Changelog in Linux kernel 6.18.25

 
ALSA: caiaq: take a reference on the USB device in create_card() [+ + +]
Author: Berk Cem Goksel <berkcgoksel@gmail.com>
Date:   Mon Apr 13 06:49:41 2026 +0300

    ALSA: caiaq: take a reference on the USB device in create_card()
    
    commit 80bb50e2d459213cccff3111d5ef98ed4238c0d5 upstream.
    
    The caiaq driver stores a pointer to the parent USB device in
    cdev->chip.dev but never takes a reference on it. The card's
    private_free callback, snd_usb_caiaq_card_free(), can run
    asynchronously via snd_card_free_when_closed() after the USB
    device has already been disconnected and freed, so any access to
    cdev->chip.dev in that path dereferences a freed usb_device.
    
    On top of the refcounting issue, the current card_free implementation
    calls usb_reset_device(cdev->chip.dev). A reset in a free callback
    is inappropriate: the device is going away, the call takes the
    device lock in a teardown context, and the reset races with the
    disconnect path that the callback is already cleaning up after.
    
    Take a reference on the USB device in create_card() with
    usb_get_dev(), drop it with usb_put_dev() in the free callback,
    and remove the usb_reset_device() call.
    
    Fixes: b04dcbb7f7b1 ("ALSA: caiaq: Use snd_card_free_when_closed() at disconnection")
    Cc: stable@vger.kernel.org
    Cc: Andrey Konovalov <andreyknvl@gmail.com>
    Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com>
    Link: https://patch.msgid.link/20260413034941.1131465-3-berkcgoksel@gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: hda/realtek: Add quirk for Legion S7 15IMH [+ + +]
Author: Eric Naim <dnaim@cachyos.org>
Date:   Mon Apr 13 23:48:17 2026 +0800

    ALSA: hda/realtek: Add quirk for Legion S7 15IMH
    
    commit 67f4c61a73e9b17dc9593bf27badc6785ecadd78 upstream.
    
    Fix speaker output on the Lenovo Legion S7 15IMH05.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Eric Naim <dnaim@cachyos.org>
    Link: https://patch.msgid.link/20260413154818.351597-1-dnaim@cachyos.org
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: usb-audio: apply quirk for MOONDROP JU Jiu [+ + +]
Author: Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Date:   Thu Apr 2 13:36:57 2026 +0800

    ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    
    commit 4513d3e0bbc0585b86ccf2631902593ff97e88f5 upstream.
    
    It(ID 31b2:0111 JU Jiu) reports a MIN value -12800 for volume control, but
    will mute when setting it less than -10880.
    
    Thanks to my girlfriend Kagura for reporting this issue.
    
    Cc: Kagura <me@mail.kagurach.uk>
    Cc: stable@vger.kernel.org
    Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
    Link: https://patch.msgid.link/20260402-syy-v1-1-068d3bc30ddc@linux.dev
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
arm64: cputype: Add C1-Pro definitions [+ + +]
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Tue Apr 21 11:00:16 2026 +0100

    arm64: cputype: Add C1-Pro definitions
    
    commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 upstream.
    
    Add cputype definitions for C1-Pro. These will be used for errata
    detection in subsequent patches.
    
    These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in
    issue 07 of the C1-Pro TRM:
    
      https://documentation-service.arm.com/static/6930126730f8f55a656570af
    
    Acked-by: Mark Rutland <mark.rutland@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Cc: James Morse <james.morse@arm.com>
    Reviewed-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: errata: Work around early CME DVMSync acknowledgement [+ + +]
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Tue Apr 21 11:00:17 2026 +0100

    arm64: errata: Work around early CME DVMSync acknowledgement
    
    commit 0baba94a9779c13c857f6efc55807e6a45b1d4e4 upstream.
    
    C1-Pro acknowledges DVMSync messages before completing the SME/CME
    memory accesses. Work around this by issuing an IPI to the affected CPUs
    if they are running in EL0 with SME enabled.
    
    Note that we avoid the local DSB in the IPI handler as the kernel runs
    with SCTLR_EL1.IESB=1. This is sufficient to complete SME memory
    accesses at EL0 on taking an exception to EL1. On the return to user
    path, no barrier is necessary either. See the comment in
    sme_set_active() and the more detailed explanation in the link below.
    
    To avoid a potential IPI flood from malicious applications (e.g.
    madvise(MADV_PAGEOUT) in a tight loop), track where a process is active
    via mm_cpumask() and only interrupt those CPUs.
    
    Link: https://lore.kernel.org/r/ablEXwhfKyJW1i7l@J2N7QTR9R3
    Cc: Will Deacon <will@kernel.org>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: James Morse <james.morse@arm.com>
    Cc: Mark Brown <broonie@kernel.org>
    Reviewed-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: tlb: Allow XZR argument to TLBI ops [+ + +]
Author: Mark Rutland <mark.rutland@arm.com>
Date:   Tue Apr 21 11:00:12 2026 +0100

    arm64: tlb: Allow XZR argument to TLBI ops
    
    commit bfd9c931d19aa59fb8371d557774fa169b15db9a upstream.
    
    The TLBI instruction accepts XZR as a register argument, and for TLBI
    operations with a register argument, there is no functional difference
    between using XZR or another GPR which contains zeroes. Operations
    without a register argument are encoded as if XZR were used.
    
    Allow the __TLBI_1() macro to use XZR when a register argument is all
    zeroes.
    
    Today this only results in a trivial code saving in
    __do_compat_cache_op()'s workaround for Neoverse-N1 erratum #1542419. In
    subsequent patches this pattern will be used more generally.
    
    There should be no functional change as a result of this patch.
    
    Signed-off-by: Mark Rutland <mark.rutland@arm.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Marc Zyngier <maz@kernel.org>
    Cc: Oliver Upton <oupton@kernel.org>
    Cc: Ryan Roberts <ryan.roberts@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance [+ + +]
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Tue Apr 21 11:00:14 2026 +0100

    arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance
    
    commit 6bfbf574a39139da11af9fdf6e8d56fe1989cd3e upstream.
    
    Add __tlbi_sync_s1ish_kernel() similar to __tlbi_sync_s1ish() and use it
    for kernel TLB maintenance. Also use this function in flush_tlb_all()
    which is only used in relation to kernel mappings. Subsequent patches
    can differentiate between workarounds that apply to user only or both
    user and kernel.
    
    A subsequent patch will add mm_struct to __tlbi_sync_s1ish(). Since
    arch_tlbbatch_flush() is not specific to an mm, add a corresponding
    __tlbi_sync_s1ish_batch() helper.
    
    Acked-by: Mark Rutland <mark.rutland@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Reviewed-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI [+ + +]
Author: Mark Rutland <mark.rutland@arm.com>
Date:   Tue Apr 21 11:00:13 2026 +0100

    arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
    
    commit a8f78680ee6bf795086384e8aea159a52814f827 upstream.
    
    The ARM64_WORKAROUND_REPEAT_TLBI workaround is used to mitigate several
    errata where broadcast TLBI;DSB sequences don't provide all the
    architecturally required synchronization. The workaround performs more
    work than necessary, and can have significant overhead. This patch
    optimizes the workaround, as explained below.
    
    The workaround was originally added for Qualcomm Falkor erratum 1009 in
    commit:
    
      d9ff80f83ecb ("arm64: Work around Falkor erratum 1009")
    
    As noted in the message for that commit, the workaround is applied even
    in cases where it is not strictly necessary.
    
    The workaround was later reused without changes for:
    
    * Arm Cortex-A76 erratum #1286807
      SDEN v33: https://developer.arm.com/documentation/SDEN-885749/33-0/
    
    * Arm Cortex-A55 erratum #2441007
      SDEN v16: https://developer.arm.com/documentation/SDEN-859338/1600/
    
    * Arm Cortex-A510 erratum #2441009
      SDEN v19: https://developer.arm.com/documentation/SDEN-1873351/1900/
    
    The important details to note are as follows:
    
    1. All relevant errata only affect the ordering and/or completion of
       memory accesses which have been translated by an invalidated TLB
       entry. The actual invalidation of TLB entries is unaffected.
    
    2. The existing workaround is applied to both broadcast and local TLB
       invalidation, whereas for all relevant errata it is only necessary to
       apply a workaround for broadcast invalidation.
    
    3. The existing workaround replaces every TLBI with a TLBI;DSB;TLBI
       sequence, whereas for all relevant errata it is only necessary to
       execute a single additional TLBI;DSB sequence after any number of
       TLBIs are completed by a DSB.
    
       For example, for a sequence of batched TLBIs:
    
           TLBI <op1>[, <arg1>]
           TLBI <op2>[, <arg2>]
           TLBI <op3>[, <arg3>]
           DSB ISH
    
       ... the existing workaround will expand this to:
    
           TLBI <op1>[, <arg1>]
           DSB ISH                  // additional
           TLBI <op1>[, <arg1>]     // additional
           TLBI <op2>[, <arg2>]
           DSB ISH                  // additional
           TLBI <op2>[, <arg2>]     // additional
           TLBI <op3>[, <arg3>]
           DSB ISH                  // additional
           TLBI <op3>[, <arg3>]     // additional
           DSB ISH
    
       ... whereas it is sufficient to have:
    
           TLBI <op1>[, <arg1>]
           TLBI <op2>[, <arg2>]
           TLBI <op3>[, <arg3>]
           DSB ISH
           TLBI <opX>[, <argX>]     // additional
           DSB ISH                  // additional
    
       Using a single additional TBLI and DSB at the end of the sequence can
       have significantly lower overhead as each DSB which completes a TLBI
       must synchronize with other PEs in the system, with potential
       performance effects both locally and system-wide.
    
