so after tee() both the original and the
    cloned pipe_buffer share the same smc_spd_priv *.
    
    When both pipes are subsequently released, smc_rx_pipe_buf_release() is
    called twice against the same object:
    
      1st call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [correct]
      2nd call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [UAF]
    
    KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which
    then escalates to a NULL-pointer dereference and kernel panic via
    smc_rx_update_consumer() when it chases the freed priv->smc pointer:
    
      BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0
      Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74
      Call Trace:
       <TASK>
       dump_stack_lvl+0x53/0x70
       print_report+0xce/0x650
       kasan_report+0xc6/0x100
       smc_rx_pipe_buf_release+0x78/0x2a0
       free_pipe_info+0xd4/0x130
       pipe_release+0x142/0x160
       __fput+0x1c6/0x490
       __x64_sys_close+0x4f/0x90
       do_syscall_64+0xa6/0x1a0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>
    
      BUG: kernel NULL pointer dereference, address: 0000000000000020
      RIP: 0010:smc_rx_update_consumer+0x8d/0x350
      Call Trace:
       <TASK>
       smc_rx_pipe_buf_release+0x121/0x2a0
       free_pipe_info+0xd4/0x130
       pipe_release+0x142/0x160
       __fput+0x1c6/0x490
       __x64_sys_close+0x4f/0x90
       do_syscall_64+0xa6/0x1a0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>
      Kernel panic - not syncing: Fatal exception
    
    Beyond the memory-safety problem, duplicating an SMC splice buffer is
    semantically questionable: smc_rx_update_cons() would advance the
    consumer cursor twice for the same data, corrupting receive-window
    accounting.  A refcount on smc_spd_priv could fix the double-free, but
    the cursor-accounting issue would still need to be addressed separately.
    
    The .get callback is invoked by both tee(2) and splice_pipe_to_pipe()
    for partial transfers; both will now return -EFAULT.  Users who need
    to duplicate SMC socket data must use a copy-based read path.
    
    Fixes: 9014db202cb7 ("smc: add support for splice()")
    Signed-off-by: Qi Tang <tpluszz77@gmail.com>
    Link: https://patch.msgid.link/20260318064847.23341-1-tpluszz77@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Thu Mar 12 17:29:07 2026 +0800

    net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
    
    [ Upstream commit 6d5e4538364b9ceb1ac2941a4deb86650afb3538 ]
    
    Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
    
    smc_tcp_syn_recv_sock() is called in the TCP receive path
    (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
    listening socket). It reads sk_user_data to get the smc_sock
    pointer. However, when the SMC listen socket is being closed
    concurrently, smc_close_active() sets clcsock->sk_user_data
    to NULL under sk_callback_lock, and then the smc_sock itself
    can be freed via sock_put() in smc_release().
    
    This leads to two issues:
    
    1) NULL pointer dereference: sk_user_data is NULL when
       accessed.
    2) Use-after-free: sk_user_data is read as non-NULL, but the
       smc_sock is freed before its fields (e.g., queued_smc_hs,
       ori_af_ops) are accessed.
    
    The race window looks like this (the syzkaller crash [1]
    triggers via the SYN cookie path: tcp_get_cookie_sock() ->
    smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
    has the same race):
    
      CPU A (softirq)              CPU B (process ctx)
    
      tcp_v4_rcv()
        TCP_NEW_SYN_RECV:
        sk = req->rsk_listener
        sock_hold(sk)
        /* No lock on listener */
                                   smc_close_active():
                                     write_lock_bh(cb_lock)
                                     sk_user_data = NULL
                                     write_unlock_bh(cb_lock)
                                     ...
                                     smc_clcsock_release()
                                     sock_put(smc->sk) x2
                                       -> smc_sock freed!
        tcp_check_req()
          smc_tcp_syn_recv_sock():
            smc = user_data(sk)
              -> NULL or dangling
            smc->queued_smc_hs
              -> crash!
    
    Note that the clcsock and smc_sock are two independent objects
    with separate refcounts. TCP stack holds a reference on the
    clcsock, which keeps it alive, but this does NOT prevent the
    smc_sock from being freed.
    
    Fix this by using RCU and refcount_inc_not_zero() to safely
    access smc_sock. Since smc_tcp_syn_recv_sock() is called in
    the TCP three-way handshake path, taking read_lock_bh on
    sk_callback_lock is too heavy and would not survive a SYN
    flood attack. Using rcu_read_lock() is much more lightweight.
    
    - Set SOCK_RCU_FREE on the SMC listen socket so that
      smc_sock freeing is deferred until after the RCU grace
      period. This guarantees the memory is still valid when
      accessed inside rcu_read_lock().
    - Use rcu_read_lock() to protect reading sk_user_data.
    - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the
      smc_sock. If the refcount has already reached zero (close
      path completed), it returns false and we bail out safely.
    
    Note: smc_hs_congested() has a similar lockless read of
    sk_user_data without rcu_read_lock(), but it only checks for
    NULL and accesses the global smc_hs_wq, never dereferencing
    any smc_sock field, so it is not affected.
    
    Reproducer was verified with mdelay injection and smc_run,
    the issue no longer occurs with this patch applied.
    
    [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
    
    Fixes: 8270d9c21041 ("net/smc: Limit backlog connections")
    Reported-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/67eaf9b8.050a0220.3c3d88.004a.GAE@google.com/T/
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Link: https://patch.msgid.link/20260312092909.48325-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/smc: Fix slab-out-of-bounds issue in fallback [+ + +]
Author: Wen Gu <guwen@linux.alibaba.com>
Date:   Fri Apr 22 15:56:19 2022 +0800

    net/smc: Fix slab-out-of-bounds issue in fallback
    
    [ Upstream commit 0558226cebee256aa3f8ec0cc5a800a10bf120a6 ]
    
    syzbot reported a slab-out-of-bounds/use-after-free issue,
    which was caused by accessing an already freed smc sock in
    fallback-specific callback functions of clcsock.
    
    This patch fixes the issue by restoring fallback-specific
    callback functions to original ones and resetting clcsock
    sk_user_data to NULL before freeing smc sock.
    
    Meanwhile, this patch introduces sk_callback_lock to make
    the access and assignment to sk_user_data mutually exclusive.
    
    Reported-by: syzbot+b425899ed22c6943e00b@syzkaller.appspotmail.com
    Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
    Link: https://lore.kernel.org/r/00000000000013ca8105d7ae3ada@google.com/
    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Acked-by: Karsten Graul <kgraul@linux.ibm.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: 6d5e4538364b ("net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/smc: Only save the original clcsock callback functions [+ + +]
Author: Wen Gu <guwen@linux.alibaba.com>
Date:   Fri Apr 22 15:56:18 2022 +0800

    net/smc: Only save the original clcsock callback functions
    
    [ Upstream commit 97b9af7a70936e331170c79040cc9bf20071b566 ]
    
    Both listen and fallback process will save the current clcsock
    callback functions and establish new ones. But if both of them
    happen, the saved callback functions will be overwritten.
    
    So this patch introduces some helpers to ensure that only save
    the original callback functions of clcsock.
    
    Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Acked-by: Karsten Graul <kgraul@linux.ibm.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: 6d5e4538364b ("net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption [+ + +]
Author: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
Date:   Fri Apr 3 09:36:17 2026 +0800

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
    
    commit a9b8b18364fffce4c451e6f6fd218fa4ab646705 upstream.
    
    The -EBUSY handling in tls_do_encryption(), introduced by commit
    859054147318 ("net: tls: handle backlogging of crypto requests"), has
    a use-after-free due to double cleanup of encrypt_pending and the
    scatterlist entry.
    
    When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to
    the cryptd backlog and the async callback tls_encrypt_done() will be
    invoked upon completion. That callback unconditionally restores the
    scatterlist entry (sge->offset, sge->length) and decrements
    ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an
    error, the synchronous error path in tls_do_encryption() performs the
    same cleanup again, double-decrementing encrypt_pending and
    double-restoring the scatterlist.
    
    The double-decrement corrupts the encrypt_pending sentinel (initialized
    to 1), making tls_encrypt_async_wait() permanently skip the wait for
    pending async callbacks. A subsequent sendmsg can then free the
    tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still
    pending, resulting in a use-after-free when the callback fires on the
    freed record.
    
    Fix this by skipping the synchronous cleanup when the -EBUSY async
    wait returns an error, since the callback has already handled
    encrypt_pending and sge restoration.
    
    Fixes: 859054147318 ("net: tls: handle backlogging of crypto requests")
    Cc: stable@vger.kernel.org
    Signed-off-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
    Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
    Link: https://patch.msgid.link/20260403013617.2838875-1-ramdhan@starlabs.sg
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
net/x25: Fix overflow when accumulating packets [+ + +]
Author: Martin Schiller <ms@dev.tdt.de>
Date:   Tue Mar 31 09:43:18 2026 +0200

    net/x25: Fix overflow when accumulating packets
    
    [ Upstream commit a1822cb524e89b4cd2cf0b82e484a2335496a6d9 ]
    
    Add a check to ensure that `x25_sock.fraglen` does not overflow.
    
    The `fraglen` also needs to be resetted when purging `fragment_queue` in
    `x25_clear_queues()`.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Suggested-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Martin Schiller <ms@dev.tdt.de>
    Link: https://patch.msgid.link/20260331-x25_fraglen-v4-2-3e69f18464b4@dev.tdt.de
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net/x25: Fix potential double free of skb [+ + +]
Author: Martin Schiller <ms@dev.tdt.de>
Date:   Tue Mar 31 09:43:17 2026 +0200

    net/x25: Fix potential double free of skb
    
    [ Upstream commit d10a26aa4d072320530e6968ef945c8c575edf61 ]
    
    When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
    line 48 and returns 1 (error).
    This error propagates back through the call chain:
    
    x25_queue_rx_frame returns 1
        |
        v
    x25_state3_machine receives the return value 1 and takes the else
    branch at line 278, setting queued=0 and returning 0
        |
        v
    x25_process_rx_frame returns queued=0
        |
        v
    x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
    again
    
    This would free the same skb twice. Looking at x25_backlog_rcv:
    
    net/x25/x25_in.c:x25_backlog_rcv() {
        ...
        queued = x25_process_rx_frame(sk, skb);
        ...
        if (!queued)
            kfree_skb(skb);
    }
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Martin Schiller <ms@dev.tdt.de>
    Link: https://patch.msgid.link/20260331-x25_fraglen-v4-1-3e69f18464b4@dev.tdt.de
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() [+ + +]
Author: David Carlier <devnexen@gmail.com>
Date:   Wed Apr 1 22:12:18 2026 +0100

    net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
    
    commit 6dede3967619b5944003227a5d09fdc21ed57d10 upstream.
    
    When dma_map_single() fails in tse_start_xmit(), the function returns
    NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the
    stack the packet was consumed, the skb is never freed, leaking memory
    on every DMA mapping failure.
    
    Add dev_kfree_skb_any() before returning to properly free the skb.
    
    Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Link: https://patch.msgid.link/20260401211218.279185-1-devnexen@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: arcnet: com20020-pci: fix support for 2.5Mbit cards [+ + +]
Author: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Date:   Thu Feb 12 20:55:09 2026 -0800

    net: arcnet: com20020-pci: fix support for 2.5Mbit cards
    
    [ Upstream commit c7d9be66b71af490446127c6ffcb66d6bb71b8b9 ]
    
    Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
    converted the com20020-pci driver to use a card info structure instead
    of a single flag mask in driver_data. However, it failed to take into
    account that in the original code, driver_data of 0 indicates a card
    with no special flags, not a card that should not have any card info
    structure. This introduced a null pointer dereference when cards with
    no flags were probed.
    
    Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in
    com20020pci_probe()") then papered over this issue by rejecting cards
    with no driver_data instead of resolving the problem at its source.
    
    Fix the original issue by introducing a new card info structure for
    2.5Mbit cards that does not set any flags and using it if no
    driver_data is present.
    
    Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
    Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()")
    Cc: stable@vger.kernel.org
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
    Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: bcmgenet: increase WoL poll timeout [+ + +]
Author: Justin Chen <justin.chen@broadcom.com>
Date:   Thu Mar 12 12:18:52 2026 -0700

    net: bcmgenet: increase WoL poll timeout
    
    [ Upstream commit 6cfc3bc02b977f2fba5f7268e6504d1931a774f7 ]
    
    Some systems require more than 5ms to get into WoL mode. Increase the
    timeout value to 50ms.
    
    Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code")
    Signed-off-by: Justin Chen <justin.chen@broadcom.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Link: https://patch.msgid.link/20260312191852.3904571-1-justin.chen@broadcom.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: bonding: fix NULL deref in bond_debug_rlb_hash_show [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Mon Mar 16 17:50:34 2026 -0700

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show
    
    [ Upstream commit 605b52497bf89b3b154674deb135da98f916e390 ]
    
    rlb_clear_slave intentionally keeps RLB hash-table entries on
    the rx_hashtbl_used_head list with slave set to NULL when no
    replacement slave is available. However, bond_debug_rlb_hash_show
    visites client_info->slave without checking if it's NULL.
    
    Other used-list iterators in bond_alb.c already handle this NULL-slave
    state safely:
    
    - rlb_update_client returns early on !client_info->slave
    - rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance
    compare slave values before visiting
    - lb_req_update_subnet_clients continues if slave is NULL
    
    The following NULL deref crash can be trigger in
    bond_debug_rlb_hash_show:
    
    [    1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [    1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)
    [    1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286
    [    1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204
    [    1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078
    [    1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000
    [    1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0
    [    1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8
    [    1.294864] FS:  0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000
    [    1.295239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [    1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0
    [    1.295897] Call Trace:
    [    1.296134]  seq_read_iter (fs/seq_file.c:231)
    [    1.296341]  seq_read (fs/seq_file.c:164)
    [    1.296493]  full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))
    [    1.296658]  vfs_read (fs/read_write.c:572)
    [    1.296981]  ksys_read (fs/read_write.c:717)
    [    1.297132]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
    [    1.297325]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
    
    Add a NULL check and print "(none)" for entries with no assigned slave.
    
    Fixes: caafa84251b88 ("bonding: add the debugfs interface to see RLB hash table")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Link: https://patch.msgid.link/20260317005034.1888794-1-xmei5@asu.edu
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled [+ + +]
Author: Fernando Fernandez Mancera <fmancera@suse.de>
Date:   Wed Mar 4 13:03:56 2026 +0100

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
    
    [ Upstream commit e5e890630533bdc15b26a34bb8e7ef539bdf1322 ]
    
    When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
    initialized because inet6_init() exits before ndisc_init() is called
    which initializes it. Then, if neigh_suppress is enabled and an ICMPv6
    Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will
    dereference ipv6_stub->nd_tbl which is NULL, passing it to
    neigh_lookup(). This causes a kernel NULL pointer dereference.
    
     BUG: kernel NULL pointer dereference, address: 0000000000000268
     Oops: 0000 [#1] PREEMPT SMP NOPTI
     [...]
     RIP: 0010:neigh_lookup+0x16/0xe0
     [...]
     Call Trace:
      <IRQ>
      ? neigh_lookup+0x16/0xe0
      br_do_suppress_nd+0x160/0x290 [bridge]
      br_handle_frame_finish+0x500/0x620 [bridge]
      br_handle_frame+0x353/0x440 [bridge]
      __netif_receive_skb_core.constprop.0+0x298/0x1110
      __netif_receive_skb_one_core+0x3d/0xa0
      process_backlog+0xa0/0x140
      __napi_poll+0x2c/0x170
      net_rx_action+0x2c4/0x3a0
      handle_softirqs+0xd0/0x270
      do_softirq+0x3f/0x60
    
    Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in
    the callers. This is in essence disabling NS/NA suppression when IPv6 is
    disabled.
    
    Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
    Reported-by: Guruprasad C P <gurucp2005@gmail.com>
    Closes: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp=utE2H2VTX5nqfgs7LDxQ@mail.gmail.com/
    Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Link: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac() [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Tue Nov 29 16:12:17 2022 +0200

    net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac()
    
    [ Upstream commit bc230671bfb25c2d3c225f674fe6c03cea88d22e ]
    
    The helper function will gain a lockdep annotation in a future patch.
    Make sure to benefit from it.
    
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Tue Nov 29 16:12:15 2022 +0200

    net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call
    
    [ Upstream commit 88d64367cea019fa6197d0d97a85ac90279919b7 ]
    
    The dpaa2-switch has the exact same locking requirements when connected
    to a DPMAC, so it needs port_priv->mac to always point either to NULL,
    or to a DPMAC with a fully initialized phylink instance.
    
    Make the same preparatory change in the dpaa2-switch driver as in the
    dpaa2-eth one.
    
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dpaa2-switch: serialize changes to priv->mac with a mutex [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Tue Nov 29 16:12:20 2022 +0200

    net: dpaa2-switch: serialize changes to priv->mac with a mutex
    
    [ Upstream commit 3c7f44fa9c4c8a9154935ca49e4cf45c14240335 ]
    
    The dpaa2-switch driver uses a DPMAC in the same way as the dpaa2-eth
    driver, so we need to duplicate the locking solution established by the
    previous change to the switch driver as well.
    
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy() [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Tue Nov 29 16:12:11 2022 +0200

    net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy()
    
    [ Upstream commit 320fefa9e2edc67011e235ea1d50f0d00ddfe004 ]
    
    dpaa2_mac_is_type_fixed() is a header with no implementation and no
    callers, which is referenced from the documentation though. It can be
    deleted.
    
    On the other hand, it would be useful to reuse the code between
    dpaa2_eth_is_type_phy() and dpaa2_switch_port_is_type_phy(). That common
    code should be called dpaa2_mac_is_type_phy(), so let's create that.
    
    The removal and the addition are merged into the same patch because,
    in fact, is_type_phy() is the logical opposite of is_type_fixed().
    
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths [+ + +]
Author: Anas Iqbal <mohd.abd.6602@gmail.com>
Date:   Wed Mar 18 08:42:12 2026 +0000

    net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
    
    [ Upstream commit b48731849609cbd8c53785a48976850b443153fd ]
    
    Smatch reports:
    drivers/net/dsa/bcm_sf2.c:997 bcm_sf2_sw_resume() warn:
    'priv->clk' from clk_prepare_enable() not released on lines: 983,990.
    
    The clock enabled by clk_prepare_enable() in bcm_sf2_sw_resume()
    is not released if bcm_sf2_sw_rst() or bcm_sf2_cfp_resume() fails.
    
    Add the missing clk_disable_unprepare() calls in the error paths
    to properly release the clock resource.
    
    Fixes: e9ec5c3bd238 ("net: dsa: bcm_sf2: request and handle clocks")
    Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com>
    Link: https://patch.msgid.link/20260318084212.1287-1-mohd.abd.6602@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: enetc: fix the output issue of 'ethtool --show-ring' [+ + +]
Author: Wei Fang <wei.fang@nxp.com>
Date:   Fri Mar 20 17:42:22 2026 +0800

    net: enetc: fix the output issue of 'ethtool --show-ring'
    
    [ Upstream commit 70b439bf06f6a12e491f827fa81a9887a11501f9 ]
    
    Currently, enetc_get_ringparam() only provides rx_pending and tx_pending,
    but 'ethtool --show-ring' no longer displays these fields. Because the
    ringparam retrieval path has moved to the new netlink interface, where
    rings_fill_reply() emits the *x_pending only if the *x_max_pending values
    are non-zero. So rx_max_pending and tx_max_pending to are added to
    enetc_get_ringparam() to fix the issue.
    
    Note that the maximum tx/rx ring size of hardware is 64K, but we haven't
    added set_ringparam() to make the ring size configurable. To avoid users
    mistakenly believing that the ring size can be increased, so set
    the *x_max_pending to priv->*x_bd_count.
    
    Fixes: e4a1717b677c ("ethtool: provide ring sizes with RINGS_GET request")
    Signed-off-by: Wei Fang <wei.fang@nxp.com>
    Link: https://patch.msgid.link/20260320094222.706339-1-wei.fang@nxp.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ethernet: arc: emac: quiesce interrupts before requesting IRQ [+ + +]
Author: Fan Wu <fanwu01@zju.edu.cn>
Date:   Mon Mar 9 13:24:09 2026 +0000

    net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
    
    commit 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c upstream.
    
    Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe
    should not see interrupt delivery in the usual case. However, hardware may
    still present stale or latched interrupt status left by firmware or the
    bootloader.
    
    If probe later unwinds after devm_request_irq() has installed the handler,
    such a stale interrupt can still reach arc_emac_intr() during teardown and
    race with release of the associated net_device.
    
    Avoid that window by putting the device into a known quiescent state before
    requesting the IRQ: disable all EMAC interrupt sources and clear any
    pending EMAC interrupt status bits. This keeps the change hardware-focused
    and minimal, while preventing spurious IRQ delivery from leftover state.
    
    Fixes: e4f2379db6c6 ("ethernet/arc/arc_emac - Add new driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
    Link: https://patch.msgid.link/20260309132409.584966-1-fanwu01@zju.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table [+ + +]
Author: Chintan Vankar <c-vankar@ti.com>
Date:   Tue Feb 24 23:43:59 2026 +0530

    net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
    
    [ Upstream commit be11a537224d72b906db6b98510619770298c8a4 ]
    
    In the current implementation, flushing multicast entries in MAC mode
    incorrectly deletes entries for all ports instead of only the target port,
    disrupting multicast traffic on other ports. The cause is adding multicast
    entries by setting only host port bit, and not setting the MAC port bits.
    
    Fix this by setting the MAC port's bit in the port mask while adding the
    multicast entry. Also fix the flush logic to preserve the host port bit
    during removal of MAC port and free ALE entries when mask contains only
    host port.
    
    Fixes: 5c50a856d550 ("drivers: net: ethernet: cpsw: add multicast address to ALE table")
    Signed-off-by: Chintan Vankar <c-vankar@ti.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20260224181359.2055322-1-c-vankar@ti.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: fix fanout UAF in packet_release() via NETDEV_UP race [+ + +]
Author: Yochai Eisenrich <echelonh@gmail.com>
Date:   Thu Mar 19 22:06:10 2026 +0200

    net: fix fanout UAF in packet_release() via NETDEV_UP race
    
    [ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
    
    `packet_release()` has a race window where `NETDEV_UP` can re-register a
    socket into a fanout group's `arr[]` array. The re-registration is not
    cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout
    array.
    `packet_release()` does NOT zero `po->num` in its `bind_lock` section.
    After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`
    still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`
    that already found the socket in `sklist` can re-register the hook.
    For fanout sockets, this re-registration calls `__fanout_link(sk, po)`
    which adds the socket back into `f->arr[]` and increments `f->num_members`,
    but does NOT increment `f->sk_ref`.
    
    The fix sets `po->num` to zero in `packet_release` while `bind_lock` is
    held to prevent NETDEV_UP from linking, preventing the race window.
    
    This bug was found following an additional audit with Claude Code based
    on CVE-2025-38617.
    
    Fixes: ce06b03e60fc ("packet: Add helpers to register/unregister ->prot_hook")
    Link: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve
    Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20260319200610.25101-1-echelonh@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ftgmac100: fix ring allocation unwind on open failure [+ + +]
Author: Yufan Chen <yufan.chen@linux.dev>
Date:   Sun Mar 29 00:32:57 2026 +0800

    net: ftgmac100: fix ring allocation unwind on open failure
    
    commit c0fd0fe745f5e8c568d898cd1513d0083e46204a upstream.
    
    ftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and
    rx_scratch in stages. On intermediate failures it returned -ENOMEM
    directly, leaking resources allocated earlier in the function.
    
    Rework the failure path to use staged local unwind labels and free
    allocated resources in reverse order before returning -ENOMEM. This
    matches common netdev allocation cleanup style.
    
    Fixes: d72e01a0430f ("ftgmac100: Use a scratch buffer for failed RX allocations")
    Cc: stable@vger.kernel.org
    Signed-off-by: Yufan Chen <yufan.chen@linux.dev>
    Link: https://patch.msgid.link/20260328163257.60836-1-yufan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: Handle napi_schedule() calls from non-interrupt [+ + +]
Author: Frederic Weisbecker <frederic@kernel.org>
Date:   Sun Feb 23 23:17:08 2025 +0100

    net: Handle napi_schedule() calls from non-interrupt
    
    commit 77e45145e3039a0fb212556ab3f8c87f54771757 upstream.
    
    napi_schedule() is expected to be called either:
    
    * From an interrupt, where raised softirqs are handled on IRQ exit
    
    * From a softirq disabled section, where raised softirqs are handled on
      the next call to local_bh_enable().
    
    * From a softirq handler, where raised softirqs are handled on the next
      round in do_softirq(), or further deferred to a dedicated kthread.
    
    Other bare tasks context may end up ignoring the raised NET_RX vector
    until the next random softirq handling opportunity, which may not
    happen before a while if the CPU goes idle afterwards with the tick
    stopped.
    
    Such "misuses" have been detected on several places thanks to messages
    of the kind:
    
            "NOHZ tick-stop error: local softirq work is pending, handler #08!!!"
    
    For example:
    
           __raise_softirq_irqoff
            __napi_schedule
            rtl8152_runtime_resume.isra.0
            rtl8152_resume
            usb_resume_interface.isra.0
            usb_resume_both
            __rpm_callback
            rpm_callback
            rpm_resume
            __pm_runtime_resume
            usb_autoresume_device
            usb_remote_wakeup
            hub_event
            process_one_work
            worker_thread
            kthread
            ret_from_fork
            ret_from_fork_asm
    
    And also:
    
    * drivers/net/usb/r8152.c::rtl_work_func_t
    * drivers/net/netdevsim/netdev.c::nsim_start_xmit
    
    There is a long history of issues of this kind:
    
            019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()")
            330068589389 ("idpf: disable local BH when scheduling napi for marker packets")
            e3d5d70cb483 ("net: lan78xx: fix "softirq work is pending" error")
            e55c27ed9ccf ("mt76: mt7615: add missing bh-disable around rx napi schedule")
            c0182aa98570 ("mt76: mt7915: add missing bh-disable around tx napi enable/schedule")
            970be1dff26d ("mt76: disable BH around napi_schedule() calls")
            019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()")
            30bfec4fec59 ("can: rx-offload: can_rx_offload_threaded_irq_finish(): add new  function to be called from threaded interrupt")
            e63052a5dd3c ("mlx5e: add add missing BH locking around napi_schdule()")
            83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule")
            bd4ce941c8d5 ("mlx4: Invoke softirqs after napi_reschedule")
            8cf699ec849f ("mlx4: do not call napi_schedule() without care")
            ec13ee80145c ("virtio_net: invoke softirqs after __napi_schedule")
    
    This shows that relying on the caller to arrange a proper context for
    the softirqs to be handled while calling napi_schedule() is very fragile
    and error prone. Also fixing them can also prove challenging if the
    caller may be called from different kinds of contexts.
    
    Therefore fix this from napi_schedule() itself with waking up ksoftirqd
    when softirqs are raised from task contexts.
    
    Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Reported-by: Francois Romieu <romieu@fr.zoreil.com>
    Closes: https://lore.kernel.org/lkml/354a2690-9bbf-4ccb-8769-fa94707a9340@molgen.mpg.de/
    Cc: Breno Leitao <leitao@debian.org>
    Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20250223221708.27130-1-frederic@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: hsr: fix VLAN add unwind on slave errors [+ + +]
Author: Luka Gejak <luka.gejak@linux.dev>
Date:   Wed Apr 1 11:22:43 2026 +0200

    net: hsr: fix VLAN add unwind on slave errors
    
    [ Upstream commit 2e3514e63bfb0e972b1f19668547a455d0129e88 ]
    
    When vlan_vid_add() fails for a secondary slave, the error path calls
    vlan_vid_del() on the failing port instead of the peer slave that had
    already succeeded. This results in asymmetric VLAN state across the HSR
    pair.
    
    Fix this by switching to a centralized unwind path that removes the VID
    from any slave device that was already programmed.
    
    Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support")
    Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
    Link: https://patch.msgid.link/20260401092243.52121-3-luka.gejak@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Wed Mar 4 19:38:13 2026 +0800

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
    
    [ Upstream commit 21ec92774d1536f71bdc90b0e3d052eff99cf093 ]
    
    When a standalone IPv6 nexthop object is created with a loopback device
    (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies
    it as a reject route. This is because nexthop objects have no destination
    prefix (fc_dst=::), causing fib6_is_reject() to match any loopback
    nexthop. The reject path skips fib_nh_common_init(), leaving
    nhc_pcpu_rth_output unallocated. If an IPv4 route later references this
    nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and
    panics.
    
    Simplify the check in fib6_nh_init() to only match explicit reject
    routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback
    promotion heuristic in fib6_is_reject() is handled separately by
    ip6_route_info_create_nh(). After this change, the three cases behave
    as follows:
    
    1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"):
       RTF_REJECT is set, enters reject path, skips fib_nh_common_init().
       No behavior change.
    
    2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"):
       RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
       called. ip6_route_info_create_nh() still promotes it to reject
       afterward. nhc_pcpu_rth_output is allocated but unused, which is
       harmless.
    
    3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"):
       RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
       called. nhc_pcpu_rth_output is properly allocated, fixing the crash
       when IPv4 routes reference this nexthop.
    
    Suggested-by: Ido Schimmel <idosch@nvidia.com>
    Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects")
    Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ipv6: flowlabel: defer exclusive option free until RCU teardown [+ + +]
Author: Zhengchuan Liang <zcliangcn@gmail.com>
Date:   Mon Mar 30 16:46:24 2026 +0800

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown
    
    [ Upstream commit 9ca562bb8e66978b53028fa32b1a190708e6a091 ]
    
    `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
    RCU read-side lock and prints `fl->opt->opt_nflen` when an option block
    is present.
    
    Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`
    drops to zero in `fl_release()`. However, the surrounding
    `struct ip6_flowlabel` remains visible in the global hash table until
    later garbage collection removes it and `fl_free_rcu()` finally tears it
    down.
    
    A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that
    early `kfree()` and dereference freed option state, triggering a crash
    in `ip6fl_seq_show()`.
    
    Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches
    the lifetime already required for the enclosing flowlabel while readers
    can still reach it under RCU.
    
    Fixes: d3aedd5ebd4b ("ipv6 flowlabel: Convert hash list to RCU.")
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Co-developed-by: Yuan Tan <yuantan098@gmail.com>
    Signed-off-by: Yuan Tan <yuantan098@gmail.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Tested-by: Ren Wei <enjou1224z@gmail.com>
    Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
    Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/07351f0ec47bcee289576f39f9354f4a64add6e4.1774855883.git.zcliangcn@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak [+ + +]
Author: Yochai Eisenrich <echelonh@gmail.com>
Date:   Wed Mar 25 00:49:25 2026 +0200

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
    
    [ Upstream commit ae05340ccaa9d347fe85415609e075545bec589f ]
    
    When processing Router Advertisements with user options the kernel
    builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
    has three padding fields that are never zeroed and can leak kernel data
    
    The fix is simple, just zeroes the padding fields.
    
    Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink (RDNSS support)")
    Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20260324224925.2437775-1-echelonh@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: macb: fix clk handling on PCI glue driver removal [+ + +]
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Mon Mar 30 21:45:40 2026 +0300

    net: macb: fix clk handling on PCI glue driver removal
    
    [ Upstream commit ce8fe5287b87e24e225c342f3b0ec04f0b3680fe ]
    
    platform_device_unregister() may still want to use the registered clks
    during runtime resume callback.
    
    Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free
    on rmmod") that addressed the similar problem of clk vs platform device
    unregistration but just moved the bug to another place.
    
    Save the pointers to clks into local variables for reuse after platform
    device is unregistered.
    
    BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60
    Read of size 8 at addr ffff888104f85e00 by task modprobe/597
    
    CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x8d/0xba
     print_report+0x17f/0x496
     kasan_report+0xd9/0x180
     clk_prepare+0x5a/0x60
     macb_runtime_resume+0x13d/0x410 [macb]
     pm_generic_runtime_resume+0x97/0xd0
     __rpm_callback+0xc8/0x4d0
     rpm_callback+0xf6/0x230
     rpm_resume+0xeeb/0x1a70
     __pm_runtime_resume+0xb4/0x170
     bus_remove_device+0x2e3/0x4b0
     device_del+0x5b3/0xdc0
     platform_device_del+0x4e/0x280
     platform_device_unregister+0x11/0x50
     pci_device_remove+0xae/0x210
     device_remove+0xcb/0x180
     device_release_driver_internal+0x529/0x770
     driver_detach+0xd4/0x1a0
     bus_remove_driver+0x135/0x260
     driver_unregister+0x72/0xb0
     pci_unregister_driver+0x26/0x220
     __do_sys_delete_module+0x32e/0x550
     do_syscall_64+0x35/0x80
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
     </TASK>
    
    Allocated by task 519:
     kasan_save_stack+0x2c/0x50
     kasan_set_track+0x21/0x30
     __kasan_kmalloc+0x8e/0x90
     __clk_register+0x458/0x2890
     clk_hw_register+0x1a/0x60
     __clk_hw_register_fixed_rate+0x255/0x410
     clk_register_fixed_rate+0x3c/0xa0
     macb_probe+0x1d8/0x42e [macb_pci]
     local_pci_probe+0xd7/0x190
     pci_device_probe+0x252/0x600
     really_probe+0x255/0x7f0
     __driver_probe_device+0x1ee/0x330
     driver_probe_device+0x4c/0x1f0
     __driver_attach+0x1df/0x4e0
     bus_for_each_dev+0x15d/0x1f0
     bus_add_driver+0x486/0x5e0
     driver_register+0x23a/0x3d0
     do_one_initcall+0xfd/0x4d0
     do_init_module+0x18b/0x5a0
     load_module+0x5663/0x7950
     __do_sys_finit_module+0x101/0x180
     do_syscall_64+0x35/0x80
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    Freed by task 597:
     kasan_save_stack+0x2c/0x50
     kasan_set_track+0x21/0x30
     kasan_save_free_info+0x2a/0x50
     __kasan_slab_free+0x106/0x180
     __kmem_cache_free+0xbc/0x320
     clk_unregister+0x6de/0x8d0
     macb_remove+0x73/0xc0 [macb_pci]
     pci_device_remove+0xae/0x210
     device_remove+0xcb/0x180
     device_release_driver_internal+0x529/0x770
     driver_detach+0xd4/0x1a0
     bus_remove_driver+0x135/0x260
     driver_unregister+0x72/0xb0
     pci_unregister_driver+0x26/0x220
     __do_sys_delete_module+0x32e/0x550
     do_syscall_64+0x35/0x80
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    Fixes: d82d5303c4c5 ("net: macb: fix use after free on rmmod")
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Link: https://patch.msgid.link/20260330184542.626619-1-pchelkin@ispras.ru
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: macb: fix uninitialized rx_fs_lock [+ + +]
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Mon Mar 16 13:38:25 2026 +0300

    net: macb: fix uninitialized rx_fs_lock
    
    [ Upstream commit 34b11cc56e4369bc08b1f4c4a04222d75ed596ce ]
    
    If hardware doesn't support RX Flow Filters, rx_fs_lock spinlock is not
    initialized leading to the following assertion splat triggerable via
    set_rxnfc callback.
    
    INFO: trying to register non-static key.
    The code is fine but needs lockdep annotation, or maybe
    you didn't initialize this object before use?
    turning off the locking correctness validator.
    CPU: 1 PID: 949 Comm: syz.0.6 Not tainted 6.1.164+ #113
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106
     assign_lock_key kernel/locking/lockdep.c:974 [inline]
     register_lock_class+0x141b/0x17f0 kernel/locking/lockdep.c:1287
     __lock_acquire+0x74f/0x6c40 kernel/locking/lockdep.c:4928
     lock_acquire kernel/locking/lockdep.c:5662 [inline]
     lock_acquire+0x190/0x4b0 kernel/locking/lockdep.c:5627
     __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
     _raw_spin_lock_irqsave+0x33/0x50 kernel/locking/spinlock.c:162
     gem_del_flow_filter drivers/net/ethernet/cadence/macb_main.c:3562 [inline]
     gem_set_rxnfc+0x533/0xac0 drivers/net/ethernet/cadence/macb_main.c:3667
     ethtool_set_rxnfc+0x18c/0x280 net/ethtool/ioctl.c:961
     __dev_ethtool net/ethtool/ioctl.c:2956 [inline]
     dev_ethtool+0x229c/0x6290 net/ethtool/ioctl.c:3095
     dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510
     sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
     sock_ioctl+0x577/0x6d0 net/socket.c:1320
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:870 [inline]
     __se_sys_ioctl fs/ioctl.c:856 [inline]
     __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
     do_syscall_x64 arch/x86/entry/common.c:46 [inline]
     do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    A more straightforward solution would be to always initialize rx_fs_lock,
    just like rx_fs_list.  However, in this case the driver set_rxnfc callback
    would return with a rather confusing error code, e.g. -EINVAL.  So deny
    set_rxnfc attempts directly if the RX filtering feature is not supported
    by hardware.
    
    Fixes: ae8223de3df5 ("net: macb: Added support for RX filtering")
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Link: https://patch.msgid.link/20260316103826.74506-2-pchelkin@ispras.ru
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: macb: fix use-after-free access to PTP clock [+ + +]
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Mon Mar 16 13:38:24 2026 +0300

    net: macb: fix use-after-free access to PTP clock
    
    commit 8da13e6d63c1a97f7302d342c89c4a56a55c7015 upstream.
    
    PTP clock is registered on every opening of the interface and destroyed on
    every closing.  However it may be accessed via get_ts_info ethtool call
    which is possible while the interface is just present in the kernel.
    
    BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426
    Read of size 4 at addr ffff8880194345cc by task syz.0.6/948
    
    CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106
     print_address_description mm/kasan/report.c:316 [inline]
     print_report+0x17f/0x496 mm/kasan/report.c:420
     kasan_report+0xd9/0x180 mm/kasan/report.c:524
     ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426
     gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349
     macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371
     __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558
     ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline]
     __dev_ethtool net/ethtool/ioctl.c:3017 [inline]
     dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095
     dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510
     sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
     sock_ioctl+0x577/0x6d0 net/socket.c:1320
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:870 [inline]
     __se_sys_ioctl fs/ioctl.c:856 [inline]
     __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
     do_syscall_x64 arch/x86/entry/common.c:46 [inline]
     do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
     </TASK>
    
    Allocated by task 457:
     kmalloc include/linux/slab.h:563 [inline]
     kzalloc include/linux/slab.h:699 [inline]
     ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235
     gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375
     macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920
     __dev_open+0x2ce/0x500 net/core/dev.c:1501
     __dev_change_flags+0x56a/0x740 net/core/dev.c:8651
     dev_change_flags+0x92/0x170 net/core/dev.c:8722
     do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833
     __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608
     rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655
     rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150
     netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872
     sock_sendmsg_nosec net/socket.c:718 [inline]
     __sock_sendmsg+0x14b/0x180 net/socket.c:730
     __sys_sendto+0x320/0x3b0 net/socket.c:2152
     __do_sys_sendto net/socket.c:2164 [inline]
     __se_sys_sendto net/socket.c:2160 [inline]
     __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160
     do_syscall_x64 arch/x86/entry/common.c:46 [inline]
     do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    Freed by task 938:
     kasan_slab_free include/linux/kasan.h:177 [inline]
     slab_free_hook mm/slub.c:1729 [inline]
     slab_free_freelist_hook mm/slub.c:1755 [inline]
     slab_free mm/slub.c:3687 [inline]
     __kmem_cache_free+0xbc/0x320 mm/slub.c:3700
     device_release+0xa0/0x240 drivers/base/core.c:2507
     kobject_cleanup lib/kobject.c:681 [inline]
     kobject_release lib/kobject.c:712 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x1cd/0x350 lib/kobject.c:729
     put_device+0x1b/0x30 drivers/base/core.c:3805
     ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391
     gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404
     macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966
     __dev_close_many+0x1b9/0x310 net/core/dev.c:1585
     __dev_close net/core/dev.c:1597 [inline]
     __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649
     dev_change_flags+0x92/0x170 net/core/dev.c:8722
     dev_ifsioc+0x151/0xe00 net/core/dev_ioctl.c:326
     dev_ioctl+0x33e/0x1070 net/core/dev_ioctl.c:572
     sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
     sock_ioctl+0x577/0x6d0 net/socket.c:1320
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:870 [inline]
     __se_sys_ioctl fs/ioctl.c:856 [inline]
     __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
     do_syscall_x64 arch/x86/entry/common.c:46 [inline]
     do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    Set the PTP clock pointer to NULL after unregistering.
    
    Fixes: c2594d804d5c ("macb: Common code to enable ptp support for MACB/GEM")
    Cc: stable@vger.kernel.org
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Link: https://patch.msgid.link/20260316103826.74506-1-pchelkin@ispras.ru
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: macb: Move devm_{free,request}_irq() out of spin lock area [+ + +]
Author: Kevin Hao <haokexin@gmail.com>
Date:   Tue Mar 31 20:02:38 2026 -0400

    net: macb: Move devm_{free,request}_irq() out of spin lock area
    
    [ Upstream commit 317e49358ebbf6390fa439ef3c142f9239dd25fb ]
    
    The devm_free_irq() and devm_request_irq() functions should not be
    executed in an atomic context.
    
    During device suspend, all userspace processes and most kernel threads
    are frozen. Additionally, we flush all tx/rx status, disable all macb
    interrupts, and halt rx operations. Therefore, it is safe to split the
    region protected by bp->lock into two independent sections, allowing
    devm_free_irq() and devm_request_irq() to run in a non-atomic context.
    This modification resolves the following lockdep warning:
      BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
      in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake
      preempt_count: 1, expected: 0
      RCU nest depth: 1, expected: 0
      7 locks held by rtcwake/501:
       #0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368
       #1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8
       #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8
       #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290
       #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0
       #5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48
       #6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558
      irq event stamp: 8682
      hardirqs last  enabled at (8681): [<ffff8000813c7d7c>] _raw_spin_unlock_irqrestore+0x44/0x88
      hardirqs last disabled at (8682): [<ffff8000813c7b58>] _raw_spin_lock_irqsave+0x38/0x98
      softirqs last  enabled at (7322): [<ffff8000800f1b4c>] handle_softirqs+0x52c/0x588
      softirqs last disabled at (7317): [<ffff800080010310>] __do_softirq+0x20/0x2c
      CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT
      Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
      Call trace:
       show_stack+0x24/0x38 (C)
       __dump_stack+0x28/0x38
       dump_stack_lvl+0x64/0x88
       dump_stack+0x18/0x24
       __might_resched+0x200/0x218
       __might_sleep+0x38/0x98
       __mutex_lock_common+0x7c/0x1378
       mutex_lock_nested+0x38/0x50
       free_irq+0x68/0x2b0
       devm_irq_release+0x24/0x38
       devres_release+0x40/0x80
       devm_free_irq+0x48/0x88
       macb_suspend+0x298/0x558
       device_suspend+0x218/0x4f0
       dpm_suspend+0x244/0x3a0
       dpm_suspend_start+0x50/0x78
       suspend_devices_and_enter+0xec/0x560
       pm_suspend+0x194/0x290
       state_store+0x110/0x158
       kobj_attr_store+0x1c/0x30
       sysfs_kf_write+0xa8/0xd0
       kernfs_fop_write_iter+0x11c/0x1c8
       vfs_write+0x248/0x368
       ksys_write+0x7c/0xf8
       __arm64_sys_write+0x28/0x40
       invoke_syscall+0x4c/0xe8
       el0_svc_common+0x98/0xf0
       do_el0_svc+0x28/0x40
       el0_svc+0x54/0x1e0
       el0t_64_sync_handler+0x84/0x130
       el0t_64_sync+0x198/0x1a0
    
    Fixes: 558e35ccfe95 ("net: macb: WoL support for GEM type of Ethernet controller")
    Cc: stable@vger.kernel.org
    Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
    Signed-off-by: Kevin Hao <haokexin@gmail.com>
    Link: https://patch.msgid.link/20260318-macb-irq-v2-1-f1179768ab24@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ adapted WoL register writes to use MACB_BIT(MAG) instead of tmp variable ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: macb: properly unregister fixed rate clocks [+ + +]
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Mon Mar 30 21:45:41 2026 +0300

    net: macb: properly unregister fixed rate clocks
    
    [ Upstream commit f0f367a4f459cc8118aadc43c6bba53c60d93f8d ]
    
    The additional resources allocated with clk_register_fixed_rate() need
    to be released with clk_unregister_fixed_rate(), otherwise they are lost.
    
    Fixes: 83a77e9ec415 ("net: macb: Added PCI wrapper for Platform Driver.")
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Link: https://patch.msgid.link/20260330184542.626619-2-pchelkin@ispras.ru
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: macb: use the current queue number for stats [+ + +]
Author: Paolo Valerio <pvalerio@redhat.com>
Date:   Mon Mar 23 20:16:34 2026 +0100

    net: macb: use the current queue number for stats
    
    [ Upstream commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 ]
    
    There's a potential mismatch between the memory reserved for statistics
    and the amount of memory written.
    
    gem_get_sset_count() correctly computes the number of stats based on the
    active queues, whereas gem_get_ethtool_stats() indiscriminately copies
    data using the maximum number of queues, and in the case the number of
    active queues is less than MACB_MAX_QUEUES, this results in a OOB write
    as observed in the KASAN splat.
    
    ==================================================================
    BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78
      [macb]
    Write of size 760 at addr ffff80008080b000 by task ethtool/1027
    
    CPU: [...]
    Tainted: [E]=UNSIGNED_MODULE
    Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
    Call trace:
     show_stack+0x20/0x38 (C)
     dump_stack_lvl+0x80/0xf8
     print_report+0x384/0x5e0
     kasan_report+0xa0/0xf0
     kasan_check_range+0xe8/0x190
     __asan_memcpy+0x54/0x98
     gem_get_ethtool_stats+0x54/0x78 [macb
       926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
     dev_ethtool+0x1220/0x38c0
     dev_ioctl+0x4ac/0xca8
     sock_do_ioctl+0x170/0x1d8
     sock_ioctl+0x484/0x5d8
     __arm64_sys_ioctl+0x12c/0x1b8
     invoke_syscall+0xd4/0x258
     el0_svc_common.constprop.0+0xb4/0x240
     do_el0_svc+0x48/0x68
     el0_svc+0x40/0xf8
     el0t_64_sync_handler+0xa0/0xe8
     el0t_64_sync+0x1b0/0x1b8
    
    The buggy address belongs to a 1-page vmalloc region starting at
      0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
    The buggy address belongs to the physical page:
    page: refcount:1 mapcount:0 mapping:0000000000000000
      index:0xffff00000a333000 pfn:0xa333
    flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
    raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
    raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                      ^
     ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
     ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
    ==================================================================
    
    Fix it by making sure the copied size only considers the active number of
    queues.
    
    Fixes: 512286bbd4b7 ("net: macb: Added some queue statistics")
    Signed-off-by: Paolo Valerio <pvalerio@redhat.com>
    Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
    Link: https://patch.msgid.link/20260323191634.2185840-1-pvalerio@redhat.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown [+ + +]
Author: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Date:   Wed Mar 11 12:22:04 2026 -0700

    net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
    
    [ Upstream commit fa103fc8f56954a60699a29215cb713448a39e87 ]
    
    A potential race condition exists in mana_hwc_destroy_channel() where
    hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
    Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
    handler to dereference freed memory, leading to a use-after-free or
    NULL pointer dereference in mana_hwc_handle_resp().
    
    mana_smc_teardown_hwc() signals the hardware to stop but does not
    synchronize against IRQ handlers already executing on other CPUs. The
    IRQ synchronization only happens in mana_hwc_destroy_cq() via
    mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
    after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()
    can dereference freed caller_ctx (and rxq->msg_buf) in
    mana_hwc_handle_resp().
    
    Fix this by reordering teardown to reverse-of-creation order: destroy
    the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This
    ensures all in-flight interrupt handlers complete before the memory they
    access is freed.
    
    Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
    Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
    Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/abHA3AjNtqa1nx9k@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mana: Improve the HWC error handling [+ + +]
Author: Dexuan Cui <decui@microsoft.com>
Date:   Fri Oct 29 17:54:07 2021 -0700

    net: mana: Improve the HWC error handling
    
    [ Upstream commit 62ea8b77ed3b7086561765df0226ebc7bb442020 ]
    
    Currently when the HWC creation fails, the error handling is flawed,
    e.g. if mana_hwc_create_channel() -> mana_hwc_establish_channel() fails,
    the resources acquired in mana_hwc_init_queues() is not released.
    
    Enhance mana_hwc_destroy_channel() to do the proper cleanup work and
    call it accordingly.
    
    Signed-off-by: Dexuan Cui <decui@microsoft.com>
    Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: fa103fc8f569 ("net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mana: Ring doorbell at 4 CQ wraparounds [+ + +]
Author: Long Li <longli@microsoft.com>
Date:   Thu Feb 26 11:28:33 2026 -0800

    net: mana: Ring doorbell at 4 CQ wraparounds
    
    commit dabffd08545ffa1d7183bc45e387860984025291 upstream.
    
    MANA hardware requires at least one doorbell ring every 8 wraparounds
    of the CQ. The driver rings the doorbell as a form of flow control to
    inform hardware that CQEs have been consumed.
    
    The NAPI poll functions mana_poll_tx_cq() and mana_poll_rx_cq() can
    poll up to CQE_POLLING_BUFFER (512) completions per call. If the CQ
    has fewer than 512 entries, a single poll call can process more than
    4 wraparounds without ringing the doorbell. The doorbell threshold
    check also uses ">" instead of ">=", delaying the ring by one extra
    CQE beyond 4 wraparounds. Combined, these issues can cause the driver
    to exceed the 8-wraparound hardware limit, leading to missed
    completions and stalled queues.
    
    Fix this by capping the number of CQEs polled per call to 4 wraparounds
    of the CQ in both TX and RX paths. Also change the doorbell threshold
    from ">" to ">=" so the doorbell is rung as soon as 4 wraparounds are
    reached.
    
    Cc: stable@vger.kernel.org
    Fixes: 58a63729c957 ("net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings")
    Signed-off-by: Long Li <longli@microsoft.com>
    Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
    Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
    Link: https://patch.msgid.link/20260226192833.1050807-1-longli@microsoft.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: mctp: Don't access ifa_index when missing [+ + +]
Author: Matt Johnston <matt@codeconstruct.com.au>
Date:   Wed Apr 1 08:44:41 2026 +0800

    net: mctp: Don't access ifa_index when missing
    
    [ Upstream commit f11cf946c0a92c560a890d68e4775723353599e1 ]
    
    In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but
    only when the struct ifaddrmsg is provided. Otherwise it will be
    comparing to uninitialised memory - reproducible in the syzkaller case from
    dhcpd, or busybox "ip addr show".
    
    The kernel MCTP implementation has always filtered by ifa_index, so
    existing userspace programs expecting to dump MCTP addresses must
    already be passing a valid ifa_index value (either 0 or a real index).
    
    BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
     mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
     rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380
     rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824
     netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309
    
    [ The context change is due to the commit 2d45eeb7d5d7
    ("mctp: no longer rely on net->dev_index_head[]") in v6.14
    which is irrelevant to the logic of this patch. ]
    
    Fixes: 583be982d934 ("mctp: Add device handling and netlink interface")
    Reported-by: syzbot+e76d52dadc089b9d197f@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/68135815.050a0220.3a872c.000e.GAE@google.com/
    Reported-by: syzbot+1065a199625a388fce60@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/681357d6.050a0220.14dd7d.000d.GAE@google.com/
    Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
    Link: https://patch.msgid.link/20250508-mctp-addr-dump-v2-1-c8a53fd2dd66@codeconstruct.com.au
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Johnny Hao <johnny_haocn@sina.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mvpp2: guard flow control update with global_tx_fc in buffer switching [+ + +]
Author: Muhammad Hammad Ijaz <mhijaz@amazon.com>
Date:   Mon Mar 16 12:31:01 2026 -0700

    net: mvpp2: guard flow control update with global_tx_fc in buffer switching
    
    [ Upstream commit 8a63baadf08453f66eb582fdb6dd234f72024723 ]
    
    mvpp2_bm_switch_buffers() unconditionally calls
    mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and
    shared buffer pool modes. This function programs CM3 flow control
    registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference
    priv->cm3_base without any NULL check.
    
    When the CM3 SRAM resource is not present in the device tree (the
    third reg entry added by commit 60523583b07c ("dts: marvell: add CM3
    SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains
    NULL and priv->global_tx_fc is false. Any operation that triggers
    mvpp2_bm_switch_buffers(), for example an MTU change that crosses
    the jumbo frame threshold, will crash:
    
      Unable to handle kernel NULL pointer dereference at
      virtual address 0000000000000000
      Mem abort info:
        ESR = 0x0000000096000006
        EC = 0x25: DABT (current EL), IL = 32 bits
      pc : readl+0x0/0x18
      lr : mvpp2_cm3_read.isra.0+0x14/0x20
      Call trace:
       readl+0x0/0x18
       mvpp2_bm_pool_update_fc+0x40/0x12c
       mvpp2_bm_pool_update_priv_fc+0x94/0xd8
       mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0
       mvpp2_change_mtu+0x140/0x380
       __dev_set_mtu+0x1c/0x38
       dev_set_mtu_ext+0x78/0x118
       dev_set_mtu+0x48/0xa8
       dev_ifsioc+0x21c/0x43c
       dev_ioctl+0x2d8/0x42c
       sock_ioctl+0x314/0x378
    
    Every other flow control call site in the driver already guards
    hardware access with either priv->global_tx_fc or port->tx_fc.
    mvpp2_bm_switch_buffers() is the only place that omits this check.
    
    Add the missing priv->global_tx_fc guard to both the disable and
    re-enable calls in mvpp2_bm_switch_buffers(), consistent with the
    rest of the driver.
    
    Fixes: 3a616b92a9d1 ("net: mvpp2: Add TX flow control support for jumbo frames")
    Signed-off-by: Muhammad Hammad Ijaz <mhijaz@amazon.com>
    Reviewed-by: Gunnar Kudrjavets <gunnarku@amazon.com>
    Link: https://patch.msgid.link/20260316193157.65748-1-mhijaz@amazon.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: ncsi: fix skb leak in error paths [+ + +]
Author: Jian Zhang <zhangjian.3032@bytedance.com>
Date:   Thu Mar 5 14:06:55 2026 +0800

    net: ncsi: fix skb leak in error paths
    
    commit 5c3398a54266541610c8d0a7082e654e9ff3e259 upstream.
    
    Early return paths in NCSI RX and AEN handlers fail to release
    the received skb, resulting in a memory leak.
    
    Specifically, ncsi_aen_handler() returns on invalid AEN packets
    without consuming the skb. Similarly, ncsi_rcv_rsp() exits early
    when failing to resolve the NCSI device, response handler, or
    request, leaving the skb unfreed.
    
    CC: stable@vger.kernel.org
    Fixes: 7a82ecf4cfb8 ("net/ncsi: NCSI AEN packet handler")
    Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
    Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
    Link: https://patch.msgid.link/20260305060656.3357250-1-zhangjian.3032@bytedance.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: nfc: nci: Fix zero-length proprietary notifications [+ + +]
Author: Ian Ray <ian.ray@gehealthcare.com>
Date:   Mon Mar 2 18:32:37 2026 +0200

    net: nfc: nci: Fix zero-length proprietary notifications
    
    [ Upstream commit f7d92f11bd33a6eb49c7c812255ef4ab13681f0f ]
    
    NCI NFC controllers may have proprietary OIDs with zero-length payload.
    One example is: drivers/nfc/nxp-nci/core.c, NXP_NCI_RF_TXLDO_ERROR_NTF.
    
    Allow a zero length payload in proprietary notifications *only*.
    
    Before:
    
    -- >8 --
    kernel: nci: nci_recv_frame: len 3
    -- >8 --
    
    After:
    
    -- >8 --
    kernel: nci: nci_recv_frame: len 3
    kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x23, plen=0
    kernel: nci: nci_ntf_packet: unknown ntf opcode 0x123
    kernel: nfc nfc0: NFC: RF transmitter couldn't start. Bad power and/or configuration?
    -- >8 --
    
    After fixing the hardware:
    
    -- >8 --
    kernel: nci: nci_recv_frame: len 27
    kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x5, plen=24
    kernel: nci: nci_rf_intf_activated_ntf_packet: rf_discovery_id 1
    -- >8 --
    
    Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
    Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
    Link: https://patch.msgid.link/20260302163238.140576-1-ian.ray@gehealthcare.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: openvswitch: Avoid releasing netdev before teardown completes [+ + +]
Author: Toke Høiland-Jørgensen <toke@redhat.com>
Date:   Wed Mar 18 16:55:51 2026 +0100

    net: openvswitch: Avoid releasing netdev before teardown completes
    
    [ Upstream commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 ]
    
    The patch cited in the Fixes tag below changed the teardown code for
    OVS ports to no longer unconditionally take the RTNL. After this change,
    the netdev_destroy() callback can proceed immediately to the call_rcu()
    invocation if the IFF_OVS_DATAPATH flag is already cleared on the
    netdev.
    
    The ovs_netdev_detach_dev() function clears the flag before completing
    the unregistration, and if it gets preempted after clearing the flag (as
    can happen on an -rt kernel), netdev_destroy() can complete and the
    device can be freed before the unregistration completes. This leads to a
    splat like:
    
    [  998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI
    [  998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT
    [  998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025
    [  998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0
    [  998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90
    [  998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246
    [  998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000
    [  998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05
    [  998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000
    [  998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006
    [  998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000
    [  998.393931] FS:  00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000
    [  998.393936] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0
    [  998.393944] PKRU: 55555554
    [  998.393946] Call Trace:
    [  998.393949]  <TASK>
    [  998.393952]  ? show_trace_log_lvl+0x1b0/0x2f0
    [  998.393961]  ? show_trace_log_lvl+0x1b0/0x2f0
    [  998.393975]  ? dp_device_event+0x41/0x80 [openvswitch]
    [  998.394009]  ? __die_body.cold+0x8/0x12
    [  998.394016]  ? die_addr+0x3c/0x60
    [  998.394027]  ? exc_general_protection+0x16d/0x390
    [  998.394042]  ? asm_exc_general_protection+0x26/0x30
    [  998.394058]  ? dev_set_promiscuity+0x8d/0xa0
    [  998.394066]  ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch]
    [  998.394092]  dp_device_event+0x41/0x80 [openvswitch]
    [  998.394102]  notifier_call_chain+0x5a/0xd0
    [  998.394106]  unregister_netdevice_many_notify+0x51b/0xa60
    [  998.394110]  rtnl_dellink+0x169/0x3e0
    [  998.394121]  ? rt_mutex_slowlock.constprop.0+0x95/0xd0
    [  998.394125]  rtnetlink_rcv_msg+0x142/0x3f0
    [  998.394128]  ? avc_has_perm_noaudit+0x69/0xf0
    [  998.394130]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
    [  998.394132]  netlink_rcv_skb+0x50/0x100
    [  998.394138]  netlink_unicast+0x292/0x3f0
    [  998.394141]  netlink_sendmsg+0x21b/0x470
    [  998.394145]  ____sys_sendmsg+0x39d/0x3d0
    [  998.394149]  ___sys_sendmsg+0x9a/0xe0
    [  998.394156]  __sys_sendmsg+0x7a/0xd0
    [  998.394160]  do_syscall_64+0x7f/0x170
    [  998.394162]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
    [  998.394165] RIP: 0033:0x7fad61bf4724
    [  998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89
    [  998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
    [  998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724
    [  998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003
    [  998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f
    [  998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380
    [  998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000
    [  998.394200]  </TASK>
    
    To fix this, reorder the operations in ovs_netdev_detach_dev() to only
    clear the flag after completing the other operations, and introduce an
    smp_wmb() to make the ordering requirement explicit. The smp_wmb() is
    paired with a full smp_mb() in netdev_destroy() to make sure the
    call_rcu() invocation does not happen before the unregister operations
    are visible.
    
    Reported-by: Minxi Hou <mhou@redhat.com>
    Tested-by: Minxi Hou <mhou@redhat.com>
    Fixes: 549822767630 ("net: openvswitch: Avoid needlessly taking the RTNL on vport destroy")
    Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Link: https://patch.msgid.link/20260318155554.1133405-1-toke@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: phy: register phy led_triggers during probe to avoid AB-BA deadlock [+ + +]
Author: Andrew Lunn <andrew@lunn.ch>
Date:   Mon Mar 9 09:59:58 2026 -0400

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
    
    [ Upstream commit c8dbdc6e380e7e96a51706db3e4b7870d8a9402d ]
    
    There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
    LED_TRIGGER_PHY are enabled:
    
    [ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc             <-- Trying to get lock "triggers_list_lock" via down_write(&triggers_list_lock);
    [ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234
    [ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c
    [ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c
    [ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0
    [ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0
    [ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c
    [ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78
    [ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654                       <-- Hold lock "rtnl_mutex" by calling rtnl_lock();
    [ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0
    [ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c
    [ 1362.104022] [<80014504>] syscall_common+0x34/0x58
    
    Here LED_TRIGGER_PHY is registering LED triggers during phy_attach
    while holding RTNL and then taking triggers_list_lock.
    
    [ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168      <-- Trying to get lock "rtnl_mutex" via rtnl_lock();
    [ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4
    [ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360                 <-- Hold lock "triggers_list_lock" by down_read(&triggers_list_lock);
    [ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c
    [ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc
    [ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c
    [ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4
    [ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c
    [ 1362.232164] [<80014504>] syscall_common+0x34/0x58
    
    Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes
    triggers_list_lock and then RTNL. A classical AB-BA deadlock.
    
    phy_led_triggers_registers() does not require the RTNL, it does not
    make any calls into the network stack which require protection. There
    is also no requirement the PHY has been attached to a MAC, the
    triggers only make use of phydev state. This allows the call to
    phy_led_triggers_registers() to be placed elsewhere. PHY probe() and
    release() don't hold RTNL, so solving the AB-BA deadlock.
    
    Reported-by: Shiji Yang <yangshiji66@outlook.com>
    Closes: https://lore.kernel.org/all/OS7PR01MB13602B128BA1AD3FA38B6D1FFBC69A@OS7PR01MB13602.jpnprd01.prod.outlook.com/
    Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger")
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrew Lunn <andrew@lunn.ch>
    Tested-by: Shiji Yang <yangshiji66@outlook.com>
    Link: https://patch.msgid.link/20260222152601.1978655-1-andrew@lunn.ch
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    [ dropped `is_on_sfp_module` guards and `CONFIG_PHYLIB_LEDS`/`of_phy_leds` logic ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak [+ + +]
Author: Jiayuan Chen <jiayuan.chen@shopee.com>
Date:   Tue Mar 24 16:06:44 2026 +0800

    net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
    
    [ Upstream commit 2428083101f6883f979cceffa76cd8440751ffe6 ]
    
    __radix_tree_create() allocates and links intermediate nodes into the
    tree one by one. If a subsequent allocation fails, the already-linked
    nodes remain in the tree with no corresponding leaf entry. These orphaned
    internal nodes are never reclaimed because radix_tree_for_each_slot()
    only visits slots containing leaf values.
    
    The radix_tree API is deprecated in favor of xarray. As suggested by
    Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead
    of fixing the radix_tree itself [1]. xarray properly handles cleanup of
    internal nodes — xa_destroy() frees all internal xarray nodes when the
    qrtr_node is released, preventing the leak.
    
    [1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/
    Reported-by: syzbot+006987d1be3586e13555@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/000000000000bfba3a060bf4ffcf@google.com/T/
    Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control")
    Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20260324080645.290197-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure [+ + +]
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date:   Thu Apr 2 15:12:07 2026 +0800

    net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
    
    commit b76254c55dc8f23edc089027dd3f8792554c69fb upstream.
    
    qca_tty_receive() consumes each input byte before checking whether a
    completed frame needs a fresh receive skb. When the current byte completes
    a frame, the driver delivers that frame and then allocates a new skb for
    the next one.
    
    If that allocation fails, the current code returns i even though data[i]
    has already been consumed and may already have completed the delivered
    frame. Since serdev interprets the return value as the number of accepted
    bytes, this under-reports progress by one byte and can replay the final
    byte of the completed frame into a fresh parser state on the next call.
    
    Return i + 1 in that failure path so the accepted-byte count matches the
    actual receive-state progress.
    
    Fixes: dfc768fbe618 ("net: qualcomm: add QCA7000 UART driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
    Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20260402071207.4036-1-pengpeng@iscas.ac.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: rfkill: prevent unlimited numbers of rfkill events from being created [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Apr 12 12:57:46 2026 -0400

    net: rfkill: prevent unlimited numbers of rfkill events from being created
    
    [ Upstream commit ea245d78dec594372e27d8c79616baf49e98a4a1 ]
    
    Userspace can create an unlimited number of rfkill events if the system
    is so configured, while not consuming them from the rfkill file
    descriptor, causing a potential out of memory situation.  Prevent this
    from bounding the number of pending rfkill events at a "large" number
    (i.e. 1000) to prevent abuses like this.
    
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Reported-by: Yuan Tan <yuantan098@gmail.com>
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Reported-by: Xin Liu <bird@lzu.edu.cn>
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/2026033013-disfigure-scroll-e25e@gregkh
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [ replaced `scoped_guard()` with explicit `mutex_lock()`/`mutex_unlock()` calls ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs [+ + +]
Author: Koichiro Den <den@valinux.co.jp>
Date:   Sat Feb 28 23:53:07 2026 +0900

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
    
    [ Upstream commit 7f083faf59d14c04e01ec05a7507f036c965acf8 ]
    
    When shrinking the number of real tx queues,
    netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush
    qdiscs for queues which will no longer be used.
    
    qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with
    qdisc_lock(). However, for lockless qdiscs, the dequeue path is
    serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so
    qdisc_reset() can run concurrently with __qdisc_run() and free skbs
    while they are still being dequeued, leading to UAF.
    
    This can easily be reproduced on e.g. virtio-net by imposing heavy
    traffic while frequently changing the number of queue pairs:
    
      iperf3 -ub0 -c $peer -t 0 &
      while :; do
        ethtool -L eth0 combined 1
        ethtool -L eth0 combined 2
      done
    
    With KASAN enabled, this leads to reports like:
    
      BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760
      ...
      Call Trace:
       <TASK>
       ...
       __qdisc_run+0x133f/0x1760
       __dev_queue_xmit+0x248f/0x3550
       ip_finish_output2+0xa42/0x2110
       ip_output+0x1a7/0x410
       ip_send_skb+0x2e6/0x480
       udp_send_skb+0xb0a/0x1590
       udp_sendmsg+0x13c9/0x1fc0
       ...
       </TASK>
    
      Allocated by task 1270 on cpu 5 at 44.558414s:
       ...
       alloc_skb_with_frags+0x84/0x7c0
       sock_alloc_send_pskb+0x69a/0x830
       __ip_append_data+0x1b86/0x48c0
       ip_make_skb+0x1e8/0x2b0
       udp_sendmsg+0x13a6/0x1fc0
       ...
    
      Freed by task 1306 on cpu 3 at 44.558445s:
       ...
       kmem_cache_free+0x117/0x5e0
       pfifo_fast_reset+0x14d/0x580
       qdisc_reset+0x9e/0x5f0
       netif_set_real_num_tx_queues+0x303/0x840
       virtnet_set_channels+0x1bf/0x260 [virtio_net]
       ethnl_set_channels+0x684/0xae0
       ethnl_default_set_doit+0x31a/0x890
       ...
    
    Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by
    taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the
    serialization model already used by dev_reset_queue().
    
    Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state
    reflects an empty queue, avoiding needless re-scheduling.
    
    Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking")
    Signed-off-by: Koichiro Den <den@valinux.co.jp>
    Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak [+ + +]
Author: Yochai Eisenrich <echelonh@gmail.com>
Date:   Sun Mar 29 00:14:36 2026 +0300

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
    
    [ Upstream commit e6e3eb5ee89ac4c163d46429391c889a1bb5e404 ]
    
    When building netlink messages, tc_chain_fill_node() never initializes
    the tcm_info field of struct tcmsg. Since the allocation is not zeroed,
    kernel heap memory is leaked to userspace through this 4-byte field.
    
    The fix simply zeroes tcm_info alongside the other fields that are
    already initialized.
    
    Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
    Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://patch.msgid.link/20260328211436.1010152-1-echelonh@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz [+ + +]
Author: Huacai Chen <chenhuacai@kernel.org>
Date:   Tue Feb 3 14:29:01 2026 +0800

    net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
    
    commit e1aa5ef892fb4fa9014a25e87b64b97347919d37 upstream.
    
    Current clk_csr_i setting of Loongson STMMAC (including LS7A1000/2000
    and LS2K1000/2000/3000) are copy & paste from other drivers. In fact,
    Loongson STMMAC use 125MHz clocks and need 62 freq division to within
    2.5MHz, meeting most PHY MDC requirement. So fix by setting clk_csr_i
    to 100-150MHz, otherwise some PHYs may link fail.
    
    Cc: stable@vger.kernel.org
    Fixes: 30bba69d7db40e7 ("stmmac: pci: Add dwmac support for Loongson")
    Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Link: https://patch.msgid.link/20260203062901.2158236-1-chenhuacai@loongson.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: stmmac: Fix error handling in VLAN add and delete paths [+ + +]
Author: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
Date:   Tue Mar 3 14:58:25 2026 +0000

    net: stmmac: Fix error handling in VLAN add and delete paths
    
    [ Upstream commit 35dfedce442c4060cfe5b98368bc9643fb995716 ]
    
    stmmac_vlan_rx_add_vid() updates active_vlans and the VLAN hash
    register before writing the HW filter entry. If the filter write
    fails, it leaves a stale VID in active_vlans and the hash register.
    
    stmmac_vlan_rx_kill_vid() has the reverse problem: it clears
    active_vlans before removing the HW filter. On failure, the VID is
    gone from active_vlans but still present in the HW filter table.
    
    To fix this, reorder the operations to update the hash table first,
    then attempt the HW filter operation. If the HW filter fails, roll
    back both the active_vlans bitmap and the hash table by calling
    stmmac_vlan_update() again.
    
    Fixes: ed64639bc1e0 ("net: stmmac: Add support for VLAN Rx filtering")
    Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
    Link: https://patch.msgid.link/20260303145828.7845-2-ovidiu.panait.rb@renesas.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: stmmac: fix integer underflow in chain mode [+ + +]
Author: Tyllis Xu <livelycarpet87@gmail.com>
Date:   Tue Mar 31 23:47:07 2026 -0500

    net: stmmac: fix integer underflow in chain mode
    
    commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67 upstream.
    
    The jumbo_frm() chain-mode implementation unconditionally computes
    
        len = nopaged_len - bmax;
    
    where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is
    BUF_SIZE_8KiB or BUF_SIZE_2KiB.  However, the caller stmmac_xmit()
    decides to invoke jumbo_frm() based on skb->len (total length including
    page fragments):
    
        is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);
    
    When a packet has a small linear portion (nopaged_len <= bmax) but a
    large total length due to page fragments (skb->len > bmax), the
    subtraction wraps as an unsigned integer, producing a huge len value
    (~0xFFFFxxxx).  This causes the while (len != 0) loop to execute
    hundreds of thousands of iterations, passing skb->data + bmax * i
    pointers far beyond the skb buffer to dma_map_single().  On IOMMU-less
    SoCs (the typical deployment for stmmac), this maps arbitrary kernel
    memory to the DMA engine, constituting a kernel memory disclosure and
    potential memory corruption from hardware.
    
    Fix this by introducing a buf_len local variable clamped to
    min(nopaged_len, bmax).  Computing len = nopaged_len - buf_len is then
    always safe: it is zero when the linear portion fits within a single
    descriptor, causing the while (len != 0) loop to be skipped naturally,
    and the fragment loop in stmmac_xmit() handles page fragments afterward.
    
    Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)")
    Cc: stable@vger.kernel.org
    Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
    Link: https://patch.msgid.link/20260401044708.1386919-1-LivelyCarpet87@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: aqc111: Do not perform PM inside suspend callback [+ + +]
Author: Nikola Z. Ivanov <zlatistiv@gmail.com>
Date:   Fri Mar 13 16:16:43 2026 +0200

    net: usb: aqc111: Do not perform PM inside suspend callback
    
    [ Upstream commit 069c8f5aebe4d5224cf62acc7d4b3486091c658a ]
    
    syzbot reports "task hung in rpm_resume"
    
    This is caused by aqc111_suspend calling
    the PM variant of its write_cmd routine.
    
    The simplified call trace looks like this:
    
    rpm_suspend()
      usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING
        aqc111_suspend() - called for the usb device interface
          aqc111_write32_cmd()
            usb_autopm_get_interface()
              pm_runtime_resume_and_get()
                rpm_resume() - here we call rpm_resume() on our parent
                  rpm_resume() - Here we wait for a status change that will never happen.
    
    At this point we block another task which holds
    rtnl_lock and locks up the whole networking stack.
    
    Fix this by replacing the write_cmd calls with their _nopm variants
    
    Reported-by: syzbot+48dc1e8dfc92faf1124c@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=48dc1e8dfc92faf1124c
    Fixes: e58ba4544c77 ("net: usb: aqc111: Add support for wake on LAN by MAGIC packet")
    Signed-off-by: Nikola Z. Ivanov <zlatistiv@gmail.com>
    Link: https://patch.msgid.link/20260313141643.1181386-1-zlatistiv@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: usb: kalmia: validate USB endpoints [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 13:59:26 2026 +0100

    net: usb: kalmia: validate USB endpoints
    
    commit c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 upstream.
    
    The kalmia driver should validate that the device it is probing has the
    proper number and types of USB endpoints it is expecting before it binds
    to it.  If a malicious device were to not have the same urbs the driver
    will crash later on when it blindly accesses these endpoints.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730")
    Link: https://patch.msgid.link/2026022326-shack-headstone-ef6f@gregkh
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: kaweth: validate USB endpoints [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 14:00:06 2026 +0100

    net: usb: kaweth: validate USB endpoints
    
    commit 4b063c002ca759d1b299988ee23f564c9609c875 upstream.
    
    The kaweth driver should validate that the device it is probing has the
    proper number and types of USB endpoints it is expecting before it binds
    to it.  If a malicious device were to not have the same urbs the driver
    will crash later on when it blindly accesses these endpoints.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Link: https://patch.msgid.link/2026022305-substance-virtual-c728@gregkh
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: lan78xx: fix silent drop of packets with checksum errors [+ + +]
Author: Oleksij Rempel <o.rempel@pengutronix.de>
Date:   Thu Mar 5 15:34:26 2026 +0100

    net: usb: lan78xx: fix silent drop of packets with checksum errors
    
    commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream.
    
    Do not drop packets with checksum errors at the USB driver level;
    pass them to the network stack.
    
    Previously, the driver dropped all packets where the 'Receive Error
    Detected' (RED) bit was set, regardless of the specific error type. This
    caused packets with only IP or TCP/UDP checksum errors to be dropped
    before reaching the kernel, preventing the network stack from accounting
    for them or performing software fallback.
    
    Add a mask for hard hardware errors to safely drop genuinely corrupt
    frames, while allowing checksum-errored frames to pass with their
    ip_summed field explicitly set to CHECKSUM_NONE.
    
    Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Link: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: lan78xx: skip LTM configuration for LAN7850 [+ + +]
Author: Oleksij Rempel <o.rempel@pengutronix.de>
Date:   Thu Mar 5 15:34:28 2026 +0100

    net: usb: lan78xx: skip LTM configuration for LAN7850
    
    commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream.
    
    Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.
    
    The LAN7850 is a High-Speed (USB 2.0) only device and does not support
    SuperSpeed features like LTM. Currently, the driver unconditionally
    attempts to configure LTM registers during initialization. On the
    LAN7850, these registers do not exist, resulting in writes to invalid
    or undocumented memory space.
    
    This issue was identified during a port to the regmap API with strict
    register validation enabled. While no functional issues or crashes have
    been observed from these invalid writes, bypassing LTM initialization
    on the LAN7850 ensures the driver strictly adheres to the hardware's
    valid register map.
    
    Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Link: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: pegasus: validate USB endpoints [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 13:58:48 2026 +0100

    net: usb: pegasus: validate USB endpoints
    
    commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 upstream.
    
    The pegasus driver should validate that the device it is probing has the
    proper number and types of USB endpoints it is expecting before it binds
    to it.  If a malicious device were to not have the same urbs the driver
    will crash later on when it blindly accesses these endpoints.
    
