5.10.261-rc1 review

This is the start of the stable review cycle for the 5.10.261 release. There are 699 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.261-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.261-rc1

Taehee Yoo <[email protected]>
mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()

Eric Dumazet <[email protected]>
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()

Nikita Zhandarovich <[email protected]>
ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work

Taehee Yoo <[email protected]>
net: mld: fix reference count leak in mld_{query | report}_work()

Eric Dumazet <[email protected]>
ipv6: fix lockdep splat in in6_dump_addrs()

Ignat Korchagin <[email protected]>
ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()

Kristian Evensen <[email protected]>
net: ethernet: rmnet: Always subtract MAP header

Yue Haibing <[email protected]>

    ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

Taehee Yoo <[email protected]>
mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix odr switching to same value

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: fix frequency setting when chip is off

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix regressions caused by reusing ident

Marc Zyngier <[email protected]>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

Zhan Xusheng <[email protected]>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

Ricardo Robaina <[email protected]>
audit: fix potential integer overflow in audit_log_n_hex()

Ricardo Robaina <[email protected]>
audit: add audit_log_nf_skb helper function

Giovanni Cabiddu <[email protected]>
crypto: qat - validate RSA CRT component lengths

Ahsan Atta <[email protected]>
crypto: qat - fix restarting state leak on allocation failure

Qu Wenruo <[email protected]>
btrfs: do not trim a device which is not writeable

Neill Kapron <[email protected]>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A

Uwe Kleine-König <[email protected]>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0

Krzysztof Kozlowski <[email protected]>
crypto: atmel-sha204a - Mark OF related data as maybe unused

Tyler Baker <[email protected]>
usb: gadget: f_fs: initialize reset_work at allocation time

Andy Yan <[email protected]>
usb: typec: tcpm: Fix VDM type for Enter Mode commands

Mauricio Faria de Oliveira <[email protected]>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

Fan Wu <[email protected]>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

Uwe Kleine-König <[email protected]>
gpio: pca953x: Make platform teardown callback return void

Uwe Kleine-König <[email protected]>
leds: lm3601x: Improve error reporting for problems during .remove()

Uwe Kleine-König <[email protected]>
leds: lm3697: Remove duplicated error reporting in .remove()

Uwe Kleine-König <[email protected]>
drm/i2c/sil164: Drop no-op remove function

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write buffer corruption

Oliver Neukum <[email protected]>
usb: iowarrior: remove inherent race with minor number

Dawei Feng <[email protected]>
usb: free iso schedules on failed submit

Xu Rao <[email protected]>
usb: gadget: f_printer: take kref only for successful open

Andrzej Pietrasiewicz <[email protected]>
usb: gadget: function: Simplify diagnostic messaging in printer

Tristan Madani <[email protected]>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Viacheslav Dubeyko <[email protected]>
hfs/hfsplus: prevent getting negative values of offset/length

Yousef Alhouseen <[email protected]>
xfs: use null daddr for unset first bad log block

Alexey Nepomnyashih <[email protected]>
xfs: fix unreachable BIGTIME check in dquot flush validation

Dave Chinner <[email protected]>
xfs: reflect sb features in xfs_mount

Andy Shevchenko <[email protected]>
serial: 8250_mid: Disable DMA for selected platforms

Ilpo Järvinen <[email protected]>

    serial: 8250_mid: Remove 8250_pci usage

Manish Khadka <[email protected]>
HID: appleir: fix UAF on pending key_up_timer in remove()

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (part 1)

Fushuai Wang <[email protected]>

    cpufreq: intel_pstate: Sync policy->cur during CPU offline

Trung Nguyen <[email protected]>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags

Angela Czubak <[email protected]>
HID: add haptics page defines

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (FD links)

Christoph Hellwig <[email protected]>
proc: rename proc_setattr to proc_nochmod_setattr

Thomas Weißschuh <[email protected]>
proc: use generic setattr() for /proc/$PID/net

Lukas Wunner <[email protected]>
X.509: Fix validation of ASN.1 certificate header

Baokun Li <[email protected]>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

Zihan Xi <[email protected]>
smb: client: harden POSIX SID length parsing

Zihan Xi <[email protected]>
smb: client: use unaligned reads in parse_posix_ctxt()

Norbert Manthey <[email protected]>
smb: client: mask server-provided mode to 07777 in modefromsid

Haoxiang Li <[email protected]>
smb: client: Fix next buffer leak in receive_encrypted_standard()

Runyu Xiao <[email protected]>

    Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not tracking outstanding TX ident

Florian Westphal <[email protected]>
netfilter: ebtables: zero chainstack array

Qianfeng Rong <[email protected]>
netfilter: ebtables: Use vmalloc_array() to improve code

Runyu Xiao <[email protected]>
coresight: etb10: restore atomic_t for shared reading state

Marco Nenciarini <[email protected]>
PCI: Skip Resizable BAR restore on read error

Ilpo Järvinen <[email protected]>
PCI: Move Resizable BAR code to rebar.c

Ilpo Järvinen <[email protected]>
PCI: Add kerneldoc for pci_resize_resource()

Ilpo Järvinen <[email protected]>
PCI: Fix restoring BARs on BAR resize rollback path

Ilpo Järvinen <[email protected]>
PCI: Free saved list without holding pci_bus_sem

Ilpo Järvinen <[email protected]>
PCI: Prevent resource tree corruption when BAR resize fails

Giovanni Cabiddu <[email protected]>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove DBG_871X log argument

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Fix IRQ domain leak when port fails to enable

Christian Marangi <[email protected]>
PCI: mediatek: Convert bool to single quirks entry and bitmap

Jiri Slaby (SUSE) <[email protected]>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Franziska Naepelt <[email protected]>
staging: rtl8723bs: Fix space issues

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

Michael Straube <[email protected]>
staging: rtl8723bs: clean up comparsions to NULL

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove commented out condition

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove 5Ghz code blocks

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove 5Ghz code related to channel plan definition

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove all 5Ghz network types

Fabio Aiuto <[email protected]>
staging: rtl8723bs: remove commented out RT_ASSERT occurrences

Fabio Aiuto <[email protected]>
staging: rtl8723bs: split too long line

Richard Zhu <[email protected]>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling

Shoichiro Miyamoto <[email protected]>
smb: client: restrict implied bcc[0] exemption to responses without data area

Enzo Matsumiya <[email protected]>
cifs: remove unused server parameter from calc_smb_size()

Enzo Matsumiya <[email protected]>
smb2: small refactor in smb2_check_message()

Jakob Koschel <[email protected]>
cifs: remove check of list iterator against head past the loop body

Ronnie Sahlberg <[email protected]>
cifs: Create a new shared file holding smb2 pdu definitions

Arnd Bergmann <[email protected]>
staging: media: atomisp: reduce load_primary_binaries() stack usage

Martiros Shakhzadyan <[email protected]>
media: staging: media: atomisp: Fix alignment and line length issues

Martiros Shakhzadyan <[email protected]>
media: staging: media: atomisp: Replace if else clause with a ternary

Martiros Shakhzadyan <[email protected]>
media: staging: media: atomisp: Fix the rest of sh_css.c brace issues

Martiros Shakhzadyan <[email protected]>
media: staging: media: atomisp: Fix sh_css.c brace coding style issues

Aditya Srivastava <[email protected]>
media: atomisp: replace boolean comparison of values with bool variables

Mahesh Vaidya <[email protected]>
PCI: altera: Fix resource leaks on probe failure

Carlos Llamas <[email protected]>
binder: fix UAF in binder_free_transaction()

Alex Williamson <[email protected]>
vfio/pci: Release the VGA arbiter client on register_device() failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix wakeup source leak on probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on marvell probe failure

Luiz Augusto von Dentz <[email protected]>
Bluetooth: btintel: Check firmware version before download

Kiran K <[email protected]>
Bluetooth: btintel: Fix offset calculation boot address parameter

Zhao Dongdong <[email protected]>
ALSA: aoa: check snd_ctl_new1() return value

Herman van Hazendonk <[email protected]>
iio: common: st_sensors: honour channel endianness in read_axis_data

Alexander Lobakin <[email protected]>
bitops: make BYTES_TO_BITS() treewide-available

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: stabilized timestamp in interrupt

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix timestamp glitches when switching frequency

Colin Ian King <[email protected]>
iio: invensense: remove redundant initialization of variable period

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: use the common inv_sensors timestamp module

Jean-Baptiste Maneyrol <[email protected]>
iio: make invensense timestamp module generic

Jean-Baptiste Maneyrol <[email protected]>
iio: move inv_icm42600 timestamp module in common

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: make timestamp module chip independent

Zhang Lixu <[email protected]>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

Runyu Xiao <[email protected]>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

Sven Eckelmann <[email protected]>
batman-adv: clean untagged VLAN on netdev registration failure

Eric Biggers <[email protected]>
crypto: crypto4xx - Remove insecure and unused rng_alg

Herbert Xu <[email protected]>
crypto: crypto4xx - Remove ahash-related code

Aditya Srivastava <[email protected]>
crypto: amcc - fix incorrect kernel-doc comment syntax in files

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: fsl_ifc: return errors for failed page reads

Runyu Xiao <[email protected]>
mmc: vub300: defer reset until cmd_mutex is unlocked

Pengpeng Hou <[email protected]>
mtd: onenand: samsung: report DMA completion timeouts

Rafael Beims <[email protected]>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Zhiling Zou <[email protected]>
wifi: mac80211: free ack status frame on TX header build failure

Junrui Luo <[email protected]>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

Zhao Dongdong <[email protected]>
reset: sunxi: fix memory region leak on ioremap failure

Robby Cai <[email protected]>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ

Julian Anastasov <[email protected]>
ipvs: fix more places with wrong ipv6 transport offsets

Maoyi Xie <[email protected]>
memstick: ms_block: reject a card that reports too many blocks

James Raphael Tiovalen <[email protected]>
macsec: fix promiscuity refcount leak in macsec_dev_open()

Xuanqiang Luo <[email protected]>
llc: fix SAP refcount leak when creating incoming sockets

Laxman Acharya Padhya <[email protected]>
Bluetooth: btrtl: validate firmware patch bounds

Abhishek Ojha <[email protected]>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Dawei Feng <[email protected]>

    wifi: mac80211: fix memory leak in ieee80211_register_hw()

Runyu Xiao <[email protected]>
wifi: rt2x00: avoid full teardown before work setup in probe

Farhad Alemi <[email protected]>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Michael Bommarito <[email protected]>
drbd: reject data replies with an out-of-range payload size

Yizhou Zhao <[email protected]>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in SCTP state lookup

Shuangpeng Bai <[email protected]>
llc: fix SAP refcount leak in llc_ui_autobind()

Yousef Alhouseen <[email protected]>
mac802154: remove interfaces with RCU list deletion

Gerald Schaefer <[email protected]>
s390/monwriter: Reject buffer reuse with different data length

HyeongJun An <[email protected]>
hwmon: (asus_atk0110) Check package count before accessing element

Wentao Liang <[email protected]>
ata: pata_pxa: Fix DMA channel leak on probe error

Bryam Vargas <[email protected]>
orangefs: keep the readdir entry size 64-bit in fill_from_part()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix double addition of offset for @+FOFFSET

Bryam Vargas <[email protected]>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Haoxiang Li <[email protected]>
fsl/fman: Free init resources on KeyGen failure in fman_init()

Haoxiang Li <[email protected]>
net: liquidio: fix BAR resource leak on PF number failure

Pengpeng Hou <[email protected]>
hwmon: (w83793) remove vrm sysfs file on probe failure

Pengpeng Hou <[email protected]>
hwmon: (w83627hf) remove VID sysfs files on error and remove

Abdun Nihaal <[email protected]>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()

Davidlohr Bueso <[email protected]>
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Keenan Dong <[email protected]>
rtmutex: Use waiter::task instead of current in remove_waiter()

Sven Eckelmann <[email protected]>
batman-adv: ensure minimal ethernet header on TX

Sven Eckelmann <[email protected]>
batman-adv: retrieve ethhdr after potential skb realloc on RX

Shivam Kumar <[email protected]>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure

Michael Bommarito <[email protected]>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

Michael Bommarito <[email protected]>
ieee802154: admin-gate legacy LLSEC dump operations

Maoyi Xie <[email protected]>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

Dawei Feng <[email protected]>
net: ena: clean up XDP TX queues when regular TX setup fails

Maoyi Xie <[email protected]>
net: sit: require CAP_NET_ADMIN in the device netns for changelink

Andreas Kemnade <[email protected]>
gpios: palmas: add .get_direction() op

Bradley Morgan <[email protected]>
cpu: hotplug: Preserve per instance callback errors

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix DMA mapping violation in line setup

Dmitry Torokhov <[email protected]>
Input: ims-pcu - add response length checks

Dmitry Torokhov <[email protected]>
Input: ims-pcu - validate control endpoint type

Dmitry Torokhov <[email protected]>
Input: ims-pcu - release data interface on disconnect

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix use-after-free and double-free in disconnect

Bryam Vargas <[email protected]>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Xu Rao <[email protected]>
scsi: sg: Report request-table problems when any status is set

Haoxiang Li <[email protected]>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

Mikulas Patocka <[email protected]>
dm-verity: increase sprintf buffer size

Mikulas Patocka <[email protected]>
dm_early_create: fix freeing used table on dm_resume failure

Mikulas Patocka <[email protected]>
dm-stats: fix merge accounting

Mikulas Patocka <[email protected]>
dm-stats: fix dm_jiffies_to_msec64

Benjamin Marzinski <[email protected]>
dm-log: fix a bitset_size overflow on 32bit machines

Mikulas Patocka <[email protected]>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard

Samuel Moelius <[email protected]>
dm era: fix out-of-bounds memory access for non-zero start sector

Ming-Hung Tsai <[email protected]>
dm thin metadata: fix metadata snapshot consistency on commit failure

Genjian Zhang <[email protected]>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Oliver Hartkopp <[email protected]>
can: bcm: add missing rcu list annotations and operations

Oliver Hartkopp <[email protected]>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

Oliver Hartkopp <[email protected]>
can: isotp: use unconditional synchronize_rcu() in isotp_release()

Bryam Vargas <[email protected]>
nvmet-rdma: handle inline data with a nonzero offset

Weiming Shi <[email protected]>
sctp: validate STALE_COOKIE cause length before reading staleness

Kunihiko Hayashi <[email protected]>
spi: uniphier: Fix completion initialization order before devm_request_irq()

Wang Yan <[email protected]>
time: Fix off-by-one in compat settimeofday() usec validation

Jaewon Yang <[email protected]>
tpm: Make the TPM character devices non-seekable

Thorsten Blum <[email protected]>
tpm: fix event_size output in tpm1_binary_bios_measurements_show

Maoyi Xie <[email protected]>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

Sanman Pradhan <[email protected]>
xfrm: use compat translator only for u64 alignment mismatch

Wentao Liang <[email protected]>
xen/gntdev: fix error handling in ioctl

Xuanqiang Luo <[email protected]>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

Roman Vivchar <[email protected]>
i2c: mediatek: fix WRRD for SoCs without auto_restart option

Bhargav Joshi <[email protected]>
irqchip/crossbar: Use correct index in crossbar_domain_free()

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

Michael Bommarito <[email protected]>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters

Michael Bommarito <[email protected]>
ocfs2: reject dinodes whose i_rdev disagrees with the file type

Michael Bommarito <[email protected]>
ocfs2: reject dinodes with non-canonical i_mode type

Ian Bridges <[email protected]>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

Kyle Zeng <[email protected]>
ocfs2: avoid moving extents to occupied clusters

Arseniy Krasnov <[email protected]>
mtd: rawnand: fix condition in 'nand_select_target()'

Tristan Madani <[email protected]>
ocfs2: use kzalloc for quota recovery bitmap allocation

Martin Wilck <[email protected]>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()

Ruoyu Wang <[email protected]>
mtd: slram: remove failed entries from the device list

Krzysztof Wilczyński <[email protected]>
proc: only bump parent nlink when registering directories

WenTao Liang <[email protected]>
power: supply: charger-manager: fix refcount leak in is_full_charged()

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix device reference leak in probe

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix kfree() of static object

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix gio device memory leak

Chuck Lever <[email protected]>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

Chuck Lever <[email protected]>
lockd: Plug nlm_file leak when nlm_do_fopen() fails

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arenas on btt_init() error paths

Bartosz Golaszewski <[email protected]>
mfd: tps6586x: Fix OF node refcount

Sven Eckelmann <[email protected]>
batman-adv: tt: prevent TVLV OOB check overflow

Sven Eckelmann <[email protected]>
batman-adv: frag: fix primary_if leak on failed linearization

Sven Eckelmann <[email protected]>
batman-adv: frag: free unfragmentable packet

Sven Eckelmann <[email protected]>
batman-adv: fix VLAN priority offset

Sven Eckelmann <[email protected]>
batman-adv: tt: avoid request storms during pending request

Sven Eckelmann <[email protected]>
batman-adv: dat: fix tie-break for candidate selection

Sven Eckelmann <[email protected]>
batman-adv: dat: ensure accessible eth_hdr proto field

Sven Eckelmann <[email protected]>
batman-adv: bla: reacquire gw address after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: dat: acquire ARP hw source only after skb realloc

Sven Eckelmann <[email protected]>

    batman-adv: access unicast_ttvn skb->data only after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: gw: acquire ethernet header only after skb realloc

Thorsten Blum <[email protected]>
x86/boot: Reject too long acpi_rsdp= values

Thorsten Blum <[email protected]>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang

Guangshuo Li <[email protected]>
mfd: sm501: Fix reference leak on failed device registration

Armin Wolf <[email protected]>
leds: uleds: Fix potential buffer overread

Wang Jun <[email protected]>
soc: fsl: qe: panic on ioremap() failure in qe_reset()

Siddharth Vadapalli <[email protected]>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy

Guangshuo Li <[email protected]>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

Xiang Mei (Microsoft) <[email protected]>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

Wyatt Feng <[email protected]>
netfilter: xt_nat: reject unsupported target families

Yizhou Zhao <[email protected]>
netfilter: nf_conncount: fix zone comparison in tuple dedup

Xiang Mei <[email protected]>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: reload possible stale data pointer

Wyatt Feng <[email protected]>
netfilter: xt_cluster: reject template conntracks in hash match

David Carlier <[email protected]>
netfilter: nfnl_cthelper: apply per-class values when updating policies

Muhammad Bilal <[email protected]>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

Abdun Nihaal <[email protected]>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

Abdun Nihaal <[email protected]>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

Abdun Nihaal <[email protected]>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

Abdun Nihaal <[email protected]>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

Abdun Nihaal <[email protected]>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: i740fb: fix potential memory leak in i740fb_probe()

Abdun Nihaal <[email protected]>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

Li RongQing <[email protected]>
fbdev: sm712: Fix operator precedence in big_swap macro

Hyunwoo Kim <[email protected]>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it

Nickolay Goppen <[email protected]>
arm64: dts: qcom: sdm630: describe adsp_mem region properly

Yong Wang <[email protected]>
net: ife: require ETH_HLEN to be pullable in ife_decode()

Zhengchuan Liang <[email protected]>
net: atm: reject out-of-range traffic classes in QoS validation

Michael Bommarito <[email protected]>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

Guangshuo Li <[email protected]>
smb: client: fix overflow in passthrough ioctl bounds check

Li RongQing <[email protected]>
net/mlx5: Fix L3 tunnel entropy refcount leak

Timur Tabi <[email protected]>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

Douglas Anderson <[email protected]>
regulator: core: Make regulator_lock_two() logic easier to follow

Cao Guanghui <[email protected]>
dm era: fix NULL pointer dereference in metadata_open()

Julian Anastasov <[email protected]>
ipvs: ensure inner headers in ICMP errors are in headroom

Yizhou Zhao <[email protected]>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in TCP state lookup

Yizhou Zhao <[email protected]>
ipvs: pass parsed transport offset to state handlers

Eric Dumazet <[email protected]>
ipv6: mcast: Fix potential UAF in MLD delayed work

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Replace locking comments with lockdep annotations.