    4. The existing workaround repeats each specific TLBI operation, whereas
       for all relevant errata it is sufficient for the additional TLBI to
       use *any* operation which will be broadcast, regardless of which
       translation regime or stage of translation the operation applies to.
    
       For example, for a single TLBI:
    
           TLBI ALLE2IS
           DSB ISH
    
       ... the existing workaround will expand this to:
    
           TLBI ALLE2IS
           DSB ISH
           TLBI ALLE2IS             // additional
           DSB ISH                  // additional
    
       ... whereas it is sufficient to have:
    
           TLBI ALLE2IS
           DSB ISH
           TLBI VALE1IS, XZR        // additional
           DSB ISH                  // additional
    
       As the additional TLBI doesn't have to match a specific earlier TLBI,
       the additional TLBI can be implemented in separate code, with no
       memory of the earlier TLBIs. The additional TLBI can also use a
       cheaper TLBI operation.
    
    5. The existing workaround is applied to both Stage-1 and Stage-2 TLB
       invalidation, whereas for all relevant errata it is only necessary to
       apply a workaround for Stage-1 invalidation.
    
       Architecturally, TLBI operations which invalidate only Stage-2
       information (e.g. IPAS2E1IS) are not required to invalidate TLB
       entries which combine information from Stage-1 and Stage-2
       translation table entries, and consequently may not complete memory
       accesses translated by those combined entries. In these cases,
       completion of memory accesses is only guaranteed after subsequent
       invalidation of Stage-1 information (e.g. VMALLE1IS).
    
    Taking the above points into account, this patch reworks the workaround
    logic to reduce overhead:
    
    * New __tlbi_sync_s1ish() and __tlbi_sync_s1ish_hyp() functions are
      added and used in place of any dsb(ish) which is used to complete
      broadcast Stage-1 TLB maintenance. When the
      ARM64_WORKAROUND_REPEAT_TLBI workaround is enabled, these helpers will
      execute an additional TLBI;DSB sequence.
    
      For consistency, it might make sense to add __tlbi_sync_*() helpers
      for local and stage 2 maintenance. For now I've left those with
      open-coded dsb() to keep the diff small.
    
    * The duplication of TLBIs in __TLBI_0() and __TLBI_1() is removed. This
      is no longer needed as the necessary synchronization will happen in
      __tlbi_sync_s1ish() or __tlbi_sync_s1ish_hyp().
    
    * The additional TLBI operation is chosen to have minimal impact:
    
      - __tlbi_sync_s1ish() uses "TLBI VALE1IS, XZR". This is only used at
        EL1 or at EL2 with {E2H,TGE}=={1,1}, where it will target an unused
        entry for the reserved ASID in the kernel's own translation regime,
        and have no adverse affect.
    
      - __tlbi_sync_s1ish_hyp() uses "TLBI VALE2IS, XZR". This is only used
        in hyp code, where it will target an unused entry in the hyp code's
        TTBR0 mapping, and should have no adverse effect.
    
    * As __TLBI_0() and __TLBI_1() no longer replace each TLBI with a
      TLBI;DSB;TLBI sequence, batching TLBIs is worthwhile, and there's no
      need for arch_tlbbatch_should_defer() to consider
      ARM64_WORKAROUND_REPEAT_TLBI.
    
    When building defconfig with GCC 15.1.0, compared to v6.19-rc1, this
    patch saves ~1KiB of text, makes the vmlinux ~42KiB smaller, and makes
    the resulting Image 64KiB smaller:
    
    | [mark@lakrids:~/src/linux]% size vmlinux-*
    |    text    data     bss     dec     hex filename
    | 21179831        19660919         708216 41548966        279fca6 vmlinux-after
    | 21181075        19660903         708216 41550194        27a0172 vmlinux-before
    | [mark@lakrids:~/src/linux]% ls -l vmlinux-*
    | -rwxr-xr-x 1 mark mark 157771472 Feb  4 12:05 vmlinux-after
    | -rwxr-xr-x 1 mark mark 157815432 Feb  4 12:05 vmlinux-before
    | [mark@lakrids:~/src/linux]% ls -l Image-*
    | -rw-r--r-- 1 mark mark 41007616 Feb  4 12:05 Image-after
    | -rw-r--r-- 1 mark mark 41073152 Feb  4 12:05 Image-before
    
    Signed-off-by: Mark Rutland <mark.rutland@arm.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Marc Zyngier <maz@kernel.org>
    Cc: Oliver Upton <oupton@kernel.org>
    Cc: Ryan Roberts <ryan.roberts@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() [+ + +]
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Tue Apr 21 11:00:15 2026 +0100

    arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()
    
    commit d9fb08ba946a6190c371dcd9f9e465d0d52c5021 upstream.
    
    The mm structure will be used for workarounds that need limiting to
    specific tasks.
    
    Acked-by: Mark Rutland <mark.rutland@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Reviewed-by: Will Deacon <will@kernel.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
crypto: authencesn - Fix src offset when decrypting in-place [+ + +]
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Apr 15 07:39:06 2026 +0800

    crypto: authencesn - Fix src offset when decrypting in-place
    
    commit 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa upstream.
    
    The src SG list offset wasn't set properly when decrypting in-place,
    fix it.
    
    Reported-by: Wolfgang Walter <linux@stwm.de>
    Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption")
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed [+ + +]
Author: Sean Christopherson <seanjc@google.com>
Date:   Fri Mar 13 10:43:16 2026 -0700

    crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
    
    commit abe4a6d6f606113251868c2c4a06ba904bb41eed upstream.
    
    When retrieving the PEK CSR, don't attempt to copy the blob to userspace
    if the firmware command failed.  If the failure was due to an invalid
    length, i.e. the userspace buffer+length was too small, copying the number
    of bytes _firmware_ requires will overflow the kernel-allocated buffer and
    leak data to userspace.
    
      BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
      BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
      BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
      Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405
    
      CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY
      Tainted: [U]=USER, [O]=OOT_MODULE
      Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025
      Call Trace:
       <TASK>
       dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120
       print_address_description ../mm/kasan/report.c:378 [inline]
       print_report+0xbc/0x260 ../mm/kasan/report.c:482
       kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595
       check_region_inline ../mm/kasan/generic.c:-1 [inline]
       kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200
       instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
       _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
       _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
       copy_to_user ../include/linux/uaccess.h:236 [inline]
       sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872
       sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562
       vfs_ioctl ../fs/ioctl.c:51 [inline]
       __do_sys_ioctl ../fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583
       do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x76/0x7e
       </TASK>
    
    WARN if the driver says the command succeeded, but the firmware error code
    says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any
    firwmware error.
    
    Reported-by: Alexander Potapenko <glider@google.com>
    Reported-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
    Fixes: e799035609e1 ("crypto: ccp: Implement SEV_PEK_CSR ioctl command")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed [+ + +]
Author: Sean Christopherson <seanjc@google.com>
Date:   Fri Mar 13 10:57:31 2026 -0700

    crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
    
    commit 4f685dbfa87c546e51d9dc6cab379d20f275e114 upstream.
    
    When retrieving the ID for the CPU, don't attempt to copy the ID blob to
    userspace if the firmware command failed.  If the failure was due to an
    invalid length, i.e. the userspace buffer+length was too small, copying
    the number of bytes _firmware_ requires will overflow the kernel-allocated
    buffer and leak data to userspace.
    
      BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
      BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
      BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
      Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388
    
      CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY
      Tainted: [U]=USER, [O]=OOT_MODULE
      Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025
      Call Trace:
       <TASK>
       dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120
       print_address_description ../mm/kasan/report.c:378 [inline]
       print_report+0xbc/0x260 ../mm/kasan/report.c:482
       kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595
       check_region_inline ../mm/kasan/generic.c:-1 [inline]
       kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200
       instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
       _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
       _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
       copy_to_user ../include/linux/uaccess.h:236 [inline]
       sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222
       sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575
       vfs_ioctl ../fs/ioctl.c:51 [inline]
       __do_sys_ioctl ../fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583
       do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x76/0x7e
       </TASK>
    
    WARN if the driver says the command succeeded, but the firmware error code
    says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any
    firwmware error.
    
    Reported-by: Alexander Potapenko <glider@google.com>
    Reported-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
    Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed [+ + +]
Author: Sean Christopherson <seanjc@google.com>
Date:   Fri Mar 13 10:48:53 2026 -0700

    crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
    
    commit e76239fed3cffd6d304d8ca3ce23984fd24f57d3 upstream.
    
    When retrieving the PDH cert, don't attempt to copy the blobs to userspace
    if the firmware command failed.  If the failure was due to an invalid
    length, i.e. the userspace buffer+length was too small, copying the number
    of bytes _firmware_ requires will overflow the kernel-allocated buffer and
    leak data to userspace.
    
      BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
      BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
      BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
      Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033
    
      CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY
      Tainted: [U]=USER, [O]=OOT_MODULE
      Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025
      Call Trace:
       <TASK>
       dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120
       print_address_description ../mm/kasan/report.c:378 [inline]
       print_report+0xbc/0x260 ../mm/kasan/report.c:482
       kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595
       check_region_inline ../mm/kasan/generic.c:-1 [inline]
       kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200
       instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]
       _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]
       _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26
       copy_to_user ../include/linux/uaccess.h:236 [inline]
       sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347
       sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568
       vfs_ioctl ../fs/ioctl.c:51 [inline]
       __do_sys_ioctl ../fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583
       do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x76/0x7e
       </TASK>
    
    WARN if the driver says the command succeeded, but the firmware error code
    says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any
    firwmware error.
    