    Cc: Petko Manolov <petkan@nucleusys.com>
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: r8152: add TRENDnet TUC-ET2G [+ + +]
Author: Valentin Spreckels <valentin@spreckels.dev>
Date:   Thu Feb 26 20:54:09 2026 +0100

    net: usb: r8152: add TRENDnet TUC-ET2G
    
    [ Upstream commit 15fba71533bcdfaa8eeba69a5a5a2927afdf664a ]
    
    The TRENDnet TUC-ET2G is a RTL8156 based usb ethernet adapter. Add its
    vendor and product IDs.
    
    Signed-off-by: Valentin Spreckels <valentin@spreckels.dev>
    Link: https://patch.msgid.link/20260226195409.7891-2-valentin@spreckels.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled [+ + +]
Author: Fernando Fernandez Mancera <fmancera@suse.de>
Date:   Wed Mar 4 13:03:57 2026 +0100

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
    
    [ Upstream commit 168ff39e4758897d2eee4756977d036d52884c7e ]
    
    When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
    initialized because inet6_init() exits before ndisc_init() is called
    which initializes it. If an IPv6 packet is injected into the interface,
    route_shortcircuit() is called and a NULL pointer dereference happens on
    neigh_lookup().
    
     BUG: kernel NULL pointer dereference, address: 0000000000000380
     Oops: Oops: 0000 [#1] SMP NOPTI
     [...]
     RIP: 0010:neigh_lookup+0x20/0x270
     [...]
     Call Trace:
      <TASK>
      vxlan_xmit+0x638/0x1ef0 [vxlan]
      dev_hard_start_xmit+0x9e/0x2e0
      __dev_queue_xmit+0xbee/0x14e0
      packet_sendmsg+0x116f/0x1930
      __sys_sendto+0x1f5/0x200
      __x64_sys_sendto+0x24/0x30
      do_syscall_64+0x12f/0x1590
      entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    Fix this by adding an early check on route_shortcircuit() when protocol
    is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because
    VXLAN can be built-in even when IPv6 is built as a module.
    
    Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
    Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
    Link: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec [+ + +]
Author: Suraj Gupta <suraj.gupta2@amd.com>
Date:   Fri Mar 27 13:02:37 2026 +0530

    net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
    
    [ Upstream commit 393e0b4f178ec7fce1141dacc3304e3607a92ee9 ]
    
    The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK
    macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP
    product guide (PG021) specifies the buffer length field as bits 25:0
    (26 bits). Update both masks to match the IP documentation.
    
    In practice this had no functional impact, since Ethernet frames are
    far smaller than 2^23 bytes and the extra bits were always zero, but
    the masks should still reflect the hardware specification.
    
    Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
    Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
    Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
    Link: https://patch.msgid.link/20260327073238.134948-2-suraj.gupta2@amd.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Sun Mar 8 02:21:37 2026 +0900

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
    
    [ Upstream commit 5cb81eeda909dbb2def209dd10636b51549a3f8a ]
    
    ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the
    netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the
    conntrack reference immediately after netlink_dump_start().  When the
    dump spans multiple rounds, the second recvmsg() triggers the dump
    callback which dereferences the now-freed conntrack via nfct_help(ct),
    leading to a use-after-free on ct->ext.
    
    The bug is that the netlink_dump_control has no .start or .done
    callbacks to manage the conntrack reference across dump rounds.  Other
    dump functions in the same file (e.g. ctnetlink_get_conntrack) properly
    use .start/.done callbacks for this purpose.
    
    Fix this by adding .start and .done callbacks that hold and release the
    conntrack reference for the duration of the dump, and move the
    nfct_help() call after the cb->args[0] early-return check in the dump
    callback to avoid dereferencing ct->ext unnecessarily.
    
     BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0
     Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133
    
     CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY
     Call Trace:
      <TASK>
      ctnetlink_exp_ct_dump_table+0x4f/0x2e0
      netlink_dump+0x333/0x880
      netlink_recvmsg+0x3e2/0x4b0
      ? aa_sk_perm+0x184/0x450
      sock_recvmsg+0xde/0xf0
    
     Allocated by task 133:
      kmem_cache_alloc_noprof+0x134/0x440
      __nf_conntrack_alloc+0xa8/0x2b0
      ctnetlink_create_conntrack+0xa1/0x900
      ctnetlink_new_conntrack+0x3cf/0x7d0
      nfnetlink_rcv_msg+0x48e/0x510
      netlink_rcv_skb+0xc9/0x1f0
      nfnetlink_rcv+0xdb/0x220
      netlink_unicast+0x3ec/0x590
      netlink_sendmsg+0x397/0x690
      __sys_sendmsg+0xf4/0x180
    
     Freed by task 0:
      slab_free_after_rcu_debug+0xad/0x1e0
      rcu_core+0x5c3/0x9c0
    
    Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: ctnetlink: remove refcounting in expectation dumpers [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Aug 1 17:25:09 2025 +0200

    netfilter: ctnetlink: remove refcounting in expectation dumpers
    
    [ Upstream commit 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a ]
    
    Same pattern as previous patch: do not keep the expectation object
    alive via refcount, only store a cookie value and then use that
    as the skip hint for dump resumption.
    
    AFAICS this has the same issue as the one resolved in the conntrack
    dumper, when we do
      if (!refcount_inc_not_zero(&exp->use))
    
    to increment the refcount, there is a chance that exp == last, which
    causes a double-increment of the refcount and subsequent memory leak.
    
    Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping")
    Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Stable-dep-of: 5cb81eeda909 ("netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: ctnetlink: use netlink policy range checks [+ + +]
Author: David Carlier <devnexen@gmail.com>
Date:   Wed Mar 25 14:11:08 2026 +0100

    netfilter: ctnetlink: use netlink policy range checks
    
    [ Upstream commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 ]
    
    Replace manual range and mask validations with netlink policy
    annotations in ctnetlink code paths, so that the netlink core rejects
    invalid values early and can generate extack errors.
    
    - CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
      policy level, removing the manual >= TCP_CONNTRACK_MAX check.
    - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
      (14). The normal TCP option parsing path already clamps to this value,
      but the ctnetlink path accepted 0-255, causing undefined behavior when
      used as a u32 shift count.
    - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
      CTA_FILTER_F_ALL, removing the manual mask checks.
    - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
      a new mask define grouping all valid expect flags.
    
    Extracted from a broader nf-next patch by Florian Westphal, scoped to
    ctnetlink for the fixes tree.
    
    Fixes: c8e2078cfe41 ("[NETFILTER]: ctnetlink: add support for internal tcp connection tracking flags handling")
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Co-developed-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent [+ + +]
Author: Qi Tang <tpluszz77@gmail.com>
Date:   Tue Mar 31 14:17:12 2026 +0800

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
    
    [ Upstream commit 35177c6877134a21315f37d57a5577846225623e ]
    
    ctnetlink_alloc_expect() allocates expectations from a non-zeroing
    slab cache via nf_ct_expect_alloc().  When CTA_EXPECT_NAT is not
    present in the netlink message, saved_addr and saved_proto are
    never initialized.  Stale data from a previous slab occupant can
    then be dumped to userspace by ctnetlink_exp_dump_expect(), which
    checks these fields to decide whether to emit CTA_EXPECT_NAT.
    
    The safe sibling nf_ct_expect_init(), used by the packet path,
    explicitly zeroes these fields.
    
    Zero saved_addr, saved_proto and dir in the else branch, guarded
    by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when
    NAT is enabled.
    
    Confirmed by priming the expect slab with NAT-bearing expectations,
    freeing them, creating a new expectation without CTA_EXPECT_NAT,
    and observing that the ctnetlink dump emits a spurious
    CTA_EXPECT_NAT containing stale data from the prior allocation.
    
    Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
    Reported-by: kernel test robot <lkp@intel.com>
    Signed-off-by: Qi Tang <tpluszz77@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: flowtable: strictly check for maximum number of actions [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Mar 26 00:17:09 2026 +0100

    netfilter: flowtable: strictly check for maximum number of actions
    
    [ Upstream commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 ]
    
    The maximum number of flowtable hardware offload actions in IPv6 is:
    
    * ethernet mangling (4 payload actions, 2 for each ethernet address)
    * SNAT (4 payload actions)
    * DNAT (4 payload actions)
    * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing)
      for QinQ.
    * Redirect (1 action)
    
    Which makes 17, while the maximum is 16. But act_ct supports for tunnels
    actions too. Note that payload action operates at 32-bit word level, so
    mangling an IPv6 address takes 4 payload actions.
    
    Update flow_action_entry_next() calls to check for the maximum number of
    supported actions.
    
    While at it, rise the maximum number of actions per flow from 16 to 24
    so this works fine with IPv6 setups.
    
    Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
    Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() [+ + +]
Author: Ren Wei <n05ec@lzu.edu.cn>
Date:   Wed Mar 25 14:11:00 2026 +0100

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
    
    [ Upstream commit 9d3f027327c2fa265f7f85ead41294792c3296ed ]
    
    Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
    
    rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].
    Validate addrnr during rule installation so malformed rules are rejected
    before the match logic can use an out-of-range value.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Co-developed-by: Yuan Tan <yuantan098@gmail.com>
    Signed-off-by: Yuan Tan <yuantan098@gmail.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Tested-by: Yuhang Zheng <z1652074432@gmail.com>
    Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: ipset: drop logically empty buckets in mtype_del [+ + +]
Author: Yifan Wu <yifanwucs@gmail.com>
Date:   Mon Mar 30 14:39:24 2026 -0700

    netfilter: ipset: drop logically empty buckets in mtype_del
    
    commit 9862ef9ab0a116c6dca98842aab7de13a252ae02 upstream.
    
    mtype_del() counts empty slots below n->pos in k, but it only drops the
    bucket when both n->pos and k are zero. This misses buckets whose live
    entries have all been removed while n->pos still points past deleted slots.
    
    Treat a bucket as empty when all positions below n->pos are unused and
    release it directly instead of shrinking it further.
    
    Fixes: 8af1c6fbd923 ("netfilter: ipset: Fix forceadd evaluation path")
    Cc: stable@vger.kernel.org
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Reported-by: Xin Liu <dstsmallbird@foxmail.com>
    Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
    Co-developed-by: Yuan Tan <yuantan098@gmail.com>
    Signed-off-by: Yuan Tan <yuantan098@gmail.com>
    Reviewed-by: Phil Sutter <phil@nwl.cc>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Mon Mar 30 14:16:34 2026 +0200

    netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
    
    [ Upstream commit b7e8590987aa94c9dc51518fad0e58cb887b1db5 ]
    
    IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they
    cannot be treated like a c-string.
    
    They either have to be switched to NLA_NUL_STRING, or the compare
    operations need to use the nla functions.
    
    Fixes: f830837f0eed ("netfilter: ipset: list:set set type support")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() [+ + +]
Author: Jenny Guanni Qu <qguanni@gmail.com>
Date:   Thu Mar 12 14:49:50 2026 +0000

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
    
    [ Upstream commit f173d0f4c0f689173f8cdac79991043a4a89bf66 ]
    
    In DecodeQ931(), the UserUserIE code path reads a 16-bit length from
    the packet, then decrements it by 1 to skip the protocol discriminator
    byte before passing it to DecodeH323_UserInformation(). If the encoded
    length is 0, the decrement wraps to -1, which is then passed as a
    large value to the decoder, leading to an out-of-bounds read.
    
    Add a check to ensure len is positive after the decrement.
    
    Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper")
    Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
    Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
    Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case [+ + +]
Author: Jenny Guanni Qu <qguanni@gmail.com>
Date:   Thu Mar 12 02:29:32 2026 +0000

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
    
    [ Upstream commit 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a ]
    
    In decode_int(), the CONS case calls get_bits(bs, 2) to read a length
    value, then calls get_uint(bs, len) without checking that len bytes
    remain in the buffer. The existing boundary check only validates the
    2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint()
    reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte
    slab-out-of-bounds read.
    
    Add a boundary check for len bytes after get_bits() and before
    get_uint().
    
    Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper")
    Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
    Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
    Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_conntrack_helper: pass helper to expect cleanup [+ + +]
Author: Qi Tang <tpluszz77@gmail.com>
Date:   Mon Mar 30 00:50:36 2026 +0800

    netfilter: nf_conntrack_helper: pass helper to expect cleanup
    
    [ Upstream commit a242a9ae58aa46ff7dae51ce64150a93957abe65 ]
    
    nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()
    to remove expectations belonging to the helper being unregistered.
    However, it passes NULL instead of the helper pointer as the data
    argument, so expect_iter_me() never matches any expectation and all
    of them survive the cleanup.
    
    After unregister returns, nfnl_cthelper_del() frees the helper
    object immediately.  Subsequent expectation dumps or packet-driven
    init_conntrack() calls then dereference the freed exp->helper,
    causing a use-after-free.
    
    Pass the actual helper pointer so expectations referencing it are
    properly destroyed before the helper object is freed.
    
      BUG: KASAN: slab-use-after-free in string+0x38f/0x430
      Read of size 1 at addr ffff888003b14d20 by task poc/103
      Call Trace:
       string+0x38f/0x430
       vsnprintf+0x3cc/0x1170
       seq_printf+0x17a/0x240
       exp_seq_show+0x2e5/0x560
       seq_read_iter+0x419/0x1280
       proc_reg_read+0x1ac/0x270
       vfs_read+0x179/0x930
       ksys_read+0xef/0x1c0
      Freed by task 103:
      The buggy address is located 32 bytes inside of
       freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)
    
    Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers")
    Signed-off-by: Qi Tang <tpluszz77@gmail.com>
    Reviewed-by: Phil Sutter <phil@nwl.cc>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() [+ + +]
Author: Lukas Johannes Möller <research@johannes-moeller.dev>
Date:   Tue Mar 10 21:49:01 2026 +0000

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
    
    [ Upstream commit fbce58e719a17aa215c724473fd5baaa4a8dc57c ]
    
    sip_help_tcp() parses the SIP Content-Length header with
    simple_strtoul(), which returns unsigned long, but stores the result in
    unsigned int clen.  On 64-bit systems, values exceeding UINT_MAX are
    silently truncated before computing the SIP message boundary.
    
    For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32,
    causing the parser to miscalculate where the current message ends.  The
    loop then treats trailing data in the TCP segment as a second SIP
    message and processes it through the SDP parser.
    
    Fix this by changing clen to unsigned long to match the return type of
    simple_strtoul(), and reject Content-Length values that exceed the
    remaining TCP payload length.
    
    Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support")
    Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Wed Mar 25 14:11:07 2026 +0100

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
    
    [ Upstream commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 ]
    
    process_sdp() declares union nf_inet_addr rtp_addr on the stack and
    passes it to the nf_nat_sip sdp_session hook after walking the SDP
    media descriptions. However rtp_addr is only initialized inside the
    media loop when a recognized media type with a non-zero port is found.
    
    If the SDP body contains no m= lines, only inactive media sections
    (m=audio 0 ...) or only unrecognized media types, rtp_addr is never
    assigned. Despite that, the function still calls hooks->sdp_session()
    with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack
    value as an IP address and rewrite the SDP session owner and connection
    lines with it.
    
    With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this
    results in the session-level o= and c= addresses being rewritten to
    0.0.0.0 for inactive SDP sessions. Without stack auto-init the
    rewritten address is whatever happened to be on the stack.
    
    Fix this by pre-initializing rtp_addr from the session-level connection
    address (caddr) when available, and tracking via a have_rtp_addr flag
    whether any valid address was established. Skip the sdp_session hook
    entirely when no valid address exists.
    
    Fixes: 4ab9e64e5e3c ("[NETFILTER]: nf_nat_sip: split up SDP mangling")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_tables: de-constify set commit ops function argument [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Oct 13 14:18:14 2023 +0200

    netfilter: nf_tables: de-constify set commit ops function argument
    
    commit 256001672153af5786c6ca148114693d7d76d836 upstream.
    
    The set backend using this already has to work around this via ugly
    cast, don't spread this pattern.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: nf_tables: reject immediate NF_QUEUE verdict [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Mar 31 23:08:02 2026 +0200

    netfilter: nf_tables: reject immediate NF_QUEUE verdict
    
    [ Upstream commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec ]
    
    nft_queue is always used from userspace nftables to deliver the NF_QUEUE
    verdict. Immediately emitting an NF_QUEUE verdict is never used by the
    userspace nft tools, so reject immediate NF_QUEUE verdicts.
    
    The arp family does not provide queue support, but such an immediate
    verdict is still reachable. Globally reject NF_QUEUE immediate verdicts
    to address this issue.
    
    Fixes: f342de4e2f33 ("netfilter: nf_tables: reject QUEUE/DROP verdict parameters")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Sun Mar 8 02:23:34 2026 +0900

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
    
    [ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ]
    
    nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label
    inside the for loop body.  When the "last" helper saved in cb->args[1]
    is deleted between dump rounds, every entry fails the (cur != last)
    check, so cb->args[1] is never cleared.  The for loop finishes with
    cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back
    into the loop body bypassing the bounds check, causing an 8-byte
    out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
    
    The 'goto restart' block was meant to re-traverse the current bucket
    when "last" is no longer found, but it was placed after the for loop
    instead of inside it.  Move the block into the for loop body so that
    the restart only occurs while cb->args[0] is still within bounds.
    
     BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0
     Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131
     Call Trace:
      nfnl_cthelper_dump_table+0x9f/0x1b0
      netlink_dump+0x333/0x880
      netlink_recvmsg+0x3e2/0x4b0
      sock_recvmsg+0xde/0xf0
      __sys_recvfrom+0x150/0x200
      __x64_sys_recvfrom+0x76/0x90
      do_syscall_64+0xc3/0x6e0
    
     Allocated by task 1:
      __kvmalloc_node_noprof+0x21b/0x700
      nf_ct_alloc_hashtable+0x65/0xd0
      nf_conntrack_helper_init+0x21/0x60
      nf_conntrack_init_start+0x18d/0x300
      nf_conntrack_standalone_init+0x12/0xc0
    
    Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nfnetlink_log: account for netlink header size [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Thu Mar 26 16:17:24 2026 +0100

    netfilter: nfnetlink_log: account for netlink header size
    
    [ Upstream commit 6d52a4a0520a6696bdde51caa11f2d6821cd0c01 ]
    
    This is a followup to an old bug fix: NLMSG_DONE needs to account
    for the netlink header size, not just the attribute size.
    
    This can result in a WARN splat + drop of the netlink message,
    but other than this there are no ill effects.
    
    Fixes: 9dfa1dfe4d5e ("netfilter: nf_log: account for size of NLMSG_DONE attribute")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Wed Mar 25 14:10:58 2026 +0100

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
    
    [ Upstream commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 ]
    
    __build_packet_message() manually constructs the NFULA_PAYLOAD netlink
    attribute using skb_put() and skb_copy_bits(), bypassing the standard
    nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes
    are allocated (including NLA alignment padding), only data_len bytes
    of actual packet data are copied. The trailing nla_padlen(data_len)
    bytes (1-3 when data_len is not 4-byte aligned) are never initialized,
    leaking stale heap contents to userspace via the NFLOG netlink socket.
    
    Replace the manual attribute construction with nla_reserve(), which
    handles the tailroom check, header setup, and padding zeroing via
    __nla_reserve(). The subsequent skb_copy_bits() fills in the payload
    data on top of the properly initialized attribute.
    
    Fixes: df6fb868d611 ("[NETFILTER]: nfnetlink: convert to generic netlink attribute functions")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path [+ + +]
Author: Hyunwoo Kim <imv4bel@gmail.com>
Date:   Sun Mar 8 02:24:06 2026 +0900

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
    
    [ Upstream commit f1ba83755d81c6fc66ac7acd723d238f974091e9 ]
    
    nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue
    entry from the queue data structures, taking ownership of the entry.
    For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN
    attributes.  If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN
    present but NFQA_VLAN_TCI missing), the function returns immediately
    without freeing the dequeued entry or its sk_buff.
    
    This leaks the nf_queue_entry, its associated sk_buff, and all held
    references (net_device refcounts, struct net refcount).  Repeated
    triggering exhausts kernel memory.
    
    Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict
    on the error path, consistent with other error handling in this file.
    
    Fixes: 8d45ff22f1b4 ("netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR")
    Reviewed-by: David Dull <monderasdor@gmail.com>
    Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nft_ct: add seqadj extension for natted connections [+ + +]
Author: Andrii Melnychenko <a.melnychenko@vyos.io>
Date:   Fri Oct 24 18:22:16 2025 +0200

    netfilter: nft_ct: add seqadj extension for natted connections
    
    [ Upstream commit 90918e3b6404c2a37837b8f11692471b4c512de2 ]
    
    Sequence adjustment may be required for FTP traffic with PASV/EPSV modes.
    due to need to re-write packet payload (IP, port) on the ftp control
    connection. This can require changes to the TCP length and expected
    seq / ack_seq.
    
    The easiest way to reproduce this issue is with PASV mode.
    Example ruleset:
    table inet ftp_nat {
            ct helper ftp_helper {
                    type "ftp" protocol tcp
                    l3proto inet
            }
    
            chain prerouting {
                    type filter hook prerouting priority 0; policy accept;
                    tcp dport 21 ct state new ct helper set "ftp_helper"
            }
    }
    table ip nat {
            chain prerouting {
                    type nat hook prerouting priority -100; policy accept;
                    tcp dport 21 dnat ip prefix to ip daddr map {
                            192.168.100.1 : 192.168.13.2/32 }
            }
    
            chain postrouting {
                    type nat hook postrouting priority 100 ; policy accept;
                    tcp sport 21 snat ip prefix to ip saddr map {
                            192.168.13.2 : 192.168.100.1/32 }
            }
    }
    
    Note that the ftp helper gets assigned *after* the dnat setup.
    
    The inverse (nat after helper assign) is handled by an existing
    check in nf_nat_setup_info() and will not show the problem.
    
    Topoloy:
    
     +-------------------+     +----------------------------------+
     | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
     +-------------------+     +----------------------------------+
                                          |
                             +-----------------------+
                             | Client: 192.168.100.2 |
                             +-----------------------+
    
    ftp nat changes do not work as expected in this case:
    Connected to 192.168.100.1.
    [..]
    ftp> epsv
    EPSV/EPRT on IPv4 off.
    ftp> ls
    227 Entering passive mode (192,168,100,1,209,129).
    421 Service not available, remote server has closed connection.
    
    Kernel logs:
    Missing nfct_seqadj_ext_add() setup call
    WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41
    [..]
     __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]
     nf_nat_ftp+0x142/0x280 [nf_nat_ftp]
     help+0x4d1/0x880 [nf_conntrack_ftp]
     nf_confirm+0x122/0x2e0 [nf_conntrack]
     nf_hook_slow+0x3c/0xb0
     ..
    
    Fix this by adding the required extension when a conntrack helper is assigned
    to a connection that has a nat binding.
    
    Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support")
    Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Stable-dep-of: 36eae0956f65 ("netfilter: nft_ct: drop pending enqueued packets on removal")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nft_ct: drop pending enqueued packets on removal [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Mar 12 13:48:47 2026 +0100

    netfilter: nft_ct: drop pending enqueued packets on removal
    
    [ Upstream commit 36eae0956f659e48d5366d9b083d9417f3263ddc ]
    
    Packets sitting in nfqueue might hold a reference to:
    
    - templates that specify the conntrack zone, because a percpu area is
      used and module removal is possible.
    - conntrack timeout policies and helper, where object removal leave
      a stale reference.
    
    Since these objects can just go away, drop enqueued packets to avoid
    stale reference to them.
    
    If there is a need for finer grain removal, this logic can be revisited
    to make selective packet drop upon dependencies.
    
    Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nft_ct: fix use-after-free in timeout object destroy [+ + +]
Author: Tuan Do <tuan@calif.io>
Date:   Fri Apr 3 00:33:17 2026 -0700

    netfilter: nft_ct: fix use-after-free in timeout object destroy
    
    commit f8dca15a1b190787bbd03285304b569631160eda upstream.
    
    nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
    immediately after nf_ct_untimeout(), without waiting for an RCU grace
    period. Concurrent packet processing on other CPUs may still hold
    RCU-protected references to the timeout object obtained via
    rcu_dereference() in nf_ct_timeout_data().
    
    Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
    freeing until after an RCU grace period, matching the approach already
    used in nfnetlink_cttimeout.c.
    
    KASAN report:
     BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
     Read of size 4 at addr ffff8881035fe19c by task exploit/80
    
     Call Trace:
      nf_conntrack_tcp_packet+0x1381/0x29d0
      nf_conntrack_in+0x612/0x8b0
      nf_hook_slow+0x70/0x100
      __ip_local_out+0x1b2/0x210
      tcp_sendmsg_locked+0x722/0x1580
      __sys_sendto+0x2d8/0x320
    
     Allocated by task 75:
      nft_ct_timeout_obj_init+0xf6/0x290
      nft_obj_init+0x107/0x1b0
      nf_tables_newobj+0x680/0x9c0
      nfnetlink_rcv_batch+0xc29/0xe00
    
     Freed by task 26:
      nft_obj_destroy+0x3f/0xa0
      nf_tables_trans_destroy_work+0x51c/0x5c0
      process_one_work+0x2c4/0x5a0
    
    Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Tuan Do <tuan@calif.io>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: nft_payload: reject out-of-range attributes via policy [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Mon Sep 5 12:09:37 2022 +0200

    netfilter: nft_payload: reject out-of-range attributes via policy
    
    [ Upstream commit e7af210e6dd0de633d3f4850383310cf57473bc8 ]
    
    Now that nla_policy allows range checks for bigendian data make use of
    this to reject such attributes.  At this time, reject happens later
    from the init or select_ops callbacks, but its prone to errors.
    
    In the future, new attributes can be handled via NLA_POLICY_MAX_BE
    and exiting ones can be converted one by one.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() [+ + +]
Author: Jenny Guanni Qu <qguanni@gmail.com>
Date:   Fri Mar 6 19:12:38 2026 +0000

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
    
    [ Upstream commit d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 ]
    
    pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the
    to_offset argument on every iteration, including the last one where
    i == m->field_count - 1. This reads one element past the end of the
    stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]
    with NFT_PIPAPO_MAX_FIELDS == 16).
    
    Although pipapo_unmap() returns early when is_last is true without
    using the to_offset value, the argument is evaluated at the call site
    before the function body executes, making this a genuine out-of-bounds
    stack read confirmed by KASAN:
    
      BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]
      Read of size 4 at addr ffff8000810e71a4
    
      This frame has 1 object:
       [32, 160) 'rulemap'
    
      The buggy address is at offset 164 -- exactly 4 bytes past the end
      of the rulemap array.
    
    Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid
    the out-of-bounds read.
    
    Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
    Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nft_set_pipapo: split gc into unlink and reclaim phase [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Mar 3 16:31:32 2026 +0100

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
    
    commit 9df95785d3d8302f7c066050117b04cd3c2048c2 upstream.
    
    Yiming Qian reports Use-after-free in the pipapo set type:
      Under a large number of expired elements, commit-time GC can run for a very
      long time in a non-preemptible context, triggering soft lockup warnings and
      RCU stall reports (local denial of service).
    
    We must split GC in an unlink and a reclaim phase.
    
    We cannot queue elements for freeing until pointers have been swapped.
    Expired elements are still exposed to both the packet path and userspace
    dumpers via the live copy of the data structure.
    
    call_rcu() does not protect us: dump operations or element lookups starting
    after call_rcu has fired can still observe the free'd element, unless the
    commit phase has made enough progress to swap the clone and live pointers
    before any new reader has picked up the old version.
    
    This a similar approach as done recently for the rbtree backend in commit
    35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
    
    Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: x_tables: ensure names are nul-terminated [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Mar 31 23:13:36 2026 +0200

    netfilter: x_tables: ensure names are nul-terminated
    
    [ Upstream commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e ]
    
    Reject names that lack a \0 character before feeding them
    to functions that expect c-strings.
    
    Fixes tag is the most recent commit that needs this change.
    
    Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: x_tables: guard option walkers against 1-byte tail reads [+ + +]
Author: David Dull <monderasdor@gmail.com>
Date:   Sat Mar 7 20:26:21 2026 +0200

    netfilter: x_tables: guard option walkers against 1-byte tail reads
    
    [ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ]
    
    When the last byte of options is a non-single-byte option kind, walkers
    that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
    of the option area.
    
    Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
    in xt_tcpudp and xt_dccp option walkers.
    
    Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
    Signed-off-by: David Dull <monderasdor@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Mar 31 16:41:25 2026 +0200

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
    
    [ Upstream commit 3d5d488f11776738deab9da336038add95d342d1 ]
    
    Weiming Shi says:
    
    xt_match and xt_target structs registered with NFPROTO_UNSPEC can be
    loaded by any protocol family through nft_compat. When such a
    match/target sets .hooks to restrict which hooks it may run on, the
    bitmask uses NF_INET_* constants. This is only correct for families
    whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge
    all share the same five hooks (PRE_ROUTING ... POST_ROUTING).
    
    ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different
    semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks
    validation silently passes for the wrong reasons, allowing matches to
    run on ARP chains where the hook assumptions (e.g. state->in being
    set on input hooks) do not hold. This leads to NULL pointer
    dereferences; xt_devgroup is one concrete example:
    
     Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
     KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
     RIP: 0010:devgroup_mt+0xff/0x350
     Call Trace:
      <TASK>
      nft_match_eval (net/netfilter/nft_compat.c:407)
      nft_do_chain (net/netfilter/nf_tables_core.c:285)
      nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61)
      nf_hook_slow (net/netfilter/core.c:623)
      arp_xmit (net/ipv4/arp.c:666)
      </TASK>
     Kernel panic - not syncing: Fatal exception in interrupt
    
    Fix it by restricting arptables to NFPROTO_ARP extensions only.
    Note that arptables-legacy only supports:
    
    - arpt_CLASSIFY
    - arpt_mangle
    - arpt_MARK
    
    that provide explicit NFPROTO_ARP match/target declarations.
    
    Fixes: 9291747f118d ("netfilter: xtables: add device group match")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: xt_CT: drop pending enqueued packets on template removal [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Mar 12 13:48:48 2026 +0100

    netfilter: xt_CT: drop pending enqueued packets on template removal
    
    [ Upstream commit f62a218a946b19bb59abdd5361da85fa4606b96b ]
    
    Templates refer to objects that can go away while packets are sitting in
    nfqueue refer to:
    
    - helper, this can be an issue on module removal.
    - timeout policy, nfnetlink_cttimeout might remove it.
    
    The use of templates with zone and event cache filter are safe, since
    this just copies values.
    
    Flush these enqueued packets in case the template rule gets removed.
    
    Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels [+ + +]
Author: Yuan Tan <tanyuan98@outlook.com>
Date:   Mon Mar 9 03:41:46 2026 -0700

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
    
    [ Upstream commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf ]
    
    IDLETIMER revision 0 rules reuse existing timers by label and always call
    mod_timer() on timer->timer.
    
    If the label was created first by revision 1 with XT_IDLETIMER_ALARM,
    the object uses alarm timer semantics and timer->timer is never initialized.
    Reusing that object from revision 0 causes mod_timer() on an uninitialized
    timer_list, triggering debugobjects warnings and possible panic when
    panic_on_warn=1.
    
    Fix this by rejecting revision 0 rule insertion when an existing timer with
    the same label is of ALARM type.
    
    Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
    Co-developed-by: Yifan Wu <yifanwucs@gmail.com>
    Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
    Co-developed-by: Juefei Pu <tomapufckgml@gmail.com>
    Signed-off-by: Juefei Pu <tomapufckgml@gmail.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Xin Liu <dstsmallbird@foxmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: xt_time: use unsigned int for monthday bit shift [+ + +]
Author: Jenny Guanni Qu <qguanni@gmail.com>
Date:   Thu Mar 12 14:59:49 2026 +0000

    netfilter: xt_time: use unsigned int for monthday bit shift
    
    [ Upstream commit 00050ec08cecfda447e1209b388086d76addda3a ]
    
    The monthday field can be up to 31, and shifting a signed integer 1
    by 31 positions (1 << 31) is undefined behavior in C, as the result
    overflows a 32-bit signed int. Use 1U to ensure well-defined behavior
    for all valid monthday values.
    
    Change the weekday shift to 1U as well for consistency.
    
    Fixes: ee4411a1b1e0 ("[NETFILTER]: x_tables: add xt_time match")
    Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
    Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
    Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
netlink: add nla be16/32 types to minlen array [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Wed Feb 21 18:27:33 2024 +0100

    netlink: add nla be16/32 types to minlen array
    
    commit 9a0d18853c280f6a0ee99f91619f2442a17a323a upstream.
    
    BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline]
    BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]
    BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]
    BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631
     nla_validate_range_unsigned lib/nlattr.c:222 [inline]
     nla_validate_int_range lib/nlattr.c:336 [inline]
     validate_nla lib/nlattr.c:575 [inline]
    ...
    
    The message in question matches this policy:
    
     [NFTA_TARGET_REV]       = NLA_POLICY_MAX(NLA_BE32, 255),
    
    but because NLA_BE32 size in minlen array is 0, the validation
    code will read past the malformed (too small) attribute.
    
    Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:
    those likely should be added too.
    
    Reported-by: syzbot+3f497b07aa3baf2fb4d0@syzkaller.appspotmail.com
    Reported-by: xingwei lee <xrivendell7@gmail.com>
    Closes: https://lore.kernel.org/all/CABOYnLzFYHSnvTyS6zGa-udNX55+izqkOt2sB9WDqUcEGW6n8w@mail.gmail.com/raw
    Fixes: ecaf75ffd5f5 ("netlink: introduce bigendian integer types")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Link: https://lore.kernel.org/r/20240221172740.5092-1-fw@strlen.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netlink: allow be16 and be32 types in all uint policy checks [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Jul 18 09:52:29 2023 +0200

    netlink: allow be16 and be32 types in all uint policy checks
    
    [ Upstream commit 5fac9b7c16c50c6c7699517f582b56e3743f453a ]
    
    __NLA_IS_BEINT_TYPE(tp) isn't useful.  NLA_BE16/32 are identical to
    NLA_U16/32, the only difference is that it tells the netlink validation
    functions that byteorder conversion might be needed before comparing
    the value to the policy min/max ones.
    
    After this change all policy macros that can be used with UINT types,
    such as NLA_POLICY_MASK() can also be used with NLA_BE16/32.
    
    This will be used to validate nf_tables flag attributes which
    are in bigendian byte order.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netlink: hide validation union fields from kdoc [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Thu Oct 27 14:21:07 2022 -0700

    netlink: hide validation union fields from kdoc
    
    [ Upstream commit 7354c9024f2835f6122ed9612e21ab379df050f9 ]
    
    Mark the validation fields as private, users shouldn't set
    them directly and they are too complicated to explain in
    a more succinct way (there's already a long explanation
    in the comment above).
    
    The strict_start_type field is set directly and has a dedicated
    comment so move that above the "private" section.
    
    Link: https://lore.kernel.org/r/20221027212107.2639255-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netlink: introduce bigendian integer types [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Mon Oct 31 13:34:07 2022 +0100

    netlink: introduce bigendian integer types
    
    [ Upstream commit ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f ]
    
    Jakub reported that the addition of the "network_byte_order"
    member in struct nla_policy increases size of 32bit platforms.
    
    Instead of scraping the bit from elsewhere Johannes suggested
    to add explicit NLA_BE types instead, so do this here.
    
    NLA_POLICY_MAX_BE() macro is removed again, there is no need
    for it: NLA_POLICY_MAX(NLA_BE.., ..) will do the right thing.
    
    NLA_BE64 can be added later.
    
    Fixes: 08724ef69907 ("netlink: introduce NLA_POLICY_MAX_BE")
    Reported-by: Jakub Kicinski <kuba@kernel.org>
    Suggested-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Link: https://lore.kernel.org/r/20221031123407.9158-1-fw@strlen.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netlink: introduce NLA_POLICY_MAX_BE [+ + +]
Author: Florian Westphal <fw@strlen.de>
Date:   Mon Sep 5 12:09:36 2022 +0200

    netlink: introduce NLA_POLICY_MAX_BE
    
    [ Upstream commit 08724ef69907214ce622344fe4945412e38368f0 ]
    
    netlink allows to specify allowed ranges for integer types.
    Unfortunately, nfnetlink passes integers in big endian, so the existing
    NLA_POLICY_MAX() cannot be used.
    
    At the moment, nfnetlink users, such as nf_tables, need to resort to
    programmatic checking via helpers such as nft_parse_u32_check().
    
    This is both cumbersome and error prone.  This adds NLA_POLICY_MAX_BE
    which adds range check support for BE16, BE32 and BE64 integers.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Tue Mar 3 08:23:44 2026 -0800

    nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
    
    [ Upstream commit 0efdc02f4f6d52f8ca5d5889560f325a836ce0a8 ]
    
    Move clear_bit(NCI_DATA_EXCHANGE) before invoking the data exchange
    callback in nci_data_exchange_complete().
    
    The callback (e.g. rawsock_data_exchange_complete) may immediately
    schedule another data exchange via schedule_work(tx_work).  On a
    multi-CPU system, tx_work can run and reach nci_transceive() before
    the current nci_data_exchange_complete() clears the flag, causing
    test_and_set_bit(NCI_DATA_EXCHANGE) to return -EBUSY and the new
    transfer to fail.
    
    This causes intermittent flakes in nci/nci_dev in NIPA:
    
      # #  RUN           NCI.NCI1_0.t4t_tag_read ...
      # # t4t_tag_read: Test terminated by timeout
      # #          FAIL  NCI.NCI1_0.t4t_tag_read
      # not ok 3 NCI.NCI1_0.t4t_tag_read
    
    Fixes: 38f04c6b1b68 ("NFC: protect nci_data_exchange transactions")
    Reviewed-by: Joe Damato <joe@dama.to>
    Link: https://patch.msgid.link/20260303162346.2071888-5-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

nfc: nci: fix circular locking dependency in nci_close_device [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Tue Mar 17 12:33:34 2026 -0700

    nfc: nci: fix circular locking dependency in nci_close_device
    
    [ Upstream commit 4527025d440ce84bf56e75ce1df2e84cb8178616 ]
    
    nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
    This causes a circular locking dependency because nci_rx_work()
    running on rx_wq can end up taking req_lock too:
    
      nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
        -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
        -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)
    
    Move the flush of rx_wq after req_lock has been released.
    This should safe (I think) because NCI_UP has already been cleared
    and the transport is closed, so the work will see it and return
    -ENETDOWN.
    