Eric Dumazet <[email protected]>
ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()

Taehee Yoo <[email protected]>
mld: add mc_lock for protecting per-interface mld data

Taehee Yoo <[email protected]>
mld: add new workqueues for process mld events

Taehee Yoo <[email protected]>
mld: convert ifmcaddr6 to RCU

Taehee Yoo <[email protected]>
mld: convert ip6_sf_list to RCU

Taehee Yoo <[email protected]>

    mld: convert ipv6_mc_socklist->sflist to RCU

Taehee Yoo <[email protected]>

    mld: get rid of inet6_dev->mc_lock

Taehee Yoo <[email protected]>
mld: convert from timer to delayed work

Samuel Moelius <[email protected]>
net/sched: cake: reject overhead values that underflow length

Enrico Pozzobon <[email protected]>
net: usb: lan78xx: disable VLAN filter in promiscuous mode

Hui Wang <[email protected]>
ring-buffer: Fix event length with forced 8-byte alignment

Weiming Shi <[email protected]>

    Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Xiang Mei <[email protected]>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

Xiang Mei <[email protected]>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing

Daniele Palmas <[email protected]>
net: qualcomm: rmnet: add tx packets aggregation

Sharath Chandra Vurukala <[email protected]>
net: ethernet: rmnet: Support for ingress MAPv5 checksum offload

Alex Elder <[email protected]>
net: qualcomm: rmnet: don't use C bit-fields in rmnet checksum header

Alex Elder <[email protected]>
net: qualcomm: rmnet: use masks instead of C bit-fields

Alex Elder <[email protected]>
net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros

Alex Elder <[email protected]>
net: qualcomm: rmnet: simplify some byte order logic

Shigeru Yoshida <[email protected]>
qede: fix off-by-one in BD ring consumption on build_skb failure

Zhixing Chen <[email protected]>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

Feng Wu <[email protected]>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

Wyatt Feng <[email protected]>
netfilter: xt_u32: reject invalid shift counts

Qihang <[email protected]>
gue: validate REMCSUM private option length

Xiang Mei <[email protected]>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Lee Jones <[email protected]>
HID: core: Fix OOB read in hid_get_report for numbered reports

Georgiy Osokin <[email protected]>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

Myeonghun Pak <[email protected]>
ata: sata_gemini: unwind clocks on IDE pinctrl errors

David Howells <[email protected]>
afs: Fix unchecked-length string display in debug statement

David Howells <[email protected]>
afs: Fix vllist leak

David Howells <[email protected]>
afs: Fix callback service message parsers to pass through -EAGAIN

Dan Carpenter <[email protected]>
afs: Fix error code in afs_extract_vl_addrs()

Samuel Moelius <[email protected]>
net/sched: hhf: clear heavy-hitter state on reset

Vladimir Zapolskiy <[email protected]>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

Gleb Markov <[email protected]>
cxgb4: Fix decode strings dump for T6 adapters

Longjun Tang <[email protected]>
virtio_net: disable cb when NAPI is busy-polled

Masami Hiramatsu (Google) <[email protected]>
tracing/events: Fix to check the simple_tsk_fn creation

Xiang Mei <[email protected]>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

Matti Vaittinen <[email protected]>
hwmon: adm1275: Prevent reading uninitialized stack

Nuoqi Gui <[email protected]>
seg6: validate SRH length before reading fixed fields

Pengpeng Hou <[email protected]>
gpio: htc-egpio: use managed gpiochip registration

Pengpeng Hou <[email protected]>
gpio: mvebu: fail probe if gpiochip registration fails

Pengpeng Hou <[email protected]>
spi: sh-msiof: abort transfers when reset times out

Martin Kaiser <[email protected]>
tracing: probes: fix typo in a log message

Ruoyu Wang <[email protected]>
net: sungem: fix probe error cleanup

Yun Zhou <[email protected]>
net: mvneta: re-enable percpu interrupt on resume

Haoxiang Li <[email protected]>
rtc: cmos: unregister HPET IRQ handler on probe failure

Fredrik M Olsson <[email protected]>
rtc: ds1307: Fix off-by-one issue with wday for rx8130

Huiwen He <[email protected]>
smb/client: preserve errors from smb2_set_sparse()

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_policy sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in forwarding sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_ipv6 sysctl

Aleksandrova Alyona <[email protected]>
net: dsa: sja1105: round up PTP perout pin duration

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

Runyu Xiao <[email protected]>

    netfilter: nft_synproxy: stop bypassing the priv->info snapshot

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't ignore error route in local/main tables.

Xiang Mei <[email protected]>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

Xiang Mei <[email protected]>
drm/edid: fix OOB read in drm_parse_tiled_block()

Nuoqi Gui <[email protected]>
bpf: Fix stack slot index in nospec checks

Ronan Dalton <[email protected]>

    rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231

Antoni Pokusinski <[email protected]>

    rtc: abx80x: fix the RTC_VL_CLR clearing all status flags

Sayali Patil <[email protected]>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests

Sayali Patil <[email protected]>
selftests/mm: clarify alternate unmapping in compaction_test

Bhargav Joshi <[email protected]>
irqchip/crossbar: Fix parent domain resource leak

Florian Westphal <[email protected]>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Aleksandr Nogikh <[email protected]>
ieee802154: fix kernel-infoleak in dgram_recvmsg()

Ivan Abramov <[email protected]>

    ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()

Andy Shevchenko <[email protected]>
ACPI: resource: Amend kernel-doc style

Ricardo Neri <[email protected]>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure

Breno Leitao <[email protected]>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS

Xin Long <[email protected]>
sctp: hold socket lock when dumping endpoints in sctp_diag

Jakub Kicinski <[email protected]>
net: psample: fix info leak in PSAMPLE_ATTR_DATA

Ratheesh Kannoth <[email protected]>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Eric Dumazet <[email protected]>
xfrm: validate selector family and prefixlen during match

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use snprintf() for root_dir path construction

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()

Pengpeng Hou <[email protected]>
sparc: led: avoid trimming a newline from empty writes

John Johansen <[email protected]>
apparmor: fix label can not be immediately before a declaration

Adrian Hunter <[email protected]>
i3c: master: Prevent reuse of dynamic address on device add failure

Zygmunt Krynicki <[email protected]>
apparmor: put secmark label after secid lookup

Zygmunt Krynicki <[email protected]>
apparmor: aa_getprocattr free procattr leak on format failure

Maxime Bélair <[email protected]>
apparmor: fix potential UAF in aa_replace_profiles

Ryan Lee <[email protected]>
apparmor: grab ns lock and refresh when looking up changehat child profiles

Zygmunt Krynicki <[email protected]>
apparmor: aa_label_alloc use aa_label_free on alloc failure

Ruoyu Wang <[email protected]>
apparmor: check label build before no_new_privs test

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Use actual physical address instead of virt_to_phys()

Ryder Lee <[email protected]>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to elf_read_build_id() note iteration

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix mount_overload() snprintf truncation and toupper range

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix filename__write_int() writing uninitialized stack data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix thread__set_comm_from_proc() on empty comm file

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check .gnu_debuglink section data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix missing null termination in filename__read_int/ull()

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file

Arnaldo Carvalho de Melo <[email protected]>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix idle-hist callchain display using wrong rb_first variant

Lad Prabhakar <[email protected]>
PCI: rcar-host: Remove unused LIST_HEAD(res)

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file

Li RongQing <[email protected]>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors

Dai Ngo <[email protected]>
NFSv4/pnfs: defer return_range callbacks until after inode unlock

Sagi Grimberg <[email protected]>
pNFS/filelayout: fix cheking if a layout is striped

Phillip Varney <[email protected]>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz

Nuno Sá <[email protected]>
dmaengine: Fix possible use after free

Arnaldo Carvalho de Melo <[email protected]>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Fix NULL deref in aio cleanup on alloc failure

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Clean up idle_threads entry on init failure

Rui Qi <[email protected]>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()

Rosen Penev <[email protected]>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

Sanjay Chitroda <[email protected]>

    iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

Joshua Crofts <[email protected]>
iio: magnetometer: ak8975: fix potential kernel stack memory leak

Joshua Crofts <[email protected]>
iio: light: si1133: prevent race condition on timeout

Joshua Crofts <[email protected]>
iio: light: si1133: reset counter to prevent race condition

James Kim <[email protected]>
char: tlclk: fix use-after-free in tlclk_cleanup()

Seungjin Bae <[email protected]>
usb: host: max3421: Reject hub port requests for non-existent ports

Seungjin Bae <[email protected]>

    usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

Guangshuo Li <[email protected]>
staging: most: video: avoid double free on video register failure

Ian Rogers <[email protected]>
perf sched: Add missing mmap2 handler in timehist

Rafael J. Wysocki <[email protected]>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling

Rafael J. Wysocki <[email protected]>
x86/platform/olpc: xo15: Drop wakeup source on driver removal

Yingchao Deng <[email protected]>
coresight: cti: Fix DT filter signals silently ignored

Alexandru Hossu <[email protected]>
staging: nvec: fix use-after-free in nvec_rx_completed()

Yizhou Zhao <[email protected]>

    net/9p: fix race condition on rdma->state in trans_rdma.c

Aleksandr Nogikh <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write

Eric Dumazet <[email protected]>

    tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

Eric Dumazet <[email protected]>
tipc: fix UAF in tipc_l2_send_msg()

Gui-Dong Han <[email protected]>
KEYS: Use acquire when reading state in keyring search

Aboorva Devarajan <[email protected]>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus

Aboorva Devarajan <[email protected]>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down

Aboorva Devarajan <[email protected]>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

Yadan Fan <[email protected]>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Sechang Lim <[email protected]>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

Weiming Shi <[email protected]>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

Florian Westphal <[email protected]>
netfilter: nf_conncount: callers must hold rcu read lock

Runyu Xiao <[email protected]>
kcm: use WRITE_ONCE() when changing lower socket callbacks

Victor Nogueira <[email protected]>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Victor Nogueira <[email protected]>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Lars Pöschel <[email protected]>
spi: xilinx: use FIFO occupancy register to determine buffer size

Herbert Xu <[email protected]>
crypto: rng - Free default RNG on module exit

Felix Gu <[email protected]>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index

Felix Gu <[email protected]>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

Michael Bommarito <[email protected]>
tipc: prevent snt_unacked underflow on CONN_ACK

Michael Bommarito <[email protected]>
tipc: require net admin for TIPCv2 netlink mutators

Victor Nogueira <[email protected]>
net/sched: sch_hfsc: Don't make class passive twice

Xin Long <[email protected]>
sctp: validate embedded address parameter length

Kuniyuki Iwashima <[email protected]>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

HyeongJun An <[email protected]>
ASoC: tegra: tegra210_ahub: Validate written enum value

HyeongJun An <[email protected]>
ASoC: fsl: fsl_audmix: Validate written enum values

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix undefined shift of user RQ WQE size

Maxwell Doose <[email protected]>
fs: efs: remove unneeded debug prints

Louis Scalbert <[email protected]>
bonding: 3ad: fix mux port state on oper down

longlong yan <[email protected]>
tools/virtio: check mmap return value in vringh_test

Qihang Tang <[email protected]>
vhost/vdpa: validate virtqueue index in mmap and fault paths

Jason Gunthorpe <[email protected]>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified

David Laight <[email protected]>
fbdev: sm501fb: Fix buffer errors in OF binding code

Filipe Manana <[email protected]>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

Wolfram Sang <[email protected]>
hwspinlock: qcom: avoid uninitialized struct members

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39

Al Viro <[email protected]>

    configfs: fix lockless traversals of ->s_children

Dmitry Vyukov <[email protected]>
firmware_loader: Fix recursive lock in device_cache_fw_images()

Felix Gu <[email protected]>
spi: ep93xx: fix double-free of zeropage on DMA setup failure

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix conservative governor freq_step description

Yuho Choi <[email protected]>
ACPI: IPMI: Fix message kref handling on dead device

Rui Qi <[email protected]>

    riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

Leon Hwang <[email protected]>
bpf: Update transport_header when encapsulating UDP tunnel in lwt

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

Joseph Qi <[email protected]>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

Zhang Cen <[email protected]>
ocfs2/dlm: require a ref for locking_state debugfs open

Zhang Cen <[email protected]>
ocfs2: reject FITRIM ranges shorter than a cluster

Dmitry Antipov <[email protected]>
ocfs2: fix buffer head management in ocfs2_read_blocks()

Zhang Cen <[email protected]>
ocfs2: rebase copied fsdlm LVB pointers in locking_state

Sandipan Das <[email protected]>
perf/x86/amd/core: Always use the NMI latency mitigation

Woojin Ji <[email protected]>
bpftool: Use libbpf error code for flow dissector query

Alexander Potapenko <[email protected]>

    lib/test_meminit: use && for bools

Sang-Heon Jeon <[email protected]>
mm/fake-numa: fix under-allocation detection in uniform split

Dan Carpenter <[email protected]>
scsi: pm8001: Fix error code in non_fatal_log_show()

Martin Wilck <[email protected]>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"

Yuho Choi <[email protected]>
ARM: imx31: Fix IIM mapping leak in revision check

Yuho Choi <[email protected]>
ARM: imx3: Fix CCM node reference leak

Zhang Yi <[email protected]>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback

Renjiang Han <[email protected]>
media: qcom: venus: drop extra padding in NV12 raw size calculation

Jessica Zhang <[email protected]>
drm/msm/dp: Fix the ISR_* enum values

Jessica Zhang <[email protected]>
drm/msm/dp: fix HPD state status bit shift value

Tetsuo Handa <[email protected]>

    ocfs2: kill osb->system_file_mutex lock

ZhengYuan Huang <[email protected]>
ocfs2: don't BUG_ON an invalid journal dinode

Dan Carpenter <[email protected]>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

Felix Gu <[email protected]>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()

Jiayuan Chen <[email protected]>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback

Eric Dumazet <[email protected]>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()

Breno Leitao <[email protected]>
workqueue: drop spurious '*' from print_worker_info() fn declaration

Nilay Shroff <[email protected]>
nvme-multipath: fix flex array size in struct nvme_ns_head

Miquel Raynal <[email protected]>
mtd: spi-nor: Drop duplicate Kconfig dependency

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Remove do_IRQ() call indirection

Maciej W. Rozycki <[email protected]>
MIPS: Fix big-endian stack argument fetching in o32 wrapper

Jiakai Xu <[email protected]>
PM: sleep: Use complete() in device_pm_sleep_init()

Lianfa Weng <[email protected]>
RDMA/hns: Fix warning in poll cq direct mode

Guangshuo Li <[email protected]>
IB/mlx4: Fix refcount leak in add_port() error path

Samuel Holland <[email protected]>
bus: sunxi-rsb: Always check register address validity

Ronaldo Nunez <[email protected]>
pwm: imx27: Fix variable truncation in .apply()

Lifeng Zheng <[email protected]>
cpufreq: conservative: Simplify frequency limit handling

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix sampling_down_factor range

Stepan Ionichev <[email protected]>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()

Sven Püschel <[email protected]>
media: rockchip: rga: fix too small buffer size

Eric Dumazet <[email protected]>

    net/sched: sch_drr: annotate data-races around cl->deficit

Greg Kroah-Hartman <[email protected]>
sysfs: clamp show() return value in sysfs_kf_read()

Zilin Guan <[email protected]>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

Sara Venkatesh <[email protected]>
RDMA/srpt: fix integer overflow in immediate data length check