    Reported-by: Alexander Potapenko <glider@google.com>
    Reported-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
    Fixes: 76a2b524a4b1 ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: krb5enc - fix async decrypt skipping hash verification [+ + +]
Author: Dudu Lu <phx0fer@gmail.com>
Date:   Mon Apr 20 12:40:27 2026 +0800

    crypto: krb5enc - fix async decrypt skipping hash verification
    
    commit 3bfbf5f0a99c991769ec562721285df7ab69240b upstream.
    
    krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher
    callback, which is the caller's own completion handler. When the
    skcipher completes asynchronously, this signals "done" to the caller
    without executing krb5enc_dispatch_decrypt_hash(), completely bypassing
    the integrity verification (hash check).
    
    Compare with the encrypt path which correctly uses
    krb5enc_encrypt_done as an intermediate callback to chain into the
    hash computation on async completion.
    
    Fix by adding krb5enc_decrypt_done as an intermediate callback that
    chains into krb5enc_dispatch_decrypt_hash() upon async skcipher
    completion, matching the encrypt path's callback pattern.
    
    Also fix EBUSY/EINPROGRESS handling throughout: remove
    krb5enc_request_complete() which incorrectly swallowed EINPROGRESS
    notifications that must be passed up to callers waiting on backlogged
    requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done
    for the dispatch_encrypt return value.
    
    Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm")
    Signed-off-by: Dudu Lu <phx0fer@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    Unset MAY_BACKLOG on the async completion path so the user won't
    see back-to-back EINPROGRESS notifications.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

crypto: krb5enc - fix sleepable flag handling in encrypt dispatch [+ + +]
Author: Wesley Atwell <atwellwea@gmail.com>
Date:   Mon Mar 9 00:26:24 2026 -0600

    crypto: krb5enc - fix sleepable flag handling in encrypt dispatch
    
    commit 2ef3bac16fb5e9eee4fb1d722578a79b751ea58a upstream.
    
    krb5enc_encrypt_ahash_done() continues encryption from an ahash
    completion callback by calling krb5enc_dispatch_encrypt().
    
    That helper takes a flags argument for this continuation path, but it
    ignored that argument and reused aead_request_flags(req) when setting
    up the skcipher subrequest callback. This can incorrectly preserve
    CRYPTO_TFM_REQ_MAY_SLEEP when the encrypt step is started from callback
    context.
    
    Preserve the original request flags but clear
    CRYPTO_TFM_REQ_MAY_SLEEP for the callback continuation path, and use
    the caller-supplied flags when setting up the skcipher subrequest.
    
    Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm")
    Assisted-by: Codex:GPT-5
    Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu: replace PASID IDR with XArray [+ + +]
Author: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Date:   Tue Mar 31 19:21:26 2026 +0500

    drm/amdgpu: replace PASID IDR with XArray
    
    commit 3c863ff920b45fa7a9b7d4cb932f466488a87a58 upstream.
    
    Replace the PASID IDR + spinlock with XArray as noted in the TODO
    left by commit ea56aa262570 ("drm/amdgpu: fix the idr allocation
    flags").
    
    The IDR conversion still has an IRQ safety issue:
    amdgpu_pasid_free() can be called from hardirq context via the fence
    signal path, but amdgpu_pasid_idr_lock is taken with plain spin_lock()
    in process context, creating a potential deadlock:
    
         CPU0
         ----
         spin_lock(&amdgpu_pasid_idr_lock)   // process context, IRQs on
         <Interrupt>
           spin_lock(&amdgpu_pasid_idr_lock) // deadlock
    
       The hardirq call chain is:
    
         sdma_v6_0_process_trap_irq
          -> amdgpu_fence_process
           -> dma_fence_signal
            -> drm_sched_job_done
             -> dma_fence_signal
              -> amdgpu_pasid_free_cb
               -> amdgpu_pasid_free
    
    Use XArray with XA_FLAGS_LOCK_IRQ (all xa operations use IRQ-safe
    locking internally) and XA_FLAGS_ALLOC1 (zero is not a valid PASID).
    Both xa_alloc_cyclic() and xa_erase() then handle locking
    consistently, fixing the IRQ safety issue and removing the need for
    an explicit spinlock.
    
    v8: squash in irq safe fix
    
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
    Fixes: ea56aa262570 ("drm/amdgpu: fix the idr allocation flags")
    Fixes: 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case")
    Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: Thomas Sowell <tom@ldtlb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
f2fs: fix to avoid memory leak in f2fs_rename() [+ + +]
Author: Chao Yu <chao@kernel.org>
Date:   Wed Mar 4 16:22:31 2026 +0800

    f2fs: fix to avoid memory leak in f2fs_rename()
    
    commit 3cf11e6f36c170050c12171dd6fd3142711478fc upstream.
    
    syzbot reported a f2fs bug as below:
    
    BUG: memory leak
    unreferenced object 0xffff888127f70830 (size 16):
      comm "syz.0.23", pid 6144, jiffies 4294943712
      hex dump (first 16 bytes):
        3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  <.Wr[...n..3B9..
      backtrace (crc 925f8a80):
        kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
        slab_post_alloc_hook mm/slub.c:4520 [inline]
        slab_alloc_node mm/slub.c:4844 [inline]
        __do_kmalloc_node mm/slub.c:5237 [inline]
        __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250
        kmalloc_noprof include/linux/slab.h:954 [inline]
        fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364
        f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143
        f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961
        f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308
        vfs_rename+0x7ff/0x1250 fs/namei.c:6026
        filename_renameat2+0x4f4/0x660 fs/namei.c:6144
        __do_sys_renameat2 fs/namei.c:6173 [inline]
        __se_sys_renameat2 fs/namei.c:6168 [inline]
        __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168
        do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
        do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
        entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    The root cause is in commit 40b2d55e0452 ("f2fs: fix to create selinux
    label during whiteout initialization"), we added a call to
    f2fs_setup_filename() without a matching call to f2fs_free_filename(),
    fix it.
    
    Fixes: 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization")
    Cc: stable@kernel.org
    Reported-by: syzbot+cf7946ab25b21abc4b66@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-f2fs-devel/69a75fe1.a70a0220.b118c.0014.GAE@google.com
    Suggested-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer [+ + +]
Author: Chao Yu <chao@kernel.org>
Date:   Mon Mar 9 02:22:37 2026 +0000

    f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
    
    commit 7b9161a605e91d0987e2596a245dc1f21621b23f upstream.
    
    syzbot reported a f2fs bug as below:
    
    BUG: KMSAN: uninit-value in f2fs_sanity_check_node_footer+0x374/0xa20 fs/f2fs/node.c:1520
     f2fs_sanity_check_node_footer+0x374/0xa20 fs/f2fs/node.c:1520
     f2fs_finish_read_bio+0xe1e/0x1d60 fs/f2fs/data.c:177
     f2fs_read_end_io+0x6ab/0x2220 fs/f2fs/data.c:-1
     bio_endio+0x1006/0x1160 block/bio.c:1792
     submit_bio_noacct+0x533/0x2960 block/blk-core.c:891
     submit_bio+0x57a/0x620 block/blk-core.c:926
     blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
     f2fs_submit_read_bio+0x12c/0x360 fs/f2fs/data.c:557
     f2fs_submit_page_bio+0xee2/0x1450 fs/f2fs/data.c:775
     read_node_folio+0x384/0x4b0 fs/f2fs/node.c:1481
     __get_node_folio+0x5db/0x15d0 fs/f2fs/node.c:1576
     f2fs_get_inode_folio+0x40/0x50 fs/f2fs/node.c:1623
     do_read_inode fs/f2fs/inode.c:425 [inline]
     f2fs_iget+0x1209/0x9380 fs/f2fs/inode.c:596
     f2fs_fill_super+0x8f5a/0xb2e0 fs/f2fs/super.c:5184
     get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694
     get_tree_bdev+0x38/0x50 fs/super.c:1717
     f2fs_get_tree+0x35/0x40 fs/f2fs/super.c:5436
     vfs_get_tree+0xb3/0x5d0 fs/super.c:1754
     fc_mount fs/namespace.c:1193 [inline]
     do_new_mount_fc fs/namespace.c:3763 [inline]
     do_new_mount+0x885/0x1dd0 fs/namespace.c:3839
     path_mount+0x7a2/0x20b0 fs/namespace.c:4159
     do_mount fs/namespace.c:4172 [inline]
     __do_sys_mount fs/namespace.c:4361 [inline]
     __se_sys_mount+0x704/0x7f0 fs/namespace.c:4338
     __x64_sys_mount+0xe4/0x150 fs/namespace.c:4338
     x64_sys_call+0x39f0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:166
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    The root cause is: in f2fs_finish_read_bio(), we may access uninit data
    in folio if we failed to read the data from device into folio, let's add
    a check condition to avoid such issue.
    
    Cc: stable@kernel.org
    Fixes: 50ac3ecd8e05 ("f2fs: fix to do sanity check on node footer in {read,write}_end_io")
    Reported-by: syzbot+9aac813cdc456cdd49f8@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-f2fs-devel/69a9ca26.a70a0220.305d9a.0000.GAE@google.com
    Signed-off-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally [+ + +]
Author: Chao Yu <chao@kernel.org>
Date:   Wed Mar 11 21:35:42 2026 +0800

    f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
    
    commit 6af249c996f7d73a3435f9e577956fa259347d18 upstream.
    