    NIPA has been hitting this running the nci selftest with a debug
    kernel on roughly 4% of the runs.
    
    Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
    Reviewed-by: Ian Ray <ian.ray@gehealthcare.com>
    Link: https://patch.msgid.link/20260317193334.988609-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

nfc: nci: free skb on nci_transceive early error paths [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Tue Mar 3 08:23:41 2026 -0800

    nfc: nci: free skb on nci_transceive early error paths
    
    [ Upstream commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c ]
    
    nci_transceive() takes ownership of the skb passed by the caller,
    but the -EPROTO, -EINVAL, and -EBUSY error paths return without
    freeing it.
    
    Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes
    the nci/nci_dev selftest hits the error path occasionally in NIPA,
    and kmemleak detects leaks:
    
    unreferenced object 0xff11000015ce6a40 (size 640):
      comm "nci_dev", pid 3954, jiffies 4295441246
      hex dump (first 32 bytes):
        6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b  kkkk.......kkkkk
        6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      backtrace (crc 7c40cc2a):
        kmem_cache_alloc_node_noprof+0x492/0x630
        __alloc_skb+0x11e/0x5f0
        alloc_skb_with_frags+0xc6/0x8f0
        sock_alloc_send_pskb+0x326/0x3f0
        nfc_alloc_send_skb+0x94/0x1d0
        rawsock_sendmsg+0x162/0x4c0
        do_syscall_64+0x117/0xfc0
    
    Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
    Reviewed-by: Joe Damato <joe@dama.to>
    Link: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
NFC: nxp-nci: allow GPIOs to sleep [+ + +]
Author: Ian Ray <ian.ray@gehealthcare.com>
Date:   Tue Mar 17 10:53:36 2026 +0200

    NFC: nxp-nci: allow GPIOs to sleep
    
    commit 55dc632ab2ac2889b15995a9eef56c753d48ebc7 upstream.
    
    Allow the firmware and enable GPIOs to sleep.
    
    This fixes a `WARN_ON' and allows the driver to operate GPIOs which are
    connected to I2C GPIO expanders.
    
    -- >8 --
    kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98
    -- >8 --
    
    Fixes: 43201767b44c ("NFC: nxp-nci: Convert to use GPIO descriptor")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
    Link: https://patch.msgid.link/20260317085337.146545-1-ian.ray@gehealthcare.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
nfc: pn533: allocate rx skb before consuming bytes [+ + +]
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date:   Sun Apr 5 08:40:00 2026 +0800

    nfc: pn533: allocate rx skb before consuming bytes
    
    commit c71ba669b570c7b3f86ec875be222ea11dacb352 upstream.
    
    pn532_receive_buf() reports the number of accepted bytes to the serdev
    core. The current code consumes bytes into recv_skb and may already hand
    a complete frame to pn533_recv_frame() before allocating a fresh receive
    buffer.
    
    If that alloc_skb() fails, the callback returns 0 even though it has
    already consumed bytes, and it leaves recv_skb as NULL for the next
    receive callback. That breaks the receive_buf() accounting contract and
    can also lead to a NULL dereference on the next skb_put_u8().
    
    Allocate the receive skb lazily before consuming the next byte instead.
    If allocation fails, return the number of bytes already accepted.
    
    Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
    Link: https://patch.msgid.link/20260405094003.3-pn533-v2-pengpeng@iscas.ac.cn
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
NFC: pn533: bound the UART receive buffer [+ + +]
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date:   Thu Mar 26 22:20:33 2026 +0800

    NFC: pn533: bound the UART receive buffer
    
    [ Upstream commit 30fe3f5f6494f827d812ff179f295a8e532709d6 ]
    
    pn532_receive_buf() appends every incoming byte to dev->recv_skb and
    only resets the buffer after pn532_uart_rx_is_frame() recognizes a
    complete frame. A continuous stream of bytes without a valid PN532 frame
    header therefore keeps growing the skb until skb_put_u8() hits the tail
    limit.
    
    Drop the accumulated partial frame once the fixed receive buffer is full
    so malformed UART traffic cannot grow the skb past
    PN532_UART_SKB_BUFF_LEN.
    
    Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
    Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
    Link: https://patch.msgid.link/20260326142033.82297-1-pengpeng@iscas.ac.cn
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nfc: pn533: properly drop the usb interface reference on disconnect [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 12:28:30 2026 +0100

    nfc: pn533: properly drop the usb interface reference on disconnect
    
    commit 12133a483dfa832241fbbf09321109a0ea8a520e upstream.
    
    When the device is disconnected from the driver, there is a "dangling"
    reference count on the usb interface that was grabbed in the probe
    callback.  Fix this up by properly dropping the reference after we are
    done with it.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Fixes: c46ee38620a2 ("NFC: pn533: add NXP pn533 nfc device driver")
    Link: https://patch.msgid.link/2026022329-flashing-ought-7573@gregkh
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

nfc: rawsock: cancel tx_work before socket teardown [+ + +]
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Tue Mar 3 08:23:45 2026 -0800

    nfc: rawsock: cancel tx_work before socket teardown
    
    [ Upstream commit d793458c45df2aed498d7f74145eab7ee22d25aa ]
    
    In rawsock_release(), cancel any pending tx_work and purge the write
    queue before orphaning the socket.  rawsock_tx_work runs on the system
    workqueue and calls nfc_data_exchange which dereferences the NCI
    device.  Without synchronization, tx_work can race with socket and
    device teardown when a process is killed (e.g. by SIGKILL), leading
    to use-after-free or leaked references.
    
    Set SEND_SHUTDOWN first so that if tx_work is already running it will
    see the flag and skip transmitting, then use cancel_work_sync to wait
    for any in-progress execution to finish, and finally purge any
    remaining queued skbs.
    
    Fixes: 23b7869c0fd0 ("NFC: add the NFC socket raw protocol")
    Reviewed-by: Joe Damato <joe@dama.to>
    Link: https://patch.msgid.link/20260303162346.2071888-6-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nfnetlink_osf: validate individual option lengths in fingerprints [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Thu Mar 19 15:32:44 2026 +0800

    nfnetlink_osf: validate individual option lengths in fingerprints
    
    [ Upstream commit dbdfaae9609629a9569362e3b8f33d0a20fd783c ]
    
    nfnl_osf_add_callback() validates opt_num bounds and string
    NUL-termination but does not check individual option length fields.
    A zero-length option causes nf_osf_match_one() to enter the option
    matching loop even when foptsize sums to zero, which matches packets
    with no TCP options where ctx->optp is NULL:
    
     Oops: general protection fault
     KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
     RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
     Call Trace:
      nf_osf_match (net/netfilter/nfnetlink_osf.c:227)
      xt_osf_match_packet (net/netfilter/xt_osf.c:32)
      ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)
      nf_hook_slow (net/netfilter/core.c:623)
      ip_local_deliver (net/ipv4/ip_input.c:262)
      ip_rcv (net/ipv4/ip_input.c:573)
    
    Additionally, an MSS option (kind=2) with length < 4 causes
    out-of-bounds reads when nf_osf_match_one() unconditionally accesses
    optp[2] and optp[3] for MSS value extraction.  While RFC 9293
    section 3.2 specifies that the MSS option is always exactly 4
    bytes (Kind=2, Length=4), the check uses "< 4" rather than
    "!= 4" because lengths greater than 4 do not cause memory
    safety issues -- the buffer is guaranteed to be at least
    foptsize bytes by the ctx->optsize == foptsize check.
    
    Reject fingerprints where any option has zero length, or where an MSS
    option has length less than 4, at add time rather than trusting these
    values in the packet matching hot path.
    
    Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep [+ + +]
Author: Dave Airlie <airlied@redhat.com>
Date:   Tue Feb 24 13:17:50 2026 +1000

    nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
    
    commit 8f3c6f08ababad2e3bdd239728cf66a9949446b4 upstream.
    
    If we have runtime suspended, and userspace wants to use /dev/drm_dp_*
    then just tell it the device is busy instead of crashing in the GSP
    code.
    
    WARNING: CPU: 2 PID: 565741 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164 r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
    CPU: 2 UID: 0 PID: 565741 Comm: fwupd Not tainted 6.18.10-200.fc43.x86_64 #1 PREEMPT(lazy)
    Hardware name: LENOVO 20QTS0PQ00/20QTS0PQ00, BIOS N2OET65W (1.52 ) 08/05/2024
    RIP: 0010:r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
    
    This is a simple fix to get backported. We should probably engineer a
    proper power domain solution to wake up devices and keep them awake
    while fw updates are happening.
    
    Cc: stable@vger.kernel.org
    Fixes: 8894f4919bc4 ("drm/nouveau: register a drm_dp_aux channel for each dp connector")
    Reviewed-by: Lyude Paul <lyude@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Link: https://patch.msgid.link/20260224031750.791621-1-airlied@gmail.com
    Signed-off-by: Danilo Krummrich <dakr@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
nvdimm/bus: Fix potential use after free in asynchronous initialization [+ + +]
Author: Ira Weiny <ira.weiny@intel.com>
Date:   Fri Mar 6 12:33:05 2026 -0600

    nvdimm/bus: Fix potential use after free in asynchronous initialization
    
    commit a8aec14230322ed8f1e8042b6d656c1631d41163 upstream.
    
    Dingisoul with KASAN reports a use after free if device_add() fails in
    nd_async_device_register().
    
    Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while
    scheduling async init") correctly added a reference on the parent device
    to be held until asynchronous initialization was complete.  However, if
    device_add() results in an allocation failure the ref count of the
    device drops to 0 prior to the parent pointer being accessed.  Thus
    resulting in use after free.
    
    The bug bot AI correctly identified the fix.  Save a reference to the
    parent pointer to be used to drop the parent reference regardless of the
    outcome of device_add().
    
    Reported-by: Dingisoul <dingiso.kernel@gmail.com>
    Closes: http://lore.kernel.org/8855544b-be9e-4153-aa55-0bc328b13733@gmail.com
    Fixes: b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init")
    Cc: stable@vger.kernel.org
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://patch.msgid.link/20260306-fix-uaf-async-init-v1-1-a28fd7526723@intel.com
    Signed-off-by: Ira Weiny <ira.weiny@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
nvme-pci: cap queue creation to used queues [+ + +]
Author: Keith Busch <kbusch@kernel.org>
Date:   Tue Feb 10 11:00:12 2026 -0800

    nvme-pci: cap queue creation to used queues
    
    [ Upstream commit 4735b510a00fb2d4ac9e8d21a8c9552cb281f585 ]
    
    If the user reduces the special queue count at runtime and resets the
    controller, we need to reduce the number of queues and interrupts
    requested accordingly rather than start with the pre-allocated queue
    count.
    
    Tested-by: Kanchan Joshi <joshi.k@samsung.com>
    Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

nvme-pci: ensure we're polling a polled queue [+ + +]
Author: Keith Busch <kbusch@kernel.org>
Date:   Tue Feb 10 09:26:54 2026 -0800

    nvme-pci: ensure we're polling a polled queue
    
    [ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
    
    A user can change the polled queue count at run time. There's a brief
    window during a reset where a hipri task may try to poll that queue
    before the block layer has updated the queue maps, which would race with
    the now interrupt driven queue and may cause double completions.
    
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set [+ + +]
Author: Sungwoo Kim <iam@sung-woo.kim>
Date:   Sun Mar 8 14:20:59 2026 -0400

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
    
    [ Upstream commit b4e78f1427c7d6859229ae9616df54e1fc05a516 ]
    
    dev->online_queues is a count incremented in nvme_init_queue. Thus,
    valid indices are 0 through dev->online_queues − 1.
    
    This patch fixes the loop condition to ensure the index stays within the
    valid range. Index 0 is excluded because it is the admin queue.
    
    KASAN splat:
    
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
    BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
    Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74
    
    CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
    Workqueue: nvme-reset-wq nvme_reset_work
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:378 [inline]
     print_report+0xce/0x5d0 mm/kasan/report.c:482
     kasan_report+0xdc/0x110 mm/kasan/report.c:595
     __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
     nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
     nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
     nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252
     process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
     process_scheduled_works kernel/workqueue.c:3340 [inline]
     worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
     kthread+0x41a/0x930 kernel/kthread.c:463
     ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
     </TASK>
    
    Allocated by task 34 on cpu 1 at 4.241550s:
     kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57
     kasan_save_track+0x1c/0x70 mm/kasan/common.c:78
     kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570
     poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
     __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415
     kasan_kmalloc include/linux/kasan.h:263 [inline]
     __do_kmalloc_node mm/slub.c:5657 [inline]
     __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663
     kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
     nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]
     nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534
     local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324
     pci_call_probe drivers/pci/pci-driver.c:392 [inline]
     __pci_device_probe drivers/pci/pci-driver.c:417 [inline]
     pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451
     call_driver_probe drivers/base/dd.c:583 [inline]
     really_probe+0x29b/0xb70 drivers/base/dd.c:661
     __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803
     driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833
     __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159
     async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129
     process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
     process_scheduled_works kernel/workqueue.c:3340 [inline]
     worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
     kthread+0x41a/0x930 kernel/kthread.c:463
     ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
    
    The buggy address belongs to the object at ffff88800592a000
     which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 244 bytes to the right of
     allocated 1152-byte region [ffff88800592a000, ffff88800592a480)
    
    The buggy address belongs to the physical page:
    page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928
    head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
    anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)
    page_type: f5(slab)
    raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
    raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
    head: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
    head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
    head: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff
    head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    >ffff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                 ^
     ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ==================================================================
    
    Fixes: 0f0d2c876c96 (nvme: free sq/cq dbbuf pointers when dbbuf set fails)
    Acked-by: Chao Shi <cshi008@fiu.edu>
    Acked-by: Weidong Zhu <weizhu@fiu.edu>
    Acked-by: Dave Tian <daveti@purdue.edu>
    Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nvmet-tcp: fix use-before-check of sg in bounds validation [+ + +]
Author: Cengiz Can <cengiz.can@canonical.com>
Date:   Sun Apr 5 00:23:36 2026 +0300

    nvmet-tcp: fix use-before-check of sg in bounds validation
    
    The stable backport of commit 52a0a9854934 ("nvmet-tcp: add bounds
    checks in nvmet_tcp_build_pdu_iovec") placed the bounds checks after
    the iov_len calculation:
    
        while (length) {
            u32 iov_len = min_t(u32, length, sg->length - sg_offset);
    
            if (!sg_remaining) {    /* too late: sg already dereferenced */
    
    In mainline, the checks come first because C99 allows mid-block variable
    declarations. The stable backport moved the declaration to the top of the
    loop to satisfy C89 declaration rules, but this ended up placing the
    sg->length dereference before the sg_remaining and sg->length guards.
    
    If sg_next() returns NULL at the end of the scatterlist, the next
    iteration dereferences a NULL pointer in the iov_len calculation before
    the sg_remaining check can prevent it.
    
    Fix this by moving the iov_len declaration to function scope and
    keeping the assignment after the bounds checks, matching the ordering
    in mainline.
    
    Fixes: 42afe8ed8ad2 ("nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec")
    Cc: stable@vger.kernel.org
    Cc: YunJe Shin <ioerts@kookmin.ac.kr>
    Cc: Sagi Grimberg <sagi@grimberg.me>
    Cc: Keith Busch <kbusch@kernel.org>
    Cc: linux-nvme@lists.infradead.org
    Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
objtool: Fix Clang jump table detection [+ + +]
Author: Josh Poimboeuf <jpoimboe@kernel.org>
Date:   Mon Mar 9 09:03:05 2026 -0700

    objtool: Fix Clang jump table detection
    
    [ Upstream commit 4e5019216402ad0b4a84cff457b662d26803f103 ]
    
    With Clang, there can be a conditional forward jump between the load of
    the jump table address and the indirect branch.
    
    Fixes the following warning:
    
      vmlinux.o: warning: objtool: ___bpf_prog_run+0x1c5: sibling call from callable instruction with modified stack frame
    
    Reported-by: Arnd Bergmann <arnd@arndb.de>
    Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com
    Link: https://patch.msgid.link/7d8600caed08901b6679767488acd639f6df9688.1773071992.git.jpoimboe@kernel.org
    Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
octeontx2-af: devlink: fix NIX RAS reporter recovery condition [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Tue Mar 10 11:48:16 2026 -0700

    octeontx2-af: devlink: fix NIX RAS reporter recovery condition
    
    [ Upstream commit dc26ca99b835e21e76a58b1463b84adb0ca34f58 ]
    
    The NIX RAS health reporter recovery routine checks nix_af_rvu_int to
    decide whether to re-enable NIX_AF_RAS interrupts. This is the RVU
    interrupt status field and is unrelated to RAS events, so the recovery
    flow may incorrectly skip re-enabling NIX_AF_RAS interrupts.
    
    Check nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S.
    
    Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Link: https://patch.msgid.link/20260310184824.1183651-1-alok.a.tiwari@oracle.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
of: Add cleanup.h based auto release via __free(device_node) markings [+ + +]
Author: Jonathan Cameron <jic23@kernel.org>
Date:   Sun Feb 25 14:27:11 2024 +0000

    of: Add cleanup.h based auto release via __free(device_node) markings
    
    [ Upstream commit 9448e55d032d99af8e23487f51a542d51b2f1a48 ]
    
    The recent addition of scope based cleanup support to the kernel
    provides a convenient tool to reduce the chances of leaking reference
    counts where of_node_put() should have been called in an error path.
    
    This enables
            struct device_node *child __free(device_node) = NULL;
    
            for_each_child_of_node(np, child) {
                    if (test)
                            return test;
            }
    
    with no need for a manual call of of_node_put().
    A following patch will reduce the scope of the child variable to the
    for loop, to avoid an issues with ordering of autocleanup, and make it
    obvious when this assigned a non NULL value.
    
    In this simple example the gains are small but there are some very
    complex error handling cases buried in these loops that will be
    greatly simplified by enabling early returns with out the need
    for this manual of_node_put() call.
    
    Note that there are coccinelle checks in
    scripts/coccinelle/iterators/for_each_child.cocci to detect a failure
    to call of_node_put(). This new approach does not cause false positives.
    Longer term we may want to add scripting to check this new approach is
    done correctly with no double of_node_put() calls being introduced due
    to the auto cleanup. It may also be useful to script finding places
    this new approach is useful.
    
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Reviewed-by: Rob Herring <robh@kernel.org>
    Link: https://lore.kernel.org/r/20240225142714.286440-2-jic23@kernel.org
    Signed-off-by: Rob Herring <robh@kernel.org>
    Stable-dep-of: 879c001afbac ("firmware: arm_scpi: Fix device_node reference leak in probe path")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
openvswitch: validate MPLS set/set_masked payload length [+ + +]
Author: Yang Yang <n05ec@lzu.edu.cn>
Date:   Thu Mar 19 08:02:27 2026 +0000

    openvswitch: validate MPLS set/set_masked payload length
    
    [ Upstream commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 ]
    
    validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for
    SET/SET_MASKED actions. In action handling, OVS expects fixed-size
    MPLS key data (struct ovs_key_mpls).
    
    Use the already normalized key_len (masked case included) and reject
    non-matching MPLS action key sizes.
    
    Reject invalid MPLS action payload lengths early.
    
    Fixes: fbdcdd78da7c ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
    Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
    Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
    Link: https://patch.msgid.link/20260319080228.3423307-1-n05ec@lzu.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
parisc: Fix initial page table creation for boot [+ + +]
Author: Helge Deller <deller@gmx.de>
Date:   Wed Mar 4 22:24:18 2026 +0100

    parisc: Fix initial page table creation for boot
    
    commit 8475d8fe21ec9c7eb2faca555fbc5b68cf0d2597 upstream.
    
    The KERNEL_INITIAL_ORDER value defines the initial size (usually 32 or
    64 MB) of the page table during bootup. Up until now the whole area was
    initialized with PTE entries, but there was no check if we filled too
    many entries.  Change the code to fill up with so many entries that the
    "_end" symbol can be reached by the kernel, but not more entries than
    actually fit into the initial PTE tables.
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    Cc: <stable@vger.kernel.org> # v6.0+
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parisc: Increase initial mapping to 64 MB with KALLSYMS [+ + +]
Author: Helge Deller <deller@gmx.de>
Date:   Tue Mar 3 23:36:10 2026 +0100

    parisc: Increase initial mapping to 64 MB with KALLSYMS
    
    commit 8e732934fb81282be41602550e7e07baf265e972 upstream.
    
    The 32MB initial kernel mapping can become too small when CONFIG_KALLSYMS
    is used. Increase the mapping to 64 MB in this case.
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    Cc: <stable@vger.kernel.org> # v6.0+
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off [+ + +]
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date:   Tue Apr 7 14:38:07 2026 +0300

    phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
    
    commit 9ce71e85b29eb63e48e294479742e670513f03a0 upstream.
    
    Assert PLL reset on PHY power off. This saves power.
    
    [claudiu.beznea: fixed conflict in rcar_gen3_phy_usb2_power_off() by
     using spin_lock_irqsave()/spin_unlock_irqrestore() instead of
     scoped_guard()]
    
    Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
    Cc: stable@vger.kernel.org
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://lore.kernel.org/r/20250507125032.565017-5-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind [+ + +]
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date:   Tue Apr 7 14:38:04 2026 +0300

    phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
    
    commit 54c4c58713aaff76c2422ff5750e557ab3b100d7 upstream.
    
    It has been observed on the Renesas RZ/G3S SoC that unbinding and binding
    the PHY driver leads to role autodetection failures. This issue occurs when
    PHY 3 is the first initialized PHY. PHY 3 does not have an interrupt
    associated with the USB2_INT_ENABLE register (as
    rcar_gen3_int_enable[3] = 0). As a result, rcar_gen3_init_otg() is called
    to initialize OTG without enabling PHY interrupts.
    
    To resolve this, add rcar_gen3_is_any_otg_rphy_initialized() and call it in
    role_store(), role_show(), and rcar_gen3_init_otg(). At the same time,
    rcar_gen3_init_otg() is only called when initialization for a PHY with
    interrupt bits is in progress. As a result, the
    struct rcar_gen3_phy::otg_initialized is no longer needed.
    
    [claudiu.beznea: declare the i iterrator from
     rcar_gen3_is_any_otg_rphy_initialized() outside of for loop]
    
    Fixes: 549b6b55b005 ("phy: renesas: rcar-gen3-usb2: enable/disable independent irqs")
    Cc: stable@vger.kernel.org
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://lore.kernel.org/r/20250507125032.565017-2-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data [+ + +]
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date:   Tue Apr 7 14:38:06 2026 +0300

    phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
    
    commit 55a387ebb9219cbe4edfa8ba9996ccb0e7ad4932 upstream.
    
    The phy-rcar-gen3-usb2 driver exposes four individual PHYs that are
    requested and configured by PHY users. The struct phy_ops APIs access the
    same set of registers to configure all PHYs. Additionally, PHY settings can
    be modified through sysfs or an IRQ handler. While some struct phy_ops APIs
    are protected by a driver-wide mutex, others rely on individual
    PHY-specific mutexes.
    
    This approach can lead to various issues, including:
    1/ the IRQ handler may interrupt PHY settings in progress, racing with
       hardware configuration protected by a mutex lock
    2/ due to msleep(20) in rcar_gen3_init_otg(), while a configuration thread
       suspends to wait for the delay, another thread may try to configure
       another PHY (with phy_init() + phy_power_on()); re-running the
       phy_init() goes to the exact same configuration code, re-running the
       same hardware configuration on the same set of registers (and bits)
       which might impact the result of the msleep for the 1st configuring
       thread
    3/ sysfs can configure the hardware (though role_store()) and it can
       still race with the phy_init()/phy_power_on() APIs calling into the
       drivers struct phy_ops
    
    To address these issues, add a spinlock to protect hardware register access
    and driver private data structures (e.g., calls to
    rcar_gen3_is_any_rphy_initialized()). Checking driver-specific data remains
    necessary as all PHY instances share common settings. With this change,
    the existing mutex protection is removed and the cleanup.h helpers are
    used.
    
    While at it, to keep the code simpler, do not skip
    regulator_enable()/regulator_disable() APIs in
    rcar_gen3_phy_usb2_power_on()/rcar_gen3_phy_usb2_power_off() as the
    regulators enable/disable operations are reference counted anyway.
    
    [claudiu.beznea:
     - in rcar_gen3_phy_usb2_irq() and rcar_gen3_phy_usb2_power_off() replaced
       scoped_guard() with spin_lock()/spin_unlock(), since scoped_guard() is
       not available in v5.15
     - in rcar_gen3_phy_usb2_power_on() used spin_lock_irqsave()/
       spin_unlock_irqrestore() instead of guard() to avoid compilation warning
       "ISO C90 forbids mixed declarations and code"]
    
    Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
    Cc: stable@vger.kernel.org
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://lore.kernel.org/r/20250507125032.565017-4-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: renesas: rcar-gen3-usb2: Move IRQ request in probe [+ + +]
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date:   Tue Apr 7 14:38:05 2026 +0300

    phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
    
    commit de76809f60cc938d3580bbbd5b04b7d12af6ce3a upstream.
    
    Commit 08b0ad375ca6 ("phy: renesas: rcar-gen3-usb2: move IRQ registration
    to init") moved the IRQ request operation from probe to
    struct phy_ops::phy_init API to avoid triggering interrupts (which lead to
    register accesses) while the PHY clocks (enabled through runtime PM APIs)
    are not active. If this happens, it results in a synchronous abort.
    
    One way to reproduce this issue is by enabling CONFIG_DEBUG_SHIRQ, which
    calls free_irq() on driver removal.
    
    Move the IRQ request and free operations back to probe, and take the
    runtime PM state into account in IRQ handler. This commit is preparatory
    for the subsequent fixes in this series.
    
    [claudiu.beznea: fixed conflict in probe b/w IRQ request probe and
     platform_set_drvdata() by keeping platform_set_drvdata() code before
     IRQ request code]
    
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Link: https://lore.kernel.org/r/20250507125032.565017-3-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() [+ + +]
Author: Felix Gu <ustc.gu@gmail.com>
Date:   Thu Feb 12 18:39:19 2026 +0800

    phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
    
    [ Upstream commit 584b457f4166293bdfa50f930228e9fb91a38392 ]
    
    The serdes device_node is obtained using of_get_child_by_name(),
    which increments the reference count. However, it is never put,
    leading to a reference leak.
    
    Add the missing of_node_put() calls to ensure the reference count is
    properly balanced.
    
    Fixes: 7ae14cf581f2 ("phy: ti: j721e-wiz: Implement DisplayPort mode to the wiz driver")
    Suggested-by: Vladimir Oltean <olteanv@gmail.com>
    Signed-off-by: Felix Gu <ustc.gu@gmail.com>
    Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
    Link: https://patch.msgid.link/20260212-wiz-v2-1-6e8bd4cc7a4a@gmail.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
pinctrl: mediatek: common: Fix probe failure for devices without EINT [+ + +]
Author: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Date:   Tue Mar 17 11:02:06 2026 +0000

    pinctrl: mediatek: common: Fix probe failure for devices without EINT
    
    [ Upstream commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd ]
    
    Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but
    the mtk_eint_init function is always called and returns -ENODEV, which
    then bubbles up and causes probe failure.
    
    To address this only call mtk_eint_init if EINT pins are present.
    
    Tested on Xiaomi Mi Smart Clock x04g (mt6392).
    
    Fixes: e46df235b4e6 ("pinctrl: mediatek: refactor EINT related code for all MediaTek pinctrl can fit")
    Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Linus Walleij <linusw@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Tue Mar 10 06:01:35 2026 -0700

    platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
    
    [ Upstream commit 2061f7b042f88d372cca79615f8425f3564c0b40 ]
    
    The command length check validates inlen (> 5), but the error message
    incorrectly printed resp_len. Print inlen so the log reflects the
    actual command length.
    
    Fixes: 0c3d931b3ab9e ("Platform: OLPC: Add XO-1.75 EC driver")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Acked-by: Lubomir Rintel <lkundrak@v3.sk>
    Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
    Link: https://patch.msgid.link/20260310130138.700687-1-alok.a.tiwari@oracle.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data [+ + +]
Author: Thorsten Blum <thorsten.blum@linux.dev>
Date:   Tue Mar 3 12:30:51 2026 +0100

    platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
    
    commit d1a196e0a6dcddd03748468a0e9e3100790fc85c upstream.
    
    set_new_password() hex dumps the entire buffer, which contains plaintext
    password data, including current and new passwords. Remove the hex dump
    to avoid leaking credentials.
    
    Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
    Cc: stable@vger.kernel.org
    Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
    Link: https://patch.msgid.link/20260303113050.58127-2-thorsten.blum@linux.dev
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: dell-wmi: Add audio/mic mute key codes [+ + +]
Author: Kurt Borja <kuurtb@gmail.com>
Date:   Sat Feb 7 12:16:34 2026 -0500

    platform/x86: dell-wmi: Add audio/mic mute key codes
    
    commit 26a7601471f62b95d56a81c3a8ccb551b5a6630f upstream.
    
    Add audio/mic mute key codes found in Alienware m18 r1 AMD.
    
    Cc: stable@vger.kernel.org
    Tested-by: Olexa Bilaniuk <obilaniu@gmail.com>
    Suggested-by: Olexa Bilaniuk <obilaniu@gmail.com>
    Signed-off-by: Kurt Borja <kuurtb@gmail.com>
    Acked-by: Pali Rohár <pali@kernel.org>
    Link: https://patch.msgid.link/20260207-mute-keys-v2-1-c55e5471c9c1@gmail.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list [+ + +]
Author: Peter Metz <peter.metz@unarin.com>
Date:   Thu Feb 12 23:46:27 2026 -0500

    platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
    
    [ Upstream commit 6b3fa0615cd8432148581de62a52f83847af3d70 ]
    
    The Dell 14 Plus 2-in-1 (model DB04250) requires the VGBS allow list
    entry to correctly enable the tablet mode switch. Without this, the
    chassis state is not reported, and the hinge rotation only emits
    unknown scancodes.
    
    Verified on Dell 14 Plus 2-in-1 DB04250.
    
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221090
    Signed-off-by: Peter Metz <peter.metz@unarin.com>
    Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
    Link: https://patch.msgid.link/20260213044627.203638-1-peter.metz@unarin.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 [+ + +]
Author: Leif Skunberg <diamondback@cohunt.app>
Date:   Tue Feb 10 09:56:25 2026 +0100

    platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
    
    [ Upstream commit b38d478dad79e61e8a65931021bdfd7a71741212 ]
    
    The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down
    buttons that are handled through the intel-hid 5-button array
    interface. The firmware does not advertise 5-button array support via
    HEBC, so the driver relies on a DMI allowlist to enable it.
    
    Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the
    volume buttons work out of the box.
    
    Signed-off-by: Leif Skunberg <diamondback@cohunt.app>
    Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
    Link: https://patch.msgid.link/20260210085625.34380-1-diamondback@cohunt.app
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: thinkpad_acpi: Fix errors reading battery thresholds [+ + +]
Author: Jonathan Teh <jonathan.teh@outlook.com>
Date:   Mon Feb 16 01:01:29 2026 +0000

    platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
    
    [ Upstream commit 53e977b1d50c46f2c4ec3865cd13a822f58ad3cd ]
    
    Check whether the battery supports the relevant charge threshold before
    reading the value to silence these errors:
    
    thinkpad_acpi: acpi_evalf(BCTG, dd, ...) failed: AE_NOT_FOUND
    ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCTG: evaluate failed
    thinkpad_acpi: acpi_evalf(BCSG, dd, ...) failed: AE_NOT_FOUND
    ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCSG: evaluate failed
    
    when reading the charge thresholds via sysfs on platforms that do not
    support them such as the ThinkPad T400.
    
    Fixes: 2801b9683f74 ("thinkpad_acpi: Add support for battery thresholds")
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202619
    Signed-off-by: Jonathan Teh <jonathan.teh@outlook.com>
    Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
    Link: https://patch.msgid.link/MI0P293MB01967B206E1CA6F337EBFB12926CA@MI0P293MB0196.ITAP293.PROD.OUTLOOK.COM
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 [+ + +]
Author: Hans de Goede <johannes.goede@oss.qualcomm.com>
Date:   Tue Feb 17 14:23:46 2026 +0100

    platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
    
    [ Upstream commit 7d87ed70fc95482c12edf9493c249b6413be485e ]
    
    The touchscreen on the SUPI S10 tablet reports inverted Y coordinates,
    causing touch input to be mirrored vertically relative to the display.
    
    Add a quirk to set the "touchscreen-inverted-y" boolean device-property
    on the touchscreen device, so that the goodix_ts driver will fixup
    the coordinates.
    
    Reported-by: Yajat Kumar <yajatapps3@gmail.com>
    Closes: https://lore.kernel.org/linux-input/20251230221639.582406-1-yajatapps3@gmail.com/
    Tested-by: Yajat Kumar <yajatapps3@gmail.com>
    Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
    Link: https://patch.msgid.link/20260217132346.34535-1-johannes.goede@oss.qualcomm.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
PM: runtime: Fix a race condition related to device removal [+ + +]
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Thu Mar 12 11:27:20 2026 -0700

    PM: runtime: Fix a race condition related to device removal
    
    [ Upstream commit 29ab768277617452d88c0607c9299cdc63b6e9ff ]
    
    The following code in pm_runtime_work() may dereference the dev->parent
    pointer after the parent device has been freed:
    
            /* Maybe the parent is now able to suspend. */
            if (parent && !parent->power.ignore_children) {
                    spin_unlock(&dev->power.lock);
    
                    spin_lock(&parent->power.lock);
                    rpm_idle(parent, RPM_ASYNC);
                    spin_unlock(&parent->power.lock);
    
                    spin_lock(&dev->power.lock);
            }
    
    Fix this by inserting a flush_work() call in pm_runtime_remove().
    
    Without this patch blktest block/001 triggers the following complaint
    sporadically:
    
    BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160
    Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081
    Workqueue: pm pm_runtime_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x61/0x80
     print_address_description.constprop.0+0x8b/0x310
     print_report+0xfd/0x1d7
     kasan_report+0xd8/0x1d0
     __kasan_check_byte+0x42/0x60
     lock_acquire.part.0+0x38/0x230
     lock_acquire+0x70/0x160
     _raw_spin_lock+0x36/0x50
     rpm_suspend+0xc6a/0xfe0
     rpm_idle+0x578/0x770
     pm_runtime_work+0xee/0x120
     process_one_work+0xde3/0x1410
     worker_thread+0x5eb/0xfe0
     kthread+0x37b/0x480
     ret_from_fork+0x6cb/0x920
     ret_from_fork_asm+0x11/0x20
     </TASK>
    
    Allocated by task 4314:
     kasan_save_stack+0x2a/0x50
     kasan_save_track+0x18/0x40
     kasan_save_alloc_info+0x3d/0x50
     __kasan_kmalloc+0xa0/0xb0
     __kmalloc_noprof+0x311/0x990
     scsi_alloc_target+0x122/0xb60 [scsi_mod]
     __scsi_scan_target+0x101/0x460 [scsi_mod]
     scsi_scan_channel+0x179/0x1c0 [scsi_mod]
     scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]
     store_scan+0x2d2/0x390 [scsi_mod]
     dev_attr_store+0x43/0x80
     sysfs_kf_write+0xde/0x140
     kernfs_fop_write_iter+0x3ef/0x670
     vfs_write+0x506/0x1470
     ksys_write+0xfd/0x230
     __x64_sys_write+0x76/0xc0
     x64_sys_call+0x213/0x1810
     do_syscall_64+0xee/0xfc0
     entry_SYSCALL_64_after_hwframe+0x4b/0x53
    
    Freed by task 4314:
     kasan_save_stack+0x2a/0x50
     kasan_save_track+0x18/0x40
     kasan_save_free_info+0x3f/0x50
     __kasan_slab_free+0x67/0x80
     kfree+0x225/0x6c0
     scsi_target_dev_release+0x3d/0x60 [scsi_mod]
     device_release+0xa3/0x220
     kobject_cleanup+0x105/0x3a0
     kobject_put+0x72/0xd0
     put_device+0x17/0x20
     scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]
     device_release+0xa3/0x220
     kobject_cleanup+0x105/0x3a0
     kobject_put+0x72/0xd0
     put_device+0x17/0x20
     scsi_device_put+0x7f/0xc0 [scsi_mod]
     sdev_store_delete+0xa5/0x120 [scsi_mod]
     dev_attr_store+0x43/0x80
     sysfs_kf_write+0xde/0x140
     kernfs_fop_write_iter+0x3ef/0x670
     vfs_write+0x506/0x1470
     ksys_write+0xfd/0x230
     __x64_sys_write+0x76/0xc0
     x64_sys_call+0x213/0x1810
    
    Reported-by: Ming Lei <ming.lei@redhat.com>
    Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/
    Reported-by: syzbot+6c905ab800f20cf4086c@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/
    Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
pmdomain: bcm: bcm2835-power: Increase ASB control timeout [+ + +]
Author: Maíra Canal <mcanal@igalia.com>
Date:   Sat Mar 21 08:41:08 2026 -0400

    pmdomain: bcm: bcm2835-power: Increase ASB control timeout
    
    [ Upstream commit b826d2c0b0ecb844c84431ba6b502e744f5d919a ]
    
    The bcm2835_asb_control() function uses a tight polling loop to wait
    for the ASB bridge to acknowledge a request. During intensive workloads,
    this handshake intermittently fails for V3D's master ASB on BCM2711,
    resulting in "Failed to disable ASB master for v3d" errors during
    runtime PM suspend. As a consequence, the failed power-off leaves V3D in
    a broken state, leading to bus faults or system hangs on later accesses.
    
    As the timeout is insufficient in some scenarios, increase the polling
    timeout from 1us to 5us, which is still negligible in the context of a
    power domain transition. Also, replace the open-coded ktime_get_ns()/
    cpu_relax() polling loop with readl_poll_timeout_atomic().
    