Prathamesh Deshpande <[email protected]>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Alexander Chesnokov <[email protected]>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()

Linmao Li <[email protected]>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

Eric Dumazet <[email protected]>
net/sched: sch_htb: annotate data-races (I)

Sean Christopherson <[email protected]>
crypto: ccp - Treat zero-length cert chain as query for blob lengths

Eric Dumazet <[email protected]>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()

Rafael J. Wysocki <[email protected]>
thermal: hwmon: Fix critical temperature attribute removal

Cristian Marussi <[email protected]>
clk: scmi: Fix clock rate rounding

Sean Christopherson <[email protected]>
iommu/amd: Fix a stale comment about which legacy mode is user visible

Weiming Shi <[email protected]>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

Thorsten Blum <[email protected]>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic

Felix Gu <[email protected]>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path

Samuel Holland <[email protected]>
media: cedrus: Fix failure to clean up hardware on probe failure

Felix Gu <[email protected]>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure

Jihed Chaibi <[email protected]>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint

Tristan Madani <[email protected]>
wifi: ath9k: fix OOB access from firmware tx status queue ID

Xingjing Deng <[email protected]>
kconfig: fix potential NULL pointer dereference in conf_askvalue

Tristan Madani <[email protected]>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

Danilo Krummrich <[email protected]>

    driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

Yuho Choi <[email protected]>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Tomi Valkeinen <[email protected]>
drm/tidss: Drop extra drm_mode_config_reset() call

David Howells <[email protected]>
afs: Fix further netns teardown to cancel the preallocation charger

Matvey Kovalev <[email protected]>
afs: fix NULL pointer dereference in afs_get_tree()

David Howells <[email protected]>
afs: Fix netns teardown to cancel the preallocation charger

Matthias Feser <[email protected]>
serial: 8250_omap: clear rx_running on zero-length DMA completes

Stephan Gerhold <[email protected]>
serial: msm: Disable DMA for kernel console UART

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix buffer sequence in frame gaps

Ricardo Ribalda <[email protected]>
media: uvcvideo: Avoid partial metadata buffers

Eric Biggers <[email protected]>
crypto: af_alg - Remove zero-copy support from skcipher and aead

Yichong Chen <[email protected]>
tools/mm/slabinfo: fix total_objects attribute name

Muhammet Kaan KILINÇ <[email protected]>

    crypto: algif_skcipher - force synchronous processing on trees without ctx->state

Adam Li <[email protected]>
sched/fair: Only update stats for allowed CPUs when looking for dst group

Joanne Koong <[email protected]>
fuse: re-lock request before returning from fuse_ref_folio()

Alberto Ruiz <[email protected]>
fuse: fix device node leak in cuse_process_init_reply()

Michael Bommarito <[email protected]>
RDMA/siw: bound Read Response placement to the RREAD length

Dmitry Torokhov <[email protected]>
Input: maplecontrol - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maplemouse - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maple_keyb - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: mms114 - fix multi-touch slot corruption

Florian Fuchs <[email protected]>
Input: maplemouse - fix NULL pointer dereference in open()

Bryam Vargas <[email protected]>
Input: touchwin - reset the packet index on every complete packet

Bryam Vargas <[email protected]>
Input: iforce - bound the device-reported force-feedback effect index

Bryam Vargas <[email protected]>
Input: goodix - clamp the device-reported contact count

Ranjan Kumar <[email protected]>
Input: elan_i2c - prevent division by zero and arithmetic underflow

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Haoxiang Li <[email protected]>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure

Guillermo Rodríguez <[email protected]>
i2c: stm32f7: truncate clock period instead of rounding it

Mikhail Gavrilov <[email protected]>
udmabuf: fix DMA direction mismatch in release_udmabuf()

Sean Christopherson <[email protected]>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

Bryam Vargas <[email protected]>
exfat: bound uniname advance in exfat_find_dir_entry()

Benjamin Coddington <[email protected]>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Huihui Huang <[email protected]>
tracing: Prevent out-of-bounds read in glob matching

Carlos Song <[email protected]>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

Carlos Song <[email protected]>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()

Paul Louvel <[email protected]>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header

Eric Biggers <[email protected]>
crypto: drbg - Fix the fips_enabled priority boost

Eric Biggers <[email protected]>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

Eric Biggers <[email protected]>
crypto: drbg - Fix returning success on failure in CTR_DRBG

Ruijie Li <[email protected]>
crypto: pcrypt - restore callback for non-parallel fallback

Anastasia Tishchenko <[email protected]>
crypto: ecc - Fix carry overflow in vli multiplication

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps

Bryam Vargas <[email protected]>
isofs: bound Rock Ridge symlink components to the SL record

Bryam Vargas <[email protected]>
partitions: aix: bound the pp_count scan to the ppe array

Mikulas Patocka <[email protected]>
dm-ioctl: report an error if a device has no table

Bryam Vargas <[email protected]>
udf: validate sparing table length as an entry count, not a byte count

Bryam Vargas <[email protected]>
udf: validate VAT header length against the VAT inode size

Michael Bommarito <[email protected]>
udf: validate free block extents against the partition length

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check

Maxwell Doose <[email protected]>
iio: adc: spear: Initialize completion before requesting IRQ

Madhu M <[email protected]>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Invert DisplayPort role assignment

Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Sam Day <[email protected]>
usbip: vudc: fix NULL deref in vep_dequeue()

Yichong Chen <[email protected]>
usbip: tools: support SuperSpeedPlus devices

Xu Rao <[email protected]>
USB: usb-storage: ene_ub6250: restore media-ready check

Johan Hovold <[email protected]>
USB: ulpi: fix memory leak on registration failure

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix hard lockup on disconnect

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix broken rx after throttle

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990D50 compositions

Haoxiang Li <[email protected]>
usb: mtu3: unmap request DMA on queue failure

Myeonghun Pak <[email protected]>
USB: misc: uss720: unregister parport on probe failure

Xu Rao <[email protected]>
USB: storage: include US_FL_NO_SAME in quirks mask

Myeonghun Pak <[email protected]>
usb: sl811-hcd: disable controller wakeup on remove

Johan Hovold <[email protected]>
USB: legousbtower: fix use-after-free on disconnect race

Erich E. Hoover <[email protected]>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect

Johan Hovold <[email protected]>
USB: ldusb: fix use-after-free on disconnect race

Johan Hovold <[email protected]>
USB: idmouse: fix use-after-free on disconnect race

Maoyi Xie <[email protected]>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

Rodrigo Lugathe da Conceição Alves <[email protected]>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

Jared Baldridge <[email protected]>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner

Maoyi Xie <[email protected]>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

Deepanshu Kartikey <[email protected]>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

Tristan Madani <[email protected]>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Srinivas Pandruvada <[email protected]>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads

Maoyi Xie <[email protected]>
HID: lg-g15: cancel pending work on remove to fix a use-after-free

Myeonghun Pak <[email protected]>
HID: wacom: stop hardware after post-start probe failures

WenTao Liang <[email protected]>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

Yuho Choi <[email protected]>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Tianxiang Chen <[email protected]>
cpufreq: Fix hotplug-suspend race during reboot

Steven Rostedt <[email protected]>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

Sebastian Andrzej Siewior <[email protected]>
net: Drop the lock in skb_may_tx_timestamp()

Muhammad Bilal <[email protected]>
Bluetooth: L2CAP: validate option length before reading conf opt value

Yousef Alhouseen <[email protected]>
Bluetooth: fix UAF in bt_accept_dequeue()

Yousef Alhouseen <[email protected]>
Bluetooth: bnep: pin L2CAP connection during netdev registration

Xiang Mei <[email protected]>
netfilter: ebtables: terminate table name before find_table_lock()

Florian Westphal <[email protected]>
netfilter: ebtables: module names must be null-terminated

Andrei Kuchynski <[email protected]>
mfd: cros_ec: Delay dev_set_drvdata() until probe success

Wyatt Feng <[email protected]>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Yuyang Huang <[email protected]>
ipv4: igmp: remove multicast group from hash table on device destruction

Runyu Xiao <[email protected]>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

Runyu Xiao <[email protected]>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path

Thomas Gleixner <[email protected]>
debugobjects: Plug race against a concurrent OOM disable

Chi Wang <[email protected]>
audit: Fix data races of skb_queue_len() readers on audit_queue

Zijing Yin <[email protected]>
net: af_key: initialize alg_key_len for IPComp states

Dawei Feng <[email protected]>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()

Ricardo Ribalda <[email protected]>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe

Samuel Page <[email protected]>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks

Yizhou Zhao <[email protected]>
6lowpan: fix NHC entry use-after-free on error path

Alan Stern <[email protected]>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Michael Bommarito <[email protected]>
hwrng: virtio: clamp device-reported used.len at copy_data()

Johan Hovold <[email protected]>
virtio-mmio: fix device release warning on module unload

Xiang Mei <[email protected]>
netfilter: ipset: fix race between dump and ip_set_list resize

Ratheesh Kannoth <[email protected]>
PCI: host-common: Request bus reassignment when not probe-only

Mahesh Vaidya <[email protected]>
PCI: altera: Do not dispose parent IRQ mapping

胡连勤 <[email protected]>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_thread_release()

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on registration failure

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Roll back quirk control caches on write errors

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()

Darvell Long <[email protected]>
ALSA: usb-audio: avoid kobject path lookup in DualSense match

Maoyi Xie <[email protected]>
ALSA: firewire: isight: bound the sample count to the packet payload

Zhao Dongdong <[email protected]>
ALSA: es1938: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start

Andy Shevchenko <[email protected]>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call

Javier Carrasco <[email protected]>
iio: light: veml6030: fix channel type when pushing events

Joshua Crofts <[email protected]>
iio: light: opt3001: fix missing state reset on timeout

Biren Pandya <[email protected]>
iio: light: gp2ap002: fix runtime PM leak on read error

Vidhu Sarwal <[email protected]>
iio: light: al3010: fix incorrect scale for the highest gain range

Andreas Kempe <[email protected]>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami

Runyu Xiao <[email protected]>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: wait full startup time after mode change at probe

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table

Lars-Peter Clausen <[email protected]>
iio: event: Fix event FIFO reset race

Maxwell Doose <[email protected]>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

Pengpeng Hou <[email protected]>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors

Maxwell Doose <[email protected]>
iio: adc: lpc32xx: Initialize completion before requesting IRQ

Biren Pandya <[email protected]>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

Bryam Vargas <[email protected]>
iio: accel: bmc150: clamp the device-reported FIFO frame count

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check for header

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check to response query

Michal Kosiorek <[email protected]>
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Fan Wu <[email protected]>
hdlc_ppp: sync per-proto timers before freeing hdlc state

Johan Hovold <[email protected]>
i2c: core: fix adapter registration race

Johan Hovold <[email protected]>
i2c: core: fix adapter debugfs creation

Johan Hovold <[email protected]>
i2c: core: fix NULL-deref on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix hang on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix irq domain leak on adapter registration failure

Mingyu Wang <[email protected]>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Michael Bommarito <[email protected]>
NFSv4/flexfiles: reject zero filehandle version count

Keshav Verma <[email protected]>
f2fs: fix listxattr handling of corrupted xattr entries

Ruipeng Qi <[email protected]>
f2fs: fix potential deadlock in f2fs_balance_fs()

Bryam Vargas <[email protected]>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

Wenjie Qi <[email protected]>
f2fs: validate orphan inode entry count

Sunmin Jeong <[email protected]>
f2fs: fix to round down start offset of fallocate for pin file

Jaegeuk Kim <[email protected]>
f2fs: adjust zone capacity when considering valid block count

Bryam Vargas <[email protected]>
apparmor: mediate the implicit connect of TCP fast open sendmsg

Maoyi Xie <[email protected]>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

Ruslan Valiyev <[email protected]>
apparmor: fix use-after-free in rawdata dedup loop

Yiming Qian <[email protected]>
net: skmsg: preserve sg.copy across SG transforms

Eric Dumazet <[email protected]>
skmsg: convert struct sk_msg_sg::copy to a bitmap

Xiang Mei <[email protected]>
netfilter: nf_log: validate MAC header was set before dumping it

Krishna chaitanya chundru <[email protected]>
bus: mhi: host: Add alignment check for event ring read pointer

Florian Fainelli <[email protected]>
perf trace beauty fcntl: Fix build with older kernel headers

Sean Christopherson <[email protected]>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC

NeilBrown <[email protected]>
nfsd: change nfs4_client_to_reclaim() to allocate data

NeilBrown <[email protected]>
nfsd: move name lookup out of nfsd4_list_rec_dir()

Jiasheng Jiang <[email protected]>
clk: imx: Add check for kcalloc

Kiryl Shutsemau <[email protected]>
userfaultfd: gate must_wait writability check on pte_present()

Jeff Layton <[email protected]>
nfsd: reset write verifier on deferred writeback errors

Chris Mason <[email protected]>
nfsd: release layout stid on setlease failure

Chaitanya Kulkarni <[email protected]>
nvmet-tcp: fix race between ICReq handling and queue teardown

-------------

Diffstat:

 Documentation/admin-guide/pm/cpufreq.rst           |    6 +-
 Documentation/crypto/userspace-if.rst              |   31 +-
 Documentation/driver-api/pci/pci.rst               |    3 +
 Makefile                                           |    4 +-
 arch/alpha/kernel/pci-sysfs.c                      |   13 +-
 arch/arm/boot/dts/am335x-sl50.dts                  |    4 +-
 arch/arm/mach-davinci/board-da850-evm.c            |   12 +-
 arch/arm/mach-imx/cpu-imx31.c                      |    9 +-
 arch/arm/mach-imx/mm-imx3.c                        |    2 +
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |    9 +-
 arch/arm64/kernel/hw_breakpoint.c                  |    9 +
 arch/arm64/kvm/vgic/vgic-its.c                     |   15 +-
 arch/arm64/kvm/vgic/vgic.c                         |   11 +-
 arch/mips/dec/int-handler.S                        |    2 +-
 arch/mips/dec/prom/init.c                          |    6 +-
 arch/mips/dec/setup.c                              |    6 -
 arch/mips/fw/lib/call_o32.S                        |    2 +-
 arch/mips/include/asm/dec/prom.h                   |   15 +-
 arch/mips/mm/init.c                                |   12 +-
 arch/mips/sgi-ip22/ip22-gio.c                      |    7 +-
 arch/powerpc/kexec/core_64.c                       |    4 +-
 arch/powerpc/perf/core-fsl-emb.c                   |    3 +-
 arch/powerpc/platforms/cell/spufs/file.c           |    6 +-
 arch/powerpc/platforms/powernv/setup.c             |    3 +-
 arch/riscv/kernel/stacktrace.c                     |    2 +-
 arch/sparc/kernel/led.c                            |    2 +-
 arch/x86/boot/compressed/acpi.c                    |    7 +-
 arch/x86/boot/early_serial_console.c               |   11 +-
 arch/x86/events/amd/core.c                         |    6 +-
 arch/x86/kernel/cpu/mce/therm_throt.c              |    7 +-
 arch/x86/kvm/vmx/vmx.c                             |    3 +-
 arch/x86/mm/numa_emulation.c                       |   17 +-
 arch/x86/platform/olpc/olpc-xo15-sci.c             |    1 +
 block/partitions/aix.c                             |    9 +
 certs/common.c                                     |    2 +-
 crypto/af_alg.c                                    |   54 +-
 crypto/algif_skcipher.c                            |   49 +-
 crypto/asymmetric_keys/verify_pefile.c             |    2 +
 crypto/drbg.c                                      |    4 +-
 crypto/ecc.c                                       |   31 +-
 crypto/ecrdsa.c                                    |    2 +-
 crypto/pcrypt.c                                    |    4 +
 crypto/rng.c                                       |   11 +
 drivers/acpi/acpi_ipmi.c                           |    2 +-
 drivers/acpi/nfit/core.c                           |   15 +-
 drivers/acpi/resource.c                            |    6 +-
 drivers/android/binder.c                           |   19 +-
 drivers/ata/pata_pxa.c                             |    1 +
 drivers/ata/sata_gemini.c                          |    2 +-
 drivers/base/firmware_loader/main.c                |    3 +-
 drivers/base/power/main.c                          |    6 +-
 drivers/base/property.c                            |    4 +-
 drivers/block/drbd/drbd_receiver.c                 |    5 +
 drivers/bluetooth/bpa10x.c                         |    8 +-
 drivers/bluetooth/btintel.c                        |  105 +-
 drivers/bluetooth/btintel.h                        |    5 +-
 drivers/bluetooth/btrtl.c                          |    5 +-
 drivers/bluetooth/btusb.c                          |   44 +-
 drivers/bluetooth/hci_intel.c                      |    7 +-
 drivers/bus/mhi/host/main.c                        |    3 +-
 drivers/bus/sunxi-rsb.c                            |    3 +
 drivers/char/hw_random/virtio-rng.c                |   23 +-
 drivers/char/tlclk.c                               |    4 +
 drivers/char/tpm/eventlog/tpm1.c                   |    4 +-
 drivers/char/tpm/tpm-dev.c                         |    2 +-
 drivers/char/tpm/tpmrm-dev.c                       |    2 +-
 drivers/clk/clk-scmi.c                             |    4 +-
 drivers/clk/imx/clk.c                              |    2 +
 drivers/clk/qcom/a53-pll.c                         |    2 +-
 drivers/cpufreq/cpufreq.c                          |    2 +
 drivers/cpufreq/cpufreq_conservative.c             |   12 +-
 drivers/cpufreq/intel_pstate.c                     |    6 +-
 drivers/cpufreq/pcc-cpufreq.c                      |    2 +
 drivers/crypto/amcc/crypto4xx_alg.c                |  114 +-
 drivers/crypto/amcc/crypto4xx_core.c               |  148 +-
 drivers/crypto/amcc/crypto4xx_core.h               |   15 +-
 drivers/crypto/amcc/crypto4xx_reg_def.h            |   19 +-
 drivers/crypto/amcc/crypto4xx_sa.h                 |   18 +-
 drivers/crypto/amcc/crypto4xx_trng.h               |    2 +-
 drivers/crypto/amlogic/amlogic-gxl-core.c          |    2 +-
 drivers/crypto/atmel-ecc.c                         |    2 +-
 drivers/crypto/atmel-sha204a.c                     |   29 +-
 drivers/crypto/caam/caamalg.c                      |   12 +-
 drivers/crypto/caam/caamalg_qi.c                   |   12 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   12 +-
 drivers/crypto/caam/caamhash.c                     |    4 +-
 drivers/crypto/caam/key_gen.c                      |    4 +-
 drivers/crypto/cavium/cpt/cptvf_reqmanager.c       |    4 +-
 drivers/crypto/ccp/sev-dev.c                       |    3 +-
 drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c |    4 +-
 drivers/crypto/qat/qat_common/adf_accel_devices.h  |    2 +
 drivers/crypto/qat/qat_common/adf_aer.c            |    7 +-
 drivers/crypto/qat/qat_common/adf_common_drv.h     |    4 +
 drivers/crypto/qat/qat_common/adf_isr.c            |   18 +
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c      |   22 +
 drivers/crypto/qat/qat_common/adf_sriov.c          |   38 +-
 drivers/crypto/qat/qat_common/qat_asym_algs.c      |   10 +-
 drivers/crypto/talitos.c                           |   26 +-
 drivers/dma-buf/udmabuf.c                          |    5 +-
 drivers/dma/dmaengine.c                            |    3 +-
 drivers/gpio/gpio-eic-sprd.c                       |    8 +-
 drivers/gpio/gpio-htc-egpio.c                      |    6 +-
 drivers/gpio/gpio-mvebu.c                          |    5 +-
 drivers/gpio/gpio-palmas.c                         |   19 +
 drivers/gpio/gpio-pca953x.c                        |   11 +-
 drivers/gpio/gpio-timberdale.c                     |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |    4 +-
 drivers/gpu/drm/drm_edid.c                         |    8 +
 drivers/gpu/drm/i2c/sil164_drv.c                   |    7 -
 drivers/gpu/drm/msm/dp/dp_display.c                |    4 +-
 drivers/gpu/drm/msm/dp/dp_reg.h                    |    4 +-
 drivers/gpu/drm/radeon/radeon_ring.c               |    4 +-
 drivers/gpu/drm/tegra/dc.c                         |    4 +-
 drivers/gpu/drm/tidss/tidss_kms.c                  |    2 -
 drivers/gpu/host1x/bus.c                           |    2 +-
 drivers/hid/hid-appleir.c                          |   45 +-
 drivers/hid/hid-core.c                             |    7 +
 drivers/hid/hid-lg-g15.c                           |   16 +
 drivers/hid/hid-logitech-hidpp.c                   |    1 -
 drivers/hid/hid-multitouch.c                       |   32 +-
 drivers/hid/hid-picolcd_core.c                     |    3 +-
 drivers/hid/hid-sensor-hub.c                       |   77 +-
 drivers/hid/wacom_sys.c                            |   12 +-
 drivers/hwmon/asus_atk0110.c                       |    3 +
 drivers/hwmon/pmbus/adm1275.c                      |    2 +-
 drivers/hwmon/w83627hf.c                           |    4 +
 drivers/hwmon/w83793.c                             |    1 +
 drivers/hwspinlock/qcom_hwspinlock.c               |    5 +-
 .../hwtracing/coresight/coresight-cti-platform.c   |    1 +
 drivers/hwtracing/coresight/coresight-etb10.c      |    6 +-
 drivers/i2c/busses/i2c-mlxbf.c                     |    4 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |    2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |    9 +-
 drivers/i2c/i2c-core-base.c                        |   82 +-
 drivers/i3c/master.c                               |   19 +-
 drivers/iio/accel/bmc150-accel-core.c              |    2 +
 drivers/iio/accel/kxsd9.c                          |    5 +-
 drivers/iio/accel/mma8452.c                        |    2 +
 drivers/iio/adc/lpc32xx_adc.c                      |    4 +-
 drivers/iio/adc/spear_adc.c                        |    4 +-
 drivers/iio/adc/ti-ads124s08.c                     |    3 +-
 drivers/iio/chemical/scd30_core.c                  |   19 +-
 drivers/iio/common/Kconfig                         |    1 +
 drivers/iio/common/Makefile                        |    1 +
 drivers/iio/common/inv_sensors/Kconfig             |    7 +
 drivers/iio/common/inv_sensors/Makefile            |    6 +
 .../inv_sensors/inv_sensors_timestamp.c}           |  120 +-
 drivers/iio/common/st_sensors/st_sensors_core.c    |   23 +-
 drivers/iio/gyro/bmg160_core.c                     |   16 +-
 drivers/iio/imu/adis_trigger.c                     |    2 +-
 drivers/iio/imu/bmi160/bmi160_core.c               |    3 +-
 drivers/iio/imu/inv_icm42600/Kconfig               |    1 +
 drivers/iio/imu/inv_icm42600/Makefile              |    1 -
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c  |   35 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c |   61 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h |    3 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c   |   24 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c   |   35 +-
 .../iio/imu/inv_icm42600/inv_icm42600_timestamp.h  |   85 -
 drivers/iio/imu/inv_mpu6050/Kconfig                |    1 +
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c         |   30 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h          |   18 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c         |   85 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c      |   11 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   21 +-
 drivers/iio/industrialio-event.c                   |    5 +-
 drivers/iio/light/al3010.c                         |    2 +-
 drivers/iio/light/gp2ap002.c                       |    2 +-
 drivers/iio/light/opt3001.c                        |    6 +-
 drivers/iio/light/si1133.c                         |   14 +-
 drivers/iio/light/veml6030.c                       |    8 +-
 drivers/iio/magnetometer/ak8975.c                  |   15 +
 drivers/iio/orientation/hid-sensor-rotation.c      |   40 +-
 drivers/iio/temperature/ltc2983.c                  |    5 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |    8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |    2 +-
 drivers/infiniband/hw/mlx4/mlx4_ib.h               |    1 +
 drivers/infiniband/hw/mlx4/mr.c                    |    9 +-
 drivers/infiniband/hw/mlx4/sysfs.c                 |   45 +-
 drivers/infiniband/hw/mlx5/devx.c                  |   30 +-
 drivers/infiniband/hw/mlx5/qp.c                    |   11 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |    9 +
 drivers/infiniband/ulp/srpt/ib_srpt.c              |    5 +-
 drivers/input/joystick/iforce/iforce-packets.c     |   18 +-
 drivers/input/joystick/maplecontrol.c              |    3 +-
 drivers/input/keyboard/maple_keyb.c                |    4 +-
 drivers/input/misc/ims-pcu.c                       |  115 +-
 drivers/input/mouse/elan_i2c_core.c                |   36 +-
 drivers/input/mouse/maplemouse.c                   |    9 +-
 drivers/input/rmi4/rmi_bus.c                       |    4 +-
 drivers/input/rmi4/rmi_f30.c                       |    2 +-
 drivers/input/rmi4/rmi_f3a.c                       |    2 +-
 drivers/input/touchscreen/goodix.c                 |    3 +-
 drivers/input/touchscreen/mms114.c                 |    2 +-
 drivers/input/touchscreen/touchwin.c               |   15 +-
 drivers/iommu/amd/amd_iommu_types.h                |   11 +-
 drivers/irqchip/irq-crossbar.c                     |   10 +-
 drivers/leds/leds-lm3601x.c                        |   11 +-
 drivers/leds/leds-lm3697.c                         |    4 +-
 drivers/leds/uleds.c                               |    3 +-
 drivers/md/dm-bufio.c                              |    4 +-
 drivers/md/dm-era-target.c                         |   10 +-
 drivers/md/dm-ioctl.c                              |    7 +-
 drivers/md/dm-log.c                                |    3 +
 drivers/md/dm-stats.c                              |   10 +-
 drivers/md/dm-thin-metadata.c                      |   67 +-
 drivers/md/dm-verity-target.c                      |    2 +-
 drivers/media/platform/qcom/venus/helpers.c        |    4 +-
 drivers/media/platform/rockchip/rga/rga-hw.c       |    2 +-
 drivers/media/platform/rockchip/rga/rga-hw.h       |    2 +-
 drivers/media/usb/uvc/uvc_video.c                  |   30 +-
 drivers/memstick/core/ms_block.c                   |    4 +
 drivers/mfd/cros_ec_dev.c                          |    3 +-
 drivers/mfd/sm501.c                                |    4 +-
 drivers/mfd/tps6586x.c                             |    2 +-
 drivers/mmc/host/renesas_sdhi_core.c               |    1 +
 drivers/mmc/host/vub300.c                          |   26 +-
 drivers/mtd/devices/slram.c                        |   22 +-
 drivers/mtd/maps/vmu-flash.c                       |    1 +
 drivers/mtd/nand/onenand/onenand_samsung.c         |    7 +-
 drivers/mtd/nand/raw/fsl_ifc_nand.c                |    9 +-
 drivers/mtd/nand/raw/lpc32xx_mlc.c                 |   12 +-
 drivers/mtd/nand/raw/lpc32xx_slc.c                 |   12 +-
 drivers/mtd/nand/raw/nand_base.c                   |    2 +-
 drivers/mtd/spi-nor/Kconfig                        |    1 -
 drivers/net/bonding/bond_3ad.c                     |    1 +
 drivers/net/dsa/sja1105/sja1105_ptp.c              |    2 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   23 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c    |    3 +-
 .../ethernet/cavium/liquidio/cn23xx_pf_device.c    |   18 +-
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c         |    8 -
 drivers/net/ethernet/freescale/fman/fman.c         |    4 +-
 drivers/net/ethernet/marvell/mvneta.c              |    3 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |    1 +
 .../net/ethernet/mellanox/mlx5/core/lib/port_tun.c |    3 +-
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |    1 +
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |    5 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |    5 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |   20 +
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   |   53 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h    |   22 +-
 .../ethernet/qualcomm/rmnet/rmnet_map_command.c    |   11 +-
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |  334 +++-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c    |    9 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h    |    1 +
 drivers/net/ethernet/sun/sungem.c                  |   13 +-
 drivers/net/ieee802154/ca8210.c                    |    9 +-
 drivers/net/macsec.c                               |    7 +-
 drivers/net/usb/gl620a.c                           |    6 +-
 drivers/net/usb/kalmia.c                           |    8 +
 drivers/net/usb/lan78xx.c                          |   18 +-
 drivers/net/usb/net1080.c                          |    2 +-
 drivers/net/virtio_net.c                           |    3 +
 drivers/net/wan/hdlc_ppp.c                         |   15 +-
 drivers/net/wireless/ath/ath9k/xmit.c              |    5 +
 drivers/net/wireless/ath/wcn36xx/smd.c             |    6 +
 drivers/net/wireless/marvell/mwifiex/join.c        |    1 -
 drivers/net/wireless/ralink/rt2x00/rt2x00dev.c     |   12 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |    5 +
 drivers/nvdimm/btt.c                               |   14 +-
 drivers/nvme/host/core.c                           |    2 +-
 drivers/nvme/target/rdma.c                         |   18 +-
 drivers/nvme/target/tcp.c                          |   33 +-
 drivers/pci/Makefile                               |    2 +-
 drivers/pci/controller/dwc/pci-imx6.c              |    5 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |    2 +-
 .../pci/controller/mobiveil/pcie-mobiveil-host.c   |    8 +-
 drivers/pci/controller/pci-host-common.c           |    4 +
 drivers/pci/controller/pcie-altera-msi.c           |    2 +-
 drivers/pci/controller/pcie-altera.c               |   32 +-
 drivers/pci/controller/pcie-mediatek.c             |  117 +-
 drivers/pci/controller/pcie-rcar-host.c            |    1 -
 drivers/pci/controller/pcie-xilinx-nwl.c           |    2 +-
 drivers/pci/pci.c                                  |  135 --
 drivers/pci/pci.h                                  |    4 +
 drivers/pci/rebar.c                                |  217 +++
 drivers/pci/setup-bus.c                            |  100 +-
 drivers/pci/setup-res.c                            |   53 -
 drivers/pinctrl/mediatek/pinctrl-mt8167.c          |    2 +-
 drivers/pinctrl/mediatek/pinctrl-mt8516.c          |    2 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |    2 +-
 drivers/platform/x86/xo15-ebook.c                  |    7 +-
 drivers/power/supply/charger-manager.c             |    6 +-
 drivers/pwm/pwm-imx27.c                            |    8 +-
 drivers/rapidio/devices/tsi721.c                   |    3 +-
 drivers/regulator/core.c                           |   29 +-
 drivers/regulator/ltc3676.c                        |   10 +-
 drivers/reset/reset-imx7.c                         |    6 +
 drivers/reset/reset-sunxi.c                        |    4 +-
 drivers/rtc/rtc-abx80x.c                           |    3 +-
 drivers/rtc/rtc-cmos.c                             |    6 +
 drivers/rtc/rtc-ds1307.c                           |   30 +-
 drivers/s390/char/monwriter.c                      |    3 +
 drivers/s390/net/qeth_l3_main.c                    |    6 +-
 drivers/scsi/hpsa.c                                |    4 +
 drivers/scsi/pm8001/pm8001_ctl.c                   |    5 +-
 drivers/scsi/scsi_scan.c                           |    2 +-
 drivers/scsi/scsi_transport_sas.c                  |   60 +-
 drivers/scsi/sg.c                                  |    7 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |    2 +-
 drivers/soc/fsl/qe/qe.c                            |    3 +
 drivers/soc/ti/k3-ringacc.c                        |    4 +-
 drivers/spi/spi-ep93xx.c                           |    1 +
 drivers/spi/spi-fsl-lpspi.c                        |   18 +-
 drivers/spi/spi-sh-msiof.c                         |   10 +-
 drivers/spi/spi-uniphier.c                         |    4 +-
 drivers/spi/spi-xilinx.c                           |   11 +-
 drivers/staging/media/atomisp/pci/atomisp_cmd.c    |    6 +-
 .../media/atomisp/pci/atomisp_compat_css20.c       |    2 +-
 .../atomisp/pci/runtime/isys/src/virtual_isys.c    |   12 +-
 drivers/staging/media/atomisp/pci/sh_css.c         | 1946 +++++++++-----------
 drivers/staging/media/ipu3/ipu3-css-params.c       |    8 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |    4 +-
 drivers/staging/most/video/video.c                 |    7 +-
 drivers/staging/nvec/nvec.c                        |    4 +-
 drivers/staging/rtl8723bs/core/rtw_ap.c            |   31 +-
 drivers/staging/rtl8723bs/core/rtw_cmd.c           |   96 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   22 +-
 drivers/staging/rtl8723bs/core/rtw_ioctl_set.c     |    4 +-
 drivers/staging/rtl8723bs/core/rtw_mlme.c          |   16 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |  349 ++--
 drivers/staging/rtl8723bs/core/rtw_recv.c          |    4 +-
 drivers/staging/rtl8723bs/core/rtw_security.c      |    6 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c     |   14 +-
 drivers/staging/rtl8723bs/hal/hal_com_phycfg.c     |   34 -
 drivers/staging/rtl8723bs/hal/odm.c                |   30 -
 drivers/staging/rtl8723bs/hal/odm.h                |    3 -
 drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c |    4 +-
 drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c  |    1 -
 drivers/staging/rtl8723bs/hal/sdio_halinit.c       |   10 -
 drivers/staging/rtl8723bs/include/hal_phy.h        |    3 -
 drivers/staging/rtl8723bs/include/ieee80211.h      |   22 +-
 drivers/staging/rtl8723bs/include/rtw_mlme_ext.h   |    6 +-
 drivers/staging/rtl8723bs/include/wifi.h           |    1 -
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |  118 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c     |   41 +-
 drivers/staging/rtl8723bs/os_dep/os_intfs.c        |    6 +-
 drivers/target/target_core_pr.c                    |    8 +-
 drivers/thermal/thermal_hwmon.c                    |    5 +-
 drivers/tty/serial/8250/8250_mid.c                 |   31 +-
 drivers/tty/serial/8250/8250_omap.c                |    3 +-
 drivers/tty/serial/msm_serial.c                    |    3 +-
 drivers/usb/atm/ueagle-atm.c                       |   36 +-
 drivers/usb/class/cdc-acm.c                        |    3 +