    Syzbot reported a f2fs bug as below:
    
    ------------[ cut here ]------------
    kernel BUG at fs/f2fs/segment.c:1900!
    Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
    CPU: 1 UID: 0 PID: 6527 Comm: syz.5.110 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
    RIP: 0010:f2fs_issue_discard_timeout+0x59b/0x5a0 fs/f2fs/segment.c:1900
    Code: d9 80 e1 07 80 c1 03 38 c1 0f 8c d6 fe ff ff 48 89 df e8 a8 5e fa fd e9 c9 fe ff ff e8 4e 46 94 fd 90 0f 0b e8 46 46 94 fd 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
    RSP: 0018:ffffc9000494f940 EFLAGS: 00010283
    RAX: ffffffff843009ca RBX: 0000000000000001 RCX: 0000000000080000
    RDX: ffffc9001ca78000 RSI: 00000000000029f3 RDI: 00000000000029f4
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
    R10: dffffc0000000000 R11: ffffed100893a431 R12: 1ffff1100893a430
    R13: 1ffff1100c2b702c R14: dffffc0000000000 R15: ffff8880449d2160
    FS:  00007ffa35fed6c0(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f2b68634000 CR3: 0000000039f62000 CR4: 00000000003526f0
    Call Trace:
     <TASK>
     __f2fs_remount fs/f2fs/super.c:2960 [inline]
     f2fs_reconfigure+0x108a/0x1710 fs/f2fs/super.c:5443
     reconfigure_super+0x227/0x8a0 fs/super.c:1080
     do_remount fs/namespace.c:3391 [inline]
     path_mount+0xdc5/0x10e0 fs/namespace.c:4151
     do_mount fs/namespace.c:4172 [inline]
     __do_sys_mount fs/namespace.c:4361 [inline]
     __se_sys_mount+0x31d/0x420 fs/namespace.c:4338
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7ffa37dbda0a
    
    The root cause is there will be race condition in between f2fs_ioc_fitrim()
    and f2fs_remount():
    
    - f2fs_remount                  - f2fs_ioc_fitrim
     - f2fs_issue_discard_timeout
      - __issue_discard_cmd
      - __drop_discard_cmd
      - __wait_all_discard_cmd
                                     - f2fs_trim_fs
                                      - f2fs_write_checkpoint
                                       - f2fs_clear_prefree_segments
                                        - f2fs_issue_discard
                                         - __issue_discard_async
                                          - __queue_discard_cmd
                                           - __update_discard_tree_range
                                            - __insert_discard_cmd
                                             - __create_discard_cmd
                                             : atomic_inc(&dcc->discard_cmd_cnt);
      - sanity check on dcc->discard_cmd_cnt (expect discard_cmd_cnt to be zero)
    
    This will only happen when fitrim races w/ remount rw, if we remount to
    readonly filesystem, remount will wait until mnt_pcp.mnt_writers to zero,
    that means fitrim is not in process at that time.
    
    Cc: stable@kernel.org
    Fixes: 2482c4325dfe ("f2fs: detect bug_on in f2fs_wait_discard_bios")
    Reported-by: syzbot+62538b67389ee582837a@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-f2fs-devel/69b07d7c.050a0220.8df7.09a1.GAE@google.com
    Signed-off-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() [+ + +]
Author: Yongpeng Yang <yangyongpeng@xiaomi.com>
Date:   Fri Feb 27 15:30:52 2026 +0800

    f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
    
    commit 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 upstream.
    
    The xfstests case "generic/107" and syzbot have both reported a NULL
    pointer dereference.
    
    The concurrent scenario that triggers the panic is as follows:
    
    F2FS_WB_CP_DATA write callback          umount
                                            - f2fs_write_checkpoint
                                             - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)
    - blk_mq_end_request
     - bio_endio
      - f2fs_write_end_io
       : dec_page_count(sbi, F2FS_WB_CP_DATA)
       : wake_up(&sbi->cp_wait)
                                            - kill_f2fs_super
                                             - kill_block_super
                                              - f2fs_put_super
                                               : iput(sbi->node_inode)
                                               : sbi->node_inode = NULL
       : f2fs_in_warm_node_list
        - is_node_folio // sbi->node_inode is NULL and panic
    
    The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and
    sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is
    decremented to zero. As a result, f2fs_in_warm_node_list() may
    dereference a NULL node_inode when checking whether a folio belongs to
    the node inode, leading to a panic.
    
    This patch fixes the issue by calling f2fs_in_warm_node_list() before
    decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the
    use-after-free condition.
    
    Cc: stable@kernel.org
    Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list")
    Reported-by: syzbot+6e4cb1cac5efc96ea0ca@syzkaller.appspotmail.com
    Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
    Reviewed-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() [+ + +]
Author: George Saad <geoo115@gmail.com>
Date:   Mon Mar 23 11:21:23 2026 +0000

    f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
    
    commit 39d4ee19c1e7d753dd655aebee632271b171f43a upstream.
    
    In f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring
    the F2FS_WB_CP_DATA counter to zero, unblocking
    f2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount
    CPU. The unmount path then proceeds to call
    f2fs_destroy_page_array_cache(sbi), which destroys
    sbi->page_array_slab via kmem_cache_destroy(), and eventually
    kfree(sbi). Meanwhile, the bio completion callback is still executing:
    when it reaches page_array_free(sbi, ...), it dereferences
    sbi->page_array_slab — a destroyed slab cache — to call
    kmem_cache_free(), causing a use-after-free.
    
    This is the same class of bug as CVE-2026-23234 (which fixed the
    equivalent race in f2fs_write_end_io() in data.c), but in the
    compressed writeback completion path that was not covered by that fix.
    
    Fix this by moving dec_page_count() to after page_array_free(), so
    that all sbi accesses complete before the counter decrement that can
    unblock unmount. For non-last folios (where atomic_dec_return on
    cic->pending_pages is nonzero), dec_page_count is called immediately
    before returning — page_array_free is not reached on this path, so
    there is no post-decrement sbi access. For the last folio,
    page_array_free runs while the F2FS_WB_CP_DATA counter is still
    nonzero (this folio has not yet decremented it), keeping sbi alive,
    and dec_page_count runs as the final operation.
    
    Fixes: 4c8ff7095bef ("f2fs: support data compression")
    Cc: stable@vger.kernel.org
    Signed-off-by: George Saad <geoo115@gmail.com>
    Reviewed-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fs/ntfs3: validate rec->used in journal-replay file record check [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Apr 9 16:37:15 2026 +0200

    fs/ntfs3: validate rec->used in journal-replay file record check
    
    commit 0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b upstream.
    
    check_file_record() validates rec->total against the record size but
    never validates rec->used.  The do_action() journal-replay handlers read
    rec->used from disk and use it to compute memmove lengths:
    
      DeleteAttribute:    memmove(attr, ..., used - asize - roff)
      CreateAttribute:    memmove(..., attr, used - roff)
      change_attr_size:   memmove(..., used - PtrOffset(rec, next))
    
    When rec->used is smaller than the offset of a validated attribute, or
    larger than the record size, these subtractions can underflow allowing
    us to copy huge amounts of memory in to a 4kb buffer, generally
    considered a bad idea overall.
    
    This requires a corrupted filesystem, which isn't a threat model the
    kernel really needs to worry about, but checking for such an obvious
    out-of-bounds value is good to keep things robust, especially on journal
    replay
    
    Fix this up by bounding rec->used correctly.
    
    This is much like commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds
    read in DeleteIndexEntryRoot") which checked different values in this
    same switch statement.
    
    Cc: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
    Cc: stable <stable@kernel.org>
    Assisted-by: gregkh_clanker_t1000
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fuse: abort on fatal signal during sync init [+ + +]
Author: Miklos Szeredi <mszeredi@redhat.com>
Date:   Mon Mar 16 14:10:00 2026 +0100

    fuse: abort on fatal signal during sync init
    
    commit 204aa22a686bfee48daca7db620c1e017615f2ff upstream.
    
    When sync init is used and the server exits for some reason (error, crash)
    while processing FUSE_INIT, the filesystem creation will hang.  The reason
    is that while all other threads will exit, the mounting thread (or process)
    will keep the device fd open, which will prevent an abort from happening.
    
    This is a regression from the async mount case, where the mount was done
    first, and the FUSE_INIT processing afterwards, in which case there's no
    such recursive syscall keeping the fd open.
    
    Fixes: dfb84c330794 ("fuse: allow synchronous FUSE_INIT")
    Cc: stable@vger.kernel.org # v6.18
    Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
    Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
    Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fuse: Check for large folio with SPLICE_F_MOVE [+ + +]
Author: Bernd Schubert <bschubert@ddn.com>
Date:   Sun Jan 11 12:48:07 2026 +0100

    fuse: Check for large folio with SPLICE_F_MOVE
    
    commit 59ba47b6be9cd0146ef9a55c6e32e337e11e7625 upstream.
    
    xfstest generic/074 and generic/075 complain result in kernel
    warning messages / page dumps.
    This is easily reproducible (on 6.19) with
    CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS=y
    CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS=y
    
    This just adds a test for large folios fuse_try_move_folio
    with the same page copy fallback, but to avoid the warnings
    from fuse_check_folio().
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Bernd Schubert <bschubert@ddn.com>
    Signed-off-by: Horst Birthelmer <hbirthelmer@ddn.com>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized [+ + +]
Author: Miklos Szeredi <mszeredi@redhat.com>
Date:   Thu Apr 2 20:19:55 2026 +0200

    fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized
    
    commit da6fcc6dbddbef80e603d2f0c1554a9f2ac03742 upstream.
    