    Cc: stable@vger.kernel.org
    Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
    Signed-off-by: Maíra Canal <mcanal@igalia.com>
    Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    [ adapted unified bcm2835_asb_control() function changes to separate bcm2835_asb_enable() and bcm2835_asb_disable() functions ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powerpc/uaccess: Fix inline assembly for clang build on PPC32 [+ + +]
Author: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Date:   Tue Feb 3 08:30:41 2026 +0100

    powerpc/uaccess: Fix inline assembly for clang build on PPC32
    
    [ Upstream commit 0ee95a1d458630272d0415d0ffa9424fcb606c90 ]
    
    Test robot reports the following error with clang-16.0.6:
    
       In file included from kernel/rseq.c:75:
       include/linux/rseq_entry.h:141:3: error: invalid operand for instruction
                       unsafe_get_user(offset, &ucs->post_commit_offset, efault);
                       ^
       include/linux/uaccess.h:608:2: note: expanded from macro 'unsafe_get_user'
               arch_unsafe_get_user(x, ptr, local_label);      \
               ^
       arch/powerpc/include/asm/uaccess.h:518:2: note: expanded from macro 'arch_unsafe_get_user'
               __get_user_size_goto(__gu_val, __gu_addr, sizeof(*(p)), e); \
               ^
       arch/powerpc/include/asm/uaccess.h:284:2: note: expanded from macro '__get_user_size_goto'
               __get_user_size_allowed(x, ptr, size, __gus_retval);    \
               ^
       arch/powerpc/include/asm/uaccess.h:275:10: note: expanded from macro '__get_user_size_allowed'
               case 8: __get_user_asm2(x, (u64 __user *)ptr, retval);  break;  \
                       ^
       arch/powerpc/include/asm/uaccess.h:258:4: note: expanded from macro '__get_user_asm2'
                       "       li %1+1,0\n"                    \
                        ^
       <inline asm>:7:5: note: instantiated into assembly here
               li 31+1,0
                  ^
       1 error generated.
    
    On PPC32, for 64 bits vars a pair of registers is used. Usually the
    lower register in the pair is the high part and the higher register is
    the low part. GCC uses r3/r4 ... r11/r12 ... r14/r15 ... r30/r31
    
    In older kernel code inline assembly was using %1 and %1+1 to represent
    64 bits values. However here it looks like clang uses r31 as high part,
    allthough r32 doesn't exist hence the error.
    
    Allthoug %1+1 should work, most places now use %L1 instead of %1+1, so
    let's do the same here.
    
    With that change, the build doesn't fail anymore and a disassembly shows
    clang uses r17/r18 and r31/r14 pair when GCC would have used r16/r17 and
    r30/r31:
    
            Disassembly of section .fixup:
    
            00000000 <.fixup>:
               0:   38 a0 ff f2     li      r5,-14
               4:   3a 20 00 00     li      r17,0
               8:   3a 40 00 00     li      r18,0
               c:   48 00 00 00     b       c <.fixup+0xc>
                                    c: R_PPC_REL24  .text+0xbc
              10:   38 a0 ff f2     li      r5,-14
              14:   3b e0 00 00     li      r31,0
              18:   39 c0 00 00     li      r14,0
              1c:   48 00 00 00     b       1c <.fixup+0x1c>
                                    1c: R_PPC_REL24 .text+0x144
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202602021825.otcItxGi-lkp@intel.com/
    Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()")
    Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
    Acked-by: Nathan Chancellor <nathan@kernel.org>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/8ca3a657a650e497a96bfe7acde2f637dadab344.1770103646.git.chleroy@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
powerpc: 83xx: km83xx: Fix keymile vendor prefix [+ + +]
Author: J. Neuschäfer <j.ne@posteo.net>
Date:   Tue Mar 3 16:31:42 2026 +0100

    powerpc: 83xx: km83xx: Fix keymile vendor prefix
    
    [ Upstream commit 691417ffe7821721e0a28bd25ad8c0dc0d4ae4ad ]
    
    When kmeter.c was refactored into km83xx.c in 2011, the "keymile" vendor
    prefix was changed to upper-case "Keymile". The devicetree at
    arch/powerpc/boot/dts/kmeter1.dts never underwent the same change,
    suggesting that this was simply a mistake.
    
    Fixes: 93e2b95c81042d ("powerpc/83xx: rename and update kmeter1")
    Signed-off-by: J. Neuschäfer <j.ne@posteo.net>
    Reviewed-by: Heiko Schocher <hs@nabladev.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/20260303-keymile-v1-1-463a11e71702@posteo.net
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/irdma: Clean up unnecessary dereference of event->cm_node [+ + +]
Author: Ivan Barrera <ivan.d.barrera@intel.com>
Date:   Mon Mar 16 13:39:43 2026 -0500

    RDMA/irdma: Clean up unnecessary dereference of event->cm_node
    
    [ Upstream commit b415399c9a024d574b65479636f0d4eb625b9abd ]
    
    The cm_node is available and the usage of cm_node and event->cm_node
    seems arbitrary. Clean up unnecessary dereference of event->cm_node.
    
    Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
    Signed-off-by: Ivan Barrera <ivan.d.barrera@intel.com>
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Fix deadlock during netdev reset with active connections [+ + +]
Author: Anil Samal <anil.samal@intel.com>
Date:   Mon Mar 16 13:39:45 2026 -0500

    RDMA/irdma: Fix deadlock during netdev reset with active connections
    
    [ Upstream commit 6f52370970ac07d352a7af4089e55e0e6425f827 ]
    
    Resolve deadlock that occurs when user executes netdev reset while RDMA
    applications (e.g., rping) are active. The netdev reset causes ice
    driver to remove irdma auxiliary driver, triggering device_delete and
    subsequent client removal. During client removal, uverbs_client waits
    for QP reference count to reach zero while cma_client holds the final
    reference, creating circular dependency and indefinite wait in iWARP
    mode. Skip QP reference count wait during device reset to prevent
    deadlock.
    
    Fixes: c8f304d75f6c ("RDMA/irdma: Prevent QP use after free")
    Signed-off-by: Anil Samal <anil.samal@intel.com>
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() [+ + +]
Author: Jason Gunthorpe <jgg@ziepe.ca>
Date:   Mon Mar 9 09:27:39 2026 -0400

    RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
    
    [ Upstream commit 74586c6da9ea222a61c98394f2fc0a604748438c ]
    
    struct irdma_create_ah_resp {  // 8 bytes, no padding
        __u32 ah_id;               // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
        __u8  rsvd[4];             // offset 4 - NEVER SET <- LEAK
    };
    
    rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().
    
    The reserved members of the structure were not zeroed.
    
    Cc: stable@vger.kernel.org
    Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Link: https://patch.msgid.link/3-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    [ adapted fix to combined irdma_create_ah() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() [+ + +]
Author: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Date:   Mon Mar 16 13:39:42 2026 -0500

    RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
    
    [ Upstream commit 5e8f0239731a83753473b7aa91bda67bbdff5053 ]
    
    Remove a NOP wait_event() in irdma_modify_qp_roce() which is relevant
    for iWARP and likely a copy and paste artifact for RoCEv2. The wait event
    is for sending a reset on a TCP connection, after the reset has been
    requested in irdma_modify_qp(), which occurs only in iWarp mode.
    
    Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() [+ + +]
Author: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Date:   Mon Mar 16 13:39:44 2026 -0500

    RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
    
    [ Upstream commit c45c6ebd693b944f1ffe429fdfb6cc1674c237be ]
    
    During reset, irdma_modify_qp() to error should be called to disconnect
    the QP. Without this fix, if not preceded by irdma_modify_qp() to error, the
    API call irdma_destroy_qp() gets stuck waiting for the QP refcount to go
    to zero, because the cm_node associated with this QP isn't disconnected.
    
    Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions")
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Return EINVAL for invalid arp index error [+ + +]
Author: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Date:   Mon Mar 16 13:39:46 2026 -0500

    RDMA/irdma: Return EINVAL for invalid arp index error
    
    [ Upstream commit 7221f581eefa79ead06e171044f393fb7ee22f87 ]
    
    When rdma_connect() fails due to an invalid arp index, user space rdma core
    reports ENOMEM which is confusing. Modify irdma_make_cm_node() to return the
    correct error code.
    
    Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Update ibqp state to error if QP is already in error state [+ + +]
Author: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Date:   Mon Mar 16 13:39:41 2026 -0500

    RDMA/irdma: Update ibqp state to error if QP is already in error state
    
    [ Upstream commit 8c1f19a2225cf37b3f8ab0b5a8a5322291cda620 ]
    
    In irdma_modify_qp() update ibqp state to error if the irdma QP is already
    in error state, otherwise the ibqp state which is visible to the consumer
    app remains stale.
    
    Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
    Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/rw: Fall back to direct SGE on MR pool exhaustion [+ + +]
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Fri Mar 13 15:41:58 2026 -0400

    RDMA/rw: Fall back to direct SGE on MR pool exhaustion
    
    [ Upstream commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 ]
    
    When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs()
    produces no coalescing: each scatterlist page maps 1:1 to a DMA
    entry, so sgt.nents equals the raw page count. A 1 MB transfer
    yields 256 DMA entries. If that count exceeds the device's
    max_sgl_rd threshold (an optimization hint from mlx5 firmware),
    rdma_rw_io_needs_mr() steers the operation into the MR
    registration path. Each such operation consumes one or more MRs
    from a pool sized at max_rdma_ctxs -- roughly one MR per
    concurrent context. Under write-intensive workloads that issue
    many concurrent RDMA READs, the pool is rapidly exhausted,
    ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns
    -EAGAIN. Upper layer protocols treat this as a fatal DMA mapping
    failure and tear down the connection.
    
    The max_sgl_rd check is a performance optimization, not a
    correctness requirement: the device can handle large SGE counts
    via direct posting, just less efficiently than with MR
    registration. When the MR pool cannot satisfy a request, falling
    back to the direct SGE (map_wrs) path avoids the connection
    reset while preserving the MR optimization for the common case
    where pool resources are available.
    
    Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from
    rdma_rw_init_mr_wrs() triggers direct SGE posting instead of
    propagating the error. iWARP devices, which mandate MR
    registration for RDMA READs, and force_mr debug mode continue
    to treat -EAGAIN as terminal.
    
    Fixes: 00bd1439f464 ("RDMA/rw: Support threshold for registration vs scattering to local pages")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Link: https://patch.msgid.link/20260313194201.5818-2-cel@kernel.org
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
rds: ib: reject FRMR registration before IB connection is established [+ + +]
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Tue Mar 31 00:32:38 2026 +0800

    rds: ib: reject FRMR registration before IB connection is established
    
    [ Upstream commit a54ecccfae62c5c85259ae5ea5d9c20009519049 ]
    
    rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
    and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
    fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
    i_cm_id = NULL because the connection worker has not yet called
    rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
    RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
    the control message before any connection establishment, allowing
    rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
    kernel.
    
    The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
    commit 9e630bcb7701), which does not catch this case since ic is allocated
    early and is always non-NULL once the connection object exists.
    
     KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
     RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
     Call Trace:
      rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
      rds_ib_map_frmr (net/rds/ib_frmr.c:252)
      rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
      rds_ib_get_mr (net/rds/ib_rdma.c:615)
      __rds_rdma_map (net/rds/rdma.c:295)
      rds_cmsg_rdma_map (net/rds/rdma.c:860)
      rds_sendmsg (net/rds/send.c:1363)
      ____sys_sendmsg
      do_syscall_64
    
    Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
    non-NULL before proceeding with FRMR registration, mirroring the guard
    already present in rds_ib_post_inv(). Return -ENODEV when the connection
    is not ready, which the existing error handling in rds_cmsg_send() converts
    to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
    start the connection worker.
    
    Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Reviewed-by: Allison Henderson <achender@kernel.org>
    Link: https://patch.msgid.link/20260330163237.2752440-2-bestswngs@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
regmap: Synchronize cache for the page selector [+ + +]
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date:   Mon Mar 2 19:43:31 2026 +0100

    regmap: Synchronize cache for the page selector
    
    [ Upstream commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 ]
    
    If the selector register is represented in each page, its value
    according to the debugfs is stale because it gets synchronized
    only after the real page switch happens. Hence the regmap cache
    initialisation from the HW inherits outdated data in the selector
    register.
    
    Synchronize cache for the page selector just in time.
    
    Before (offset followed by hexdump, the first byte is selector):
    
        // Real registers
        18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
        ...
        // Virtual (per port)
        40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f
        50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
        60: 01 ff 00 00 ff ff 00 00 00 00 00 00
        70: 02 ff 00 00 cf f3 00 00 00 00 00 0c
        80: 03 ff 00 00 00 00 00 00 00 00 00 ff
        90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00
    
    After:
    
        // Real registers
        18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
        ...
        // Virtual (per port)
        40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
        50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f
        60: 02 ff 00 00 ff ff 00 00 00 00 00 00
        70: 03 ff 00 00 cf f3 00 00 00 00 00 0c
        80: 04 ff 00 00 00 00 00 00 00 00 00 ff
        90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
    
    Fixes: 6863ca622759 ("regmap: Add support for register indirect addressing.")
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Link: https://patch.msgid.link/20260302184753.2693803-1-andriy.shevchenko@linux.intel.com
    Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
regulator: pca9450: Correct interrupt type [+ + +]
Author: Peng Fan <peng.fan@nxp.com>
Date:   Tue Mar 10 12:25:52 2026 +0800

    regulator: pca9450: Correct interrupt type
    
    [ Upstream commit 5d0efaf47ee90ac60efae790acee3a3ed99ebf80 ]
    
    Kernel warning on i.MX8MP-EVK when doing module test:
    irq: type mismatch, failed to map hwirq-3 for gpio@30200000!
    
    Per PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked
    interrupt bit status is changed and it is released high once application
    processor read INT1 register.
    
    So the interrupt should be configured as IRQF_TRIGGER_LOW, not
    IRQF_TRIGGER_FALLING.
    
    Fixes: 0935ff5f1f0a4 ("regulator: pca9450: add pca9450 pmic driver")
    Signed-off-by: Peng Fan <peng.fan@nxp.com>
    Link: https://patch.msgid.link/20260310-pca9450-irq-v1-1-36adf52c2c55@nxp.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

regulator: pca9450: Make IRQ optional [+ + +]
Author: Frieder Schrempf <frieder.schrempf@kontron.de>
Date:   Mon Jul 8 10:40:34 2024 +0200

    regulator: pca9450: Make IRQ optional
    
    [ Upstream commit 83808c54064eef620ad8645dfdcaffe125551532 ]
    
    The IRQ line might not be connected on some boards. Allow the driver
    to be probed without it.
    
    Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
    Link: https://patch.msgid.link/20240708084107.38986-5-frieder@fris.de
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Stable-dep-of: 5d0efaf47ee9 ("regulator: pca9450: Correct interrupt type")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
remoteproc: mediatek: Unprepare SCP clock during system suspend [+ + +]
Author: Tzung-Bi Shih <tzungbi@kernel.org>
Date:   Fri Feb 6 03:30:33 2026 +0000

    remoteproc: mediatek: Unprepare SCP clock during system suspend
    
    [ Upstream commit 35c3f72a2d55dbf52f28f4ecae51c76be1acf545 ]
    
    Prior to commit d935187cfb27 ("remoteproc: mediatek: Break lock
    dependency to prepare_lock"), `scp->clk` was prepared and enabled only
    when it needs to communicate with the SCP.  The commit d935187cfb27
    moved the prepare operation to remoteproc's prepare(), keeping the clock
    prepared as long as the SCP is running.
    
    The power consumption due to the prolonged clock preparation can be
    negligible when the system is running, as SCP is designed to be a very
    power efficient processor.
    
    However, the clock remains prepared even when the system enters system
    suspend.  This prevents the underlying clock controller (and potentially
    the parent PLLs) from shutting down, which increases power consumption
    and may block the system from entering deep sleep states.
    
    Add suspend and resume callbacks.  Unprepare the clock in suspend() if
    it was active and re-prepare it in resume() to ensure the clock is
    properly disabled during system suspend, while maintaining the "always
    prepared" semantics while the system is active.  The driver doesn't
    implement .attach() callback, hence it only checks for RPROC_RUNNING.
    
    Fixes: d935187cfb27 ("remoteproc: mediatek: Break lock dependency to prepare_lock")
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
    Link: https://lore.kernel.org/r/20260206033034.3031781-1-tzungbi@kernel.org
    Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

remoteproc: sysmon: Correct subsys_name_len type in QMI request [+ + +]
Author: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Date:   Fri Feb 20 15:11:48 2026 -0600

    remoteproc: sysmon: Correct subsys_name_len type in QMI request
    
    [ Upstream commit da994db94e60f9a9411108ddf4d1836147ad4c9c ]
    
    The QMI message encoder has up until recently read a single byte (as
    elem_size == 1), but with the introduction of big endian support it's
    become apparent that this field is expected to be a full u32 -
    regardless of the size of the length in the encoded message (which is
    what elem_size specifies).
    
    The result is that the encoder now reads past the length byte and
    rejects the unreasonably large length formed when including the
    following 3 bytes from the subsys_name array.
    
    Fix this by changing to the expected type.
    
    Fixes: 1fb82ee806d1 ("remoteproc: qcom: Introduce sysmon")
    Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
    Reviewed-by: Chris Lew <christopher.lew@oss.qualcomm.com>
    Link: https://lore.kernel.org/r/20260220-qmi-encode-invalid-length-v2-1-5674be35ab29@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" [+ + +]
Author: Sasha Levin <sashal@kernel.org>
Date:   Sun Mar 15 03:17:07 2026 -0400

    Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
    
    This reverts commit 018e8512fed90cb3f67851dcd3e4fb0891544871.
    
    The backport applied regulator-boot-on to vreg_l12a_1p8 (ldo12) instead
    of vreg_l14a_1p88 (ldo14) due to identical surrounding context lines.
    
    Reported-by: Marco Mattiolo <marco.mattiolo@hotmail.it>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Revert "mptcp: add needs_id for netlink appending addr" [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Sun Apr 12 18:52:06 2026 -0400

    Revert "mptcp: add needs_id for netlink appending addr"
    
    [ Upstream commit 8e2760eaab778494fc1fa257031e0e1799647f46 ]
    
    This commit was originally adding the ability to add MPTCP endpoints
    with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
    net namespace level, is not supposed to handle endpoints with such ID,
    because this ID 0 is reserved to the initial subflow, as mentioned in
    the MPTCPv1 protocol [1], a per-connection setting.
    
    Note that 'ip mptcp endpoint add id 0' stops early with an error, but
    other tools might still request the in-kernel PM to create MPTCP
    endpoints with this restricted ID 0.
    
    In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
    helper to check whether the address ID attribute is set: if it was set
    to 0, a new MPTCP endpoint would be created with ID 0, which is not
    expected, and might cause various issues later.
    
    Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
    Cc: stable@vger.kernel.org
    Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
    Reviewed-by: Geliang Tang <geliang@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ adapted changes from pm_kernel.c to pm_netlink.c ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" [+ + +]
Author: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Date:   Tue Mar 31 14:44:55 2026 +0530

    Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
    
    This reverts commit b20b659c2c6a072560b360feda81ae52176034df which is
    commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream.
    
    The original commit attempted to enable ACS in pci_dma_configure() prior
    to IOMMU group assignment in iommu_init_device() to fix the ACS enablement
    issue for OF platforms. But that assumption doesn't hold true for kernel
    versions prior to v6.15, because on these older kernels,
    pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU
    groups are already created before the ACS gets enabled. This causes the
    devices that should have been split into separate groups by ACS, getting
    merged into one group, thereby breaking the IOMMU isolation as reported on
    the AMD machines.
    
    So revert the offending commit to restore the IOMMU group assignment on
    those affected machines. It should be noted that ACS has never really
    worked on kernel versions prior to v6.15, so the revert doesn't make any
    difference for OF platforms.
    
    Reported-by: John Hancock <john@kernel.doghat.io>
    Reported-by: bjorn.forsman@gmail.com
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234
    Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms")
    Cc: Linux kernel regressions list <regressions@lists.linux.dev>
    Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info
    Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
riscv: kgdb: fix several debug register assignment bugs [+ + +]
Author: Paul Walmsley <pjw@kernel.org>
Date:   Mon Mar 23 17:43:47 2026 -0600

    riscv: kgdb: fix several debug register assignment bugs
    
    [ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
    
    Fix several bugs in the RISC-V kgdb implementation:
    
    - The element of dbg_reg_def[] that is supposed to pertain to the S1
      register embeds instead the struct pt_regs offset of the A1
      register.  Fix this to use the S1 register offset in struct pt_regs.
    
    - The sleeping_thread_to_gdb_regs() function copies the value of the
      S10 register into the gdb_regs[] array element meant for the S9
      register, and copies the value of the S11 register into the array
      element meant for the S10 register.  It also neglects to copy the
      value of the S11 register.  Fix all of these issues.
    
    Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
    Cc: Vincent Chen <vincent.chen@sifive.com>
    Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
    Signed-off-by: Paul Walmsley <pjw@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size [+ + +]
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Fri Mar 20 00:02:53 2026 +0100

    rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
    
    [ Upstream commit ee00a12593ffb69db4dd1a1c00ecb0253376874a ]
    
    rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but
    rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and
    IFLA_INFO_SLAVE_KIND.
    
    Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave info")
    Reviewed-by: Jiri Pirko <jiri@nvidia.com>
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Link: https://patch.msgid.link/049843b532e23cde7ddba263c0bbe35ba6f0d26d.1773919462.git.sd@queasysnail.net
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) [+ + +]
Author: David Howells <dhowells@redhat.com>
Date:   Wed Apr 8 13:12:43 2026 +0100

    rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    
    commit 2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f upstream.
    
    An AF_RXRPC socket can be both client and server at the same time.  When
    sending new calls (ie. it's acting as a client), it uses rx->key to set the
    security, and when accepting incoming calls (ie. it's acting as a server),
    it uses rx->securities.
    
    setsockopt(RXRPC_SECURITY_KEY) sets rx->key to point to an rxrpc-type key
    and setsockopt(RXRPC_SECURITY_KEYRING) sets rx->securities to point to a
    keyring of rxrpc_s-type keys.
    
    Now, it should be possible to use both rx->key and rx->securities on the
    same socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt()
    prevents that.
    
    Fix this by:
    
     (1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING)
         makes on rx->key.
    
     (2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on
         rx->key down into rxrpc_request_key().
    
     (3) Remove rxrpc_request_key()'s check on rx->securities.
    
    This (in combination with a previous patch) pushes the checks down into the
    functions that set those pointers and removes the cross-checks that prevent
    both key and keyring being set.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: Anderson Nascimento <anderson@allelesecurity.com>
    cc: Luxiao Xu <rakukuip@gmail.com>
    cc: Yuan Tan <yuantan098@gmail.com>
    cc: Simon Horman <horms@kernel.org>
    cc: linux-afs@lists.infradead.org
    cc: stable@kernel.org
    Link: https://patch.msgid.link/20260408121252.2249051-16-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rxrpc: fix reference count leak in rxrpc_server_keyring() [+ + +]
Author: Luxiao Xu <rakukuip@gmail.com>
Date:   Wed Apr 8 13:12:42 2026 +0100

    rxrpc: fix reference count leak in rxrpc_server_keyring()
    
    commit f125846ee79fcae537a964ce66494e96fa54a6de upstream.
    
    This patch fixes a reference count leak in rxrpc_server_keyring()
    by checking if rx->securities is already set.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Co-developed-by: Yuan Tan <yuantan098@gmail.com>
    Signed-off-by: Yuan Tan <yuantan098@gmail.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Tested-by: Ren Wei <enjou1224z@gmail.com>
    Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
    Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: Simon Horman <horms@kernel.org>
    cc: linux-afs@lists.infradead.org
    cc: stable@kernel.org
    Link: https://patch.msgid.link/20260408121252.2249051-15-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
s390/barrier: Make array_index_mask_nospec() __always_inline [+ + +]
Author: Vasily Gorbik <gor@linux.ibm.com>
Date:   Thu Mar 26 14:38:44 2026 +0100

    s390/barrier: Make array_index_mask_nospec() __always_inline
    
    commit c5c0a268b38adffbb2e70e6957017537ff54c157 upstream.
    
    Mark array_index_mask_nospec() as __always_inline to guarantee the
    mitigation is emitted inline regardless of compiler inlining decisions.
    
    Fixes: e2dd833389cc ("s390: add optimized array_index_mask_nospec")
    Cc: stable@kernel.org
    Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
    Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
s390/syscalls: Add spectre boundary for syscall dispatch table [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Mar 24 17:34:05 2026 +0100

    s390/syscalls: Add spectre boundary for syscall dispatch table
    
    commit 48b8814e25d073dd84daf990a879a820bad2bcbd upstream.
    
    The s390 syscall number is directly controlled by userspace, but does
    not have an array_index_nospec() boundary to prevent access past the
    syscall function pointer tables.
    
    Cc: Heiko Carstens <hca@linux.ibm.com>
    Cc: Vasily Gorbik <gor@linux.ibm.com>
    Cc: Alexander Gordeev <agordeev@linux.ibm.com>
    Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
    Cc: Sven Schnelle <svens@linux.ibm.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Fixes: 56e62a737028 ("s390: convert to generic entry")
    Cc: stable@kernel.org
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
    Link: https://lore.kernel.org/r/2026032404-sterling-swoosh-43e6@gregkh
    Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sched: idle: Consolidate the handling of two special cases [+ + +]
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Fri Mar 13 13:25:41 2026 +0100

    sched: idle: Consolidate the handling of two special cases
    
    [ Upstream commit f4c31b07b136839e0fb3026f8a5b6543e3b14d2f ]
    
    There are two special cases in the idle loop that are handled
    inconsistently even though they are analogous.
    
    The first one is when a cpuidle driver is absent and the default CPU
    idle time power management implemented by the architecture code is used.
    In that case, the scheduler tick is stopped every time before invoking
    default_idle_call().
    
    The second one is when a cpuidle driver is present, but there is only
    one idle state in its table.  In that case, the scheduler tick is never
    stopped at all.
    
    Since each of these approaches has its drawbacks, reconcile them with
    the help of one simple heuristic.  Namely, stop the tick if the CPU has
    been woken up by it in the previous iteration of the idle loop, or let
    it tick otherwise.
    
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Reviewed-by: Christian Loehle <christian.loehle@arm.com>
    Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
    Reviewed-by: Qais Yousef <qyousef@layalina.io>
    Reviewed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
    Fixes: ed98c3491998 ("sched: idle: Do not stop the tick before cpuidle_idle_call()")
    [ rjw: Added Fixes tag, changelog edits ]
    Link: https://patch.msgid.link/4741364.LvFx2qVVIh@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

sched: idle: Make skipping governor callbacks more consistent [+ + +]
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Sat Mar 7 17:12:05 2026 +0100

    sched: idle: Make skipping governor callbacks more consistent
    
    [ Upstream commit d557640e4ce589a24dca5ca7ce3b9680f471325f ]
    
    If the cpuidle governor .select() callback is skipped because there
    is only one idle state in the cpuidle driver, the .reflect() callback
    should be skipped as well, at least for consistency (if not for
    correctness), so do it.
    
    Fixes: e5c9ffc6ae1b ("cpuidle: Skip governor when only one idle state is available")
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Reviewed-by: Christian Loehle <christian.loehle@arm.com>
    Reviewed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
    Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
    Link: https://patch.msgid.link/12857700.O9o76ZdvQC@rafael.j.wysocki
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
scsi: ata: Call scsi_done() directly [+ + +]
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Thu Oct 7 13:27:58 2021 -0700

    scsi: ata: Call scsi_done() directly
    
    [ Upstream commit 58bf201dfc032eadbb31eaf817b467bed17f753d ]
    
    Conditional statements are faster than indirect calls. Hence call
    scsi_done() directly.
    
    Link: https://lore.kernel.org/r/20211007202923.2174984-4-bvanassche@acm.org
    Acked-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Stable-dep-of: bb3a8154b1a1 ("ata: libata-scsi: refactor ata_scsi_translate()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: core: Fix refcount leak for tagset_refcnt [+ + +]
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Mon Feb 23 15:27:28 2026 -0800

    scsi: core: Fix refcount leak for tagset_refcnt
    
    commit 1ac22c8eae81366101597d48360718dff9b9d980 upstream.
    
    This leak will cause a hang when tearing down the SCSI host. For example,
    iscsid hangs with the following call trace:
    
    [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
    
    PID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: "iscsid"
     #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4
     #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f
     #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0
     #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f
     #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b
     #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]
     #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]
     #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]
     #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6
     #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef
    
    Fixes: 8fe4ce5836e9 ("scsi: core: Fix a use-after-free")
    Cc: stable@vger.kernel.org
    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Reviewed-by: Mike Christie <michael.christie@oracle.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://patch.msgid.link/20260223232728.93350-1-junxiao.bi@oracle.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() [+ + +]
Author: Tyllis Xu <livelycarpet87@gmail.com>
Date:   Sat Mar 14 12:01:50 2026 -0500

    scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
    
    commit 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f upstream.
    
    A malicious or compromised VIO server can return a num_written value in the
    discover targets MAD response that exceeds max_targets. This value is
    stored directly in vhost->num_targets without validation, and is then used
    as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which
    is only allocated for max_targets entries. Indices at or beyond max_targets
    access kernel memory outside the DMA-coherent allocation.  The
    out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI
    MADs that are sent back to the VIO server, leaking kernel memory.
    
    Fix by clamping num_written to max_targets before storing it.
    
    Fixes: 072b91f9c651 ("[SCSI] ibmvfc: IBM Power Virtual Fibre Channel Adapter Client Driver")
    Reported-by: Yuhao Jiang <danisjiang@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
    Reviewed-by: Dave Marquardt <davemarq@linux.ibm.com>
    Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com>
    Link: https://patch.msgid.link/20260314170151.548614-1-LivelyCarpet87@gmail.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

scsi: lpfc: Properly set WC for DPP mapping [+ + +]
Author: Mathias Krause <minipli@grsecurity.net>
Date:   Thu Feb 12 11:23:27 2026 -0800

    scsi: lpfc: Properly set WC for DPP mapping
    
    [ Upstream commit bffda93a51b40afd67c11bf558dc5aae83ca0943 ]
    
    Using set_memory_wc() to enable write-combining for the DPP portion of
    the MMIO mapping is wrong as set_memory_*() is meant to operate on RAM
    only, not MMIO mappings. In fact, as used currently triggers a BUG_ON()
    with enabled CONFIG_DEBUG_VIRTUAL.
    
    Simply map the DPP region separately and in addition to the already
    existing mappings, avoiding any possible negative side effects for
    these.
    
    Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4")
    Signed-off-by: Mathias Krause <minipli@grsecurity.net>
    Signed-off-by: Justin Tee <justin.tee@broadcom.com>
    Reviewed-by: Mathias Krause <minipli@grsecurity.net>
    Link: https://patch.msgid.link/20260212192327.141104-1-justintee8345@gmail.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: mpi3mr: Add NULL checks when resetting request and reply queues [+ + +]
Author: Ranjan Kumar <ranjan.kumar@broadcom.com>
Date:   Thu Feb 12 12:30:26 2026 +0530

    scsi: mpi3mr: Add NULL checks when resetting request and reply queues
    
    [ Upstream commit fa96392ebebc8fade2b878acb14cce0f71016503 ]
    
    The driver encountered a crash during resource cleanup when the reply and
    request queues were NULL due to freed memory.  This issue occurred when the
    creation of reply or request queues failed, and the driver freed the memory
    first, but attempted to mem set the content of the freed memory, leading to
    a system crash.
    
    Add NULL pointer checks for reply and request queues before accessing the
    reply/request memory during cleanup
    
    Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
    Link: https://patch.msgid.link/20260212070026.30263-1-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: scsi_transport_sas: Fix the maximum channel scanning issue [+ + +]
Author: Yihang Li <liyihang9@huawei.com>
Date:   Tue Mar 17 14:31:47 2026 +0800

    scsi: scsi_transport_sas: Fix the maximum channel scanning issue
    
    [ Upstream commit d71afa9deb4d413232ba16d693f7d43b321931b4 ]
    
    After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard
    and multi-channel scans"), if the device supports multiple channels (0 to
    shost->max_channel), user_scan() invokes updated sas_user_scan() to perform
    the scan behavior for a specific transfer.  However, when the user
    specifies shost->max_channel, it will return -EINVAL, which is not
    expected.
    
    Fix and support specifying the scan shost->max_channel for scanning.
    
    Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans")
    Signed-off-by: Yihang Li <liyihang9@huawei.com>
    Reviewed-by: John Garry <john.g.garry@oracle.com>
    Link: https://patch.msgid.link/20260317063147.2182562-1-liyihang9@huawei.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: ses: Fix devices attaching to different hosts [+ + +]
Author: Tomas Henzl <thenzl@redhat.com>
Date:   Tue Feb 10 20:18:50 2026 +0100

    scsi: ses: Fix devices attaching to different hosts
    
    [ Upstream commit 70ca8caa96ce473647054f5c7b9dab5423902402 ]
    
    On a multipath SAS system some devices don't end up with correct symlinks
    from the SCSI device to its enclosure. Some devices even have enclosure
    links pointing to enclosures attached to different SCSI hosts.
    
    ses_match_to_enclosure() calls enclosure_for_each_device() which iterates
    over all enclosures on the system, not just enclosures attached to the
    current SCSI host.
    
    Replace the iteration with a direct call to ses_enclosure_find_by_addr().
    
    Reviewed-by: David Jeffery <djeffery@redhat.com>
    Signed-off-by: Tomas Henzl <thenzl@redhat.com>
    Link: https://patch.msgid.link/20260210191850.36784-1-thenzl@redhat.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: ses: Handle positive SCSI error from ses_recv_diag() [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 16:44:59 2026 +0100

    scsi: ses: Handle positive SCSI error from ses_recv_diag()
    
    commit 7a9f448d44127217fabc4065c5ba070d4e0b5d37 upstream.
    
    ses_recv_diag() can return a positive value, which also means that an
    error happened, so do not only test for negative values.
    
    Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
    Cc: Martin K. Petersen <martin.petersen@oracle.com>
    Cc: stable <stable@kernel.org>
    Assisted-by: gkh_clanker_2000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Hannes Reinecke <hare@suse.de>
    Link: https://patch.msgid.link/2026022301-bony-overstock-a07f@gregkh
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT [+ + +]
Author: Jan Kiszka <jan.kiszka@siemens.com>
Date:   Thu Jan 29 15:30:39 2026 +0100

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
    
    [ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ]
    
    This resolves the follow splat and lock-up when running with PREEMPT_RT
    enabled on Hyper-V:
    
    [  415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002
    [  415.140822] INFO: lockdep is turned off.
    [  415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common
    [  415.140846] Preemption disabled at:
    [  415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
    [  415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)}
    [  415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024
    [  415.140857] Call Trace:
    [  415.140861]  <TASK>
    [  415.140861]  ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
    [  415.140863]  dump_stack_lvl+0x91/0xb0
    [  415.140870]  __schedule_bug+0x9c/0xc0
    [  415.140875]  __schedule+0xdf6/0x1300
    [  415.140877]  ? rtlock_slowlock_locked+0x56c/0x1980
    [  415.140879]  ? rcu_is_watching+0x12/0x60
    [  415.140883]  schedule_rtlock+0x21/0x40
    [  415.140885]  rtlock_slowlock_locked+0x502/0x1980
    [  415.140891]  rt_spin_lock+0x89/0x1e0
    [  415.140893]  hv_ringbuffer_write+0x87/0x2a0
    [  415.140899]  vmbus_sendpacket_mpb_desc+0xb6/0xe0
    [  415.140900]  ? rcu_is_watching+0x12/0x60
    [  415.140902]  storvsc_queuecommand+0x669/0xbe0 [hv_storvsc]
    [  415.140904]  ? HARDIRQ_verbose+0x10/0x10
    [  415.140908]  ? __rq_qos_issue+0x28/0x40
    [  415.140911]  scsi_queue_rq+0x760/0xd80 [scsi_mod]
    [  415.140926]  __blk_mq_issue_directly+0x4a/0xc0
    [  415.140928]  blk_mq_issue_direct+0x87/0x2b0
    [  415.140931]  blk_mq_dispatch_queue_requests+0x120/0x440
    [  415.140933]  blk_mq_flush_plug_list+0x7a/0x1a0
    [  415.140935]  __blk_flush_plug+0xf4/0x150
    [  415.140940]  __submit_bio+0x2b2/0x5c0
    [  415.140944]  ? submit_bio_noacct_nocheck+0x272/0x360
    [  415.140946]  submit_bio_noacct_nocheck+0x272/0x360
    [  415.140951]  ext4_read_bh_lock+0x3e/0x60 [ext4]
    [  415.140995]  ext4_block_write_begin+0x396/0x650 [ext4]
    [  415.141018]  ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4]
    [  415.141038]  ext4_da_write_begin+0x1c4/0x350 [ext4]
    [  415.141060]  generic_perform_write+0x14e/0x2c0
    [  415.141065]  ext4_buffered_write_iter+0x6b/0x120 [ext4]
    [  415.141083]  vfs_write+0x2ca/0x570
    [  415.141087]  ksys_write+0x76/0xf0
    [  415.141089]  do_syscall_64+0x99/0x1490
    [  415.141093]  ? rcu_is_watching+0x12/0x60
    [  415.141095]  ? finish_task_switch.isra.0+0xdf/0x3d0
    [  415.141097]  ? rcu_is_watching+0x12/0x60
    [  415.141098]  ? lock_release+0x1f0/0x2a0
    [  415.141100]  ? rcu_is_watching+0x12/0x60
    [  415.141101]  ? finish_task_switch.isra.0+0xe4/0x3d0
    [  415.141103]  ? rcu_is_watching+0x12/0x60
    [  415.141104]  ? __schedule+0xb34/0x1300
    [  415.141106]  ? hrtimer_try_to_cancel+0x1d/0x170
    [  415.141109]  ? do_nanosleep+0x8b/0x160
    [  415.141111]  ? hrtimer_nanosleep+0x89/0x100
    [  415.141114]  ? __pfx_hrtimer_wakeup+0x10/0x10
    [  415.141116]  ? xfd_validate_state+0x26/0x90
    [  415.141118]  ? rcu_is_watching+0x12/0x60
    [  415.141120]  ? do_syscall_64+0x1e0/0x1490
    [  415.141121]  ? do_syscall_64+0x1e0/0x1490
    [  415.141123]  ? rcu_is_watching+0x12/0x60
    [  415.141124]  ? do_syscall_64+0x1e0/0x1490
    [  415.141125]  ? do_syscall_64+0x1e0/0x1490
    [  415.141127]  ? irqentry_exit+0x140/0x7e0
    [  415.141129]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    get_cpu() disables preemption while the spinlock hv_ringbuffer_write is
    using is converted to an rt-mutex under PREEMPT_RT.
    
    Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
    Tested-by: Florian Bezdeka <florian.bezdeka@siemens.com>
    Reviewed-by: Michael Kelley <mhklinux@outlook.com>
    Tested-by: Michael Kelley <mhklinux@outlook.com>
    Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: target: tcm_loop: Drain commands in target_reset handler [+ + +]
Author: Josef Bacik <josef@toxicpanda.com>
Date:   Tue Mar 31 13:10:00 2026 -0400

    scsi: target: tcm_loop: Drain commands in target_reset handler
    
    [ Upstream commit 1333eee56cdf3f0cf67c6ab4114c2c9e0a952026 ]
    
    tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS
    without draining any in-flight commands.  The SCSI EH documentation
    (scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver
    has made lower layers "forget about timed out scmds" and is ready for new
    commands.  Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug,
    mpi3mr) enforces this by draining or completing outstanding commands before
    returning SUCCESS.
    
    Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight
    scsi_cmnd structures for recovery commands (e.g. TUR) while the target core
    still has async completion work queued for the old se_cmd.  The memset in
    queuecommand zeroes se_lun and lun_ref_active, causing
    transport_lun_remove_cmd() to skip its percpu_ref_put().  The leaked LUN
    reference prevents transport_clear_lun_ref() from completing, hanging
    configfs LUN unlink forever in D-state:
    
      INFO: task rm:264 blocked for more than 122 seconds.
      rm              D    0   264    258 0x00004000
      Call Trace:
       __schedule+0x3d0/0x8e0
       schedule+0x36/0xf0
       transport_clear_lun_ref+0x78/0x90 [target_core_mod]
       core_tpg_remove_lun+0x28/0xb0 [target_core_mod]
       target_fabric_port_unlink+0x50/0x60 [target_core_mod]
       configfs_unlink+0x156/0x1f0 [configfs]
       vfs_unlink+0x109/0x290
       do_unlinkat+0x1d5/0x2d0
    
    Fix this by making tcm_loop_target_reset() actually drain commands:
    
     1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that
        the target core knows about (those not yet CMD_T_COMPLETE).
    
     2. Use blk_mq_tagset_busy_iter() to iterate all started requests and
        flush_work() on each se_cmd — this drains any deferred completion work
        for commands that already had CMD_T_COMPLETE set before the TMR (which
        the TMR skips via __target_check_io_state()).  This is the same pattern
        used by mpi3mr, scsi_debug, and libsas to drain outstanding commands
        during reset.
    
    Fixes: e0eb5d38b732 ("scsi: target: tcm_loop: Use block cmd allocator for se_cmds")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Signed-off-by: Josef Bacik <josef@toxicpanda.com>
    Link: https://patch.msgid.link/27011aa34c8f6b1b94d2e3cf5655b6d037f53428.1773706803.git.josef@toxicpanda.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    [ added `bool reserved` parameter to `tcm_loop_flush_work_iter()` ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

scsi: ufs: core: Always initialize the UIC done completion [+ + +]
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Thu Sep 12 15:30:05 2024 -0700

    scsi: ufs: core: Always initialize the UIC done completion
    
    [ Upstream commit b1e8c53749adb795bfb0bf4e2f7836e26684bb90 ]
    
    Simplify __ufshcd_send_uic_cmd() by always initializing the
    uic_cmd::done completion. This is fine since the time required to
    initialize a completion is small compared to the time required to
    process an UIC command.
    
    Reviewed-by: Peter Wang <peter.wang@mediatek.com>
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://lore.kernel.org/r/20240912223019.3510966-5-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Stable-dep-of: 62c015373e1c ("scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume [+ + +]
Author: Peter Wang <peter.wang@mediatek.com>
Date:   Mon Feb 23 18:37:57 2026 +0800

    scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
    
    [ Upstream commit 62c015373e1cdb1cdca824bd2dbce2dac0819467 ]
    
    Move the link recovery trigger from ufshcd_uic_pwr_ctrl() to
    __ufshcd_wl_resume(). Ensure link recovery is only attempted when hibern8
    exit fails during resume, not during hibern8 enter in suspend. Improve
    error handling and prevent unnecessary link recovery attempts.
    
    Fixes: 35dabf4503b9 ("scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume")
    Signed-off-by: Peter Wang <peter.wang@mediatek.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://patch.msgid.link/20260223103906.2533654-1-peter.wang@mediatek.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
seg6: separate dst_cache for input and output paths in seg6 lwtunnel [+ + +]
Author: Andrea Mayer <andrea.mayer@uniroma2.it>
Date:   Sun Apr 12 18:00:05 2026 -0400

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel
    
    [ Upstream commit c3812651b522fe8437ebb7063b75ddb95b571643 ]
    
    The seg6 lwtunnel uses a single dst_cache per encap route, shared
    between seg6_input_core() and seg6_output_core(). These two paths
    can perform the post-encap SID lookup in different routing contexts
    (e.g., ip rules matching on the ingress interface, or VRF table
    separation). Whichever path runs first populates the cache, and the
    other reuses it blindly, bypassing its own lookup.
    
    Fix this by splitting the cache into cache_input and cache_output,
    so each path maintains its own cached dst independently.
    
    Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
    Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
    Link: https://patch.msgid.link/20260404004405.4057-2-andrea.mayer@uniroma2.it
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ added missing dst reference loop guard in seg6_output_core() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
selftests: mptcp: more stable simult_flows tests [+ + +]
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Tue Mar 3 11:56:02 2026 +0100

    selftests: mptcp: more stable simult_flows tests
    
    commit 8c09412e584d9bcc0e71d758ec1008d1c8d1a326 upstream.
    
    By default, the netem qdisc can keep up to 1000 packets under its belly
    to deal with the configured rate and delay. The simult flows test-case
    simulates very low speed links, to avoid problems due to slow CPUs and
    the TCP stack tend to transmit at a slightly higher rate than the
    (virtual) link constraints.
    
    All the above causes a relatively large amount of packets being enqueued
    in the netem qdiscs - the longer the transfer, the longer the queue -
    producing increasingly high TCP RTT samples and consequently increasingly
    larger receive buffer size due to DRS.
    
    When the receive buffer size becomes considerably larger than the needed
    size, the tests results can flake, i.e. because minimal inaccuracy in the
    pacing rate can lead to a single subflow usage towards the end of the
    connection for a considerable amount of data.
    
    Address the issue explicitly setting netem limits suitable for the
    configured link speeds and unflake all the affected tests.
    
    Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests")
    Cc: stable@vger.kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-1-4b5462b6f016@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY [+ + +]
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Date:   Tue Feb 3 19:10:48 2026 +0200

    serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
    
    commit e0a368ae79531ff92105a2692f10d83052055856 upstream.
    
    When DW UART is !uart_16550_compatible, it can indicate BUSY at any
    point (when under constant Rx pressure) unless a complex sequence of
    steps is performed. Any LCR write can run a foul with the condition
    that prevents writing LCR while the UART is BUSY, which triggers
    BUSY_DETECT interrupt that seems unmaskable using IER bits.
    
    Normal flow is that dw8250_handle_irq() handles BUSY_DETECT condition
    by reading USR register. This BUSY feature, however, breaks the
    assumptions made in serial8250_do_shutdown(), which runs
    synchronize_irq() after clearing IER and assumes no interrupts can
    occur after that point but then proceeds to update LCR, which on DW
    UART can trigger an interrupt.
    
    If serial8250_do_shutdown() releases the interrupt handler before the
    handler has run and processed the BUSY_DETECT condition by read the USR
    register, the IRQ is not deasserted resulting in interrupt storm that
    triggers "irq x: nobody cared" warning leading to disabling the IRQ.
    
    Add late synchronize_irq() into serial8250_do_shutdown() to ensure
    BUSY_DETECT from DW UART is handled before port's interrupt handler is
    released. Alternative would be to add DW UART specific shutdown
    function but it would mostly duplicate the generic code and the extra
    synchronize_irq() seems pretty harmless in serial8250_do_shutdown().
    
    Fixes: 7d4008ebb1c9 ("tty: add a DesignWare 8250 driver")
    Cc: stable <stable@kernel.org>
    Reported-by: Bandal, Shankar <shankar.bandal@intel.com>
    Tested-by: Bandal, Shankar <shankar.bandal@intel.com>
    Tested-by: Murthy, Shanth <shanth.murthy@intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Link: https://patch.msgid.link/20260203171049.4353-7-ilpo.jarvinen@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

serial: 8250: Fix TX deadlock when using DMA [+ + +]
Author: Raul E Rangel <rrangel@chromium.org>
Date:   Mon Feb 9 13:58:18 2026 -0700

    serial: 8250: Fix TX deadlock when using DMA
    
    commit a424a34b8faddf97b5af41689087e7a230f79ba7 upstream.
    
    `dmaengine_terminate_async` does not guarantee that the
    `__dma_tx_complete` callback will run. The callback is currently the
    only place where `dma->tx_running` gets cleared. If the transaction is
    canceled and the callback never runs, then `dma->tx_running` will never
    get cleared and we will never schedule new TX DMA transactions again.
    
    This change makes it so we clear `dma->tx_running` after we terminate
    the DMA transaction. This is "safe" because `serial8250_tx_dma_flush`
    is holding the UART port lock. The first thing the callback does is also
    grab the UART port lock, so access to `dma->tx_running` is serialized.
    
    Fixes: 9e512eaaf8f4 ("serial: 8250: Fix fifo underflow on flush")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Raul E Rangel <rrangel@google.com>
    Link: https://patch.msgid.link/20260209135815.1.I16366ecb0f62f3c96fe3dd5763fcf6f3c2b4d8cd@changeid
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

serial: 8250_pci: add support for the AX99100 [+ + +]
Author: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Date:   Mon Mar 9 15:53:10 2026 +0200

    serial: 8250_pci: add support for the AX99100
    
    commit 9c0072bc33d349c83d223e64be30794e11938a6b upstream.
    
    This is found in popular brands such as StarTech.com or Delock, and has
    been a source of frustration to quite a few people, if I can trust
    Amazon comments complaining about Linux support via the official
    out-of-the-tree driver.
    
    Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260309-8250_pci_ax99100-v1-1-3328bdfd8e94@mupuf.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

serial: caif: hold tty->link reference in ldisc_open and ser_release [+ + +]
Author: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Date:   Thu Mar 5 22:40:06 2026 -0500

    serial: caif: hold tty->link reference in ldisc_open and ser_release
    
    [ Upstream commit 288598d80a068a0e9281de35bcb4ce495f189e2a ]
    
    A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
    when caif_serial's TX path calls tty_write_room(). The faulting access
    is on tty->link->port.
    
    Hold an extra kref on tty->link for the lifetime of the caif_serial line
    discipline: get it in ldisc_open() and drop it in ser_release(), and
    also drop it on the ldisc_open() error path.
    
    With this change applied, the reproducer no longer triggers the UAF in
    my testing.
    
    Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f
    Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com
    Fixes: e31d5a05948e ("caif: tty's are kref objects so take a reference")
    Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
    Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Link: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

serial: uartlite: fix PM runtime usage count underflow on probe [+ + +]
Author: Maciej Andrzejewski ICEYE <maciej.andrzejewski@m-works.net>
Date:   Thu Mar 5 13:37:51 2026 +0100

    serial: uartlite: fix PM runtime usage count underflow on probe
    
    commit d54801cd509515f674a5aac1d3ea1401d2a05863 upstream.
    
    ulite_probe() calls pm_runtime_put_autosuspend() at the end of probe
    without holding a corresponding PM runtime reference for non-console
    ports.
    
    During ulite_assign(), uart_add_one_port() triggers uart_configure_port()
    which calls ulite_pm() via uart_change_pm(). For non-console ports, the
    UART core performs a balanced get/put cycle:
    
      uart_change_pm(ON)  -> ulite_pm() -> pm_runtime_get_sync()        +1
      uart_change_pm(OFF) -> ulite_pm() -> pm_runtime_put_autosuspend() -1
    
    This leaves no spare reference for the pm_runtime_put_autosuspend() at
    the end of probe. The PM runtime core prevents the count from actually
    going below zero, and instead triggers a
    "Runtime PM usage count underflow!" warning.
    
    For console ports the bug is masked: the UART core skips the
    uart_change_pm(OFF) call, so the UART core's unbalanced get happens to
    pair with probe's trailing put.
    
    Add pm_runtime_get_noresume() before pm_runtime_enable() to take an
    explicit probe-owned reference that the trailing
    pm_runtime_put_autosuspend() can release. This ensures a correct usage
    count regardless of whether the port is a console.
    
    Fixes: 5bbe10a6942d ("tty: serial: uartlite: Add runtime pm support")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Maciej Andrzejewski ICEYE <maciej.andrzejewski@m-works.net>
    Link: https://patch.msgid.link/20260305123746.4152800-1-maciej.andrzejewski@m-works.net
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sh: platform_early: remove pdev->driver_override check [+ + +]
Author: Danilo Krummrich <dakr@kernel.org>
Date:   Tue Mar 17 00:37:15 2026 +0100

    sh: platform_early: remove pdev->driver_override check
    
    [ Upstream commit c5f60e3f07b6609562d21efda878e83ce8860728 ]
    
    In commit 507fd01d5333 ("drivers: move the early platform device support to
    arch/sh") platform_match() was copied over to the sh platform_early
    code, accidentally including the driver_override check.
    
    This check does not make sense for platform_early, as sysfs is not even
    available in first place at this point in the boot process, hence remove
    the check.
    
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Fixes: 507fd01d5333 ("drivers: move the early platform device support to arch/sh")
    Link: https://lore.kernel.org/all/DH4M3DJ4P58T.1BGVAVXN71Z09@kernel.org/
    Signed-off-by: Danilo Krummrich <dakr@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
smb: client: Don't log plaintext credentials in cifs_set_cifscreds [+ + +]
Author: Thorsten Blum <thorsten.blum@linux.dev>
Date:   Mon Mar 9 10:00:09 2026 -0400

    smb: client: Don't log plaintext credentials in cifs_set_cifscreds
    
    [ Upstream commit 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d ]
    
    When debug logging is enabled, cifs_set_cifscreds() logs the key
    payload and exposes the plaintext username and password. Remove the
    debug log to avoid exposing credentials.
    
    Fixes: 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts")
    Cc: stable@vger.kernel.org
    Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
    Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

smb: client: Fix refcount leak for cifs_sb_tlink [+ + +]
Author: Shuhao Fu <sfual@cse.ust.hk>
Date:   Tue Mar 31 15:00:54 2026 +0800

    smb: client: Fix refcount leak for cifs_sb_tlink
    
    [ Upstream commit c2b77f42205ef485a647f62082c442c1cd69d3fc ]
    
    Fix three refcount inconsistency issues related to `cifs_sb_tlink`.
    
    Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be
    called after successful calls to `cifs_sb_tlink()`. Three calls fail to
    update refcount accordingly, leading to possible resource leaks.
    
    Fixes: 8ceb98437946 ("CIFS: Move rename to ops struct")
    Fixes: 2f1afe25997f ("cifs: Use smb 2 - 3 and cifsacl mount options getacl functions")
    Fixes: 366ed846df60 ("cifs: Use smb 2 - 3 and cifsacl mount options setacl function")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Johnny Hao <johnny_haocn@sina.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
soc: fsl: qbman: fix race condition in qman_destroy_fq [+ + +]
Author: Richard Genoud <richard.genoud@bootlin.com>
Date:   Tue Dec 23 08:25:49 2025 +0100

    soc: fsl: qbman: fix race condition in qman_destroy_fq
    
    [ Upstream commit 014077044e874e270ec480515edbc1cadb976cf2 ]
    
    When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between
    fq_table[fq->idx] state and freeing/allocating from the pool and
    WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered.
    
    Indeed, we can have:
             Thread A                             Thread B
        qman_destroy_fq()                    qman_create_fq()
          qman_release_fqid()
            qman_shutdown_fq()
            gen_pool_free()
               -- At this point, the fqid is available again --
                                               qman_alloc_fqid()
               -- so, we can get the just-freed fqid in thread B --
                                               fq->fqid = fqid;
                                               fq->idx = fqid * 2;
                                               WARN_ON(fq_table[fq->idx]);
                                               fq_table[fq->idx] = fq;
         fq_table[fq->idx] = NULL;
    
    And adding some logs between qman_release_fqid() and
    fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more.
    
    To prevent that, ensure that fq_table[fq->idx] is set to NULL before
    gen_pool_free() is called by using smp_wmb().
    
    Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver")
    Signed-off-by: Richard Genoud <richard.genoud@bootlin.com>
    Tested-by: CHAMPSEIX Thomas <thomas.champseix@alstomgroup.com>
    Link: https://lore.kernel.org/r/20251223072549.397625-1-richard.genoud@bootlin.com
    Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
spi: spi-fsl-lpspi: fix teardown order issue (UAF) [+ + +]
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Thu Mar 19 19:38:12 2026 +0100

    spi: spi-fsl-lpspi: fix teardown order issue (UAF)
    
    [ Upstream commit b341c1176f2e001b3adf0b47154fc31589f7410e ]
    
    There is a teardown order issue in the driver. The SPI controller is
    registered using devm_spi_register_controller(), which delays
    unregistration of the SPI controller until after the fsl_lpspi_remove()
    function returns.
    
    As the fsl_lpspi_remove() function synchronously tears down the DMA
    channels, a running SPI transfer triggers the following NULL pointer
    dereference due to use after free:
    
    | fsl_lpspi 42550000.spi: I/O Error in DMA RX
    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
    [...]
    | Call trace:
    |  fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]
    |  fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]
    |  spi_transfer_one_message+0x49c/0x7c8
    |  __spi_pump_transfer_message+0x120/0x420
    |  __spi_sync+0x2c4/0x520
    |  spi_sync+0x34/0x60
    |  spidev_message+0x20c/0x378 [spidev]
    |  spidev_ioctl+0x398/0x750 [spidev]
    [...]
    
    Switch from devm_spi_register_controller() to spi_register_controller() in
    fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in
    fsl_lpspi_remove().
    
    Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-fixes-v1-1-b433e435b2d8@pengutronix.de
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Squashfs: check metadata block offset is within range [+ + +]
Author: Phillip Lougher <phillip@squashfs.org.uk>
Date:   Tue Feb 17 05:09:55 2026 +0000

    Squashfs: check metadata block offset is within range
    
    commit fdb24a820a5832ec4532273282cbd4f22c291a0d upstream.
    
    Syzkaller reports a "general protection fault in squashfs_copy_data"
    
    This is ultimately caused by a corrupted index look-up table, which
    produces a negative metadata block offset.
    
    This is subsequently passed to squashfs_copy_data (via
    squashfs_read_metadata) where the negative offset causes an out of bounds
    access.
    
    The fix is to check that the offset is within range in
    squashfs_read_metadata.  This will trap this and other cases.
    
    Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
    Fixes: f400e12656ab ("Squashfs: cache operations")
    Reported-by: syzbot+a9747fe1c35a5b115d3f@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/699234e2.a70a0220.2c38d7.00e2.GAE@google.com/
    Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
    Cc: Christian Brauner <brauner@kernel.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser [+ + +]
Author: Navaneeth K <knavaneeth786@gmail.com>
Date:   Mon Mar 30 11:12:31 2026 +0800

    staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
    
    [ Upstream commit 154828bf9559b9c8421fc2f0d7f7f76b3683aaed ]
    
    The Information Element (IE) parser rtw_get_ie() trusted the length
    byte of each IE without validating that the IE body (len bytes after
    the 2-byte header) fits inside the remaining frame buffer. A malformed
    frame can advertise an IE length larger than the available data, causing
    the parser to increment its pointer beyond the buffer end. This results
    in out-of-bounds reads or, depending on the pattern, an infinite loop.
    
    Fix by validating that (offset + 2 + len) does not exceed the limit
    before accepting the IE or advancing to the next element.
    
    This prevents OOB reads and ensures the parser terminates safely on
    malformed frames.
    
    [ The context change is due to the commit 4610e57a7d2e
    ("staging: rtl8723bs: Remove redundant else branches.") in v5.19
    which is irrelevant to the logic of this patch. ]
    
    Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johnny Hao <johnny_haocn@sina.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie [+ + +]
Author: Luka Gejak <luka.gejak@linux.dev>
Date:   Tue Feb 24 14:26:47 2026 +0100

    staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
    
    commit a75281626fc8fa6dc6c9cc314ee423e8bc45203b upstream.
    
    The current code checks 'i + 5 < in_len' at the end of the if statement.
    However, it accesses 'in_ie[i + 5]' before that check, which can lead
    to an out-of-bounds read. Move the length check to the beginning of the
    conditional to ensure the index is within bounds before accessing the
    array.
    
    Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
    Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
    Link: https://patch.msgid.link/20260224132647.11642-2-luka.gejak@linux.dev
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 14:31:35 2026 +0100

    staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
    
    commit f0109b9d3e1e455429279d602f6276e34689750a upstream.
    
    Just like in commit 154828bf9559 ("staging: rtl8723bs: fix out-of-bounds
    read in rtw_get_ie() parser"), we don't trust the data in the frame so
    we should check the length better before acting on it
    
    Cc: stable <stable@kernel.org>
    Assisted-by: gkh_clanker_2000
    Tested-by: Navaneeth K <knavaneeth786@gmail.com>
    Reviewed-by: Navaneeth K <knavaneeth786@gmail.com>
    Link: https://patch.msgid.link/2026022336-arrange-footwork-6e54@gregkh
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sunrpc: fix cache_request leak in cache_release [+ + +]
Author: Jeff Layton <jlayton@kernel.org>
Date:   Mon Feb 23 12:09:58 2026 -0500

    sunrpc: fix cache_request leak in cache_release
    
    commit 17ad31b3a43b72aec3a3d83605891e1397d0d065 upstream.
    
    When a reader's file descriptor is closed while in the middle of reading
    a cache_request (rp->offset != 0), cache_release() decrements the
    request's readers count but never checks whether it should free the
    request.
    
    In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the
    cache_request is removed from the queue and freed along with its buffer
    and cache_head reference. cache_release() lacks this cleanup.
    
    The only other path that frees requests with readers == 0 is
    cache_dequeue(), but it runs only when CACHE_PENDING transitions from
    set to clear. If that transition already happened while readers was
    still non-zero, cache_dequeue() will have skipped the request, and no
    subsequent call will clean it up.
    
    Add the same cleanup logic from cache_read() to cache_release(): after
    decrementing readers, check if it reached 0 with CACHE_PENDING clear,
    and if so, dequeue and free the cache_request.
    
    Reported-by: NeilBrown <neilb@ownmail.net>
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable@kernel.org
    Signed-off-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sysctl: fix uninitialized variable in proc_do_large_bitmap [+ + +]
Author: Marc Buerg <buermarc@googlemail.com>
Date:   Wed Mar 25 23:29:50 2026 +0100

    sysctl: fix uninitialized variable in proc_do_large_bitmap
    
    [ Upstream commit f63a9df7e3f9f842945d292a19d9938924f066f9 ]
    
    proc_do_large_bitmap() does not initialize variable c, which is expected
    to be set to a trailing character by proc_get_long().
    
    However, proc_get_long() only sets c when the input buffer contains a
    trailing character after the parsed value.
    
    If c is not initialized it may happen to contain a '-'. If this is the
    case proc_do_large_bitmap() expects to be able to parse a second part of
    the input buffer. If there is no second part an unjustified -EINVAL will
    be returned.
    
    Initialize c to 0 to prevent returning -EINVAL on valid input.
    
    Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap")
    Signed-off-by: Marc Buerg <buermarc@googlemail.com>
    Reviewed-by: Joel Granados <joel.granados@kernel.org>
    Signed-off-by: Joel Granados <joel.granados@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
tg3: Fix race for querying speed/duplex [+ + +]
Author: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Date:   Wed Mar 25 12:20:53 2026 +0100

    tg3: Fix race for querying speed/duplex
    
    [ Upstream commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed ]
    
    When driver signals carrier up via netif_carrier_on() its internal
    link_up state isn't updated immediately. This leads to inconsistent
    speed/duplex in /proc/net/bonding/bondX where the speed and duplex
    is shown as unknown while ethtool shows correct values. Fix this by
    using netif_carrier_ok() for link checking in get_ksettings function.
    
    Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices")
    Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
    Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
thunderbolt: Fix property read in nhi_wake_supported() [+ + +]
Author: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Date:   Mon Mar 9 10:39:49 2026 +0100

    thunderbolt: Fix property read in nhi_wake_supported()
    
    commit 73a505dc48144ec72e25874e2b2a72487b02d3bc upstream.
    
    device_property_read_foo() returns 0 on success and only then modifies
    'val'. Currently, val is left uninitialized if the aforementioned
    function returns non-zero, making nhi_wake_supported() return true
    almost always (random != 0) if the property is not present in device
    firmware.
    
    Invert the check to make it make sense.
    
    Fixes: 3cdb9446a117 ("thunderbolt: Add support for Intel Ice Lake")
    Cc: stable@vger.kernel.org
    Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
time/jiffies: Mark jiffies_64_to_clock_t() notrace [+ + +]
Author: Steven Rostedt <rostedt@goodmis.org>
Date:   Fri Mar 6 21:24:03 2026 -0500

    time/jiffies: Mark jiffies_64_to_clock_t() notrace
    
    [ Upstream commit 755a648e78f12574482d4698d877375793867fa1 ]
    
    The trace_clock_jiffies() function that handles the "uptime" clock for
    tracing calls jiffies_64_to_clock_t(). This causes the function tracer to
    constantly recurse when the tracing clock is set to "uptime". Mark it
    notrace to prevent unnecessary recursion when using the "uptime" clock.
    
    Fixes: 58d4e21e50ff3 ("tracing: Fix wraparound problems in "uptime" trace clock")
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Thomas Gleixner <tglx@kernel.org>
    Link: https://patch.msgid.link/20260306212403.72270bb2@robin
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
time: add kernel-doc in time.c [+ + +]
Author: Randy Dunlap <rdunlap@infradead.org>
Date:   Mon Jul 3 22:24:05 2023 -0700

    time: add kernel-doc in time.c
    
    [ Upstream commit 67b3f564cb1e769ef8e45835129a4866152fcfdb ]
    
    Add kernel-doc for all APIs that do not already have it.
    
    Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
    Cc: John Stultz <jstultz@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Stephen Boyd <sboyd@kernel.org>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: linux-doc@vger.kernel.org
    Acked-by: John Stultz <jstultz@google.com>
    Signed-off-by: Jonathan Corbet <corbet@lwn.net>
    Link: https://lore.kernel.org/r/20230704052405.5089-3-rdunlap@infradead.org
    Stable-dep-of: 755a648e78f1 ("time/jiffies: Mark jiffies_64_to_clock_t() notrace")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG [+ + +]
Author: Oleh Konko <security@1seal.org>
Date:   Thu Apr 2 09:48:57 2026 +0000

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    
    commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream.
    
    The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
    bc_ackers on every inbound group ACK, even when the same member has
    already acknowledged the current broadcast round.
    
    Because bc_ackers is a u16, a duplicate ACK received after the last
    legitimate ACK wraps the counter to 65535. Once wrapped,
    tipc_group_bc_cong() keeps reporting congestion and later group
    broadcasts on the affected socket stay blocked until the group is
    recreated.
    
    Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
    bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
    prevents the underflow path.
    
    Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleh Konko <security@1seal.org>
    Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tipc: fix divide-by-zero in tipc_sk_filter_connect() [+ + +]
Author: Mehul Rao <mehulrao@gmail.com>
Date:   Tue Mar 10 13:07:30 2026 -0400

    tipc: fix divide-by-zero in tipc_sk_filter_connect()
    
    commit 6c5a9baa15de240e747263aba435a0951da8d8d2 upstream.
    
    A user can set conn_timeout to any value via
    setsockopt(TIPC_CONN_TIMEOUT), including values less than 4.  When a
    SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in
    tipc_sk_filter_connect() executes:
    
        delay %= (tsk->conn_timeout / 4);
    
    If conn_timeout is in the range [0, 3], the integer division yields 0,
    and the modulo operation triggers a divide-by-zero exception, causing a
    kernel oops/panic.
    
    Fix this by clamping conn_timeout to a minimum of 4 at the point of use
    in tipc_sk_filter_connect().
    
    Oops: divide error: 0000 [#1] SMP KASAN NOPTI
    CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+
    RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)
    Call Trace:
     tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)
     __release_sock (include/net/sock.h:1185 net/core/sock.c:3213)
     release_sock (net/core/sock.c:3797)
     tipc_connect (net/tipc/socket.c:2570)
     __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
    
    Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mehul Rao <mehulrao@gmail.com>
    Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
    Link: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure [+ + +]
Author: Josh Law <objecting@objecting.org>
Date:   Thu Mar 19 08:43:06 2026 +0900

    tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
    
    [ Upstream commit 3b2c2ab4ceb82af484310c3087541eab00ea288b ]
    
    If fstat() fails after open() succeeds, the function returns without
    closing the file descriptor. Also preserve errno across close(), since
    close() may overwrite it before the error is returned.
    
    Link: https://lore.kernel.org/all/20260318155847.78065-3-objecting@objecting.org/
    
    Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command")
    Signed-off-by: Josh Law <objecting@objecting.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
tracing: Fix potential deadlock in cpu hotplug with osnoise [+ + +]
Author: Luo Haiyang <luo.haiyang@zte.com.cn>
Date:   Mon Mar 30 17:07:37 2026 -0400

    tracing: Fix potential deadlock in cpu hotplug with osnoise
    
    [ Upstream commit 1f9885732248d22f788e4992c739a98c88ab8a55 ]
    
    The following sequence may leads deadlock in cpu hotplug:
    
        task1        task2        task3
        -----        -----        -----
    
     mutex_lock(&interface_lock)
    
                [CPU GOING OFFLINE]
    
                cpus_write_lock();
                osnoise_cpu_die();
                  kthread_stop(task3);
                    wait_for_completion();
    
                          osnoise_sleep();
                            mutex_lock(&interface_lock);
    
     cpus_read_lock();
    
     [DEAD LOCK]
    
    Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock).
    
    Cc: stable@vger.kernel.org
    Cc: <mathieu.desnoyers@efficios.com>
    Cc: <zhang.run@zte.com.cn>
    Cc: <yang.tao172@zte.com.cn>
    Cc: <ran.xiaokai@zte.com.cn>
    Fixes: bce29ac9ce0bb ("trace: Add osnoise tracer")
    Link: https://patch.msgid.link/20260326141953414bVSj33dAYktqp9Oiyizq8@zte.com.cn
    Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Luo Haiyang <luo.haiyang@zte.com.cn>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    [ adapted guard() macros to lock/unlock calls ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G [+ + +]
Author: Calvin Owens <calvin@wbinvd.org>
Date:   Fri Mar 6 19:19:25 2026 -0800

    tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
    
    commit d008ba8be8984760e36d7dcd4adbd5a41a645708 upstream.
    
    Some of the sizing logic through tracer_alloc_buffers() uses int
    internally, causing unexpected behavior if the user passes a value that
    does not fit in an int (on my x86 machine, the result is uselessly tiny
    buffers).
    
    Fix by plumbing the parameter's real type (unsigned long) through to the
    ring buffer allocation functions, which already use unsigned long.
    
    It has always been possible to create larger ring buffers via the sysfs
    interface: this only affects the cmdline parameter.
    
    Cc: stable@vger.kernel.org
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Link: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.1772852067.git.calvin@wbinvd.org
    Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")
    Signed-off-by: Calvin Owens <calvin@wbinvd.org>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Mon Mar 16 18:02:41 2026 -0700

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
    
    [ Upstream commit b3a6df291fecf5f8a308953b65ca72b7fc9e015d ]
    
    When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0
    (success) without actually creating a socket. Callers such as
    fou_create() then proceed to dereference the uninitialized socket
    pointer, resulting in a NULL pointer dereference.
    
    The captured NULL deref crash:
      BUG: kernel NULL pointer dereference, address: 0000000000000018
      RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)
      [...]
      Call Trace:
        <TASK>
        genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)
        genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
        [...]
        netlink_rcv_skb (net/netlink/af_netlink.c:2550)
        genl_rcv (net/netlink/genetlink.c:1219)
        netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
        netlink_sendmsg (net/netlink/af_netlink.c:1894)
        __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))
        __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))
        __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))
        do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
        entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)
    
    This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so
    callers correctly take their error paths. There is only one caller of
    the vulnerable function and only privileged users can trigger it.
    
    Fixes: fd384412e199b ("udp_tunnel: Seperate ipv6 functions into its own file.")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Link: https://patch.msgid.link/20260317010241.1893893-1-xmei5@asu.edu
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
unshare: fix unshare_fs() handling [+ + +]
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sat Feb 7 08:25:24 2026 +0000

    unshare: fix unshare_fs() handling
    
    [ Upstream commit 6c4b2243cb6c0755159bd567130d5e12e7b10d9f ]
    
    There's an unpleasant corner case in unshare(2), when we have a
    CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that
    case copy_mnt_ns() gets passed current->fs instead of a private copy,
    which causes interesting warts in proof of correctness]
    
    > I guess if private means fs->users == 1, the condition could still be true.
    
    Unfortunately, it's worse than just a convoluted proof of correctness.
    Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS
    (and current->fs->users == 1).
    
    We pass current->fs to copy_mnt_ns(), all right.  Suppose it succeeds and
    flips current->fs->{pwd,root} to corresponding locations in the new namespace.
    Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).
    We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's
    destroyed and its mount tree is dissolved, but...  current->fs->root and
    current->fs->pwd are both left pointing to now detached mounts.
    
    They are pinning those, so it's not a UAF, but it leaves the calling
    process with unshare(2) failing with -ENOMEM _and_ leaving it with
    pwd and root on detached isolated mounts.  The last part is clearly a bug.
    
    There is other fun related to that mess (races with pivot_root(), including
    the one between pivot_root() and fork(), of all things), but this one
    is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new
    fs_struct even if it hadn't been shared in the first place".  Sure, we could
    go for something like "if both CLONE_NEWNS *and* one of the things that might
    end up failing after copy_mnt_ns() call in create_new_namespaces() are set,
    force allocation of new fs_struct", but let's keep it simple - the cost
    of copy_fs_struct() is trivial.
    
    Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets
    a freshly allocated fs_struct, yet to be attached to anything.  That
    seriously simplifies the analysis...
    
    FWIW, that bug had been there since the introduction of unshare(2) ;-/
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Link: https://patch.msgid.link/20260207082524.GE3183987@ZenIV
    Tested-by: Waiman Long <longman@redhat.com>
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk [+ + +]
Author: Christoffer Sandberg <cs@tuxedo.de>
Date:   Fri Mar 6 18:28:14 2026 +0100

    usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
    
    commit 0326ff28d56b4fa202de36ffc8462a354f383a64 upstream.
    
    Similar to other Huawei LTE modules using this quirk, this version with
    another vid/pid suffers from spurious wakeups.
    
    Setting the quirk fixes the issue for this device as well.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
    Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
    Link: https://patch.msgid.link/20260306172817.2098898-1-wse@tuxedocomputers.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: cdc-acm: Restore CAP_BRK functionnality to CH343 [+ + +]
Author: Marc Zyngier <maz@kernel.org>
Date:   Sun Mar 1 12:44:40 2026 +0000

    usb: cdc-acm: Restore CAP_BRK functionnality to CH343
    
    commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream.
    
    The CH343 USB/serial adapter is as buggy as it is popular (very).
    One of its quirks is that despite being capable of signalling a
    BREAK condition, it doesn't advertise it.
    
    This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm:
    return correct error code on unsupported break") applied some
    reasonable restrictions, preventing breaks from being emitted on
    devices that do not advertise CAP_BRK.
    
    Add a quirk for this particular device, so that breaks can still
    be produced on some of my machines attached to my console server.
    
    Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break")
    Signed-off-by: Marc Zyngier <maz@kernel.org>
    Cc: stable <stable@kernel.org>
    Cc: Oliver Neukum <oneukum@suse.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Acked-by: Oliver Neukum <oneukum@suse.com>
    Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() [+ + +]
Author: Théo Lebrun <theo.lebrun@bootlin.com>
Date:   Wed Feb 5 18:36:49 2025 +0100

    usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
    
    [ Upstream commit 17c6526b333cfd89a4c888a6f7c876c8c326e5ae ]
    
    cdns_power_is_lost() does a register read.
    Call it only once rather than twice.
    
    Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
    Link: https://lore.kernel.org/r/20250205-s2r-cdns-v7-4-13658a271c3c@bootlin.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Stable-dep-of: 87e4b043b98a ("usb: cdns3: fix role switching during resume")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

usb: cdns3: fix role switching during resume [+ + +]
Author: Thomas Richard (TI) <thomas.richard@bootlin.com>
Date:   Fri Jan 30 11:05:45 2026 +0100

    usb: cdns3: fix role switching during resume
    
    [ Upstream commit 87e4b043b98a1d269be0b812f383881abee0ca45 ]
    
    If the role change while we are suspended, the cdns3 driver switches to the
    new mode during resume. However, switching to host mode in this context
    causes a NULL pointer dereference.
    
    The host role's start() operation registers a xhci-hcd device, but its
    probe is deferred while we are in the resume path. The host role's resume()
    operation assumes the xhci-hcd device is already probed, which is not the
    case, leading to the dereference. Since the start() operation of the new
    role is already called, the resume operation can be skipped.
    
    So skip the resume operation for the new role if a role switch occurs
    during resume. Once the resume sequence is complete, the xhci-hcd device
    can be probed in case of host mode.
    