 drivers/usb/common/ulpi.c                          |   23 +-
 drivers/usb/core/quirks.c                          |    6 +
 drivers/usb/gadget/composite.c                     |    5 +-
 drivers/usb/gadget/function/f_fs.c                 |    5 +-
 drivers/usb/gadget/function/f_printer.c            |   10 +-
 drivers/usb/gadget/function/rndis.c                |   20 +-
 drivers/usb/host/ehci-sched.c                      |   11 +-
 drivers/usb/host/fotg210-hcd.c                     |    6 +-
 drivers/usb/host/max3421-hcd.c                     |    8 +
 drivers/usb/host/sl811-hcd.c                       |    1 +
 drivers/usb/host/xhci.c                            |   11 +-
 drivers/usb/misc/chaoskey.c                        |    1 -
 drivers/usb/misc/idmouse.c                         |   45 +-
 drivers/usb/misc/iowarrior.c                       |   21 +-
 drivers/usb/misc/ldusb.c                           |   38 +-
 drivers/usb/misc/legousbtower.c                    |   37 +-
 drivers/usb/misc/uss720.c                          |    5 +-
 drivers/usb/mtu3/mtu3_gadget.c                     |    1 +
 drivers/usb/serial/digi_acceleport.c               |   43 +-
 drivers/usb/serial/option.c                        |   16 +
 drivers/usb/storage/ene_ub6250.c                   |    3 +-
 drivers/usb/storage/usb.c                          |    2 +-
 drivers/usb/typec/tcpm/tcpm.c                      |    7 +-
 drivers/usb/typec/ucsi/displayport.c               |    7 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |    2 +-
 drivers/usb/usbip/vudc.h                           |    1 -
 drivers/usb/usbip/vudc_dev.c                       |    4 +-
 drivers/vfio/pci/vfio_pci.c                        |    1 +
 drivers/vhost/vdpa.c                               |   29 +-
 drivers/video/fbdev/aty/radeon_base.c              |    1 +
 drivers/video/fbdev/carminefb.c                    |    1 +
 drivers/video/fbdev/core/fbcon.c                   |    7 +
 drivers/video/fbdev/i740fb.c                       |    1 +
 drivers/video/fbdev/nvidia/nvidia.c                |    1 +
 drivers/video/fbdev/s3fb.c                         |    1 +
 drivers/video/fbdev/sm501fb.c                      |   16 +-
 drivers/video/fbdev/sm712.h                        |    2 +-
 drivers/video/fbdev/tdfxfb.c                       |    1 +
 drivers/video/fbdev/tridentfb.c                    |    1 +
 drivers/video/fbdev/uvesafb.c                      |    4 +-
 drivers/virtio/virtio_mmio.c                       |   26 +-
 drivers/watchdog/sprd_wdt.c                        |    5 +-
 drivers/xen/gntdev.c                               |    8 +-
 fs/afs/cell.c                                      |    2 +
 fs/afs/cmservice.c                                 |    2 -
 fs/afs/rxrpc.c                                     |   11 +-
 fs/afs/super.c                                     |    3 +-
 fs/afs/vl_list.c                                   |   10 +-
 fs/btrfs/extent-tree.c                             |   17 +-
 fs/cifs/cifs_debug.c                               |    2 +-
 fs/cifs/cifsacl.c                                  |    2 +-
 fs/cifs/cifsfs.c                                   |    1 -
 fs/cifs/cifsglob.h                                 |    5 +-
 fs/cifs/cifsproto.h                                |    2 +-
 fs/cifs/connect.c                                  |   17 +-
 fs/cifs/misc.c                                     |    4 +-
 fs/cifs/netmisc.c                                  |    2 +-
 fs/cifs/readdir.c                                  |    6 +-
 fs/cifs/smb2maperror.c                             |   16 +-
 fs/cifs/smb2misc.c                                 |  123 +-
 fs/cifs/smb2ops.c                                  |  107 +-
 fs/cifs/smb2pdu.c                                  |  114 +-
 fs/cifs/smb2pdu.h                                  |  365 +---
 fs/cifs/smb2proto.h                                |    4 +-
 fs/cifs/smb2transport.c                            |   36 +-
 fs/configfs/dir.c                                  |   54 +-
 fs/efs/file.c                                      |   21 +-
 fs/exfat/dir.c                                     |   13 +-
 fs/ext4/ioctl.c                                    |   12 +-
 fs/f2fs/checkpoint.c                               |   13 +-
 fs/f2fs/data.c                                     |   29 +
 fs/f2fs/debug.c                                    |    2 +-
 fs/f2fs/f2fs.h                                     |    1 +
 fs/f2fs/file.c                                     |   15 +-
 fs/f2fs/gc.c                                       |    4 +-
 fs/f2fs/inode.c                                    |   13 +-
 fs/f2fs/segment.c                                  |   14 +-
 fs/f2fs/segment.h                                  |    8 +-
 fs/f2fs/xattr.c                                    |    4 +-
 fs/fs-writeback.c                                  |   20 +-
 fs/fuse/cuse.c                                     |    4 +-
 fs/fuse/dev.c                                      |    2 +-
 fs/hfs/bfind.c                                     |    2 +-
 fs/hfs/bnode.c                                     |   56 +-
 fs/hfs/brec.c                                      |    2 +-
 fs/hfs/btree.c                                     |    2 +-
 fs/hfs/btree.h                                     |   71 +-
 fs/hfs/hfs_fs.h                                    |   83 +-
 fs/hfs/inode.c                                     |    2 +-
 fs/hfsplus/bfind.c                                 |    2 +-
 fs/hfsplus/bnode.c                                 |   62 +-
 fs/hfsplus/brec.c                                  |    2 +-
 fs/hfsplus/btree.c                                 |    2 +-
 fs/hfsplus/hfsplus_fs.h                            |   40 +-
 fs/isofs/rock.c                                    |   11 +
 fs/lockd/svcsubs.c                                 |    4 +-
 fs/nfs/callback_proc.c                             |    9 +-
 fs/nfs/dir.c                                       |    2 +
 fs/nfs/filelayout/filelayout.c                     |    2 +
 fs/nfs/flexfilelayout/flexfilelayout.c             |   33 +
 fs/nfs/flexfilelayout/flexfilelayout.h             |   16 +
 fs/nfs/pnfs.c                                      |    4 +-
 fs/nfsd/nfs4layouts.c                              |    4 +-
 fs/nfsd/nfs4recover.c                              |  120 +-
 fs/nfsd/nfs4state.c                                |   22 +-
 fs/nfsd/vfs.c                                      |    9 +-
 fs/nilfs2/segment.c                                |   22 +
 fs/ocfs2/alloc.c                                   |    2 +-
 fs/ocfs2/aops.c                                    |   13 +-
 fs/ocfs2/buffer_head_io.c                          |    7 +-
 fs/ocfs2/dlm/dlmdebug.c                            |   16 +-
 fs/ocfs2/dlmglue.c                                 |   17 +
 fs/ocfs2/inode.c                                   |  150 +-
 fs/ocfs2/journal.c                                 |   13 +-
 fs/ocfs2/move_extents.c                            |    4 +-
 fs/ocfs2/ocfs2.h                                   |    2 -
 fs/ocfs2/quota_local.c                             |    2 +-
 fs/ocfs2/stack_user.c                              |   10 +-
 fs/ocfs2/super.c                                   |    2 -
 fs/ocfs2/sysfile.c                                 |    9 +-
 fs/orangefs/dir.c                                  |    7 +-
 fs/proc/array.c                                    |    6 +
 fs/proc/base.c                                     |  184 +-
 fs/proc/fd.c                                       |   29 +-
 fs/proc/generic.c                                  |    9 +-
 fs/proc/internal.h                                 |    4 +-
 fs/proc/namespaces.c                               |   16 +-
 fs/proc/proc_net.c                                 |    1 +
 fs/smbfs_common/smb2pdu.h                          |  318 ++++
 fs/sysfs/file.c                                    |    4 +
 fs/udf/balloc.c                                    |    5 +-
 fs/udf/super.c                                     |   11 +-
 fs/userfaultfd.c                                   |   14 +-
 fs/xfs/libxfs/xfs_format.h                         |    2 +-
 fs/xfs/libxfs/xfs_sb.c                             |   64 +
 fs/xfs/libxfs/xfs_sb.h                             |    1 +
 fs/xfs/xfs_dquot.c                                 |   16 +-
 fs/xfs/xfs_log_recover.c                           |    6 +-
 fs/xfs/xfs_mount.c                                 |    1 +
 fs/xfs/xfs_mount.h                                 |   75 +
 fs/xfs/xfs_rtalloc.c                               |    3 +
 include/crypto/drbg.h                              |   18 +-
 include/linux/audit.h                              |    8 +
 include/linux/bitops.h                             |    2 +
 include/linux/device.h                             |    5 +-
 include/linux/glob.h                               |    1 +
 include/linux/hid-sensor-hub.h                     |   25 +
 include/linux/hid.h                                |   29 +
 include/linux/if_rmnet.h                           |   70 +-
 include/linux/iio/common/inv_sensors_timestamp.h   |   94 +
 include/linux/pci.h                                |    4 +-
 include/linux/platform_data/pca953x.h              |    2 +-
 include/linux/skmsg.h                              |   22 +-
 include/net/addrconf.h                             |   12 +-
 include/net/bluetooth/hci.h                        |    5 +-
 include/net/bluetooth/l2cap.h                      |    2 +-
 include/net/fib_rules.h                            |    5 +
 include/net/gue.h                                  |    2 +-
 include/net/if_inet6.h                             |   37 +-
 include/net/ip_fib.h                               |    7 +-
 include/net/ip_vs.h                                |    3 +-
 include/net/mld.h                                  |    3 +
 include/net/ndisc.h                                |    4 +-
 include/net/rtnetlink.h                            |    2 +
 include/net/sctp/sctp.h                            |    3 +-
 include/net/sock.h                                 |    2 +-
 include/net/xfrm.h                                 |    7 +
 include/uapi/linux/if_link.h                       |    1 +
 io_uring/io-wq.c                                   |    2 +-
 kernel/audit.c                                     |   85 +-
 kernel/bpf/verifier.c                              |    3 +-
 kernel/cgroup/cpuset.c                             |    7 +-
 kernel/cpu.c                                       |    8 +-
 kernel/locking/rtmutex.c                           |   16 +-
 kernel/sched/fair.c                                |    2 +-
 kernel/sched/features.h                            |    8 +
 kernel/time/posix-cpu-timers.c                     |    3 +-
 kernel/time/time.c                                 |    2 +-
 kernel/trace/ring_buffer.c                         |    3 +-
 kernel/trace/trace_events_filter.c                 |    6 +-
 kernel/trace/trace_probe.c                         |    3 +-
 kernel/trace/trace_probe.h                         |    2 +-
 kernel/workqueue.c                                 |    2 +-
 lib/debugobjects.c                                 |   17 +
 lib/glob.c                                         |   31 +-
 lib/test_meminit.c                                 |    2 +-
 net/6lowpan/nhc.c                                  |    2 +-
 net/9p/trans_rdma.c                                |   19 +-
 net/atm/common.c                                   |    2 +
 net/batman-adv/distributed-arp-table.c             |   30 +-
 net/batman-adv/fragmentation.c                     |    8 +-
 net/batman-adv/gateway_client.c                    |    3 +-
 net/batman-adv/main.c                              |   22 +-
 net/batman-adv/multicast.c                         |    6 +-
 net/batman-adv/routing.c                           |    3 +-
 net/batman-adv/soft-interface.c                    |   11 +-
 net/batman-adv/soft-interface.h                    |    2 +
 net/batman-adv/translation-table.c                 |    5 +-
 net/batman-adv/types.h                             |    7 +
 net/bluetooth/af_bluetooth.c                       |   17 +-
 net/bluetooth/bnep/core.c                          |   27 +-
 net/bluetooth/l2cap_core.c                         |  123 +-
 net/bluetooth/l2cap_sock.c                         |    4 +-
 net/bridge/netfilter/ebtables.c                    |   22 +-
 net/bridge/netfilter/nft_meta_bridge.c             |    4 +-
 net/can/bcm.c                                      |   90 +-
 net/can/isotp.c                                    |    9 +-
 net/core/fib_rules.c                               |    6 +-
 net/core/filter.c                                  |   38 +-
 net/core/lwt_bpf.c                                 |   12 +
 net/core/rtnetlink.c                               |    8 +
 net/core/skbuff.c                                  |   23 +-
 net/core/skmsg.c                                   |    2 +
 net/ieee802154/core.c                              |    2 +-
 net/ieee802154/header_ops.c                        |    9 +-
 net/ieee802154/ieee802154.h                        |   17 +
 net/ieee802154/netlink.c                           |   36 +-
 net/ife/ife.c                                      |    2 +-
 net/ipv4/igmp.c                                    |    1 +
 net/ipv4/ip_gre.c                                  |    6 +
 net/ipv4/ip_vti.c                                  |    3 +
 net/ipv4/netfilter/nf_log_ipv4.c                   |    4 +-
 net/ipv4/sysctl_net_ipv4.c                         |   10 +-
 net/ipv4/tcp_output.c                              |    4 +-
 net/ipv6/addrconf.c                                |   38 +-
 net/ipv6/addrconf_core.c                           |    2 +-
 net/ipv6/af_inet6.c                                |    2 +-
 net/ipv6/icmp.c                                    |    4 +-
 net/ipv6/ip6_gre.c                                 |    6 +
 net/ipv6/ip6_vti.c                                 |    3 +
 net/ipv6/mcast.c                                   | 1184 +++++++-----
 net/ipv6/netfilter.c                               |    4 +-
 net/ipv6/netfilter/ip6t_ah.c                       |    5 +
 net/ipv6/netfilter/ip6t_hbh.c                      |    1 +
 net/ipv6/netfilter/ip6t_rt.c                       |    3 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |    3 +-
 net/ipv6/netfilter/nf_log_ipv6.c                   |    4 +-
 net/ipv6/route.c                                   |    9 +-
 net/ipv6/seg6.c                                    |    3 +
 net/ipv6/sit.c                                     |    3 +
 net/kcm/kcmsock.c                                  |    8 +-
 net/key/af_key.c                                   |    1 +
 net/llc/af_llc.c                                   |    1 +
 net/llc/llc_conn.c                                 |    1 -
 net/mac80211/main.c                                |    3 +-
 net/mac80211/tx.c                                  |   17 +-
 net/mac802154/iface.c                              |    2 +-
 net/netfilter/ipset/ip_set_core.c                  |   12 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |    4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   36 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |   18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |   11 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |    3 +-
 net/netfilter/nf_conncount.c                       |   23 +-
 net/netfilter/nf_conntrack_core.c                  |   18 +-
 net/netfilter/nf_conntrack_irc.c                   |    6 +-
 net/netfilter/nf_conntrack_seqadj.c                |    2 +
 net/netfilter/nf_nat_sip.c                         |    9 +
 net/netfilter/nfnetlink_cthelper.c                 |    4 +-
 net/netfilter/nfnetlink_osf.c                      |    6 +-
 net/netfilter/nft_log.c                            |   58 +-
 net/netfilter/nft_synproxy.c                       |    9 +-
 net/netfilter/xt_AUDIT.c                           |   58 +-
 net/netfilter/xt_cluster.c                         |    2 +-
 net/netfilter/xt_nat.c                             |    9 +
 net/netfilter/xt_rateest.c                         |    2 +-
 net/netfilter/xt_u32.c                             |   12 +-
 net/openvswitch/conntrack.c                        |    2 +-
 net/psample/psample.c                              |    6 +-
 net/qrtr/af_qrtr.c                                 |    2 +-
 net/sched/cls_bpf.c                                |   10 +-
 net/sched/sch_cake.c                               |    5 +-
 net/sched/sch_codel.c                              |   48 +-
 net/sched/sch_drr.c                                |    8 +-
 net/sched/sch_fq_codel.c                           |   41 +-
 net/sched/sch_hfsc.c                               |   24 +-
 net/sched/sch_hhf.c                                |   27 +
 net/sched/sch_htb.c                                |    8 +-
 net/sched/sch_multiq.c                             |    2 +-
 net/sctp/diag.c                                    |   67 +-
 net/sctp/sm_make_chunk.c                           |   10 +-
 net/sctp/sm_statefuns.c                            |   23 +-
 net/sctp/socket.c                                  |   29 +-
 net/smc/smc_cdc.c                                  |   15 +-
 net/socket.c                                       |    2 +-
 net/tipc/bcast.c                                   |   22 +-
 net/tipc/bcast.h                                   |    2 +-
 net/tipc/bearer.c                                  |    1 +
 net/tipc/netlink.c                                 |   12 +
 net/tipc/node.c                                    |   15 +-
 net/tipc/socket.c                                  |    3 +
 net/tipc/udp_media.c                               |    2 +
 net/tls/tls_sw.c                                   |    4 +
 net/xfrm/xfrm_interface_core.c                     |    3 +
 net/xfrm/xfrm_policy.c                             |    3 +
 net/xfrm/xfrm_state.c                              |   11 +-
 net/xfrm/xfrm_user.c                               |    2 +-
 samples/trace_events/trace-events-sample.c         |    4 +
 scripts/kconfig/conf.c                             |    6 +-
 security/apparmor/domain.c                         |   58 +-
 security/apparmor/include/policy_unpack.h          |   19 +
 security/apparmor/label.c                          |    2 +-
 security/apparmor/lsm.c                            |   18 +-
 security/apparmor/net.c                            |    1 +
 security/apparmor/policy.c                         |   14 +-
 security/apparmor/procattr.c                       |    2 +
 security/keys/keyring.c                            |    2 +-
 sound/aoa/fabrics/layout.c                         |    6 +
 sound/firewire/isight.c                            |    3 +-
 sound/pci/es1938.c                                 |    2 +
 sound/soc/fsl/fsl_audmix.c                         |    6 +
 sound/soc/tegra/tegra210_ahub.c                    |    4 +-
 sound/usb/caiaq/input.c                            |    2 +-
 sound/usb/mixer_quirks.c                           |  101 +-
 sound/usb/mixer_scarlett.c                         |    4 +-
 sound/usb/mixer_us16x08.c                          |  127 +-
 tools/bpf/bpftool/net.c                            |    4 +-
 tools/include/linux/bitops.h                       |    2 +
 tools/lib/api/fs/fs.c                              |   19 +-
 tools/lib/symbol/kallsyms.c                        |    5 +-
 tools/perf/builtin-c2c.c                           |    1 +
 tools/perf/builtin-sched.c                         |   37 +-
 tools/perf/trace/beauty/fcntl.c                    |   16 +
 tools/perf/util/bpf-event.c                        |   18 +-
 tools/perf/util/cpumap.c                           |    6 +
 tools/perf/util/event.c                            |   15 +-
 tools/perf/util/hist.c                             |    7 +-
 tools/perf/util/machine.c                          |   10 +-
 tools/perf/util/mmap.c                             |   10 +-
 tools/perf/util/pmu.c                              |    4 +-
 tools/perf/util/probe-finder.c                     |    4 +-
 tools/perf/util/symbol-elf.c                       |   48 +-
 tools/perf/util/symbol-minimal.c                   |   11 +-
 tools/perf/util/symbol.c                           |    2 +-
 tools/perf/util/thread.c                           |    5 +
 tools/testing/selftests/vm/compaction_test.c       |    3 +
 tools/testing/selftests/vm/hmm-tests.c             |   32 +-
 tools/usb/usbip/libsrc/usbip_common.c              |    2 +
 tools/usb/usbip/libsrc/usbip_device_driver.c       |    4 +
 tools/usb/usbip/libsrc/vhci_driver.c               |    1 +
 tools/virtio/vringh_test.c                         |    5 +
 tools/vm/slabinfo.c                                |    4 +-
 virt/kvm/eventfd.c                                 |   12 +-
 virt/kvm/kvm_main.c                                |   16 +-
 689 files changed, 8712 insertions(+), 5883 deletions(-)