    Use fuse_get_dev() not __fuse_get_dev() on the old fd, since in the case of
    synchronous INIT the caller will want to wait for the device file to be
    available for cloning, just like I/O wants to wait instead of returning an
    error.
    
    Fixes: dfb84c330794 ("fuse: allow synchronous FUSE_INIT")
    Cc: stable@vger.kernel.org # v6.18
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fuse: quiet down complaints in fuse_conn_limit_write [+ + +]
Author: Darrick J. Wong <djwong@kernel.org>
Date:   Mon Feb 23 15:06:50 2026 -0800

    fuse: quiet down complaints in fuse_conn_limit_write
    
    commit 129a45f9755a89f573c6a513a6b9e3d234ce89b0 upstream.
    
    gcc 15 complains about an uninitialized variable val that is passed by
    reference into fuse_conn_limit_write:
    
     control.c: In function ‘fuse_conn_congestion_threshold_write’:
     include/asm-generic/rwonce.h:55:37: warning: ‘val’ may be used uninitialized [-Wmaybe-uninitialized]
        55 |         *(volatile typeof(x) *)&(x) = (val);                            \
           |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
     include/asm-generic/rwonce.h:61:9: note: in expansion of macro ‘__WRITE_ONCE’
        61 |         __WRITE_ONCE(x, val);                                           \
           |         ^~~~~~~~~~~~
     control.c:178:9: note: in expansion of macro ‘WRITE_ONCE’
       178 |         WRITE_ONCE(fc->congestion_threshold, val);
           |         ^~~~~~~~~~
     control.c:166:18: note: ‘val’ was declared here
       166 |         unsigned val;
           |                  ^~~
    
    Unfortunately there's enough macro spew involved in kstrtoul_from_user
    that I think gcc gives up on its analysis and sprays the above warning.
    AFAICT it's not actually a bug, but we could just zero-initialize the
    variable to enable using -Wmaybe-uninitialized to find real problems.
    
    Previously we would use some weird uninitialized_var annotation to quiet
    down the warnings, so clearly this code has been like this for quite
    some time.
    
    Cc: stable@vger.kernel.org # v5.9
    Fixes: 3f649ab728cda8 ("treewide: Remove uninitialized_var() usage")
    Signed-off-by: Darrick J. Wong <djwong@kernel.org>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fuse: reject oversized dirents in page cache [+ + +]
Author: Samuel Page <sam@bynar.io>
Date:   Mon Apr 20 11:01:37 2026 +0200

    fuse: reject oversized dirents in page cache
    
    commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed upstream.
    
    fuse_add_dirent_to_cache() computes a serialized dirent size from the
    server-controlled namelen field and copies the dirent into a single
    page-cache page. The existing logic only checks whether the dirent fits
    in the remaining space of the current page and advances to a fresh page
    if not. It never checks whether the dirent itself exceeds PAGE_SIZE.
    
    As a result, a malicious FUSE server can return a dirent with
    namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB
    page systems this causes memcpy() to overflow the cache page by 24 bytes
    into the following kernel page.
    
    Reject dirents that cannot fit in a single page before copying them into
    the readdir cache.
    
    Fixes: 69e34551152a ("fuse: allow caching readdir")
    Cc: stable@vger.kernel.org # v6.16+
    Assisted-by: Bynario AI
    Signed-off-by: Samuel Page <sam@bynar.io>
    Reported-by: Qi Tang <tpluszz77@gmail.com>
    Reported-by: Zijun Hu <nightu@northwestern.edu>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Link: https://patch.msgid.link/20260420090139.662772-1-mszeredi@redhat.com
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ipv6: add NULL checks for idev in SRv6 paths [+ + +]
Author: Minhong He <heminhong@kylinos.cn>
Date:   Mon Mar 16 15:33:01 2026 +0800

    ipv6: add NULL checks for idev in SRv6 paths
    
    [ Upstream commit 06413793526251870e20402c39930804f14d59c0 ]
    
    __in6_dev_get() can return NULL when the device has no IPv6 configuration
    (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER).
    
    Add NULL checks for idev returned by __in6_dev_get() in both
    seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL
    pointer dereferences.
    
    Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
    Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support")
    Signed-off-by: Minhong He <heminhong@kylinos.cn>
    Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>
    Link: https://patch.msgid.link/20260316073301.106643-1-heminhong@kylinos.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment [+ + +]
Author: Tristan Madani <tristan@talencesecurity.com>
Date:   Fri Apr 17 19:33:17 2026 +0000

    ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
    
    commit 30010c952077a1c89ecdd71fc4d574c75a8f5617 upstream.
    
    smb2_get_ea() applies 4-byte alignment padding via memset() after
    writing each EA entry. The bounds check on buf_free_len is performed
    before the value memcpy, but the alignment memset fires unconditionally
    afterward with no check on remaining space.
    
    When the EA value exactly fills the remaining buffer (buf_free_len == 0
    after value subtraction), the alignment memset writes 1-3 NUL bytes
    past the buf_free_len boundary. In compound requests where the response
    buffer is shared across commands, the first command (e.g., READ) can
    consume most of the buffer, leaving a tight remainder for the QUERY_INFO
    EA response. The alignment memset then overwrites past the physical
    kvmalloc allocation into adjacent kernel heap memory.
    
    Add a bounds check before the alignment memset to ensure buf_free_len
    can accommodate the padding bytes.
    
    This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fix
    potencial OOB in get_file_all_info() for compound requests") and
    commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound
    requests"), both of which added bounds checks before unconditional
    writes in QUERY_INFO response handlers.
    
    Cc: stable@vger.kernel.org
    Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
    Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Mon Apr 20 12:38:53 2026 -0400

    ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
    
    [ Upstream commit 235e32320a470fcd3998fb3774f2290a0eb302a1 ]
    
    When a durable file handle survives session disconnect (TCP close without
    SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the
    handle for later reconnection. However, it did not clean up the byte-range
    locks on fp->lock_list.
    
    Later, when the durable scavenger thread times out and calls
    __ksmbd_close_fd(NULL, fp), the lock cleanup loop did:
    
        spin_lock(&fp->conn->llist_lock);
    
    This caused a slab use-after-free because fp->conn was NULL and the
    original connection object had already been freed by
    ksmbd_tcp_disconnect().
    
    The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were
    left dangling on the freed conn->lock_list while fp->conn was nulled out.
    
    To fix this issue properly, we need to handle the lifetime of
    smb_lock->clist across three paths:
     - Safely skip clist deletion when list is empty and fp->conn is NULL.
     - Remove the lock from the old connection's lock_list in
       session_fd_check()
     - Re-add the lock to the new connection's lock_list in
       ksmbd_reopen_durable_fd().
    
    Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
    Co-developed-by: munan Huang <munanevil@gmail.com>
    Signed-off-by: munan Huang <munanevil@gmail.com>
    Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Stable-dep-of: 49110a8ce654 ("ksmbd: validate owner of durable handle on reconnect")
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: require minimum ACE size in smb_check_perm_dacl() [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Tue Apr 14 15:15:33 2026 -0400

    ksmbd: require minimum ACE size in smb_check_perm_dacl()
    
    commit d07b26f39246a82399661936dd0c853983cfade7 upstream.
    
    Both ACE-walk loops in smb_check_perm_dacl() only guard against an
    under-sized remaining buffer, not against an ACE whose declared
    `ace->size` is smaller than the struct it claims to describe:
    
      if (offsetof(struct smb_ace, access_req) > aces_size)
          break;
      ace_size = le16_to_cpu(ace->size);
      if (ace_size > aces_size)
          break;
    
    The first check only requires the 4-byte ACE header to be in bounds;
    it does not require access_req (4 bytes at offset 4) to be readable.
    An attacker who has set a crafted DACL on a file they own can declare
    ace->size == 4 with aces_size == 4, pass both checks, and then
    
      granted |= le32_to_cpu(ace->access_req);               /* upper loop */
      compare_sids(&sid, &ace->sid);                         /* lower loop */
    
    reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at
    offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES
    * 4 bytes).
    
    Tighten both loops to require
    
      ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE
    
    which is the smallest valid on-wire ACE layout (4-byte header +
    4-byte access_req + 8-byte sid base with zero sub-auths).  Also
    reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES
    before letting compare_sids() dereference sub_auth[] entries.
    
    parse_sec_desc() already enforces an equivalent check (lines 441-448);
    smb_check_perm_dacl() simply grew weaker validation over time.
    
    Reachability: authenticated SMB client with permission to set an ACL
    on a file.  On a subsequent CREATE against that file, the kernel
    walks the stored DACL via smb_check_perm_dacl() and triggers the
    OOB read.  Not pre-auth, and the OOB read is not reflected to the
    attacker, but KASAN reports and kernel state corruption are
    possible.
    