    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
    Mem abort info:
    ...
    Data abort info:
    ...
    [0000000000000208] pgd=0000000000000000, p4d=0000000000000000
    Internal error: Oops: 0000000096000004 [#1]  SMP
    Modules linked in:
    CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted
    6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT
    Hardware name: Texas Instruments J7200 EVM (DT)
    pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : usb_hcd_is_primary_hcd+0x0/0x1c
    lr : cdns_host_resume+0x24/0x5c
    ...
    Call trace:
     usb_hcd_is_primary_hcd+0x0/0x1c (P)
     cdns_resume+0x6c/0xbc
     cdns3_controller_resume.isra.0+0xe8/0x17c
     cdns3_plat_resume+0x18/0x24
     platform_pm_resume+0x2c/0x68
     dpm_run_callback+0x90/0x248
     device_resume+0x100/0x24c
     dpm_resume+0x190/0x2ec
     dpm_resume_end+0x18/0x34
     suspend_devices_and_enter+0x2b0/0xa44
     pm_suspend+0x16c/0x5fc
     state_store+0x80/0xec
     kobj_attr_store+0x18/0x2c
     sysfs_kf_write+0x7c/0x94
     kernfs_fop_write_iter+0x130/0x1dc
     vfs_write+0x240/0x370
     ksys_write+0x70/0x108
     __arm64_sys_write+0x1c/0x28
     invoke_syscall+0x48/0x10c
     el0_svc_common.constprop.0+0x40/0xe0
     do_el0_svc+0x1c/0x28
     el0_svc+0x34/0x108
     el0t_64_sync_handler+0xa0/0xe4
     el0t_64_sync+0x198/0x19c
    Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)
    ---[ end trace 0000000000000000 ]---
    
    Cc: stable <stable@kernel.org>
    Fixes: 2cf2581cd229 ("usb: cdns3: add power lost support for system resume")
    Signed-off-by: Thomas Richard (TI) <thomas.richard@bootlin.com>
    Acked-by: Peter Chen <peter.chen@kernel.org>
    Link: https://patch.msgid.link/20260130-usb-cdns3-fix-role-switching-during-resume-v1-1-44c456852b52@bootlin.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue [+ + +]
Author: Yongchao Wu <yongchao.wu@autochips.com>
Date:   Tue Mar 31 08:04:07 2026 +0800

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
    
    commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream.
    
    When the gadget endpoint is disabled or not yet configured, the ep->desc
    pointer can be NULL. This leads to a NULL pointer dereference when
    __cdns3_gadget_ep_queue() is called, causing a kernel crash.
    
    Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
    standard return code for unconfigured endpoints.
    
    This prevents potential crashes when ep_queue is called on endpoints
    that are not ready.
    
    Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
    Acked-by: Peter Chen <peter.chen@kernel.org>
    Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: cdns3: gadget: fix state inconsistency on gadget init failure [+ + +]
Author: Yongchao Wu <yongchao.wu@autochips.com>
Date:   Wed Apr 1 08:10:00 2026 +0800

    usb: cdns3: gadget: fix state inconsistency on gadget init failure
    
    commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream.
    
    When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode
    while software state remains INACTIVE, creating hardware/software state
    inconsistency.
    
    When switching to host mode via sysfs:
      echo host > /sys/class/usb_role/13180000.usb-role-switch/role
    
    The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,
    so cdns_role_stop() skips cleanup because state is still INACTIVE.
    This violates the DRD controller design specification (Figure22),
    which requires returning to idle state before switching roles.
    
    This leads to a synchronous external abort in xhci_gen_setup() when
    setting up the host controller:
    
    [  516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
    [  516.442035] cdns-usb3 13180000.usb: Failed to add gadget
    [  516.443278] cdns-usb3 13180000.usb: set role 2 has failed
    ...
    [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
    [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
    [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
    [ 1301.393391] backtrace:
        ...
        xhci_gen_setup+0xa4/0x408    <-- CRASH
        xhci_plat_setup+0x44/0x58
        usb_add_hcd+0x284/0x678
        ...
        cdns_role_set+0x9c/0xbc        <-- Role switch
    
    Fix by calling cdns_drd_gadget_off() in the error path to properly
    clean up the DRD gadget state.
    
    Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
    Acked-by: Peter Chen <peter.chen@kernel.org>
    Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: cdns3: remove redundant if branch [+ + +]
Author: Hongyu Xie <xiehongyu1@kylinos.cn>
Date:   Tue Dec 31 09:36:41 2024 +0800

    usb: cdns3: remove redundant if branch
    
    [ Upstream commit dedab674428f8a99468a4864c067128ba9ea83a6 ]
    
    cdns->role_sw->dev->driver_data gets set in routines showing below,
    cdns_init
      sw_desc.driver_data = cdns;
      cdns->role_sw = usb_role_switch_register(dev, &sw_desc);
        dev_set_drvdata(&sw->dev, desc->driver_data);
    
    In cdns_resume,
    cdns->role = cdns_role_get(cdns->role_sw); //line redundant
      struct cdns *cdns = usb_role_switch_get_drvdata(sw);
        dev_get_drvdata(&sw->dev)
          return dev->driver_data
    return cdns->role;
    
    "line redundant" equals to,
            cdns->role = cdns->role;
    
    So fix this if branch.
    
    Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
    Acked-by: Peter Chen <peter.chen@kernel.org>
    Link: https://lore.kernel.org/r/20241231013641.23908-1-xiehongyu1@kylinos.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Stable-dep-of: 87e4b043b98a ("usb: cdns3: fix role switching during resume")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

usb: class: cdc-wdm: fix reordering issue in read code path [+ + +]
Author: Oliver Neukum <oneukum@suse.com>
Date:   Wed Mar 4 14:01:12 2026 +0100

    usb: class: cdc-wdm: fix reordering issue in read code path
    
    commit 8df672bfe3ec2268c2636584202755898e547173 upstream.
    
    Quoting the bug report:
    
    Due to compiler optimization or CPU out-of-order execution, the
    desc->length update can be reordered before the memmove. If this
    happens, wdm_read() can see the new length and call copy_to_user() on
    uninitialized memory. This also violates LKMM data race rules [1].
    
    Fix it by using WRITE_ONCE and memory barriers.
    
    Fixes: afba937e540c9 ("USB: CDC WDM driver")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Closes: https://lore.kernel.org/linux-usb/CALbr=LbrUZn_cfp7CfR-7Z5wDTHF96qeuM=3fO2m-q4cDrnC4A@mail.gmail.com/
    Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
    Reviewed-by: Gui-Dong Han <hanguidong02@gmail.com>
    Link: https://patch.msgid.link/20260304130116.1721682-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam [+ + +]
Author: JP Hein <jp@jphein.com>
Date:   Mon Mar 30 17:38:04 2026 -0700

    USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
    
    commit 8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c upstream.
    
    The Razer Kiyo Pro (1532:0e05) is a USB 3.0 UVC webcam whose firmware
    does not handle USB Link Power Management transitions reliably. When LPM
    is active, the device can enter a state where it fails to respond to
    control transfers, producing EPIPE (-32) errors on UVC probe control
    SET_CUR requests. In the worst case, the stalled endpoint triggers an
    xHCI stop-endpoint command that times out, causing the host controller
    to be declared dead and every USB device on the bus to be disconnected.
    
    This has been reported as Ubuntu Launchpad Bug #2061177. The failure
    mode is:
    
      1. UVC probe control SET_CUR returns -32 (EPIPE)
      2. xHCI host not responding to stop endpoint command
      3. xHCI host controller not responding, assume dead
      4. All USB devices on the affected xHCI controller disconnect
    
    Disabling LPM prevents the firmware from entering the problematic low-
    power states that precede the stall. This is the same approach used for
    other webcams with similar firmware issues (e.g., Logitech HD Webcam C270).
    
    Cc: stable <stable@kernel.org>
    Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2061177
    Signed-off-by: JP Hein <jp@jphein.com>
    Link: https://patch.msgid.link/20260331003806.212565-2-jp@jphein.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: core: don't power off roothub PHYs if phy_set_mode() fails [+ + +]
Author: Gabor Juhos <j4g8y7@gmail.com>
Date:   Wed Feb 18 21:21:07 2026 +0100

    usb: core: don't power off roothub PHYs if phy_set_mode() fails
    
    commit e293015ba76eb96ce4ebed7e3b2cb1a7d319f3e9 upstream.
    
    Remove the error path from the usb_phy_roothub_set_mode() function.
    The code is clearly wrong, because phy_set_mode() calls can't be
    balanced with phy_power_off() calls.
    
    Additionally, the usb_phy_roothub_set_mode() function is called only
    from usb_add_hcd() before it powers on the PHYs, so powering off those
    makes no sense anyway.
    
    Presumably, the code is copy-pasted from the phy_power_on() function
    without adjusting the error handling.
    
    Cc: stable@vger.kernel.org # v5.1+
    Fixes: b97a31348379 ("usb: core: comply to PHY framework")
    Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
    Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://patch.msgid.link/20260218-usb-phy-poweroff-fix-v1-1-66e6831e860e@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: core: Limit the length of unkillable synchronous timeouts [+ + +]
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Feb 17 22:10:32 2026 -0500

    USB: core: Limit the length of unkillable synchronous timeouts
    
    commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream.
    
    The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in
    usbcore allow unlimited timeout durations.  And since they use
    uninterruptible waits, this leaves open the possibility of hanging a
    task for an indefinitely long time, with no way to kill it short of
    unplugging the target device.
    
    To prevent this sort of problem, enforce a maximum limit on the length
    of these unkillable timeouts.  The limit chosen here, somewhat
    arbitrarily, is 60 seconds.  On many systems (although not all) this
    is short enough to avoid triggering the kernel's hung-task detector.
    
    In addition, clear up the ambiguity of negative timeout values by
    treating them the same as 0, i.e., using the maximum allowed timeout.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    CC: stable@vger.kernel.org
    Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: dummy-hcd: Fix interrupt synchronization error [+ + +]
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Sun Mar 15 14:31:00 2026 -0400

    USB: dummy-hcd: Fix interrupt synchronization error
    
    commit 2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541 upstream.
    
    This fixes an error in synchronization in the dummy-hcd driver.  The
    error has a somewhat involved history.  The synchronization mechanism
    was introduced by commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous
    synchronization change"), which added an emulated "interrupts enabled"
    flag together with code emulating synchronize_irq() (it waits until
    all current handler callbacks have returned).
    
    But the emulated interrupt-disable occurred too late, after the driver
    containing the handler callback routines had been told that it was
    unbound and no more callbacks would occur.  Commit 4a5d797a9f9c ("usb:
    gadget: dummy_hcd: fix gpf in gadget_setup") tried to fix this by
    moving the synchronize_irq() emulation code from dummy_stop() to
    dummy_pullup(), which runs before the unbind callback.
    
    There still were races, though, because the emulated interrupt-disable
    still occurred too late.  It couldn't be moved to dummy_pullup(),
    because that routine can be called for reasons other than an impending
    unbind.  Therefore commits 7dc0c55e9f30 ("USB: UDC core: Add
    udc_async_callbacks gadget op") and 04145a03db9d ("USB: UDC: Implement
    udc_async_callbacks in dummy-hcd") added an API allowing the UDC core
    to tell dummy-hcd exactly when emulated interrupts and their callbacks
    should be disabled.
    
    That brings us to the current state of things, which is still wrong
    because the emulated synchronize_irq() occurs before the emulated
    interrupt-disable!  That's no good, beause it means that more emulated
    interrupts can occur after the synchronize_irq() emulation has run,
    leading to the possibility that a callback handler may be running when
    the gadget driver is unbound.
    
    To fix this, we have to move the synchronize_irq() emulation code yet
    again, to the dummy_udc_async_callbacks() routine, which takes care of
    enabling and disabling emulated interrupt requests.  The
    synchronization will now run immediately after emulated interrupts are
    disabled, which is where it belongs.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Fixes: 04145a03db9d ("USB: UDC: Implement udc_async_callbacks in dummy-hcd")
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/c7bc93fe-4241-4d04-bd56-27c12ba35c97@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: dummy-hcd: Fix locking/synchronization error [+ + +]
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Sun Mar 15 14:30:43 2026 -0400

    USB: dummy-hcd: Fix locking/synchronization error
    
    commit 616a63ff495df12863692ab3f9f7b84e3fa7a66d upstream.
    
    Syzbot testing was able to provoke an addressing exception and crash
    in the usb_gadget_udc_reset() routine in
    drivers/usb/gadgets/udc/core.c, resulting from the fact that the
    routine was called with a second ("driver") argument of NULL.  The bad
    caller was set_link_state() in dummy_hcd.c, and the problem arose
    because of a race between a USB reset and driver unbind.
    
    These sorts of races were not supposed to be possible; commit
    7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"),
    along with a few followup commits, was written specifically to prevent
    them.  As it turns out, there are (at least) two errors remaining in
    the code.  Another patch will address the second error; this one is
    concerned with the first.
    
    The error responsible for the syzbot crash occurred because the
    stop_activity() routine will sometimes drop and then re-acquire the
    dum->lock spinlock.  A call to stop_activity() occurs in
    set_link_state() when handling an emulated USB reset, after the test
    of dum->ints_enabled and before the increment of dum->callback_usage.
    This allowed another thread (doing a driver unbind) to sneak in and
    grab the spinlock, and then clear dum->ints_enabled and dum->driver.
    Normally this other thread would have to wait for dum->callback_usage
    to go down to 0 before it would clear dum->driver, but in this case it
    didn't have to wait since dum->callback_usage had not yet been
    incremented.
    
    The fix is to increment dum->callback_usage _before_ calling
    stop_activity() instead of after.  Then the thread doing the unbind
    will not clear dum->driver until after the call to
    usb_gadget_udc_reset() safely returns and dum->callback_usage has been
    decremented again.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-usb/68fc7c9c.050a0220.346f24.023c.GAE@google.com/
    Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
    Fixes: 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change")
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/46135f42-fdbe-46b5-aac0-6ca70492af15@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() [+ + +]
Author: Juno Choi <juno.choi@lge.com>
Date:   Tue Mar 24 10:49:10 2026 +0900

    usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
    
    commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream.
    
    dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,
    which expects hsotg->lock to be held since it does spin_unlock/spin_lock
    around the gadget driver callback invocation.
    
    However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()
    without holding the lock. This leads to:
     - spin_unlock on a lock that is not held (undefined behavior)
     - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,
       causing a deadlock when spin_lock_irqsave() is called later in the
       same function.
    
    Fix this by acquiring hsotg->lock before calling
    dwc2_gadget_exit_clock_gating() and releasing it afterwards, which
    satisfies the locking requirement of the call_gadget() macro.
    
    Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Juno Choi <juno.choi@lge.com>
    Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: ehci-brcm: fix sleep during atomic [+ + +]
Author: Justin Chen <justin.chen@broadcom.com>
Date:   Wed Mar 18 11:57:07 2026 -0700

    usb: ehci-brcm: fix sleep during atomic
    
    commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
    
    echi_brcm_wait_for_sof() gets called after disabling interrupts
    in ehci_brcm_hub_control(). Use the atomic version of poll_timeout
    to fix the warning.
    
    Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Justin Chen <justin.chen@broadcom.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer [+ + +]
Author: Sebastian Urban <surban@surban.net>
Date:   Sun Mar 15 16:10:45 2026 +0100

    usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
    
    commit f50200dd44125e445a6164e88c217472fa79cdbc upstream.
    
    When a gadget request is only partially transferred in transfer()
    because the per-frame bandwidth budget is exhausted, the loop advances
    to the next queued request. If that next request is a zero-length
    packet (ZLP), len evaluates to zero and the code takes the
    unlikely(len == 0) path, which sets is_short = 1. This bypasses the
    bandwidth guard ("limit < ep->ep.maxpacket && limit < len") that
    lives in the else branch and would otherwise break out of the loop for
    non-zero requests. The is_short path then completes the URB before all
    data from the first request has been transferred.
    
    Reproducer (bulk IN, high speed):
    
      Device side (FunctionFS with Linux AIO):
        1. Queue a 65024-byte write via io_submit (127 * 512, i.e. a
           multiple of the HS bulk max packet size).
        2. Immediately queue a zero-length write (ZLP) via io_submit.
    
      Host side:
        3. Submit a 65536-byte bulk IN URB.
    
      Expected: URB completes with actual_length = 65024.
      Actual:   URB completes with actual_length = 53248, losing 11776
                bytes that leak into subsequent URBs.
    
    At high speed the per-frame budget is 53248 bytes (512 * 13 * 8).
    The 65024-byte request exhausts this budget after 53248 bytes, leaving
    the request incomplete (req->req.actual < req->req.length). Neither
    the request nor the URB is finished, and rescan is 0, so the loop
    advances to the ZLP. For the ZLP, dev_len = 0, so len = min(12288, 0)
    = 0, taking the unlikely(len == 0) path and setting is_short = 1.
    The is_short handler then sets *status = 0, completing the URB with
    only 53248 of the expected 65024 bytes.
    
    Fix this by breaking out of the loop when the current request has
    remaining data (req->req.actual < req->req.length). The request
    resumes on the next timer tick, preserving correct data ordering.
    
    Signed-off-by: Sebastian Urban <surban@surban.net>
    Cc: stable <stable@kernel.org>
    Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
    Link: https://patch.msgid.link/20260315151045.1155850-1-surban@surban.net
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: f_hid: move list and spinlock inits from bind to alloc [+ + +]
Author: Michael Zimmermann <sigmaepsilon92@gmail.com>
Date:   Sun Apr 12 08:00:00 2026 -0400

    usb: gadget: f_hid: move list and spinlock inits from bind to alloc
    
    [ Upstream commit 4e0a88254ad59f6c53a34bf5fa241884ec09e8b2 ]
    
    There was an issue when you did the following:
    - setup and bind an hid gadget
    - open /dev/hidg0
    - use the resulting fd in EPOLL_CTL_ADD
    - unbind the UDC
    - bind the UDC
    - use the fd in EPOLL_CTL_DEL
    
    When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported
    within remove_wait_queue (via ep_remove_wait_queue). After some
    debugging I found out that the queues, which f_hid registers via
    poll_wait were the problem. These were initialized using
    init_waitqueue_head inside hidg_bind. So effectively, the bind function
    re-initialized the queues while there were still items in them.
    
    The solution is to move the initialization from hidg_bind to hidg_alloc
    to extend their lifetimes to the lifetime of the function instance.
    
    Additionally, I found many other possibly problematic init calls in the
    bind function, which I moved as well.
    
    Signed-off-by: Michael Zimmermann <sigmaepsilon92@gmail.com>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260331184844.2388761-1-sigmaepsilon92@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: f_rndis: Protect RNDIS options with mutex [+ + +]
Author: Kuen-Han Tsai <khtsai@google.com>
Date:   Fri Mar 20 16:54:45 2026 +0800

    usb: gadget: f_rndis: Protect RNDIS options with mutex
    
    commit 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e upstream.
    
    The class/subclass/protocol options are suspectible to race conditions
    as they can be accessed concurrently through configfs.
    
    Use existing mutex to protect these options. This issue was identified
    during code inspection.
    
    Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol")
    Cc: stable@vger.kernel.org
    Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
    Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-2-4886b578161b@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free [+ + +]
Author: Kuen-Han Tsai <khtsai@google.com>
Date:   Fri Mar 20 16:54:44 2026 +0800

    usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
    
    commit caa27923aacd8a5869207842f2ab1657c6c0c7bc upstream.
    
    geth_alloc() increments the reference count, but geth_free() fails to
    decrement it. This prevents the configuration of attributes via configfs
    after unlinking the function.
    
    Decrement the reference count in geth_free() to ensure proper cleanup.
    
    Fixes: 02832e56f88a ("usb: gadget: f_subset: add configfs support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
    Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: f_uac1_legacy: validate control request size [+ + +]
Author: Taegu Ha <hataegu0826@gmail.com>
Date:   Thu Apr 2 04:13:11 2026 +0900

    usb: gadget: f_uac1_legacy: validate control request size
    
    commit 6e0e34d85cd46ceb37d16054e97a373a32770f6c upstream.
    
    f_audio_complete() copies req->length bytes into a 4-byte stack
    variable:
    
      u32 data = 0;
      memcpy(&data, req->buf, req->length);
    
    req->length is derived from the host-controlled USB request path,
    which can lead to a stack out-of-bounds write.
    
    Validate req->actual against the expected payload size for the
    supported control selectors and decode only the expected amount
    of data.
    
    This avoids copying a host-influenced length into a fixed-size
    stack object.
    
    Signed-off-by: Taegu Ha <hataegu0826@gmail.com>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260401191311.3604898-1-hataegu0826@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop [+ + +]
Author: Kuen-Han Tsai <khtsai@google.com>
Date:   Sat Apr 11 12:31:06 2026 -0400

    usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
    
    [ Upstream commit e1eabb072c75681f78312c484ccfffb7430f206e ]
    
    A race condition between gether_disconnect() and eth_stop() leads to a
    NULL pointer dereference. Specifically, if eth_stop() is triggered
    concurrently while gether_disconnect() is tearing down the endpoints,
    eth_stop() attempts to access the cleared endpoint descriptor, causing
    the following NPE:
    
      Unable to handle kernel NULL pointer dereference
      Call trace:
       __dwc3_gadget_ep_enable+0x60/0x788
       dwc3_gadget_ep_enable+0x70/0xe4
       usb_ep_enable+0x60/0x15c
       eth_stop+0xb8/0x108
    
    Because eth_stop() crashes while holding the dev->lock, the thread
    running gether_disconnect() fails to acquire the same lock and spins
    forever, resulting in a hardlockup:
    
      Core - Debugging Information for Hardlockup core(7)
      Call trace:
       queued_spin_lock_slowpath+0x94/0x488
       _raw_spin_lock+0x64/0x6c
       gether_disconnect+0x19c/0x1e8
       ncm_set_alt+0x68/0x1a0
       composite_setup+0x6a0/0xc50
    
    The root cause is that the clearing of dev->port_usb in
    gether_disconnect() is delayed until the end of the function.
    
    Move the clearing of dev->port_usb to the very beginning of
    gether_disconnect() while holding dev->lock. This cuts off the link
    immediately, ensuring eth_stop() will see dev->port_usb as NULL and
    safely bail out.
    
    Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
    Link: https://patch.msgid.link/20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: gadget: uvc: fix NULL pointer dereference during unbind race [+ + +]
Author: Jimmy Hu <hhhuuu@google.com>
Date:   Sat Apr 11 10:09:48 2026 -0400

    usb: gadget: uvc: fix NULL pointer dereference during unbind race
    
    [ Upstream commit eba2936bbe6b752a31725a9eb5c674ecbf21ee7d ]
    
    Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly
    shutdown") introduced two stages of synchronization waits totaling 1500ms
    in uvc_function_unbind() to prevent several types of kernel panics.
    However, this timing-based approach is insufficient during power
    management (PM) transitions.
    
    When the PM subsystem starts freezing user space processes, the
    wait_event_interruptible_timeout() is aborted early, which allows the
    unbind thread to proceed and nullify the gadget pointer
    (cdev->gadget = NULL):
    
    [  814.123447][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()
    [  814.178583][ T3173] PM: suspend entry (deep)
    [  814.192487][ T3173] Freezing user space processes
    [  814.197668][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release
    
    When the PM subsystem resumes or aborts the suspend and tasks are
    restarted, the V4L2 release path is executed and attempts to access the
    already nullified gadget pointer, triggering a kernel panic:
    
    [  814.292597][    C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake
    [  814.386727][ T3173] Restarting tasks ...
    [  814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
    [  814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4
    [  814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94
    [  814.404078][ T4558] Call trace:
    [  814.404080][ T4558]  usb_gadget_deactivate+0x14/0xf4
    [  814.404083][ T4558]  usb_function_deactivate+0x54/0x94
    [  814.404087][ T4558]  uvc_function_disconnect+0x1c/0x5c
    [  814.404092][ T4558]  uvc_v4l2_release+0x44/0xac
    [  814.404095][ T4558]  v4l2_release+0xcc/0x130
    
    Address the race condition and NULL pointer dereference by:
    
    1. State Synchronization (flag + mutex)
    Introduce a 'func_unbound' flag in struct uvc_device. This allows
    uvc_function_disconnect() to safely skip accessing the nullified
    cdev->gadget pointer. As suggested by Alan Stern, this flag is protected
    by a new mutex (uvc->lock) to ensure proper memory ordering and prevent
    instruction reordering or speculative loads. This mutex is also used to
    protect 'func_connected' for consistent state management.
    
    2. Explicit Synchronization (completion)
    Use a completion to synchronize uvc_function_unbind() with the
    uvc_vdev_release() callback. This prevents Use-After-Free (UAF) by
    ensuring struct uvc_device is freed after all video device resources
    are released.
    
    Fixes: b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly shutdown")
    Cc: stable <stable@kernel.org>
    Suggested-by: Alan Stern <stern@rowland.harvard.edu>
    Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Jimmy Hu <hhhuuu@google.com>
    Link: https://patch.msgid.link/20260320065427.1374555-1-hhhuuu@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [ replaced guard()/scoped_guard() macros ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: image: mdc800: kill download URB on timeout [+ + +]
Author: Ziyi Guo <n7l8m4@u.northwestern.edu>
Date:   Mon Feb 9 15:19:37 2026 +0000

    usb: image: mdc800: kill download URB on timeout
    
    commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
    
    mdc800_device_read() submits download_urb and waits for completion.
    If the timeout fires and the device has not responded, the function
    returns without killing the URB, leaving it active.
    
    A subsequent read() resubmits the same URB while it is still
    in-flight, triggering the WARN in usb_submit_urb():
    
      "URB submitted while active"
    
    Check the return value of wait_event_timeout() and kill the URB if
    it indicates timeout, ensuring the URB is complete before its status
    is inspected or the URB is resubmitted.
    
    Similar to
    - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
    - commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
    
    Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: mdc800: handle signal and read racing [+ + +]
Author: Oliver Neukum <oneukum@suse.com>
Date:   Mon Feb 9 15:20:48 2026 +0100

    usb: mdc800: handle signal and read racing
    
    commit 2d6d260e9a3576256fe9ef6d1f7930c9ec348723 upstream.
    
    If a signal arrives after a read has partially completed,
    we need to return the number of bytes read. -EINTR is correct
    only if that number is zero.
    
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260209142048.1503791-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: misc: uss720: properly clean up reference in uss720_probe() [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 23 13:19:43 2026 +0100

    usb: misc: uss720: properly clean up reference in uss720_probe()
    
    commit 45dba8011efac11a2f360383221b541f5ea53ce5 upstream.
    
    If get_1284_register() fails, the usb device reference count is
    incorrect and needs to be properly dropped before returning.  That will
    happen when the kref is dropped in the call to destroy_priv(), so jump
    to that error path instead of returning directly.
    
    Cc: stable <stable@kernel.org>
    Assisted-by: gkh_clanker_2000
    Link: https://patch.msgid.link/2026022342-smokiness-stove-d792@gregkh
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive [+ + +]
Author: Miao Li <limiao@kylinos.cn>
Date:   Thu Mar 19 13:39:27 2026 +0800

    usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
    
    commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
    
    Another Silicon Motion flash drive also randomly work incorrectly
    (lsusb does not list the device) on Huawei hisi platforms during
    500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
    
    Signed-off-by: Miao Li <limiao@kylinos.cn>
    Cc: stable <stable@kernel.org>
    Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: renesas_usbhs: fix use-after-free in ISR during device removal [+ + +]
Author: Fan Wu <fanwu01@zju.edu.cn>
Date:   Tue Mar 3 07:33:44 2026 +0000

    usb: renesas_usbhs: fix use-after-free in ISR during device removal
    
    commit 3cbc242b88c607f55da3d0d0d336b49bf1e20412 upstream.
    
    In usbhs_remove(), the driver frees resources (including the pipe array)
    while the interrupt handler (usbhs_interrupt) is still registered. If an
    interrupt fires after usbhs_pipe_remove() but before the driver is fully
    unbound, the ISR may access freed memory, causing a use-after-free.
    
    Fix this by calling devm_free_irq() before freeing resources. This ensures
    the interrupt handler is both disabled and synchronized (waits for any
    running ISR to complete) before usbhs_pipe_remove() is called.
    
    Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
    Cc: stable <stable@kernel.org>
    Suggested-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
    Link: https://patch.msgid.link/20260303073344.34577-1-fanwu01@zju.edu.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: serial: io_edgeport: add support for Blackbox IC135A [+ + +]
Author: Frej Drejhammar <frej@stacken.kth.se>
Date:   Sun Feb 22 18:00:42 2026 +0100

    USB: serial: io_edgeport: add support for Blackbox IC135A
    
    commit 0e01c3416eb863ee7f156a9d7e7421ec0a9f68a0 upstream.
    
    The Blackbox 724-746-5500 USB Director USB-RS-232 HUB, part number
    IC135A, is a rebadged Edgeport/4 with its own USB device id.
    
    Signed-off-by: Frej Drejhammar <frej@stacken.kth.se>
    Cc: stable@vger.kernel.org
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: option: add MeiG Smart SRM825WN [+ + +]
Author: Ernestas Kulik <ernestas.k@iconn-networks.com>
Date:   Tue Mar 24 13:07:16 2026 +0200

    USB: serial: option: add MeiG Smart SRM825WN
    
    commit e8d0ed37bd51da52da6225d278e330c2f18a6198 upstream.
    
    Add support for the SDX62-based MeiG Smart SRM825WN module.
    
    If#= 0: RNDIS
    If#= 1: RNDIS
    If#= 2: Diag
    If#= 3: AT
    If#= 4: AT
    If#= 5: NMEA
    
    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 19 Spd=480  MxCh= 0
    D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
    P:  Vendor=2dee ProdID=4d38 Rev= 5.04
    S:  Manufacturer=MEIG
    S:  Product=LTE-A Module
    S:  SerialNumber=da47a175
    C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
    A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
    I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
    E:  Ad=81(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
    E:  Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
    E:  Ad=88(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    
    Signed-off-by: Ernestas Kulik <ernestas.k@iconn-networks.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: option: add support for Rolling Wireless RW135R-GL [+ + +]
Author: Wanquan Zhong <wanquan.zhong@fibocom.com>
Date:   Mon Mar 16 19:55:12 2026 +0800

    USB: serial: option: add support for Rolling Wireless RW135R-GL
    
    commit 01e8d0f742222f1e68f48180d5480097adf7ae9f upstream.
    
    Add VID/PID 33f8:1003 for the Rolling Wireless RW135R-GL M.2 module,
    which is used in laptop debug cards with MBIM interface for
    Linux/Chrome OS. The device supports mbim, pipe functionalities.
    
    Here are the outputs of usb-devices:
    T:  Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
    D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
    P:  Vendor=33f8 ProdID=1003 Rev=05.15
    S:  Manufacturer=Rolling Wireless S.a.r.l.
    S:  Product=Rolling RW135R-GL Module
    S:  SerialNumber=12345678
    C:  #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
    I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
    E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
    E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
    E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    
    Signed-off-by: Wanquan Zhong <wanquan.zhong@fibocom.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: ulpi: fix double free in ulpi_register_interface() error path [+ + +]
Author: Guangshuo Li <lgs201920130244@gmail.com>
Date:   Wed Apr 1 10:51:42 2026 +0800

    usb: ulpi: fix double free in ulpi_register_interface() error path
    
    commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
    
    When device_register() fails, ulpi_register() calls put_device() on
    ulpi->dev.
    
    The device release callback ulpi_dev_release() drops the OF node
    reference and frees ulpi, but the current error path in
    ulpi_register_interface() then calls kfree(ulpi) again, causing a
    double free.
    
    Let put_device() handle the cleanup through ulpi_dev_release() and
    avoid freeing ulpi again in ulpi_register_interface().
    
    Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
    Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: usbcore: Introduce usb_bulk_msg_killable() [+ + +]
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Feb 17 22:07:47 2026 -0500

    USB: usbcore: Introduce usb_bulk_msg_killable()
    
    commit 416909962e7cdf29fd01ac523c953f37708df93d upstream.
    
    The synchronous message API in usbcore (usb_control_msg(),
    usb_bulk_msg(), and so on) uses uninterruptible waits.  However,
    drivers may call these routines in the context of a user thread, which
    means it ought to be possible to at least kill them.
    
    For this reason, introduce a new usb_bulk_msg_killable() function
    which behaves the same as usb_bulk_msg() except for using
    wait_for_completion_killable_timeout() instead of
    wait_for_completion_timeout().  The same can be done later for
    usb_control_msg() later on, if it turns out to be needed.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Suggested-by: Oliver Neukum <oneukum@suse.com>
    Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    CC: stable@vger.kernel.org
    Link: https://patch.msgid.link/248628b4-cc83-4e81-a620-3ce4e0376d41@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: usbtmc: Flush anchored URBs in usbtmc_release [+ + +]
Author: Heitor Alves de Siqueira <halves@igalia.com>
Date:   Thu Mar 12 09:27:28 2026 -0300

    usb: usbtmc: Flush anchored URBs in usbtmc_release
    
    commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
    
    When calling usbtmc_release, pending anchored URBs must be flushed or
    killed to prevent use-after-free errors (e.g. in the HCD giveback
    path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
    
    Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file")
    Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f
    Cc: stable <stable@kernel.org>
    Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
    Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts [+ + +]
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Feb 17 22:09:22 2026 -0500

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
    
    commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream.
    
    The usbtmc driver accepts timeout values specified by the user in an
    ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
    Since the user can specify arbitrarily long timeouts and
    usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
    instead to avoid the possibility of the user hanging a kernel thread
    indefinitely.
    
    Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t
    Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
    CC: stable@vger.kernel.org
    Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: xhci: Fix memory leak in xhci_disable_slot() [+ + +]
Author: Zilin Guan <zilin@seu.edu.cn>
Date:   Thu Mar 5 00:36:37 2026 +0200

    usb: xhci: Fix memory leak in xhci_disable_slot()
    
    commit c1c8550e70401159184130a1afc6261db01fc0ce upstream.
    
    xhci_alloc_command() allocates a command structure and, when the
    second argument is true, also allocates a completion structure.
    Currently, the error handling path in xhci_disable_slot() only frees
    the command structure using kfree(), causing the completion structure
    to leak.
    
    Use xhci_free_command() instead of kfree(). xhci_free_command() correctly
    frees both the command structure and the associated completion structure.
    Since the command structure is allocated with zero-initialization,
    command->in_ctx is NULL and will not be erroneously freed by
    xhci_free_command().
    
    This bug was found using an experimental static analysis tool we are
    developing. The tool is based on the LLVM framework and is specifically
    designed to detect memory management issues. It is currently under
    active development and not yet publicly available, but we plan to
    open-source it after our research is published.
    
    The bug was originally detected on v6.13-rc1 using our static analysis
    tool, and we have verified that the issue persists in the latest mainline
    kernel.
    
    We performed build testing on x86_64 with allyesconfig using GCC=11.4.0.
    Since triggering these error paths in xhci_disable_slot() requires specific
    hardware conditions or abnormal state, we were unable to construct a test
    case to reliably trigger these specific error paths at runtime.
    
    Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend")
    CC: stable@vger.kernel.org
    Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://patch.msgid.link/20260304223639.3882398-2-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: yurex: fix race in probe [+ + +]
Author: Oliver Neukum <oneukum@suse.com>
Date:   Mon Feb 9 15:37:20 2026 +0100

    usb: yurex: fix race in probe
    
    commit 7a875c09899ba0404844abfd8f0d54cdc481c151 upstream.
    
    The bbu member of the descriptor must be set to the value
    standing for uninitialized values before the URB whose
    completion handler sets bbu is submitted. Otherwise there is
    a window during which probing can overwrite already retrieved
    data.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Link: https://patch.msgid.link/20260209143720.1507500-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false [+ + +]
Author: xietangxin <xietangxin@yeah.net>
Date:   Thu Mar 12 10:54:06 2026 +0800

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
    
    commit ba8bda9a0896746053aa97ac6c3e08168729172c upstream.
    
    A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
    and the device's IFF_XMIT_DST_RELEASE flag is cleared
    (e.g., during the configuration of tc route filter rules).
    
    When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
    expects the driver to hold the reference to skb->dst until the packet
    is fully transmitted and freed. In virtio_net with napi_tx=N,
    skbs may remain in the virtio transmit ring for an extended period.
    
    If the network namespace is destroyed while these skbs are still pending,
    the corresponding dst_ops structure has freed. When a subsequent packet
    is transmitted, free_old_xmit() is triggered to clean up old skbs.
    It then calls dst_release() on the skb associated with the stale dst_entry.
    Since the dst_ops (referenced by the dst_entry) has already been freed,
    a UAF kernel paging request occurs.
    
    fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
    the dst reference before the skb is queued in virtio_net.
    
    Call Trace:
     Unable to handle kernel paging request at virtual address ffff80007e150000
     CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
      ...
      percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
      dst_release+0xe0/0x110  net/core/dst.c:177
      skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
      sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
      dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
      napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
      __free_old_xmit+0x164/0x230  drivers/net/virtio_net.c:611 [virtio_net]
      free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
      start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
      ...
    
    Reproduction Steps:
    NETDEV="enp3s0"
    
    config_qdisc_route_filter() {
        tc qdisc del dev $NETDEV root
        tc qdisc add dev $NETDEV root handle 1: prio
        tc filter add dev $NETDEV parent 1:0 \
            protocol ip prio 100 route to 100 flowid 1:1
        ip route add 192.168.1.100/32 dev $NETDEV realm 100
    }
    
    test_ns() {
        ip netns add testns
        ip link set $NETDEV netns testns
        ip netns exec testns ifconfig $NETDEV  10.0.32.46/24
        ip netns exec testns ping -c 1 10.0.32.1
        ip netns del testns
    }
    
    config_qdisc_route_filter
    
    test_ns
    sleep 2
    test_ns
    
    Fixes: f2fc6a54585a ("[NETNS][IPV6] route6 - move ip6_dst_ops inside the network namespace")
    Cc: stable@vger.kernel.org
    Signed-off-by: xietangxin <xietangxin@yeah.net>
    Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
    Fixes: 0287587884b1 ("net: better IFF_XMIT_DST_RELEASE support")
    Link: https://patch.msgid.link/20260312025406.15641-1-xietangxin@yeah.net
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
vxlan: validate ND option lengths in vxlan_na_create [+ + +]
Author: Yang Yang <n05ec@lzu.edu.cn>
Date:   Thu Mar 26 03:44:41 2026 +0000

    vxlan: validate ND option lengths in vxlan_na_create
    
    commit afa9a05e6c4971bd5586f1b304e14d61fb3d9385 upstream.
    
    vxlan_na_create() walks ND options according to option-provided
    lengths. A malformed option can make the parser advance beyond the
    computed option span or use a too-short source LLADDR option payload.
    
    Validate option lengths against the remaining NS option area before
    advancing, and only read source LLADDR when the option is large enough
    for an Ethernet address.
    
    Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
    Cc: stable@vger.kernel.org
    Reported-by: Yifan Wu <yifanwucs@gmail.com>
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
    Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
    Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
    Suggested-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Link: https://patch.msgid.link/20260326034441.2037420-4-n05ec@lzu.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
wifi: brcmsmac: Fix dma_free_coherent() size [+ + +]
Author: Thomas Fourier <fourier.thomas@gmail.com>
Date:   Wed Feb 18 14:07:37 2026 +0100

    wifi: brcmsmac: Fix dma_free_coherent() size
    
    commit 12cd7632757a54ce586e36040210b1a738a0fc53 upstream.
    
    dma_alloc_consistent() may change the size to align it. The new size is
    saved in alloced.
    
    Change the free size to match the allocation size.
    
    Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
    Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Link: https://patch.msgid.link/20260218130741.46566-3-fourier.thomas@gmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() [+ + +]
Author: Daniil Dulov <d.dulov@aladdin.ru>
Date:   Mon Mar 9 07:42:24 2026 -0400

    wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
    
    [ Upstream commit 767d23ade706d5fa51c36168e92a9c5533c351a1 ]
    
    There is a use-after-free error in cfg80211_shutdown_all_interfaces found
    by syzkaller:
    
    BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220
    Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326
    CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    Workqueue: events cfg80211_rfkill_block_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x116/0x1f0
     print_report+0xcd/0x630
     kasan_report+0xe0/0x110
     cfg80211_shutdown_all_interfaces+0x213/0x220
     cfg80211_rfkill_block_work+0x1e/0x30
     process_one_work+0x9cf/0x1b70
     worker_thread+0x6c8/0xf10
     kthread+0x3c5/0x780
     ret_from_fork+0x56d/0x700
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    
    The problem arises due to the rfkill_block work is not cancelled when wiphy
    is being unregistered. In order to fix the issue cancel the corresponding
    work in wiphy_unregister().
    
    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
    
    Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
    Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: cfg80211: move scan done work to wiphy work [+ + +]
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Mon Mar 9 07:42:23 2026 -0400

    wifi: cfg80211: move scan done work to wiphy work
    
    [ Upstream commit fe0af9fe54d0ff53aa49eef390c8962355b274e2 ]
    
    Move the scan done work to the new wiphy work to
    simplify the code a bit.
    
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Stable-dep-of: 767d23ade706 ("wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: libertas: fix use-after-free in lbs_free_adapter() [+ + +]
Author: Daniel Hodges <git@danielhodges.dev>
Date:   Mon Mar 9 07:21:38 2026 -0400

    wifi: libertas: fix use-after-free in lbs_free_adapter()
    
    [ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ]
    
    The lbs_free_adapter() function uses timer_delete() (non-synchronous)
    for both command_timer and tx_lockup_timer before the structure is
    freed. This is incorrect because timer_delete() does not wait for
    any running timer callback to complete.
    
    If a timer callback is executing when lbs_free_adapter() is called,
    the callback will access freed memory since lbs_cfg_free() frees the
    containing structure immediately after lbs_free_adapter() returns.
    
    Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
    access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
    which would all be use-after-free violations.
    
    Use timer_delete_sync() instead to ensure any running timer callback
    has completed before returning.
    
    This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
    lockups and reset hardware") where del_timer() was used instead of
    del_timer_sync() in the cleanup path. The command_timer has had the
    same issue since the driver was first written.
    
    Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware")
    Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence")
    Cc: stable@vger.kernel.org
    Signed-off-by: Daniel Hodges <git@danielhodges.dev>
    Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [ del_timer() => timer_delete_sync() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: mac80211: fix NULL deref in mesh_matches_local() [+ + +]
Author: Xiang Mei <xmei5@asu.edu>
Date:   Tue Mar 17 20:42:44 2026 -0700

    wifi: mac80211: fix NULL deref in mesh_matches_local()
    
    [ Upstream commit c73bb9a2d33bf81f6eecaa0f474b6c6dbe9855bd ]
    
    mesh_matches_local() unconditionally dereferences ie->mesh_config to
    compare mesh configuration parameters. When called from
    mesh_rx_csa_frame(), the parsed action-frame elements may not contain a
    Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a
    kernel NULL pointer dereference.
    
    The other two callers are already safe:
      - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before
        calling mesh_matches_local()
      - mesh_plink_get_event() is only reached through
        mesh_process_plink_frame(), which checks !elems->mesh_config, too
    
    mesh_rx_csa_frame() is the only caller that passes raw parsed elements
    to mesh_matches_local() without guarding mesh_config. An adjacent
    attacker can exploit this by sending a crafted CSA action frame that
    includes a valid Mesh ID IE but omits the Mesh Configuration IE,
    crashing the kernel.
    
    The captured crash log:
    
    Oops: general protection fault, probably for non-canonical address ...
    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    Workqueue: events_unbound cfg80211_wiphy_work
    [...]
    Call Trace:
     <TASK>
     ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65)
     ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686)
     [...]
     ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802)
     [...]
     cfg80211_wiphy_work (net/wireless/core.c:426)
     process_one_work (net/kernel/workqueue.c:3280)
     ? assign_work (net/kernel/workqueue.c:1219)
     worker_thread (net/kernel/workqueue.c:3352)
     ? __pfx_worker_thread (net/kernel/workqueue.c:3385)
     kthread (net/kernel/kthread.c:436)
     [...]
     ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255)
     </TASK>
    
    This patch adds a NULL check for ie->mesh_config at the top of
    mesh_matches_local() to return false early when the Mesh Configuration
    IE is absent.
    
    Fixes: 2e3c8736820b ("mac80211: support functions for mesh")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Link: https://patch.msgid.link/20260318034244.2595020-1-xmei5@asu.edu
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() [+ + +]
Author: Vahagn Vardanian <vahagn@redrays.io>
Date:   Mon Feb 23 00:00:00 2026 +0000

    wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
    
    commit 017c1792525064a723971f0216e6ef86a8c7af11 upstream.
    
    In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
    at lines 1638 and 1642 without a prior NULL check:
    
        ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
        ...
        pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
    
    The mesh_matches_local() check above only validates the Mesh ID,
    Mesh Configuration, and Supported Rates IEs.  It does not verify the
    presence of the Mesh Channel Switch Parameters IE (element ID 118).
    When a received CSA action frame omits that IE, ieee802_11_parse_elems()
    leaves elems->mesh_chansw_params_ie as NULL, and the unconditional
    dereference causes a kernel NULL pointer dereference.
    
    A remote mesh peer with an established peer link (PLINK_ESTAB) can
    trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame
    that includes a matching Mesh ID and Mesh Configuration IE but omits the
    Mesh Channel Switch Parameters IE.  No authentication beyond the default
    open mesh peering is required.
    
    Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000000
      Oops: Oops: 0000 [#1] SMP NOPTI
      RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]
      CR2: 0000000000000000
    
    Fix by adding a NULL check for mesh_chansw_params_ie after
    mesh_matches_local() returns, consistent with how other optional IEs
    are guarded throughout the mesh code.
    
    The bug has been present since v3.13 (released 2014-01-19).
    
    Fixes: 8f2535b92d68 ("mac80211: process the CSA frame for mesh accordingly")
    Cc: stable@vger.kernel.org
    Signed-off-by: Vahagn Vardanian <vahagn@redrays.io>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. [+ + +]
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Fri Mar 6 07:24:02 2026 +0000

    wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
    
    [ Upstream commit b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828 ]
    
    syzbot reported static_branch_dec() underflow in aql_enable_write(). [0]
    
    The problem is that aql_enable_write() does not serialise concurrent
    write()s to the debugfs.
    
    aql_enable_write() checks static_key_false(&aql_disable.key) and
    later calls static_branch_inc() or static_branch_dec(), but the
    state may change between the two calls.
    
    aql_disable does not need to track inc/dec.
    
    Let's use static_branch_enable() and static_branch_disable().
    
    [0]:
    val == 0
    WARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288
    Modules linked in:
    CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G     U       L      syzkaller #0 PREEMPT(full)
    Tainted: [U]=USER, [L]=SOFTLOCKUP
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
    RIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311
    Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00
    RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293
    RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4
    RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000
    RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a
    R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98
    FS:  00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0
    Call Trace:
     <TASK>
     __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]
     __static_key_slow_dec kernel/jump_label.c:321 [inline]
     static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336
     aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343
     short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383
     vfs_write+0x2aa/0x1070 fs/read_write.c:684
     ksys_pwrite64 fs/read_write.c:793 [inline]
     __do_sys_pwrite64 fs/read_write.c:801 [inline]
     __se_sys_pwrite64 fs/read_write.c:798 [inline]
     __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f530cf9aeb9
    Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
    RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
    RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9
    RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010
    RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000
    R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000
    R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978
     </TASK>
    
    Fixes: e908435e402a ("mac80211: introduce aql_enable node in debugfs")
    Reported-by: syzbot+feb9ce36a95341bb47a4@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/69a8979e.a70a0220.b118c.0025.GAE@google.com/
    Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
    Link: https://patch.msgid.link/20260306072405.3649474-1-kuniyu@google.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: radiotap: reject radiotap with unknown bits [+ + +]
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Tue Feb 17 13:05:26 2026 +0100

    wifi: radiotap: reject radiotap with unknown bits
    
    commit c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 upstream.
    
    The radiotap parser is currently only used with the radiotap
    namespace (not with vendor namespaces), but if the undefined
    field 18 is used, the alignment/size is unknown as well. In
    this case, iterator->_next_ns_data isn't initialized (it's
    only set for skipping vendor namespaces), and syzbot points
    out that we later compare against this uninitialized value.
    
    Fix this by moving the rejection of unknown radiotap fields
    down to after the in-namespace lookup, so it will really use
    iterator->_next_ns_data only for vendor namespaces, even in
    case undefined fields are present.
    
    Cc: stable@vger.kernel.org
    Fixes: 33e5a2f776e3 ("wireless: update radiotap parser")
    Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com
    Link: https://patch.msgid.link/20260217120526.162647-2-johannes@sipsolutions.net
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: rt2x00usb: fix devres lifetime [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Mar 27 12:32:19 2026 +0100

    wifi: rt2x00usb: fix devres lifetime
    
    commit 25369b22223d1c56e42a0cd4ac9137349d5a898e upstream.
    
    USB drivers bind to USB interfaces and any device managed resources
    should have their lifetime tied to the interface rather than parent USB
    device. This avoids issues like memory leaks when drivers are unbound
    without their devices being physically disconnected (e.g. on probe
    deferral or configuration changes).
    
    Fix the USB anchor lifetime so that it is released on driver unbind.
    
    Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
    Cc: stable@vger.kernel.org      # 4.7
    Cc: Vishal Thanki <vishalthanki@gmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/20260327113219.1313748-1-johan@kernel.org
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free [+ + +]
Author: Alexander Popov <alex.popov@linux.com>
Date:   Wed Mar 25 01:46:02 2026 +0300

    wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
    
    commit 789b06f9f39cdc7e895bdab2c034e39c41c8f8d6 upstream.
    
    Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for
    the virt_wifi net devices. However, unregistering a virt_wifi device in
    netdev_run_todo() can happen together with the device referenced by
    SET_NETDEV_DEV().
    
    It can result in use-after-free during the ethtool operations performed
    on a virt_wifi device that is currently being unregistered. Such a net
    device can have the `dev.parent` field pointing to the freed memory,
    but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.
    
    Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
    
     ==================================================================
     BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0
     Read of size 2 at addr ffff88810cfc46f8 by task pm/606
    
     Call Trace:
      <TASK>
      dump_stack_lvl+0x4d/0x70
      print_report+0x170/0x4f3
      ? __pfx__raw_spin_lock_irqsave+0x10/0x10
      kasan_report+0xda/0x110
      ? __pm_runtime_resume+0xe2/0xf0
      ? __pm_runtime_resume+0xe2/0xf0
      __pm_runtime_resume+0xe2/0xf0
      ethnl_ops_begin+0x49/0x270
      ethnl_set_features+0x23c/0xab0
      ? __pfx_ethnl_set_features+0x10/0x10
      ? kvm_sched_clock_read+0x11/0x20
      ? local_clock_noinstr+0xf/0xf0
      ? local_clock+0x10/0x30
      ? kasan_save_track+0x25/0x60
      ? __kasan_kmalloc+0x7f/0x90
      ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0
      genl_family_rcv_msg_doit+0x1e7/0x2c0
      ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
      ? __pfx_cred_has_capability.isra.0+0x10/0x10
      ? stack_trace_save+0x8e/0xc0
      genl_rcv_msg+0x411/0x660
      ? __pfx_genl_rcv_msg+0x10/0x10
      ? __pfx_ethnl_set_features+0x10/0x10
      netlink_rcv_skb+0x121/0x380
      ? __pfx_genl_rcv_msg+0x10/0x10
      ? __pfx_netlink_rcv_skb+0x10/0x10
      ? __pfx_down_read+0x10/0x10
      genl_rcv+0x23/0x30
      netlink_unicast+0x60f/0x830
      ? __pfx_netlink_unicast+0x10/0x10
      ? __pfx___alloc_skb+0x10/0x10
      netlink_sendmsg+0x6ea/0xbc0
      ? __pfx_netlink_sendmsg+0x10/0x10
      ? __futex_queue+0x10b/0x1f0
      ____sys_sendmsg+0x7a2/0x950
      ? copy_msghdr_from_user+0x26b/0x430
      ? __pfx_____sys_sendmsg+0x10/0x10
      ? __pfx_copy_msghdr_from_user+0x10/0x10
      ___sys_sendmsg+0xf8/0x180
      ? __pfx____sys_sendmsg+0x10/0x10
      ? __pfx_futex_wait+0x10/0x10
      ? fdget+0x2e4/0x4a0
      __sys_sendmsg+0x11f/0x1c0
      ? __pfx___sys_sendmsg+0x10/0x10
      do_syscall_64+0xe2/0x570
      ? exc_page_fault+0x66/0xb0
      entry_SYSCALL_64_after_hwframe+0x77/0x7f
      </TASK>
    
    This fix may be combined with another one in the ethtool subsystem:
    https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
    
    Fixes: d43c65b05b848e0b ("ethtool: runtime-resume netdev parent in ethnl_ops_begin")
    Cc: stable@vger.kernel.org
    Signed-off-by: Alexander Popov <alex.popov@linux.com>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Reviewed-by: Breno Leitao <leitao@debian.org>
    Link: https://patch.msgid.link/20260324224607.374327-1-alex.popov@linux.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation [+ + +]
Author: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
Date:   Tue Mar 24 19:06:24 2026 +0900

    wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
    
    commit d049e56b1739101d1c4d81deedb269c52a8dbba0 upstream.
    
    The variable valuesize is declared as u8 but accumulates the total
    length of all SSIDs to scan. Each SSID contributes up to 33 bytes
    (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)
    SSIDs the total can reach 330, which wraps around to 74 when stored
    in a u8.
    
    This causes kmalloc to allocate only 75 bytes while the subsequent
    memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte
    heap buffer overflow.
    
    Widen valuesize from u8 to u32 to accommodate the full range.
    
    Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
    Link: https://patch.msgid.link/20260324100624.983458-1-yasuakitorimaru@gmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: wlcore: Fix a locking bug [+ + +]
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Mon Feb 23 14:00:25 2026 -0800

    wifi: wlcore: Fix a locking bug
    
    [ Upstream commit 72c6df8f284b3a49812ce2ac136727ace70acc7c ]
    
    Make sure that wl->mutex is locked before it is unlocked. This has been
    detected by the Clang thread-safety analyzer.
    
    Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Link: https://patch.msgid.link/20260223220102.2158611-26-bart.vanassche@linux.dev
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom [+ + +]
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Tue Mar 17 23:46:36 2026 -0700

    wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
    
    [ Upstream commit deb353d9bb009638b7762cae2d0b6e8fdbb41a69 ]
    
    Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom
    before skb_push"), wl1271_tx_allocate() and with it
    wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.
    However, in wlcore_tx_work_locked(), a return value of -EAGAIN from
    wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being
    full. This causes the code to flush the buffer, put the skb back at the
    head of the queue, and immediately retry the same skb in a tight while
    loop.
    
    Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens
    immediately with GFP_ATOMIC, this will result in an infinite loop and a
    CPU soft lockup. Return -ENOMEM instead so the packet is dropped and
    the loop terminates.
    
    The problem was found by an experimental code review agent based on
    gemini-3.1-pro while reviewing backports into v6.18.y.
    
    Assisted-by: Gemini:gemini-3.1-pro
    Fixes: e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push")
    Cc: Peter Astrand <astrand@lysator.liu.se>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Link: https://patch.msgid.link/20260318064636.3065925-1-linux@roeck-us.net
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
x86/apic: Disable x2apic on resume if the kernel expects so [+ + +]
Author: Shashank Balaji <shashank.mahadasyam@sony.com>
Date:   Fri Mar 6 14:46:28 2026 +0900

    x86/apic: Disable x2apic on resume if the kernel expects so
    
    commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 upstream.
    
    When resuming from s2ram, firmware may re-enable x2apic mode, which may have
    been disabled by the kernel during boot either because it doesn't support IRQ
    remapping or for other reasons. This causes the kernel to continue using the
    xapic interface, while the hardware is in x2apic mode, which causes hangs.
    This happens on defconfig + bare metal + s2ram.
    
    Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be
    disabled, i.e. when x2apic_mode = 0.
    
    The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the
    pre-sleep configuration or initial boot configuration for each CPU, including
    MSR state:
    
      When executing from the power-on reset vector as a result of waking from an
      S2 or S3 sleep state, the platform firmware performs only the hardware
      initialization required to restore the system to either the state the
      platform was in prior to the initial operating system boot, or to the
      pre-sleep configuration state. In multiprocessor systems, non-boot
      processors should be placed in the same state as prior to the initial
      operating system boot.
    
      (further ahead)
    
      If this is an S2 or S3 wake, then the platform runtime firmware restores
      minimum context of the system before jumping to the waking vector. This
      includes:
    
            CPU configuration. Platform runtime firmware restores the pre-sleep
            configuration or initial boot configuration of each CPU (MSR, MTRR,
            firmware update, SMBase, and so on). Interrupts must be disabled (for
            IA-32 processors, disabled by CLI instruction).
    
            (and other things)
    
    So at least as per the spec, re-enablement of x2apic by the firmware is
    allowed if "x2apic on" is a part of the initial boot configuration.
    
      [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization
    
      [ bp: Massage. ]
    
    Fixes: 6e1cb38a2aef ("x64, x2apic/intr-remap: add x2apic support, including enabling interrupt-remapping")
    Co-developed-by: Rahul Bukte <rahul.bukte@sony.com>
    Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
    Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: Thomas Gleixner <tglx@kernel.org>
    Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260306-x2apic-fix-v2-1-bee99c12efa3@sony.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() [+ + +]
Author: Nikunj A Dadhania <nikunj@amd.com>
Date:   Tue Mar 31 08:16:42 2026 -0400

    x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
    
    [ Upstream commit 05243d490bb7852a8acca7b5b5658019c7797a52 ]
    
    Move FSGSBASE enablement from identify_cpu() to cpu_init_exception_handling()
    to ensure it is enabled before any exceptions can occur on both boot and
    secondary CPUs.
    
    == Background ==
    
    Exception entry code (paranoid_entry()) uses ALTERNATIVE patching based on
    X86_FEATURE_FSGSBASE to decide whether to use RDGSBASE/WRGSBASE instructions
    or the slower RDMSR/SWAPGS sequence for saving/restoring GSBASE.
    
    On boot CPU, ALTERNATIVE patching happens after enabling FSGSBASE in CR4.
    When the feature is available, the code is permanently patched to use
    RDGSBASE/WRGSBASE, which require CR4.FSGSBASE=1 to execute without triggering
    
    == Boot Sequence ==
    
    Boot CPU (with CR pinning enabled):
      trap_init()
        cpu_init()                   <- Uses unpatched code (RDMSR/SWAPGS)
          x2apic_setup()
      ...
      arch_cpu_finalize_init()
        identify_boot_cpu()
          identify_cpu()
            cr4_set_bits(X86_CR4_FSGSBASE)  # Enables the feature
            # This becomes part of cr4_pinned_bits
        ...
        alternative_instructions()   <- Patches code to use RDGSBASE/WRGSBASE
    
    Secondary CPUs (with CR pinning enabled):
      start_secondary()
        cr4_init()                   <- Code already patched, CR4.FSGSBASE=1
                                        set implicitly via cr4_pinned_bits
    
        cpu_init()                   <- exceptions work because FSGSBASE is
                                        already enabled
    
    Secondary CPU (with CR pinning disabled):
      start_secondary()
        cr4_init()                   <- Code already patched, CR4.FSGSBASE=0
        cpu_init()
          x2apic_setup()
            rdmsrq(MSR_IA32_APICBASE)  <- Triggers #VC in SNP guests
              exc_vmm_communication()
                paranoid_entry()       <- Uses RDGSBASE with CR4.FSGSBASE=0
                                          (patched code)
        ...
        ap_starting()
          identify_secondary_cpu()
            identify_cpu()
              cr4_set_bits(X86_CR4_FSGSBASE)  <- Enables the feature, which is
                                                 too late
    
    == CR Pinning ==
    
    Currently, for secondary CPUs, CR4.FSGSBASE is set implicitly through
    CR-pinning: the boot CPU sets it during identify_cpu(), it becomes part of
    cr4_pinned_bits, and cr4_init() applies those pinned bits to secondary CPUs.
    This works but creates an undocumented dependency between cr4_init() and the
    pinning mechanism.
    
    == Problem ==
    
    Secondary CPUs boot after alternatives have been applied globally. They
    execute already-patched paranoid_entry() code that uses RDGSBASE/WRGSBASE
    instructions, which require CR4.FSGSBASE=1. Upcoming changes to CR pinning
    behavior will break the implicit dependency, causing secondary CPUs to
    generate #UD.
    
    This issue manifests itself on AMD SEV-SNP guests, where the rdmsrq() in
    x2apic_setup() triggers a #VC exception early during cpu_init(). The #VC
    handler (exc_vmm_communication()) executes the patched paranoid_entry() path.
    Without CR4.FSGSBASE enabled, RDGSBASE instructions trigger #UD.
    
    == Fix ==
    
    Enable FSGSBASE explicitly in cpu_init_exception_handling() before loading
    exception handlers. This makes the dependency explicit and ensures both
    boot and secondary CPUs have FSGSBASE enabled before paranoid_entry()
    executes.
    
    Fixes: c82965f9e530 ("x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit")
    Reported-by: Borislav Petkov <bp@alien8.de>
    Suggested-by: Sohil Mehta <sohil.mehta@intel.com>
    Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
    Cc: <stable@kernel.org>
    Link: https://patch.msgid.link/20260318075654.1792916-2-nikunj@amd.com
    [ placed FSGSBASE enablement before load_current_idt() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
x86/CPU: Fix FPDSS on Zen1 [+ + +]
Author: Borislav Petkov (AMD) <bp@alien8.de>
Date:   Tue Apr 7 11:40:03 2026 +0200

    x86/CPU: Fix FPDSS on Zen1
    
    commit e55d98e7756135f32150b9b8f75d580d0d4b2dd3 upstream.
    
    Zen1's hardware divider can leave, under certain circumstances, partial
    results from previous operations.  Those results can be leaked by
    another, attacker thread.
    
    Fix that with a chicken bit.
    
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
x86/efi: defer freeing of boot services memory [+ + +]
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
Date:   Wed Feb 25 08:55:55 2026 +0200

    x86/efi: defer freeing of boot services memory
    
    commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 upstream.
    
    efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE
    and EFI_BOOT_SERVICES_DATA using memblock_free_late().
    
    There are two issue with that: memblock_free_late() should be used for
    memory allocated with memblock_alloc() while the memory reserved with
    memblock_reserve() should be freed with free_reserved_area().
    
    More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
    efi_free_boot_services() is called before deferred initialization of the
    memory map is complete.
    
    Benjamin Herrenschmidt reports that this causes a leak of ~140MB of
    RAM on EC2 t3a.nano instances which only have 512MB or RAM.
    
    If the freed memory resides in the areas that memory map for them is
    still uninitialized, they won't be actually freed because
    memblock_free_late() calls memblock_free_pages() and the latter skips
    uninitialized pages.
    
    Using free_reserved_area() at this point is also problematic because
    __free_page() accesses the buddy of the freed page and that again might
    end up in uninitialized part of the memory map.
    
    Delaying the entire efi_free_boot_services() could be problematic
    because in addition to freeing boot services memory it updates
    efi.memmap without any synchronization and that's undesirable late in
    boot when there is concurrency.
    
    More robust approach is to only defer freeing of the EFI boot services
    memory.
    
    Split efi_free_boot_services() in two. First efi_unmap_boot_services()
    collects ranges that should be freed into an array then
    efi_free_boot_services() later frees them after deferred init is complete.
    
    Link: https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@kernel.crashing.org
    Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
    Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size [+ + +]
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
Date:   Fri Mar 20 15:59:48 2026 +0200

    x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
    
    [ Upstream commit 217c0a5c177a3d4f7c8497950cbf5c36756e8bbb ]
    
    ranges_to_free array should have enough room to store the entire EFI
    memmap plus an extra element for NULL entry.
    The calculation of this array size wrongly adds 1 to the overall size
    instead of adding 1 to the number of elements.
    
    Add parentheses to properly size the array.
    
    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Fixes: a4b0bf6a40f3 ("x86/efi: defer freeing of boot services memory")
    Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
xen/acpi-processor: fix _CST detection using undersized evaluation buffer [+ + +]
Author: David Thomson <dt@linux-mail.net>
Date:   Tue Feb 24 09:37:11 2026 +0000

    xen/acpi-processor: fix _CST detection using undersized evaluation buffer
    
    [ Upstream commit 8b57227d59a86fc06d4f09de08f98133680f2cae ]
    
    read_acpi_id() attempts to evaluate _CST using a stack buffer of
    sizeof(union acpi_object) (48 bytes), but _CST returns a nested Package
    of sub-Packages (one per C-state, each containing a register descriptor,
    type, latency, and power) requiring hundreds of bytes. The evaluation
    always fails with AE_BUFFER_OVERFLOW.
    
    On modern systems using FFH/MWAIT entry (where pblk is zero), this
    causes the function to return before setting the acpi_id_cst_present
    bit. In check_acpi_ids(), flags.power is then zero for all Phase 2 CPUs
    (physical CPUs beyond dom0's vCPU count), so push_cxx_to_hypervisor() is
    never called for them.
    
    On a system with dom0_max_vcpus=2 and 8 physical CPUs, only PCPUs 0-1
    receive C-state data. PCPUs 2-7 are stuck in C0/C1 idle, unable to
    enter C2/C3. This costs measurable wall power (4W observed on an Intel
    Core Ultra 7 265K with Xen 4.20).
    
    The function never uses the _CST return value -- it only needs to know
    whether _CST exists. Replace the broken acpi_evaluate_object() call with
    acpi_has_method(), which correctly detects _CST presence using
    acpi_get_handle() without any buffer allocation. This brings C-state
    detection to parity with the P-state path, which already works correctly
    for Phase 2 CPUs.
    
    Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
    Signed-off-by: David Thomson <dt@linux-mail.net>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Message-ID: <20260224093707.19679-1-dt@linux-mail.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
xen/privcmd: add boot control for restricted usage in domU [+ + +]
Author: Juergen Gross <jgross@suse.com>
Date:   Tue Oct 14 13:28:15 2025 +0200

    xen/privcmd: add boot control for restricted usage in domU
    
    commit 1613462be621ad5103ec338a7b0ca0746ec4e5f1 upstream.
    
    When running in an unprivileged domU under Xen, the privcmd driver
    is restricted to allow only hypercalls against a target domain, for
    which the current domU is acting as a device model.
    
    Add a boot parameter "unrestricted" to allow all hypercalls (the
    hypervisor will still refuse destructive hypercalls affecting other
    guests).
    
    Make this new parameter effective only in case the domU wasn't started
    using secure boot, as otherwise hypercalls targeting the domU itself
    might result in violating the secure boot functionality.
    
    This is achieved by adding another lockdown reason, which can be
    tested to not being set when applying the "unrestricted" option.
    
    This is part of XSA-482
    
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xen/privcmd: restrict usage in unprivileged domU [+ + +]
Author: Juergen Gross <jgross@suse.com>
Date:   Thu Oct 9 16:54:58 2025 +0200

    xen/privcmd: restrict usage in unprivileged domU
    
    commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8 upstream.
    
    The Xen privcmd driver allows to issue arbitrary hypercalls from
    user space processes. This is normally no problem, as access is
    usually limited to root and the hypervisor will deny any hypercalls
    affecting other domains.
    
    In case the guest is booted using secure boot, however, the privcmd
    driver would be enabling a root user process to modify e.g. kernel
    memory contents, thus breaking the secure boot feature.
    
    The only known case where an unprivileged domU is really needing to
    use the privcmd driver is the case when it is acting as the device
    model for another guest. In this case all hypercalls issued via the
    privcmd driver will target that other guest.
    
    Fortunately the privcmd driver can already be locked down to allow
    only hypercalls targeting a specific domain, but this mode can be
    activated from user land only today.
    
    The target domain can be obtained from Xenstore, so when not running
    in dom0 restrict the privcmd driver to that target domain from the
    beginning, resolving the potential problem of breaking secure boot.
    
    This is XSA-482
    
    Reported-by: Teddy Astie <teddy.astie@vates.tech>
    Fixes: 1c5de1939c20 ("xen: add privcmd driver")
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xen/privcmd: unregister xenstore notifier on module exit [+ + +]
Author: GuoHan Zhao <zhaoguohan@kylinos.cn>
Date:   Wed Mar 25 20:02:46 2026 +0800

    xen/privcmd: unregister xenstore notifier on module exit
    
    commit cd7e1fef5a1ca1c4fcd232211962ac2395601636 upstream.
    
    Commit 453b8fb68f36 ("xen/privcmd: restrict usage in
    unprivileged domU") added a xenstore notifier to defer setting the
    restriction target until Xenstore is ready.
    
    XEN_PRIVCMD can be built as a module, but privcmd_exit() leaves that
    notifier behind. Balance the notifier lifecycle by unregistering it on
    module exit.
    
    This is harmless even if xenstore was already ready at registration
    time and the notifier was never queued on the chain.
    
    Fixes: 453b8fb68f3641fe ("xen/privcmd: restrict usage in unprivileged domU")
    Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Message-ID: <20260325120246.252899-1-zhaoguohan@kylinos.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
xfrm: call xdo_dev_state_delete during state update [+ + +]
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Tue Feb 24 00:05:13 2026 +0100

    xfrm: call xdo_dev_state_delete during state update
    
    [ Upstream commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 ]
    
    When we update an SA, we construct a new state and call
    xdo_dev_state_add, but never insert it. The existing state is updated,
    then we immediately destroy the new state. Since we haven't added it,
    we don't go through the standard state delete code, and we're skipping
    removing it from the device (but xdo_dev_state_free will get called
    when we destroy the temporary state).
    
    This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of
    offloaded SAs on failure.").
    
    Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

xfrm: Fix the usage of skb->sk [+ + +]
Author: Steffen Klassert <steffen.klassert@secunet.com>
Date:   Thu Jan 16 11:46:03 2025 +0100

    xfrm: Fix the usage of skb->sk
    
    [ Upstream commit 1620c88887b16940e00dbe57dd38c74eda9bad9e ]
    
    xfrm assumed to always have a full socket at skb->sk.
    This is not always true, so fix it by converting to a
    full socket before it is used.
    
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Stable-dep-of: 0c0eef8ccd24 ("esp: fix skb leak with espintcp and async crypto")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
xfrm_user: fix info leak in build_report() [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Apr 6 17:34:22 2026 +0200

    xfrm_user: fix info leak in build_report()
    
    commit d10119968d0e1f2b669604baf2a8b5fdb72fa6b4 upstream.
    
    struct xfrm_user_report is a __u8 proto field followed by a struct
    xfrm_selector which means there is three "empty" bytes of padding, but
    the padding is never zeroed before copying to userspace.  Fix that up by
    zeroing the structure before setting individual member variables.
    
    Cc: stable <stable@kernel.org>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Cc: Simon Horman <horms@kernel.org>
    Assisted-by: gregkh_clanker_t1000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
xfs: fix undersized l_iclog_roundoff values [+ + +]
Author: Darrick J. Wong <djwong@kernel.org>
Date:   Wed Mar 4 20:26:20 2026 -0800

    xfs: fix undersized l_iclog_roundoff values
    
    commit 52a8a1ba883defbfe3200baa22cf4cd21985d51a upstream.
    
    If the superblock doesn't list a log stripe unit, we set the incore log
    roundoff value to 512.  This leads to corrupt logs and unmountable
    filesystems in generic/617 on a disk with 4k physical sectors...
    
    XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c
    XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197.
    XFS (sda1): failed to locate log tail
    XFS (sda1): log mount/recovery failed: error -74
    XFS (sda1): log mount failed
    XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c
    XFS (sda1): Ending clean mount
    
    ...on the current xfsprogs for-next which has a broken mkfs.  xfs_info
    shows this...
    
    meta-data=/dev/sda1              isize=512    agcount=4, agsize=644992 blks
             =                       sectsz=4096  attr=2, projid32bit=1
             =                       crc=1        finobt=1, sparse=1, rmapbt=1
             =                       reflink=1    bigtime=1 inobtcount=1 nrext64=1
             =                       exchange=1   metadir=1
    data     =                       bsize=4096   blocks=2579968, imaxpct=25
             =                       sunit=0      swidth=0 blks
    naming   =version 2              bsize=4096   ascii-ci=0, ftype=1, parent=1
    log      =internal log           bsize=4096   blocks=16384, version=2
             =                       sectsz=4096  sunit=0 blks, lazy-count=1
    realtime =none                   extsz=4096   blocks=0, rtextents=0
             =                       rgcount=0    rgsize=268435456 extents
             =                       zoned=0      start=0 reserved=0
    
    ...observe that the log section has sectsz=4096 sunit=0, which means
    that the roundoff factor is 512, not 4096 as you'd expect.  We should
    fix mkfs not to generate broken filesystems, but anyone can fuzz the
    ondisk superblock so we should be more cautious.  I think the inadequate
    logic predates commit a6a65fef5ef8d0, but that's clearly going to
    require a different backport.
    
    Cc: stable@vger.kernel.org # v5.14
    Fixes: a6a65fef5ef8d0 ("xfs: log stripe roundoff is a property of the log")
    Signed-off-by: Darrick J. Wong <djwong@kernel.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Carlos Maiolino <cem@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xfs: save ailp before dropping the AIL lock in push callbacks [+ + +]
Author: Yuto Ohnuki <ytohnuki@amazon.com>
Date:   Thu Apr 2 05:12:46 2026 -0400

    xfs: save ailp before dropping the AIL lock in push callbacks
    
    [ Upstream commit 394d70b86fae9fe865e7e6d9540b7696f73aa9b6 ]
    
    In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock
    is dropped to perform buffer IO. Once the cluster buffer no longer
    protects the log item from reclaim, the log item may be freed by
    background reclaim or the dquot shrinker. The subsequent spin_lock()
    call dereferences lip->li_ailp, which is a use-after-free.
    
    Fix this by saving the ailp pointer in a local variable while the AIL
    lock is held and the log item is guaranteed to be valid.
    
    Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
    Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary")
    Cc: stable@vger.kernel.org # v5.9
    Reviewed-by: Darrick J. Wong <djwong@kernel.org>
    Reviewed-by: Dave Chinner <dchinner@redhat.com>
    Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
    Signed-off-by: Carlos Maiolino <cem@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xfs: stop reclaim before pushing AIL during unmount [+ + +]
Author: Yuto Ohnuki <ytohnuki@amazon.com>
Date:   Tue Mar 10 18:38:37 2026 +0000

    xfs: stop reclaim before pushing AIL during unmount
    
    commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 upstream.
    
    The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while
    background reclaim and inodegc are still running. This is broken
    independently of any use-after-free issues - background reclaim and
    inodegc should not be running while the AIL is being pushed during
    unmount, as inodegc can dirty and insert inodes into the AIL during the
    flush, and background reclaim can race to abort and free dirty inodes.
    
    Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background
    reclaim before pushing the AIL. Stop inodegc before cancelling
    m_reclaim_work because the inodegc worker can re-queue m_reclaim_work
    via xfs_inodegc_set_reclaimable.
    
    Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
    Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary")
    Cc: stable@vger.kernel.org # v5.9
    Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
    Reviewed-by: Darrick J. Wong <djwong@kernel.org>
    Signed-off-by: Carlos Maiolino <cem@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
xprtrdma: Decrement re_receiving on the early exit paths [+ + +]
Author: Eric Badger <ebadger@purestorage.com>
Date:   Mon Feb 23 10:28:55 2026 -0800

    xprtrdma: Decrement re_receiving on the early exit paths
    
    [ Upstream commit 7b6275c80a0c81c5f8943272292dfe67730ce849 ]
    
    In the event that rpcrdma_post_recvs() fails to create a work request
    (due to memory allocation failure, say) or otherwise exits early, we
    should decrement ep->re_receiving before returning. Otherwise we will
    hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and
    the completion will never be triggered.
    
    On a system with high memory pressure, this can appear as the following
    hung task:
    
        INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.
              Tainted: G S          E       6.19.0 #3
        "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
        task:kworker/u385:17 state:D stack:0     pid:8393  tgid:8393  ppid:2      task_flags:0x4248060 flags:0x00080000
        Workqueue: xprtiod xprt_autoclose [sunrpc]
        Call Trace:
         <TASK>
         __schedule+0x48b/0x18b0
         ? ib_post_send_mad+0x247/0xae0 [ib_core]
         schedule+0x27/0xf0
         schedule_timeout+0x104/0x110
         __wait_for_common+0x98/0x180
         ? __pfx_schedule_timeout+0x10/0x10
         wait_for_completion+0x24/0x40
         rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]
         xprt_rdma_close+0x12/0x40 [rpcrdma]
         xprt_autoclose+0x5f/0x120 [sunrpc]
         process_one_work+0x191/0x3e0
         worker_thread+0x2e3/0x420
         ? __pfx_worker_thread+0x10/0x10
         kthread+0x10d/0x230
         ? __pfx_kthread+0x10/0x10
         ret_from_fork+0x273/0x2b0
         ? __pfx_kthread+0x10/0x10
         ret_from_fork_asm+0x1a/0x30
    
    Fixes: 15788d1d1077 ("xprtrdma: Do not refresh Receive Queue while it is draining")
    Signed-off-by: Eric Badger <ebadger@purestorage.com>
    Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>