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chaitanya Kulkarni <[email protected]>

commit 5293a8882c549fab4a878bc76b0b6c951f980a61 upstream.

nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown.

If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock.

If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue.

The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference.

Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started.

Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes.

[ context diff adaptation: drop queue->state = NVMET_TCP_Q_FAILED since
the enum introduced in 6.7, 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall" ]

---
 drivers/nvme/target/tcp.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

index edcc0662c3e571..4bd82e9b113ff5 100644
@@ -345,6 +345,19 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
 
 static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
 {
+	/*
+	 * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
+	 * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
+	 * already been consumed and queue teardown has started.
+	 *
+	 * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
+	 * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
+	 * cancels it, the queue must not keep that old receive state.
+	 * Otherwise the next nvmet_tcp_io_work() run can reach
+	 * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
+	 *
+	 * That is why queue->rcv_state needs to be updated before we return.
+	 */
 	queue->rcv_state = NVMET_TCP_RECV_ERR;
 	if (queue->nvme_sq.ctrl)
 		nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);

@@ -888,10 +901,24 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
 	iov.iov_base = icresp;
 	iov.iov_len = sizeof(*icresp);
 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
-	if (ret < 0)
+	if (ret < 0) {
+		spin_lock_bh(&queue->state_lock);
+		if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+			spin_unlock_bh(&queue->state_lock);
+			return -ESHUTDOWN;
+		}
+		spin_unlock_bh(&queue->state_lock);
 		return ret; /* queue removal will cleanup */
+	}
 
+	spin_lock_bh(&queue->state_lock);
+	if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+		spin_unlock_bh(&queue->state_lock);
+		/* Tell nvmet_tcp_socket_error() teardown is in progress. */
+		return -ESHUTDOWN;
+	}
 	queue->state = NVMET_TCP_Q_LIVE;
+	spin_unlock_bh(&queue->state_lock);
 	nvmet_prepare_receive_pdu(queue);
 	return 0;
 }

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Mason <[email protected]>

commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail.

A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work.

    nfsd4_alloc_layout_stateid()
      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */
      nfsd4_layout_setlease()     /* fails */
        nfs4_put_stid()
          nfsd4_free_layout_stateid()
            delayed_work_pending(&ls->ls_fence_work)  /* needs INIT */
            nfsd4_close_layout()  /* nfsd_file_put(ls->ls_file) */
          put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

---
 fs/nfsd/nfs4layouts.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index d0fbbd34db689c..bcf16dd07d4883 100644
@@ -241,9 +241,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
 	BUG_ON(!ls->ls_file);
 
 	if (nfsd4_layout_setlease(ls)) {
-		nfsd_file_put(ls->ls_file);
-		put_nfs4_file(fp);
-		kmem_cache_free(nfs4_layout_stateid_cache, ls);
+		nfs4_put_stid(stp);
 		return NULL;
 	}
 

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email protected]>

commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable — silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.

---
 fs/nfsd/vfs.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

index 19468142486671..c8eebd03784a21 100644
@@ -1149,8 +1149,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 	nfsd_stats_io_write_add(nn, exp, *cnt);
 	fsnotify_modify(file);
 	host_err = filemap_check_wb_err(file->f_mapping, since);
-	if (host_err < 0)
+	if (host_err < 0) {
+		nfsd_reset_write_verifier(nn);
+		trace_nfsd_writeverf_reset(nn, rqstp, host_err);
 		goto out_nfserr;
+	}
 
 	if (stable && use_wgather) {
 		host_err = wait_for_concurrent_writes(file);

@@ -1286,6 +1289,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 			nfsd_copy_write_verifier(verf, nn);
 			err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
 						    since);
+			if (err2 < 0) {
+				nfsd_reset_write_verifier(nn);
+				trace_nfsd_writeverf_reset(nn, rqstp, err2);
+			}
 			err = nfserrno(err2);
 			break;
 		case -EINVAL:

2.53.0

perf fails to build with this error:

util/event.c: In function 'machine__resolve':
util/event.c:668:32: warning: implicit declaration of function 'perf_env__get_cpu_topology'; did you mean 'perf_env__read_cpu_topology_map'? [-Wimplicit-function-declaration]
668 | topo = perf_env__get_cpu_topology(env,

(struct perf_cpu){ al->cpu });
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                perf_env__read_cpu_topology_map
util/event.c:668:83: warning: excess elements in struct initializer
  668 |                         topo = perf_env__get_cpu_topology(env, 
(struct perf_cpu){ al->cpu });
      | 
                  ^~
util/event.c:668:83: note: (near initialization for '(anonymous)')
util/event.c:668:81: error: invalid use of undefined type 'struct perf_cpu'
  668 |                         topo = perf_env__get_cpu_topology(env, 
(struct perf_cpu){ al->cpu });
      | 
                ^

make[6]: *** [/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/build/Makefile.build:97: /local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/util/event.o] Error 1 make[6]: *** Waiting for unfinished jobs....

which is due to commit 07511f3c23cdaf1dbb44802f026fcc476351dfe2 ("perf tools: Use perf_env__get_cpu_topology() in machine__resolve()"), it looks like we need to also backport those commits:

751835c57632006232bf30405cd7201dceb0b8e0 ("perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu")

6d18804b963b78dcd53851f11e9080408b3d85c2 ("perf cpumap: Give CPUs their own type")

c760174401f605cf63314d3817069a40945f0e0b ("perf cpumap: Reduce cpu size from int to int16_t")

Florian

Compiled OK for an i386 and runs OK on a 32-bit eeepc. No new problems noticed.

# Librecast Test Results

020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 5.10.261-rc1-00700-g9067606e05eb #1 SMP Tue Jul 21 20:27:17 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kiryl Shutsemau <[email protected]>

[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]

userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result.

The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive.

Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.

[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree predates the marker/return-style refactor of these functions ]

---
 fs/userfaultfd.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

index 0d6c00e9b49316..6773227fbe889e 100644
@@ -251,7 +251,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (huge_pte_none(pte))
 		ret = true;
-	if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): huge_pte_write() on a
+	 * non-present migration entry decodes random offset bits. The
+	 * migration completion path re-delivers the fault if still needed.
+	 */
+	if (pte_present(pte) && !huge_pte_write(pte) && (reason & VM_UFFD_WP))
 		ret = true;
 out:
 	return ret;

@@ -332,7 +337,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (pte_none(*pte))
 		ret = true;
-	if (!pte_write(*pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): pte_write() on a
+	 * non-present swap/migration entry decodes random offset bits. The
+	 * page-in path re-delivers the fault if it still needs userspace.
+	 */
+	if (pte_present(*pte) && !pte_write(*pte) && (reason & VM_UFFD_WP))
 		ret = true;
 	pte_unmap(pte);
 

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiasheng Jiang <[email protected]>

commit ed713e2bc093239ccd380c2ce8ae9e4162f5c037 upstream.

As the potential failure of the kcalloc(),
it should be better to check it in order to
avoid the dereference of the NULL pointer.

---
 drivers/clk/imx/clk.c | 2 ++
 1 file changed, 2 insertions(+)

index d4cf0c7045ab27..be0493e5b494e6 100644
@@ -173,6 +173,8 @@ void imx_register_uart_clocks(unsigned int clk_count)
 		int i;
 
 		imx_uart_clocks = kcalloc(clk_count, sizeof(struct clk *), GFP_KERNEL);
+		if (!imx_uart_clocks)
+			return;
 
 		if (!of_stdout)
 			return;

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <[email protected]>

[ Upstream commit 89bd77cf436bf25e448817a662ebf76515f22863 ]

nfsd4_list_rec_dir() is called with two different callbacks. One of the callbacks uses vfs_rmdir() to remove the directory. The other doesn't use the dentry at all, just the name.

As only one callback needs the dentry, this patch moves the lookup into that callback. This prepares of changes to how directory operations are locked.

Stable-dep-of: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")

---
 fs/nfsd/nfs4recover.c | 55 ++++++++++++++++++++++---------------------
 1 file changed, 28 insertions(+), 27 deletions(-)

index 8ea55b2621ee41..c74c4023770694 100644
@@ -254,7 +254,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
 	nfs4_reset_creds(original_cred);
 }
 
-typedef int (recdir_func)(struct dentry *, struct dentry *, struct nfsd_net *);
+typedef int (recdir_func)(struct dentry *, char *, struct nfsd_net *);
 
 struct name_list {
 	char name[HEXDIR_LEN];

@@ -308,23 +308,14 @@ nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
 	}
 
 	status = iterate_dir(nn->rec_file, &ctx.ctx);
-	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
 
 	list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
-		if (!status) {
-			struct dentry *dentry;
-			dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
-			if (IS_ERR(dentry)) {
-				status = PTR_ERR(dentry);
-				break;
-			}
-			status = f(dir, dentry, nn);
-			dput(dentry);
-		}
+		if (!status)
+			status = f(dir, entry->name, nn);
+
 		list_del(&entry->list);
 		kfree(entry);
 	}
-	inode_unlock(d_inode(dir));
 	nfs4_reset_creds(original_cred);
 
 	list_for_each_entry_safe(entry, tmp, &ctx.names, list) {

@@ -422,18 +413,19 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
 }
 
 static int
-purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+purge_old(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
 	int status;
+	struct dentry *child;
 	struct xdr_netobj name;
 
-	if (child->d_name.len != HEXDIR_LEN - 1) {
-		printk("%s: illegal name %pd in recovery directory\n",
-				__func__, child);
+	if (strlen(cname) != HEXDIR_LEN - 1) {
+		printk("%s: illegal name %s in recovery directory\n",
+				__func__, cname);
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+	name.data = kstrdup(cname, GFP_KERNEL);
 	if (!name.data) {
 		dprintk("%s: failed to allocate memory for name.data!\n",
 			__func__);

@@ -443,10 +435,17 @@ purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
 	if (nfs4_has_reclaimed_state(name, nn))
 		goto out_free;
 
-	status = vfs_rmdir(d_inode(parent), child);
-	if (status)
-		printk("failed to remove client recovery directory %pd\n",
-				child);
+	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+	child = lookup_one_len(cname, parent, HEXDIR_LEN - 1);
+	if (!IS_ERR(child)) {
+		status = vfs_rmdir(d_inode(parent), child);
+		if (status)
+			printk("failed to remove client recovery directory %pd\n",
+			       child);
+		dput(child);
+	}
+	inode_unlock(d_inode(parent));
+
 out_free:
 	kfree(name.data);
 out:

@@ -477,18 +476,18 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
 }
 
 static int
-load_recdir(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
 	struct xdr_netobj name;
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 
-	if (child->d_name.len != HEXDIR_LEN - 1) {
-		printk("%s: illegal name %pd in recovery directory\n",
-				__func__, child);
+	if (strlen(cname) != HEXDIR_LEN - 1) {
+		printk("%s: illegal name %s in recovery directory\n",
+				__func__, cname);
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+	name.data = kstrdup(cname, GFP_KERNEL);
 	if (!name.data) {
 		dprintk("%s: failed to allocate memory for name.data!\n",
 			__func__);

@@ -843,11 +842,13 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				return PTR_ERR(name.data);
 			name.len = namelen;
 		}
+#ifdef CONFIG_NFSD_V4
 		if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
 			name.len = name.len - 5;
 			memmove(name.data, name.data + 5, name.len);
 			cn->cn_has_legacy = true;
 		}
+#endif
 		if (!nfs4_client_to_reclaim(name, princhash, nn)) {
 			kfree(name.data);
 			kfree(princhash.data);

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <[email protected]>

[ Upstream commit 4552f4e3f2c96597914f07b060d5c5db84420ddd ]

The calling convention for nfs4_client_to_reclaim() is clumsy in that the caller needs to free memory if the function fails. It is much cleaner if the function frees its own memory.

This patch changes nfs4_client_to_reclaim() to re-allocate the .data fields to be stored in the newly allocated struct nfs4_client_reclaim, and to free everything on failure.

__cld_pipe_inprogress_downcall() needs to allocate the data anyway to copy it from user-space, so now that data is allocated twice. I think that is a small price to pay for a cleaner interface.

---
 fs/nfsd/nfs4recover.c | 67 +++++++++++++++----------------------------
 fs/nfsd/nfs4state.c   | 22 ++++++++++++--
 2 files changed, 42 insertions(+), 47 deletions(-)

index c74c4023770694..8ff61f6184e24d 100644
@@ -167,24 +167,13 @@ legacy_recdir_name_error(struct nfs4_client *clp, int error)
 
 static void
 __nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
-		const char *dname, int len, struct nfsd_net *nn)
+				    char *dname, struct nfsd_net *nn)
 {
-	struct xdr_netobj name;
+	struct xdr_netobj name = { .len = strlen(dname), .data = dname };
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 	struct nfs4_client_reclaim *crp;
 
-	name.data = kmemdup(dname, len, GFP_KERNEL);
-	if (!name.data) {
-		dprintk("%s: failed to allocate memory for name.data!\n",
-			__func__);
-		return;
-	}
-	name.len = len;
 	crp = nfs4_client_to_reclaim(name, princhash, nn);
-	if (!crp) {
-		kfree(name.data);
-		return;
-	}
 	crp->cr_clp = clp;
 }
 

@@ -240,8 +229,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
 	inode_unlock(d_inode(dir));
 	if (status == 0) {
 		if (nn->in_grace)
-			__nfsd4_create_reclaim_record_grace(clp, dname,
-					HEXDIR_LEN, nn);
+			__nfsd4_create_reclaim_record_grace(clp, dname, nn);
 		vfs_fsync(nn->rec_file, 0);
 	} else {
 		printk(KERN_ERR "NFSD: failed to write recovery record"

@@ -478,7 +466,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
 static int
 load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
-	struct xdr_netobj name;
+	struct xdr_netobj name = { .len = HEXDIR_LEN, .data = cname };
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 
 	if (strlen(cname) != HEXDIR_LEN - 1) {

@@ -487,16 +475,7 @@ load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kstrdup(cname, GFP_KERNEL);
-	if (!name.data) {
-		dprintk("%s: failed to allocate memory for name.data!\n",
-			__func__);
-		goto out;
-	}
-	name.len = HEXDIR_LEN;
-	if (!nfs4_client_to_reclaim(name, princhash, nn))
-		kfree(name.data);
-out:
+	nfs4_client_to_reclaim(name, princhash, nn);
 	return 0;
 }
 

@@ -792,6 +771,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 {
 	uint8_t cmd, princhashlen;
 	struct xdr_netobj name, princhash = { .len = 0, .data = NULL };
+	char *namecopy __free(kfree) = NULL;
+	char *princhashcopy __free(kfree) = NULL;
 	uint16_t namelen;
 	struct cld_net *cn = nn->cld_net;
 

@@ -810,20 +791,20 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				dprintk("%s: namelen should not be zero", __func__);
 				return -EINVAL;
 			}
-			name.data = memdup_user(&ci->cc_name.cn_id, namelen);
-			if (IS_ERR(name.data))
-				return PTR_ERR(name.data);
+			namecopy = memdup_user(&ci->cc_name.cn_id, namelen);
+			if (IS_ERR(namecopy))
+				return PTR_ERR(namecopy);
+			name.data = namecopy;
 			name.len = namelen;
 			if (get_user(princhashlen, &ci->cc_princhash.cp_len))
 				return -EFAULT;
 			if (princhashlen > 0) {
-				princhash.data = memdup_user(
-						&ci->cc_princhash.cp_data,
-						princhashlen);
-				if (IS_ERR(princhash.data)) {
-					kfree(name.data);
-					return PTR_ERR(princhash.data);
-				}
+				princhashcopy = memdup_user(
+					&ci->cc_princhash.cp_data,
+					princhashlen);
+				if (IS_ERR(princhashcopy))
+					return PTR_ERR(princhashcopy);
+				princhash.data = princhashcopy;
 				princhash.len = princhashlen;
 			} else
 				princhash.len = 0;

@@ -837,23 +818,21 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				dprintk("%s: namelen should not be zero", __func__);
 				return -EINVAL;
 			}
-			name.data = memdup_user(&cnm->cn_id, namelen);
-			if (IS_ERR(name.data))
-				return PTR_ERR(name.data);
+			namecopy = memdup_user(&cnm->cn_id, namelen);
+			if (IS_ERR(namecopy))
+				return PTR_ERR(namecopy);
+			name.data = namecopy;
 			name.len = namelen;
 		}
 #ifdef CONFIG_NFSD_V4
 		if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
 			name.len = name.len - 5;
-			memmove(name.data, name.data + 5, name.len);
+			name.data = name.data + 5;
 			cn->cn_has_legacy = true;
 		}
 #endif
-		if (!nfs4_client_to_reclaim(name, princhash, nn)) {
-			kfree(name.data);
-			kfree(princhash.data);
+		if (!nfs4_client_to_reclaim(name, princhash, nn))
 			return -EFAULT;
-		}
 		return nn->client_tracking_ops->msglen;
 	}
 	return -EFAULT;

index 6b34bfac6194bb..c61e1a4ab620cc 100644
@@ -8037,9 +8037,6 @@ nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
 
 /*
  * failure => all reset bets are off, nfserr_no_grace...
- *
- * The caller is responsible for freeing name.data if NULL is returned (it
- * will be freed in nfs4_remove_reclaim_record in the normal case).
  */
 struct nfs4_client_reclaim *
 nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,

@@ -8048,6 +8045,22 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 	unsigned int strhashval;
 	struct nfs4_client_reclaim *crp;
 
+	name.data = kmemdup(name.data, name.len, GFP_KERNEL);
+	if (!name.data) {
+		dprintk("%s: failed to allocate memory for name.data!\n",
+			__func__);
+		return NULL;
+	}
+	if (princhash.len) {
+		princhash.data = kmemdup(princhash.data, princhash.len, GFP_KERNEL);
+		if (!princhash.data) {
+			dprintk("%s: failed to allocate memory for princhash.data!\n",
+				__func__);
+			kfree(name.data);
+			return NULL;
+		}
+	} else
+		princhash.data = NULL;
 	crp = alloc_reclaim();
 	if (crp) {
 		strhashval = clientstr_hashval(name);

@@ -8059,6 +8072,9 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 		crp->cr_princhash.len = princhash.len;
 		crp->cr_clp = NULL;
 		nn->reclaim_str_hashtbl_size++;
+	} else {
+		kfree(name.data);
+		kfree(princhash.data);
 	}
 	return crp;
 }

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lad Prabhakar <[email protected]>

The RZ/G2H (R8A774E1) SoC uses the same SDHI IP as the R-Car H3-N (R8A77951) and requires the sdhi_quirks_bad_taps2367 quirk.