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Assisted-by: Codex:gpt-5-4
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() [+ + +]
Author: DaeMyung Kang <charsyam@gmail.com>
Date:   Sun Apr 19 02:28:44 2026 +0900

    ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
    
    commit def036ef87f8641c1c525d5ae17438d7a1006491 upstream.
    
    rcount is intended to be connection-specific: 2 for curr_conn, 1 for
    every other connection sharing the same session.  However, it is
    initialised only once before the hash iteration and is never reset.
    After the loop visits curr_conn, later sibling connections are also
    checked against rcount == 2, so a sibling with req_running == 1 is
    incorrectly treated as idle.  This makes the outcome depend on the
    hash iteration order: whether a given sibling is checked against the
    loose (< 2) or the strict (< 1) threshold is decided by whether it
    happens to be visited before or after curr_conn.
    
    The function's contract is "wait until every connection sharing this
    session is idle" so that destroy_previous_session() can safely tear
    the session down.  The latched rcount violates that contract and
    reopens the teardown race window the wait logic was meant to close:
    destroy_previous_session() may proceed before sibling channels have
    actually quiesced, overlapping session teardown with in-flight work
    on those connections.
    
    Recompute rcount inside the loop so each connection is compared
    against its own threshold regardless of iteration order.
    
    This is a code-inspection fix for an iteration-order-dependent logic
    error; a targeted reproducer would require SMB3 multichannel with
    in-flight work on a sibling channel landing after curr_conn in hash
    order, which is not something that can be triggered reliably.
    
    Fixes: 76e98a158b20 ("ksmbd: fix race condition between destroy_previous_session() and smb2 operations()")
    Cc: stable@vger.kernel.org
    Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: use check_add_overflow() to prevent u16 DACL size overflow [+ + +]
Author: Tristan Madani <tristan@talencesecurity.com>
Date:   Fri Apr 17 19:54:57 2026 +0000

    ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
    
    commit 299f962c0b02d048fb45d248b4da493d03f3175d upstream.
    
    set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes
    in u16 variables. When a file has many POSIX ACL entries, the
    accumulated size can wrap past 65535, causing the pointer arithmetic
    (char *)pndace + *size to land within already-written ACEs. Subsequent
    writes then overwrite earlier entries, and pndacl->size gets a
    truncated value.
    
    Use check_add_overflow() at each accumulation point to detect the
    wrap before it corrupts the buffer, consistent with existing
    check_mul_overflow() usage elsewhere in smbacl.c.
    
    Cc: stable@vger.kernel.org
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Fri Apr 17 14:45:57 2026 -0400

    ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
    
    commit 3e4e2ea2a781018ed5d75f969e3e5606beb66e48 upstream.
    
    smb_inherit_dacl() trusts the on-disk num_aces value from the parent
    directory's DACL xattr and uses it to size a heap allocation:
    
      aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);
    
    num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces)
    without checking that it is consistent with the declared pdacl_size.
    An authenticated client whose parent directory's security.NTACL is
    tampered (e.g. via offline xattr corruption or a concurrent path that
    bypasses parse_dacl()) can present num_aces = 65535 with minimal
    actual ACE data.  This causes a ~8 MB allocation (not kzalloc, so
    uninitialized) that the subsequent loop only partially populates, and
    may also overflow the three-way size_t multiply on 32-bit kernels.
    
    Additionally, the ACE walk loop uses the weaker
    offsetof(struct smb_ace, access_req) minimum size check rather than
    the minimum valid on-wire ACE size, and does not reject ACEs whose
    declared size is below the minimum.
    
    Reproduced on UML + KASAN + LOCKDEP against the real ksmbd code path.
    A legitimate mount.cifs client creates a parent directory over SMB
    (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on
    the backing filesystem is rewritten to set num_aces = 0xFFFF while
    keeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s
    hash check still passes.  A subsequent SMB2 CREATE of a child under
    that parent drives smb2_open() into smb_inherit_dacl() (share has
    "vfs objects = acl_xattr" set), which fails the page allocator:
    
      WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0
      Workqueue: ksmbd-io handle_ksmbd_work
       __alloc_frozen_pages_noprof+0x46c/0x9c0
       ___kmalloc_large_node+0x68/0x130
       __kmalloc_large_node_noprof+0x24/0x70
       __kmalloc_noprof+0x4c9/0x690
       smb_inherit_dacl+0x394/0x2430
       smb2_open+0x595d/0xabe0
       handle_ksmbd_work+0x3d3/0x1140
    
    With the patch applied the added guard rejects the tampered value
    with -EINVAL before any large allocation runs, smb2_open() falls back
    to smb2_create_sd_buffer(), and the child is created with a default
    SD.  No warning, no splat.
    
    Fix by:
    
      1. Validating num_aces against pdacl_size using the same formula
         applied in parse_dacl().
    
      2. Replacing the raw kmalloc(sizeof * num_aces * 2) with
         kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe
         allocation.
    
      3. Tightening the per-ACE loop guard to require the minimum valid
         ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and
         rejecting under-sized ACEs, matching the hardening in
         smb_check_perm_dacl() and parse_dacl().
    
    v1 -> v2:
      - Replace the synthetic test-module splat in the changelog with a
        real-path UML + KASAN reproduction driven through mount.cifs and
        SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name
        in v1 since it does not exist in ksmbd.
      - Drop the commit-hash citation from the code comment per Namjae's
        review; keep the parse_dacl() pointer.
    
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: validate owner of durable handle on reconnect [+ + +]
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Mon Apr 20 12:38:54 2026 -0400

    ksmbd: validate owner of durable handle on reconnect
    
    [ Upstream commit 49110a8ce654bbe56bef7c5e44cce31f4b102b8a ]
    
    Currently, ksmbd does not verify if the user attempting to reconnect
    to a durable handle is the same user who originally opened the file.
    This allows any authenticated user to hijack an orphaned durable handle
    by predicting or brute-forcing the persistent ID.
    
    According to MS-SMB2, the server MUST verify that the SecurityContext
    of the reconnect request matches the SecurityContext associated with
    the existing open.
    Add a durable_owner structure to ksmbd_file to store the original opener's
    UID, GID, and account name. and catpure the owner information when a file
    handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()
    to validate the identity of the requester during SMB2_CREATE (DHnC).
    
    Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
    Reported-by: Davide Ornaghi <d.ornaghi97@gmail.com>
    Reported-by: Navaneeth K <knavaneeth786@gmail.com>
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ksmbd: validate response sizes in ipc_validate_msg() [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Wed Apr 15 07:25:00 2026 -0400

    ksmbd: validate response sizes in ipc_validate_msg()
    
    commit d6a6aa81eac2c9bff66dc6e191179cb69a14426b upstream.
    
    ipc_validate_msg() computes the expected message size for each
    response type by adding (or multiplying) attacker-controlled fields
    from the daemon response to a fixed struct size in unsigned int
    arithmetic.  Three cases can overflow:
    
      KSMBD_EVENT_RPC_REQUEST:
          msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;
      KSMBD_EVENT_SHARE_CONFIG_REQUEST:
          msg_sz = sizeof(struct ksmbd_share_config_response) +
                   resp->payload_sz;
      KSMBD_EVENT_LOGIN_REQUEST_EXT:
          msg_sz = sizeof(struct ksmbd_login_response_ext) +
                   resp->ngroups * sizeof(gid_t);
    
    resp->payload_sz is __u32 and resp->ngroups is __s32.  Each addition
    can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes
    signed and size_t, so a negative ngroups is converted to SIZE_MAX
    before the multiply.  A wrapped value of msg_sz that happens to
    equal entry->msg_sz bypasses the size check on the next line, and
    downstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,
    kmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the
    unverified length.
    
    Use check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST
    paths to detect integer overflow without constraining functional
    payload size; userspace ksmbd-tools grows NDR responses in 4096-byte
    chunks for calls like NetShareEnumAll, so a hard transport cap is
    unworkable on the response side.  For LOGIN_REQUEST_EXT, reject
    resp->ngroups outside the signed [0, NGROUPS_MAX] range up front and
    report the error from ipc_validate_msg() so it fires at the IPC
    boundary; with that bound the subsequent multiplication and addition
    stay well below UINT_MAX.  The now-redundant ngroups check and
    pr_err in ksmbd_alloc_user() are removed.
    
    This is the response-side analogue of aab98e2dbd64 ("ksmbd: fix
    integer overflows on 32 bit systems"), which hardened the request
    side.
    
    Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
    Fixes: a77e0e02af1c ("ksmbd: add support for supplementary groups")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Assisted-by: Codex:gpt-5-4
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
kunit: configs: Enable all CRC tests in all_tests.config [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:50 2026 -0700

    kunit: configs: Enable all CRC tests in all_tests.config
    
    commit 44ff3791d6295f7b51dd2711aad6a03dd79aef22 upstream.
    
    The new option CONFIG_CRC_ENABLE_ALL_FOR_KUNIT enables all the CRC code
    that has KUnit tests, causing CONFIG_KUNIT_ALL_TESTS to enable all these
    tests.  Add this option to all_tests.config so that kunit.py will run
    them when passed the --alltests option.
    
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Link: https://lore.kernel.org/r/20260314172224.15152-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

kunit: configs: Enable all crypto library tests in all_tests.config [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:53 2026 -0700

    kunit: configs: Enable all crypto library tests in all_tests.config
    
    commit 8d547482231fef30d0d6440629b73560ad3e937c upstream.
    
    The new option CONFIG_CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT enables all the
    crypto library code that has KUnit tests, causing CONFIG_KUNIT_ALL_TESTS
    to enable all these tests.  Add this option to all_tests.config so that
    kunit.py will run them when passed the --alltests option.
    
    Link: https://lore.kernel.org/r/20260314035927.51351-3-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
lib/crc: tests: Add a .kunitconfig file [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:49 2026 -0700

    lib/crc: tests: Add a .kunitconfig file
    
    commit c13cee2fc7f137dd25ed50c63eddcc578624f204 upstream.
    
    Add a .kunitconfig file to the lib/crc/ directory so that the CRC
    library tests can be run more easily using kunit.py.  Example with UML:
    
        tools/testing/kunit/kunit.py run --kunitconfig=lib/crc
    
    Example with QEMU:
    
        tools/testing/kunit/kunit.py run --kunitconfig=lib/crc --arch=arm64 --make_options LLVM=1
    
    Link: https://lore.kernel.org/r/20260306033557.250499-4-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:48 2026 -0700

    lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT
    
    commit cdf22aeaad8430905c3aa3b3d0f2686c65395c22 upstream.
    
    Now that crc_kunit uses the standard "depends on" pattern, enabling the
    full set of CRC tests is a bit difficult, mainly due to CRC7 being
    rarely used.  Add a kconfig option to make it easier.  It is visible
    only when KUNIT, so hopefully the extra prompt won't be too annoying.
    
    Link: https://lore.kernel.org/r/20260306033557.250499-3-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/crc: tests: Make crc_kunit test only the enabled CRC variants [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:47 2026 -0700

    lib/crc: tests: Make crc_kunit test only the enabled CRC variants
    
    commit 85c9f3a2b805eb96d899da7bcc38a16459aa3c16 upstream.
    
    Like commit 4478e8eeb871 ("lib/crypto: tests: Depend on library options
    rather than selecting them") did with the crypto library tests, make
    crc_kunit depend on the code it tests rather than selecting it.  This
    follows the standard convention for KUnit and fixes an issue where
    enabling KUNIT_ALL_TESTS enabled non-test code.
    
    crc_kunit does differ from the crypto library tests in that it
    consolidates the tests for multiple CRC variants, with 5 kconfig
    options, into one KUnit suite.  Since depending on *all* of these
    kconfig options would greatly restrict the ability to enable crc_kunit,
    instead just depend on *any* of these options.  Update crc_kunit
    accordingly to test only the reachable code.
    
    Alternatively we could split crc_kunit into 5 test suites.  But keeping
    it as one is simpler for now.
    
    Fixes: e47d9b1a76ed ("lib/crc_kunit.c: add KUnit test suite for CRC library functions")
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20260306033557.250499-2-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
lib/crypto: tests: Add a .kunitconfig file [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:51 2026 -0700

    lib/crypto: tests: Add a .kunitconfig file
    
    commit 20d6f07004d639967dcb00994d56ce6d16118e9e upstream.
    
    Add a .kunitconfig file to the lib/crypto/ directory so that the crypto
    library tests can be run more easily using kunit.py.  Example with UML:
    
        tools/testing/kunit/kunit.py run --kunitconfig=lib/crypto
    
    Example with QEMU:
    
        tools/testing/kunit/kunit.py run --kunitconfig=lib/crypto --arch=arm64 --make_options LLVM=1
    
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Link: https://lore.kernel.org/r/20260301040140.490310-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:54 2026 -0700

    lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS
    
    commit 6d80749becf8fc5ffa004194e578f79b558235ef upstream.
    
    Defaulting the crypto KUnit tests to KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
    instead of simply KUNIT_ALL_TESTS was originally intended to make it
    easy to enable all the crypto KUnit tests.  This additional default is
    nonstandard for KUnit tests, though, and it can cause all the KUnit
    tests to be built-in unexpectedly if CRYPTO_SELFTESTS is set.  It also
    constitutes a back-reference to crypto/ from lib/crypto/, which is
    something that we should be avoiding in order to get clean layering.
    
    Now that we provide a lib/crypto/.kunitconfig file that enables all
    crypto KUnit tests, let's consider that to be the supported way to
    enable all these tests, and drop the default of CRYPTO_SELFTESTS.
    
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Link: https://lore.kernel.org/r/20260317040626.5697-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT [+ + +]
Author: Eric Biggers <ebiggers@kernel.org>
Date:   Tue Apr 21 14:05:52 2026 -0700

    lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT
    
    commit ed1767442d919f57aaf83d69c33853da2644d902 upstream.
    
    For kunit.py to run all the crypto library tests when passed the
    --alltests option, tools/testing/kunit/configs/all_tests.config needs to
    enable options that satisfy the test dependencies.
    
    This is the same as what lib/crypto/.kunitconfig already does.
    However, the strategy that lib/crypto/.kunitconfig currently uses to
    select all the hidden library options isn't going to scale up well when
    it needs to be repeated in two places.
    
    Instead let's go ahead and introduce an option
    CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT that depends on KUNIT and selects all
    the crypto library options that have corresponding KUnit tests.
    
    Update lib/crypto/.kunitconfig to use this option.
    
    Link: https://lore.kernel.org/r/20260314035927.51351-2-ebiggers@kernel.org
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Linux: Linux 6.18.25 [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Apr 27 07:27:31 2026 -0600

    Linux 6.18.25
    
    Link: https://lore.kernel.org/r/20260424132430.006424517@linuxfoundation.org
    Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
    Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Tested-by: Peter Schneider <pschneider1968@googlemail.com>
    Tested-by: Mark Brown <broonie@kernel.org>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Brett A C Sheffield <bacs@librecast.net>
    Tested-by: Miguel Ojeda <ojeda@kernel.org>
    Tested-by: Wentao Guan <guanwentao@uniontech.com>
    Tested-by: Dileep Malepu <dileep.debian@gmail.com>
    Tested-by: Barry K. Nathan <barryn@pobox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() [+ + +]
Author: Bingquan Chen <patzilla007@gmail.com>
Date:   Sat Apr 18 19:20:06 2026 +0800

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
    
    commit 2c054e17d9d41f1020376806c7f750834ced4dc5 upstream.
    
    In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points
    directly into the mmap'd TX ring buffer shared with userspace. The
    kernel validates the header via __packet_snd_vnet_parse() but then
    re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent
    userspace thread can modify the vnet_hdr fields between validation
    and use, bypassing all safety checks.
    
    The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr
    to a stack-local variable. All other vnet_hdr consumers in the kernel
    (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX
    path is the only caller of virtio_net_hdr_to_skb() that reads directly
    from user-controlled shared memory.
    
    Fix this by copying vnet_hdr from the mmap'd ring buffer to a
    stack-local variable before validation and use, consistent with the
    approach used in packet_snd() and all other callers.
    
    Fixes: 1d036d25e560 ("packet: tpacket_snd gso and checksum offload")
    Signed-off-by: Bingquan Chen <patzilla007@gmail.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20260418112006.78823-1-patzilla007@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers [+ + +]
Author: Daniel Golle <daniel@makrotopia.org>
Date:   Tue Apr 21 16:11:30 2026 +0100

    net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
    
    commit 2dddb34dd0d07b01fa770eca89480a4da4f13153 upstream.
    
    The PPE enforces output frame size limits via per-tag-layer VLAN_MTU
    registers that the driver never initializes. The hardware defaults do
    not account for PPPoE overhead, causing the PPE to punt encapsulated
    frames back to the CPU instead of forwarding them.
    
    Initialize the registers at PPE start and on MTU changes using the
    maximum GMAC MTU. This is a conservative approximation -- the actual
    per-PPE requirement depends on egress path, but using the global
    maximum ensures the limits are never too small.
    
    Fixes: ba37b7caf1ed2 ("net: ethernet: mtk_eth_soc: add support for initializing the PPE")
    Signed-off-by: Daniel Golle <daniel@makrotopia.org>
    Link: https://patch.msgid.link/ec995ab8ce8be423267a1cc093147a74d2eb9d82.1775789829.git.daniel@makrotopia.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing [+ + +]
Author: Anderson Nascimento <anderson@allelesecurity.com>
Date:   Wed Apr 22 17:14:35 2026 +0100

    rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
    
    commit ac33733b10b484d666f97688561670afd5861383 upstream.
    
    In rxrpc_preparse(), there are two paths for parsing key payloads: the
    XDR path (for large payloads) and the non-XDR path (for payloads <= 28
    bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly
    validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR
    path fails to do so.
    
    This allows an unprivileged user to provide a very large ticket length.
    When this key is later read via rxrpc_read(), the total
    token size (toksize) calculation results in a value that exceeds
    AFSTOKEN_LENGTH_MAX, triggering a WARN_ON().
    
    [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]
    
    Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse()
    to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,
    bringing it into parity with the XDR parsing logic.
    
    Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing")
    Fixes: 84924aac08a4 ("rxrpc: Fix checker warning")
    Reported-by: Anderson Nascimento <anderson@allelesecurity.com>
    Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: Jeffrey Altman <jaltman@auristor.com>
    cc: Simon Horman <horms@kernel.org>
    cc: linux-afs@lists.infradead.org
    cc: stable@kernel.org
    Link: https://patch.msgid.link/20260422161438.2593376-7-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sched/debug: Fix avg_vruntime() usage [+ + +]
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Wed Apr 1 15:20:21 2026 +0200

    sched/debug: Fix avg_vruntime() usage
    
    commit e08d007f9d813616ce7093600bc4fdb9c9d81d89 upstream.
    
    John reported that stress-ng-yield could make his machine unhappy and
    managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
    zero_vruntime tracking").
    
    The commit in question changes avg_vruntime() from a function that is
    a pure reader, to a function that updates variables. This turns an
    unlocked sched/debug usage of this function from a minor mistake into
    a data corruptor.
    