The 5.10 stable backport of commit 77fa80a1b732 ("mmc: renesas_sdhi:
Add OF entry for RZ/G2H SoC") adds an OF match entry for RZ/G2H. However, unlike upstream, the 5.10 driver applies SoC-specific quirks through the sdhi_quirks_match table. As a result, the required quirk is not applied for RZ/G2H.

Add the missing sdhi_quirks_match entry for RZ/G2H ES3.x.

---
 drivers/mmc/host/renesas_sdhi_core.c | 1 +
 1 file changed, 1 insertion(+)

index c0acb309e3243b..f02f9ef5cfbc80 100644
@@ -903,6 +903,7 @@ static const struct renesas_sdhi_quirks sdhi_quirks_r8a77990 = {
  */
 static const struct soc_device_attribute sdhi_quirks_match[]  = {
 	{ .soc_id = "r8a774a1", .revision = "ES1.[012]", .data = &sdhi_quirks_4tap_nohs400 },
+	{ .soc_id = "r8a774e1", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 },
 	{ .soc_id = "r8a7795", .revision = "ES1.*", .data = &sdhi_quirks_4tap_nohs400 },
 	{ .soc_id = "r8a7795", .revision = "ES2.0", .data = &sdhi_quirks_4tap },
 	{ .soc_id = "r8a7795", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 },

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email protected]>

commit f1edbed787ba67988ed34e0132ca128b052b6ce8 upstream.

Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses.

For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets).

If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal.

Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.

E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned.

  ------------[ cut here ]------------
  kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
  Oops: invalid opcode: 0000 [#1] SMP
  CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
  Call Trace:
   <TASK>
   __kvm_io_bus_write+0x85/0xb0 [kvm]
   kvm_io_bus_write+0x53/0x80 [kvm]
   vcpu_mmio_write+0x66/0xf0 [kvm]
   emulator_read_write_onepage+0x12a/0x540 [kvm]
   emulator_read_write+0x109/0x2b0 [kvm]
   x86_emulate_insn+0x4f8/0xfb0 [kvm]
   x86_emulate_instruction+0x181/0x790 [kvm]
   kvm_mmu_page_fault+0x313/0x630 [kvm]
   vmx_handle_exit+0x18a/0x590 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
   kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb7/0x890
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f19c931a9bf
   </TASK>
  Modules linked in: kvm_intel kvm irqbypass
  ---[ end trace 0000000000000000 ]---

In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.

Message-ID: <[email protected]>

---
 virt/kvm/eventfd.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

index 4702b71aad0831..ff0ef5f7246e93 100644
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/seqlock.h>
 #include <linux/irqbypass.h>
+#include <asm/unaligned.h>
 #include <trace/events/kvm.h>
 
 #include <kvm/iodev.h>

@@ -695,21 +696,18 @@ ioeventfd_in_range(struct _ioeventfd *p, gpa_t addr, int len, const void *val)
 		return true;
 
 	/* otherwise, we have to actually compare the data */
-
-	BUG_ON(!IS_ALIGNED((unsigned long)val, len));
-
 	switch (len) {
 	case 1:
-		_val = *(u8 *)val;
+		_val = get_unaligned((u8 *)val);
 		break;
 	case 2:
-		_val = *(u16 *)val;
+		_val = get_unaligned((u16 *)val);
 		break;
 	case 4:
-		_val = *(u32 *)val;
+		_val = get_unaligned((u32 *)val);
 		break;
 	case 8:
-		_val = *(u64 *)val;
+		_val = get_unaligned((u64 *)val);
 		break;
 	default:
 		return false;

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email protected]>

commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream.

Toolchains with older kernel headers that do not include upstream commit c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write life time hints") will now fail to build perf due to missing definitions for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT.

Provide a fallback definition for these when they are not already defined.

---
 tools/perf/trace/beauty/fcntl.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

@@ -9,6 +9,22 @@
 #include <linux/kernel.h>
 #include <uapi/linux/fcntl.h>
 
+#ifndef F_GET_RW_HINT
+#define F_GET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 11)
+#endif
+
+#ifndef F_SET_RW_HINT
+#define F_SET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 12)
+#endif
+
+#ifndef F_GET_FILE_RW_HINT
+#define F_GET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 13)
+#endif
+
+#ifndef F_SET_FILE_RW_HINT
+#define F_SET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 14)
+#endif
+
 static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix)
 {
 	return val ? scnprintf(bf, size, "%s", "0") :

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krishna chaitanya chundru <[email protected]>

commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream.

Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption.

So add a alignment check for event ring read pointer.

---
 drivers/bus/mhi/host/main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct
 
 static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
 {
-	return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len;
+	return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len &&
+			!(addr & (sizeof(struct mhi_tre) - 1));
 }
 
 int mhi_destroy_device(struct device *dev, void *data)

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiang Mei <[email protected]>

commit a84b6fedbc97078788be78dbdd7517d143ad1a77 upstream.

The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log.

This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed).

Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before.

 BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)
 Read of size 1 at addr ffff88800ea49d3f by task exploit/148
 Call Trace:
  kasan_report (mm/kasan/report.c:595)
  dump_mac_header (net/netfilter/nf_log_syslog.c:831)
  nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)
  nf_log_packet (net/netfilter/nf_log.c:260)
  nft_log_eval (net/netfilter/nft_log.c:60)
  nft_do_chain (net/netfilter/nf_tables_core.c:285)
  nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)
  nf_hook_slow (net/netfilter/core.c:619)
  nf_hook_direct_egress (net/packet/af_packet.c:257)
  packet_xmit (net/packet/af_packet.c:280)
  packet_sendmsg (net/packet/af_packet.c:3114)
  __sys_sendto (net/socket.c:2265)

---
 net/ipv4/netfilter/nf_log_ipv4.c |    4 ++--
 net/ipv6/netfilter/nf_log_ipv6.c |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

@@ -296,8 +296,8 @@ static void dump_ipv4_mac_header(struct
 
 fallback:
 	nf_log_buf_add(m, "MAC=");
-	if (dev->hard_header_len &&
-	    skb->mac_header != skb->network_header) {
+	if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
+	    skb_mac_header_len(skb) != 0) {
 		const unsigned char *p = skb_mac_header(skb);
 		unsigned int i;
 

@@ -309,8 +309,8 @@ static void dump_ipv6_mac_header(struct
 
 fallback:
 	nf_log_buf_add(m, "MAC=");
-	if (dev->hard_header_len &&
-	    skb->mac_header != skb->network_header) {
+	if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
+	    skb_mac_header_len(skb) != 0) {
 		const unsigned char *p = skb_mac_header(skb);
 		unsigned int len = dev->hard_header_len;
 		unsigned int i;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 5a8fb33e530512ee67a11b30f3451a4f030f4b01 ]

We have plans for increasing MAX_SKB_FRAGS, but sk_msg_sg::copy is currently an unsigned long, limiting MAX_SKB_FRAGS to 30 on 32bit arches.

Convert it to a bitmap, as Jakub suggested.

Stable-dep-of: 406e8a651a7b ("net: skmsg: preserve sg.copy across SG transforms")

---
 include/linux/skmsg.h |   11 +++++------
 net/core/filter.c     |    4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)

@@ -29,7 +29,7 @@ struct sk_msg_sg {
 	u32				end;
 	u32				size;
 	u32				copybreak;
-	unsigned long			copy;
+	DECLARE_BITMAP(copy, MAX_MSG_FRAGS + 2);
 	/* The extra two elements:
 	 * 1) used for chaining the front and sections when the list becomes
 	 *    partitioned (e.g. end < start). The crypto APIs require the

@@ -38,7 +38,6 @@ struct sk_msg_sg {
 	 */
 	struct scatterlist		data[MAX_MSG_FRAGS + 2];
 };
-static_assert(BITS_PER_LONG >= NR_MSG_FRAG_IDS);
 
 /* UAPI in filter.c depends on struct sk_msg_sg being first element. */
 struct sk_msg {

@@ -235,7 +234,7 @@ static inline void sk_msg_compute_data_p
 {
 	struct scatterlist *sge = sk_msg_elem(msg, msg->sg.start);
 
-	if (test_bit(msg->sg.start, &msg->sg.copy)) {
+	if (test_bit(msg->sg.start, msg->sg.copy)) {
 		msg->data = NULL;
 		msg->data_end = NULL;
 	} else {

@@ -254,7 +253,7 @@ static inline void sk_msg_page_add(struc
 	sg_set_page(sge, page, len, offset);
 	sg_unmark_end(sge);
 
-	__set_bit(msg->sg.end, &msg->sg.copy);
+	__set_bit(msg->sg.end, msg->sg.copy);
 	msg->sg.size += len;
 	sk_msg_iter_next(msg, end);
 }

@@ -263,9 +262,9 @@ static inline void sk_msg_sg_copy(struct
 {
 	do {
 		if (copy_state)
-			__set_bit(i, &msg->sg.copy);
+			__set_bit(i, msg->sg.copy);
 		else
-			__clear_bit(i, &msg->sg.copy);
+			__clear_bit(i, msg->sg.copy);
 		sk_msg_iter_var_next(i);
 		if (i == msg->sg.end)
 			break;

@@ -2677,7 +2677,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 	 * account for the headroom.
 	 */
 	bytes_sg_total = start - offset + bytes;
-	if (!test_bit(i, &msg->sg.copy) && bytes_sg_total <= len)
+	if (!test_bit(i, msg->sg.copy) && bytes_sg_total <= len)
 		goto out;
 
 	/* At this point we need to linearize multiple scatterlist

@@ -2900,7 +2900,7 @@ place_new:
 	/* Place newly allocated data buffer */
 	sk_mem_charge(msg->sk, len);
 	msg->sg.size += len;
-	__clear_bit(new, &msg->sg.copy);
+	__clear_bit(new, msg->sg.copy);
 	sg_set_page(&msg->sg.data[new], page, len + copy, 0);
 	if (rsge.length) {
 		get_page(sg_page(&rsge));

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yiming Qian <[email protected]>

[ Upstream commit 406e8a651a7b854c41fecd5117bb282b3a6c2c6b ]

The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages.

Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache.

Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.

---
 include/linux/skmsg.h |   15 +++++++++++----
 net/core/filter.c     |   27 +++++++++++++++++++++++++++
 net/core/skmsg.c      |    2 ++
 net/tls/tls_sw.c      |    4 ++++
 4 files changed, 44 insertions(+), 4 deletions(-)

@@ -4,6 +4,7 @@
 #ifndef _LINUX_SKMSG_H
 #define _LINUX_SKMSG_H
 
+#include <linux/bitops.h>
 #include <linux/bpf.h>
 #include <linux/filter.h>
 #include <linux/scatterlist.h>

@@ -187,11 +188,14 @@ static inline void sk_msg_xfer(struct sk
 			       int which, u32 size)
 {
 	dst->sg.data[which] = src->sg.data[which];
+	__assign_bit(which, dst->sg.copy, test_bit(which, src->sg.copy));
 	dst->sg.data[which].length  = size;
 	dst->sg.size		   += size;
 	src->sg.size		   -= size;
 	src->sg.data[which].length -= size;
 	src->sg.data[which].offset += size;
+	if (!src->sg.data[which].length)
+		__clear_bit(which, src->sg.copy);
 }
 
 static inline void sk_msg_xfer_full(struct sk_msg *dst, struct sk_msg *src)

@@ -261,16 +265,19 @@ static inline void sk_msg_page_add(struc
 static inline void sk_msg_sg_copy(struct sk_msg *msg, u32 i, bool copy_state)
 {
 	do {
-		if (copy_state)
-			__set_bit(i, msg->sg.copy);
-		else
-			__clear_bit(i, msg->sg.copy);
+		__assign_bit(i, msg->sg.copy, copy_state);
 		sk_msg_iter_var_next(i);
 		if (i == msg->sg.end)
 			break;
 	} while (1);
 }
 
+static inline void sk_msg_sg_copy_assign(struct sk_msg *dst, u32 dst_i,
+					 const struct sk_msg *src, u32 src_i)
+{
+	__assign_bit(dst_i, dst->sg.copy, test_bit(src_i, src->sg.copy));
+}
+
 static inline void sk_msg_sg_copy_set(struct sk_msg *msg, u32 start)
 {
 	sk_msg_sg_copy(msg, start, true);

@@ -2718,11 +2718,13 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 		poffset += len;
 		sge->length = 0;
 		put_page(sg_page(sge));
+		__clear_bit(i, msg->sg.copy);
 
 		sk_msg_iter_var_next(i);
 	} while (i != last_sge);
 
 	sg_set_page(&msg->sg.data[first_sge], page, copy, 0);
+	__clear_bit(first_sge, msg->sg.copy);
 
 	/* To repair sg ring we need to shift entries. If we only
 	 * had a single entry though we can just replace it and

@@ -2748,9 +2750,11 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 			break;
 
 		msg->sg.data[i] = msg->sg.data[move_from];
+		sk_msg_sg_copy_assign(msg, i, msg, move_from);
 		msg->sg.data[move_from].length = 0;
 		msg->sg.data[move_from].page_link = 0;
 		msg->sg.data[move_from].offset = 0;
+		__clear_bit(move_from, msg->sg.copy);
 		sk_msg_iter_var_next(i);
 	} while (1);
 

@@ -2779,6 +2783,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 {
 	struct scatterlist sge, nsge, nnsge, rsge = {0}, *psge;
 	u32 new, i = 0, l = 0, space, copy = 0, offset = 0;
+	bool sge_copy, nsge_copy, nnsge_copy, rsge_copy = false;
 	u8 *raw, *to, *from;
 	struct page *page;
 

@@ -2851,6 +2856,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		rsge = sk_msg_elem_cpy(msg, i);
+		rsge_copy = test_bit(i, msg->sg.copy);
 
 		psge->length = start - offset;
 		rsge.length -= psge->length;

@@ -2875,24 +2881,32 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 
 	/* Shift one or two slots as needed */
 	sge = sk_msg_elem_cpy(msg, new);
+	sge_copy = test_bit(new, msg->sg.copy);
 	sg_unmark_end(&sge);
 
 	nsge = sk_msg_elem_cpy(msg, i);
+	nsge_copy = test_bit(i, msg->sg.copy);
 	if (rsge.length) {
 		sk_msg_iter_var_next(i);
 		nnsge = sk_msg_elem_cpy(msg, i);
+		nnsge_copy = test_bit(i, msg->sg.copy);
 		sk_msg_iter_next(msg, end);
 	}
 
 	while (i != msg->sg.end) {
 		msg->sg.data[i] = sge;
+		__assign_bit(i, msg->sg.copy, sge_copy);
 		sge = nsge;
+		sge_copy = nsge_copy;
 		sk_msg_iter_var_next(i);
 		if (rsge.length) {
 			nsge = nnsge;
+			nsge_copy = nnsge_copy;
 			nnsge = sk_msg_elem_cpy(msg, i);
+			nnsge_copy = test_bit(i, msg->sg.copy);
 		} else {
 			nsge = sk_msg_elem_cpy(msg, i);
+			nsge_copy = test_bit(i, msg->sg.copy);
 		}
 	}
 

@@ -2906,6 +2920,7 @@ place_new:
 		get_page(sg_page(&rsge));
 		sk_msg_iter_var_next(new);
 		msg->sg.data[new] = rsge;
+		__assign_bit(new, msg->sg.copy, rsge_copy);
 	}
 
 	sk_msg_reset_curr(msg);