    Fixes: af4cf40470c2 ("sched/fair: Add cfs_rq::avg_vruntime")
    Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
    Reported-by: John Stultz <jstultz@google.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
    Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
    Tested-by: John Stultz <jstultz@google.com>
    Link: https://patch.msgid.link/20260401132355.196370805@infradead.org
    Signed-off-by: John Stultz <jstultz@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
scripts/dtc: Remove unused dts_version in dtc-lexer.l [+ + +]
Author: Nathan Chancellor <nathan@kernel.org>
Date:   Mon Apr 20 17:36:46 2026 -0700

    scripts/dtc: Remove unused dts_version in dtc-lexer.l
    
    This patch is for stable only. Commit 5a09df20872c ("scripts/dtc: Update
    to upstream version v1.7.2-69-g53373d135579") upstream applied it as
    part of a regular scripts/dtc sync, which may be unsuitable for older
    versions of stable where the warning it fixes is present.
    
    A recent strengthening of -Wunused-but-set-variable (enabled with -Wall)
    in clang under a new subwarning, -Wunused-but-set-global, points out an
    unused static global variable in dtc-lexer.lex.c (compiled from
    dtc-lexer.l):
    
      scripts/dtc/dtc-lexer.lex.c:641:12: warning: variable 'dts_version' set but not used [-Wunused-but-set-global]
        641 | static int dts_version = 1;
            |            ^
    
    Remove it to clear up the warning, as it is truly unused.
    
    Fixes: 658f29a51e98 ("of/flattree: Update dtc to current mainline.")
    Signed-off-by: Nathan Chancellor <nathan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
scripts: generate_rust_analyzer.py: define scripts [+ + +]
Author: Tamir Duberstein <tamird@kernel.org>
Date:   Mon Apr 20 12:05:50 2026 -0400

    scripts: generate_rust_analyzer.py: define scripts
    
    [ Upstream commit 36c619f6bd793493294becb10a02fea370b67a91 ]
    
    Add IDE support for host-side scripts written in Rust. This support has
    been missing since these scripts were initially added in commit
    9a8ff24ce584 ("scripts: add `generate_rust_target.rs`"), thus add it.
    
    Change the existing instance of extension stripping to
    `pathlib.Path.stem` to maintain code consistency.
    
    Fixes: 9a8ff24ce584 ("scripts: add `generate_rust_target.rs`")
    Cc: stable@vger.kernel.org
    Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
    Reviewed-by: Fiona Behrens <me@kloenk.dev>
    Reviewed-by: Trevor Gross <tmgross@umich.edu>
    Link: https://patch.msgid.link/20260122-rust-analyzer-scripts-v1-1-ff6ba278170e@kernel.org
    Signed-off-by: Tamir Duberstein <tamird@kernel.org>
    [ changed `[std]` dep to `["std"]` and kept untyped `is_root_crate()` ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Sun Apr 19 19:35:19 2026 -0400

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
    
    commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e upstream.
    
    smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
    and the default QUERY_INFO path.  The QUERY_INFO branch clamps
    qi.input_buffer_length to the server-reported OutputBufferLength and then
    copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but
    it never verifies that the flexible-array payload actually fits within
    rsp_iov[1].iov_len.
    
    A malicious server can return OutputBufferLength larger than the actual
    QUERY_INFO response, causing copy_to_user() to walk past the response
    buffer and expose adjacent kernel heap to userspace.
    
    Guard the QUERY_INFO copy with a bounds check on the actual Buffer
    payload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)
    rather than an open-coded addition so the guard cannot overflow on
    32-bit builds.
    
    Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools")
    Cc: stable@vger.kernel.org
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Assisted-by: Claude:claude-opus-4-6
    Assisted-by: Codex:gpt-5-4
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

smb: client: require a full NFS mode SID before reading mode bits [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Mon Apr 20 09:50:58 2026 -0400

    smb: client: require a full NFS mode SID before reading mode bits
    
    commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21 upstream.
    
    parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS
    mode SID and reads sid.sub_auth[2] to recover the mode bits.
    
    That assumes the ACE carries three subauthorities, but compare_sids()
    only compares min(a, b) subauthorities.  A malicious server can return
    an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still
    matches sid_unix_NFS_mode and then drives the sub_auth[2] read four
    bytes past the end of the ACE.
    
    Require num_subauth >= 3 before treating the ACE as an NFS mode SID.
    This keeps the fix local to the special-SID mode path without changing
    compare_sids() semantics for the rest of cifsacl.
    
    Fixes: e2f8fbfb8d09 ("cifs: get mode bits from special sid on stat")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

smb: server: fix active_num_conn leak on transport allocation failure [+ + +]
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Tue Apr 14 18:54:38 2026 -0400

    smb: server: fix active_num_conn leak on transport allocation failure
    
    commit 6551300dc452ac16a855a83dbd1e74899542d3b3 upstream.
    
    Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in
    ksmbd_tcp_new_connection()") addressed the kthread_run() failure
    path.  The earlier alloc_transport() == NULL path in the same
    function has the same leak, is reachable pre-authentication via any
    TCP connect to port 445, and was empirically reproduced on UML
    (ARCH=um, v7.0-rc7): a small number of forced allocation failures
    were sufficient to put ksmbd into a state where every subsequent
    connection attempt was rejected for the remainder of the boot.
    
    ksmbd_kthread_fn() increments active_num_conn before calling
    ksmbd_tcp_new_connection() and discards the return value, so when
    alloc_transport() returns NULL the socket is released and -ENOMEM
    returned without decrementing the counter.  Each such failure
    permanently consumes one slot from the max_connections pool; once
    cumulative failures reach the cap, atomic_inc_return() hits the
    threshold on every subsequent accept and every new connection is
    rejected.  The counter is only reset by module reload.
    
    An unauthenticated remote attacker can drive the server toward the
    memory pressure that makes alloc_transport() fail by holding open
    connections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN
    (0x00FFFFFF); natural transient allocation failures on a loaded
    host produce the same drift more slowly.
    
    Mirror the existing rollback pattern in ksmbd_kthread_fn(): on the
    alloc_transport() failure path, decrement active_num_conn gated on
    server_conf.max_connections.
    
    Repro details: with the patch reverted, forced alloc_transport()
    NULL returns leaked counter slots and subsequent connection
    attempts -- including legitimate connects issued after the
    forced-fail window had closed -- were all rejected with "Limit the
    maximum number of connections".  With this patch applied, the same
    connect sequence produces no rejections and the counter cycles
    cleanly between zero and one on every accept.
    
    Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter")
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-6
    Assisted-by: Codex:gpt-5-4
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

smb: server: fix max_connections off-by-one in tcp accept path [+ + +]
Author: DaeMyung Kang <charsyam@gmail.com>
Date:   Fri Apr 17 06:17:35 2026 +0900

    smb: server: fix max_connections off-by-one in tcp accept path
    
    commit ce23158bfe584bd90d1918f279fdf9de57802012 upstream.
    
    The global max_connections check in ksmbd's TCP accept path counts
    the newly accepted connection with atomic_inc_return(), but then
    rejects the connection when the result is greater than or equal to
    server_conf.max_connections.
    
    That makes the effective limit one smaller than configured. For
    example:
    
    - max_connections=1 rejects the first connection
    - max_connections=2 allows only one connection
    
    The per-IP limit in the same function uses <= correctly because it
    counts only pre-existing connections. The global limit instead checks
    the post-increment total, so it should reject only when that total
    exceeds the configured maximum.
    
    Fix this by changing the comparison from >= to >, so exactly
    max_connections simultaneous connections are allowed and the next one
    is rejected. This matches the documented meaning of max_connections
    in fs/smb/server/ksmbd_netlink.h as the "Number of maximum simultaneous
    connections".
    
    Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter")
    Cc: stable@vger.kernel.org
    Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
writeback: Fix use after free in inode_switch_wbs_work_fn() [+ + +]
Author: Jan Kara <jack@suse.cz>
Date:   Mon Apr 13 11:36:19 2026 +0200

    writeback: Fix use after free in inode_switch_wbs_work_fn()
    
    commit 6689f01d6740cf358932b3e97ee968c6099800d9 upstream.
    
    inode_switch_wbs_work_fn() has a loop like:
    
      wb_get(new_wb);
      while (1) {
        list = llist_del_all(&new_wb->switch_wbs_ctxs);
        /* Nothing to do? */
        if (!list)
          break;
        ... process the items ...
      }
    
    Now adding of items to the list looks like:
    
    wb_queue_isw()
      if (llist_add(&isw->list, &wb->switch_wbs_ctxs))
        queue_work(isw_wq, &wb->switch_work);
    
    Because inode_switch_wbs_work_fn() loops when processing isw items, it
    can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is
    empty. This is a problem because in that case wb can get freed (no isw
    items -> no wb reference) while the work is still pending causing
    use-after-free issues.
    
    We cannot just fix this by cancelling work when freeing wb because that
    could still trigger problematic 0 -> 1 transitions on wb refcount due to
    wb_get() in inode_switch_wbs_work_fn(). It could be all handled with
    more careful code but that seems unnecessarily complex so let's avoid
    that until it is proven that the looping actually brings practical
    benefit. Just remove the loop from inode_switch_wbs_work_fn() instead.
    That way when wb_queue_isw() queues work, we are guaranteed we have
    added the first item to wb->switch_wbs_ctxs and nobody is going to
    remove it (and drop the wb reference it holds) until the queued work
    runs.
    
    Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")
    CC: stable@vger.kernel.org
    Signed-off-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz
    Acked-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>