@@ -2933,25 +2948,33 @@ static void sk_msg_shift_left(struct sk_
 		prev = i;
 		sk_msg_iter_var_next(i);
 		msg->sg.data[prev] = msg->sg.data[i];
+		sk_msg_sg_copy_assign(msg, prev, msg, i);
 	} while (i != msg->sg.end);
 
 	sk_msg_iter_prev(msg, end);
+	__clear_bit(msg->sg.end, msg->sg.copy);
 }
 
 static void sk_msg_shift_right(struct sk_msg *msg, int i)
 {
 	struct scatterlist tmp, sge;
+	bool tmp_copy, sge_copy;
 
 	sk_msg_iter_next(msg, end);
 	sge = sk_msg_elem_cpy(msg, i);
+	sge_copy = test_bit(i, msg->sg.copy);
 	sk_msg_iter_var_next(i);
 	tmp = sk_msg_elem_cpy(msg, i);
+	tmp_copy = test_bit(i, msg->sg.copy);
 
 	while (i != msg->sg.end) {
 		msg->sg.data[i] = sge;
+		__assign_bit(i, msg->sg.copy, sge_copy);
 		sk_msg_iter_var_next(i);
 		sge = tmp;
+		sge_copy = tmp_copy;
 		tmp = sk_msg_elem_cpy(msg, i);
+		tmp_copy = test_bit(i, msg->sg.copy);
 	}
 }
 

@@ -3011,6 +3034,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 		struct scatterlist *nsge, *sge = sk_msg_elem(msg, i);
 		int a = start - offset;
 		int b = sge->length - pop - a;
+		u32 sge_i = i;
+		bool sge_copy = test_bit(i, msg->sg.copy);
 
 		sk_msg_iter_var_next(i);
 

@@ -3023,6 +3048,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 				sg_set_page(nsge,
 					    sg_page(sge),
 					    b, sge->offset + pop + a);
+				__assign_bit(i, msg->sg.copy, sge_copy);
 			} else {
 				struct page *page, *orig;
 				u8 *to, *from;

@@ -3039,6 +3065,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 				memcpy(to, from, a);
 				memcpy(to + a, from + a + pop, b);
 				sg_set_page(sge, page, a + b, 0);
+				__clear_bit(sge_i, msg->sg.copy);
 				put_page(orig);
 			}
 			pop = 0;

@@ -65,6 +65,7 @@ int sk_msg_alloc(struct sock *sk, struct
 			sge = &msg->sg.data[msg->sg.end];
 			sg_unmark_end(sge);
 			sg_set_page(sge, pfrag->page, use, orig_offset);
+			__clear_bit(msg->sg.end, msg->sg.copy);
 			get_page(pfrag->page);
 			sk_msg_iter_next(msg, end);
 		}

@@ -185,6 +186,7 @@ static int sk_msg_free_elem(struct sock
 			sk_mem_uncharge(sk, len);
 		put_page(sg_page(sge));
 	}
+	__clear_bit(i, msg->sg.copy);
 	memset(sge, 0, sizeof(*sge));
 	return len;
 }

@@ -564,6 +564,7 @@ static int tls_split_open_record(struct
 	struct scatterlist *sge, *osge, *nsge;
 	u32 orig_size = msg_opl->sg.size;
 	struct scatterlist tmp = { };
+	u32 tmp_i = 0;
 	struct sk_msg *msg_npl;
 	struct tls_rec *new;
 	int ret;

@@ -585,6 +586,7 @@ static int tls_split_open_record(struct
 		if (sge->length > apply) {
 			u32 len = sge->length - apply;
 
+			tmp_i = i;
 			get_page(sg_page(sge));
 			sg_set_page(&tmp, sg_page(sge), len,
 				    sge->offset + apply);

@@ -616,6 +618,7 @@ static int tls_split_open_record(struct
 	nsge = sk_msg_elem(msg_npl, j);
 	if (tmp.length) {
 		memcpy(nsge, &tmp, sizeof(*nsge));
+		sk_msg_sg_copy_assign(msg_npl, j, msg_opl, tmp_i);
 		sk_msg_iter_var_next(j);
 		nsge = sk_msg_elem(msg_npl, j);
 	}

@@ -623,6 +626,7 @@ static int tls_split_open_record(struct
 	osge = sk_msg_elem(msg_opl, i);
 	while (osge->length) {
 		memcpy(nsge, osge, sizeof(*nsge));
+		sk_msg_sg_copy_assign(msg_npl, j, msg_opl, i);
 		sg_unmark_end(nsge);
 		sk_msg_iter_var_next(i);
 		sk_msg_iter_var_next(j);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruslan Valiyev <[email protected]>

[ Upstream commit 6f060496d03e4dc560a40f73770bd08335cb7a27 ]

aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0.

aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports

refcount_t: addition on 0; use-after-free.

inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata.

Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op.

Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped.

Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06:

  stress-ng --apparmor 1 --klog-check --timeout 60s

Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

---
 security/apparmor/include/policy_unpack.h |   19 +++++++++++++++++++
 security/apparmor/policy.c                |    8 ++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

@@ -122,6 +122,25 @@ aa_get_profile_loaddata(struct aa_loadda
 	return data;
 }
 
+/**
+ * aa_get_profile_loaddata_not0 - get a profile reference count if not zero
+ * @data: reference to get a count on
+ *
+ * Like aa_get_profile_loaddata(), but safe to call on an entry that may
+ * be on a list (e.g. ns->rawdata_list) where the last pcount has already
+ * dropped and the deferred cleanup has not yet run.
+ *
+ * Returns: pointer to reference, or %NULL if @data is NULL or its
+ *          profile refcount has already reached zero.
+ */
+static inline struct aa_loaddata *
+aa_get_profile_loaddata_not0(struct aa_loaddata *data)
+{
+	if (data && kref_get_unless_zero(&data->pcount))
+		return data;
+	return NULL;
+}
+
 void __aa_loaddata_update(struct aa_loaddata *data, long revision);
 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r);
 void aa_loaddata_kref(struct kref *kref);

@@ -976,8 +976,12 @@ ssize_t aa_replace_profiles(struct aa_ns
 		if (aa_rawdata_eq(rawdata_ent, udata)) {
 			struct aa_loaddata *tmp;
 
-			tmp = aa_get_profile_loaddata(rawdata_ent);
-			/* check we didn't fail the race */
+			/*
+			 * Entries remain on rawdata_list with
+			 * pcount == 0 until do_ploaddata_rmfs()
+			 * runs; only take a live profile ref.
+			 */
+			tmp = aa_get_profile_loaddata_not0(rawdata_ent);
 			if (tmp) {
 				aa_put_profile_loaddata(udata);
 				udata = tmp;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maoyi Xie <[email protected]>

[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]

A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.

Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.

Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

---
 include/net/rtnetlink.h |    2 ++
 net/core/rtnetlink.c    |    8 ++++++++
 net/ipv4/ip_gre.c       |    6 ++++++
 3 files changed, 16 insertions(+)

@@ -183,6 +183,8 @@ int rtnl_configure_link(struct net_devic
 int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
 			     struct netlink_ext_ack *exterr);
 struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+			       const struct net *link_net);
 
 #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
 

@@ -2024,6 +2024,14 @@ struct net *rtnl_get_net_ns_capable(stru
 }
 EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
 
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+			       const struct net *link_net)
+{
+	return net_eq(link_net, dev_net(dev)) ||
+	       ns_capable(link_net->user_ns, CAP_NET_ADMIN);
+}
+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
+
 static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
 				      bool strict_check, struct nlattr **tb,
 				      struct netlink_ext_ack *extack)

@@ -1407,6 +1407,9 @@ static int ipgre_changelink(struct net_d
 	struct ip_tunnel_parm p;
 	int err;
 
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
+
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;

@@ -1436,6 +1439,9 @@ static int erspan_changelink(struct net_
 	struct ip_tunnel_parm p;
 	int err;
 
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
+
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bryam Vargas <[email protected]>

[ Upstream commit 4d587cd8a72155089a627130bbd4716ec0856e21 ]

sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation.

Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.

---
 security/apparmor/lsm.c |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

@@ -951,7 +951,23 @@ static int aa_sock_msg_perm(const char *
 static int apparmor_socket_sendmsg(struct socket *sock,
 				   struct msghdr *msg, int size)
 {
-	return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
+	int error = aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
+
+	if (error)
+		return error;
+
+	/* TCP fast open carries connect() semantics in sendmsg(); mediate
+	 * the implicit connect so it cannot bypass the connect permission.
+	 */
+	if ((msg->msg_flags & MSG_FASTOPEN) && msg->msg_name &&
+	    (sock->sk->sk_family == AF_INET ||
+	     sock->sk->sk_family == AF_INET6) &&
+	    sock->sk->sk_type == SOCK_STREAM &&
+	    (sock->sk->sk_protocol == IPPROTO_TCP ||
+	     sock->sk->sk_protocol == IPPROTO_MPTCP))
+		error = aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
+
+	return error;
 }
 
 /**

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jaegeuk Kim <[email protected]>

[ Upstream commit 074b5ea2900ea8e40f8e7a3fd37e0a55ad3d5874 ]

This patch fixes counting unusable blocks set by zone capacity when checking the valid block count in a section.

Stable-dep-of: 4275b59673eb ("f2fs: fix to round down start offset of fallocate for pin file")

---
 fs/f2fs/debug.c   |    2 +-
 fs/f2fs/file.c    |    6 +++---
 fs/f2fs/gc.c      |    4 ++--
 fs/f2fs/segment.c |    7 +++----
 fs/f2fs/segment.h |    8 ++++----
 5 files changed, 13 insertions(+), 14 deletions(-)

@@ -39,7 +39,7 @@ void f2fs_update_sit_info(struct f2fs_sb
 
 	bimodal = 0;
 	total_vblocks = 0;
-	blks_per_sec = BLKS_PER_SEC(sbi);
+	blks_per_sec = CAP_BLKS_PER_SEC(sbi);
 	hblks_per_sec = blks_per_sec / 2;
 	for (segno = 0; segno < MAIN_SEGS(sbi); segno += sbi->segs_per_sec) {
 		vblocks = get_valid_blocks(sbi, segno, true);

@@ -1681,7 +1681,7 @@ static int expand_inode_data(struct inod
 		return 0;
 
 	if (f2fs_is_pinned_file(inode)) {
-		block_t sec_blks = BLKS_PER_SEC(sbi);
+		block_t sec_blks = CAP_BLKS_PER_SEC(sbi);
 		block_t sec_len = roundup(map.m_len, sec_blks);
 
 		map.m_len = sec_blks;

@@ -2595,7 +2595,7 @@ do_more:
 			ret = -EAGAIN;
 		goto out;
 	}
-	range->start += BLKS_PER_SEC(sbi);
+	range->start += CAP_BLKS_PER_SEC(sbi);
 	if (range->start <= end)
 		goto do_more;
 out:

@@ -2717,7 +2717,7 @@ static int f2fs_defragment_range(struct
 		goto out;
 	}
 
-	sec_num = DIV_ROUND_UP(total, BLKS_PER_SEC(sbi));
+	sec_num = DIV_ROUND_UP(total, CAP_BLKS_PER_SEC(sbi));
 
 	/*
 	 * make sure there are enough free section for LFS allocation, this can

@@ -441,7 +441,7 @@ static void atgc_lookup_victim(struct f2
 	unsigned long long age, u, accu;
 	unsigned long long max_mtime = sit_i->dirty_max_mtime;
 	unsigned long long min_mtime = sit_i->dirty_min_mtime;
-	unsigned int sec_blocks = BLKS_PER_SEC(sbi);
+	unsigned int sec_blocks = CAP_BLKS_PER_SEC(sbi);
 	unsigned int vblocks;
 	unsigned int dirty_threshold = max(am->max_candidate_count,
 					am->candidate_ratio *

@@ -1421,7 +1421,7 @@ next_step:
 		 */
 		if ((gc_type == BG_GC && has_not_enough_free_secs(sbi, 0, 0)) ||
 			(!force_migrate && get_valid_blocks(sbi, segno, true) ==
-							BLKS_PER_SEC(sbi)))
+							CAP_BLKS_PER_SEC(sbi)))
 			return submitted;
 
 		if (check_valid_map(sbi, segno, off) == 0)

@@ -820,7 +820,7 @@ static void __locate_dirty_segment(struc
 				get_valid_blocks(sbi, segno, true);
 
 			f2fs_bug_on(sbi, unlikely(!valid_blocks ||
-					valid_blocks == BLKS_PER_SEC(sbi)));
+					valid_blocks == CAP_BLKS_PER_SEC(sbi)));
 
 			if (!IS_CURSEC(sbi, secno))
 				set_bit(secno, dirty_i->dirty_secmap);

@@ -856,7 +856,7 @@ static void __remove_dirty_segment(struc
 			unsigned int secno = GET_SEC_FROM_SEG(sbi, segno);
 
 			if (!valid_blocks ||
-					valid_blocks == BLKS_PER_SEC(sbi)) {
+					valid_blocks == CAP_BLKS_PER_SEC(sbi)) {
 				clear_bit(secno, dirty_i->dirty_secmap);
 				return;
 			}

@@ -4577,7 +4577,6 @@ static void init_dirty_segmap(struct f2f
 	struct free_segmap_info *free_i = FREE_I(sbi);
 	unsigned int segno = 0, offset = 0, secno;
 	block_t valid_blocks, usable_blks_in_seg;
-	block_t blks_per_sec = BLKS_PER_SEC(sbi);
 
 	while (1) {
 		/* find dirty segment based on free segmap */

@@ -4606,7 +4605,7 @@ static void init_dirty_segmap(struct f2f
 		valid_blocks = get_valid_blocks(sbi, segno, true);
 		secno = GET_SEC_FROM_SEG(sbi, segno);
 
-		if (!valid_blocks || valid_blocks == blks_per_sec)
+		if (!valid_blocks || valid_blocks == CAP_BLKS_PER_SEC(sbi))
 			continue;
 		if (IS_CURSEC(sbi, secno))
 			continue;

@@ -608,10 +608,10 @@ static inline bool has_not_enough_free_s
 					get_pages(sbi, F2FS_DIRTY_DENTS) +
 					get_pages(sbi, F2FS_DIRTY_IMETA);
 	unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
-	unsigned int node_secs = total_node_blocks / BLKS_PER_SEC(sbi);
-	unsigned int dent_secs = total_dent_blocks / BLKS_PER_SEC(sbi);
-	unsigned int node_blocks = total_node_blocks % BLKS_PER_SEC(sbi);
-	unsigned int dent_blocks = total_dent_blocks % BLKS_PER_SEC(sbi);
+	unsigned int node_secs = total_node_blocks / CAP_BLKS_PER_SEC(sbi);
+	unsigned int dent_secs = total_dent_blocks / CAP_BLKS_PER_SEC(sbi);
+	unsigned int node_blocks = total_node_blocks % CAP_BLKS_PER_SEC(sbi);
+	unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi);
 	unsigned int free, need_lower, need_upper;
 
 	if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sunmin Jeong <[email protected]>

[ Upstream commit 4275b59673eb60b02eec3997816c83f1f4b909c4 ]

Currently, the length of fallocate for pin file is section-aligned to keep allocated sections from being selected as victims of GC. However, for the case that the start offset of fallocate is not aligned in section, the allocated sections can't be fully utilized. It's because a new section is allocated by f2fs_allocate_pinning_section() after using blks_per_sec blocks regardless of the start offset. As a result, several unexpected dirty segments may be created, including blocks assigned to the pinned file.

To address this issue, let's round down the start offset of fallocate to the length of section.

The reproducing scenario is as below

chunk=$(((2<<20)+4096)) # 2MB + 4KB
touch test
f2fs_io pinfile set test
f2fs_io fallocate 0 0 $chunk test
f2fs_io fallocate 0 $chunk $chunk test
f2fs_io fallocate 0 $((chunk*2)) $chunk test
f2fs_io fiemap 0 $((chunk*3)) test

Fiemap: offset = 0 len = 12288
logical addr. physical addr. length flags

0   0000000000000000 000000068c600000 0000000000400000 00001088
1   0000000000400000 000000003d400000 0000000000001000 00001088
2   0000000000401000 00000003eb200000 0000000000200000 00001088
3   0000000000601000 00000005e4200000 0000000000001000 00001088
4   0000000000602000 0000000605400000 0000000000200000 00001089

---
 fs/f2fs/file.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

@@ -1682,8 +1682,15 @@ static int expand_inode_data(struct inod
 
 	if (f2fs_is_pinned_file(inode)) {
 		block_t sec_blks = CAP_BLKS_PER_SEC(sbi);
-		block_t sec_len = roundup(map.m_len, sec_blks);
+		block_t sec_len;
 
+		if (map.m_lblk % sec_blks) {
+			map.m_lblk = rounddown(map.m_lblk, sec_blks);
+			map.m_len = pg_end - map.m_lblk;
+			if (off_end)
+				map.m_len++;
+		}
+		sec_len = roundup(map.m_len, sec_blks);
 		map.m_len = sec_blks;
 next_alloc:
 		if (has_not_enough_free_secs(sbi, 0,

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wenjie Qi <[email protected]>

[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]

f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

---
 fs/f2fs/checkpoint.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

@@ -723,6 +723,7 @@ int f2fs_recover_orphan_inodes(struct f2
 	for (i = 0; i < orphan_blocks; i++) {
 		struct page *page;
 		struct f2fs_orphan_block *orphan_blk;
+		unsigned int entry_count;
 
 		page = f2fs_get_meta_page(sbi, start_blk + i);
 		if (IS_ERR(page)) {

@@ -731,7 +732,17 @@ int f2fs_recover_orphan_inodes(struct f2
 		}
 
 		orphan_blk = (struct f2fs_orphan_block *)page_address(page);
-		for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
+		entry_count = le32_to_cpu(orphan_blk->entry_count);
+		if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+			f2fs_err(sbi, "invalid orphan inode entry count %u",
+				 entry_count);
+			set_sbi_flag(sbi, SBI_NEED_FSCK);
+			err = -EFSCORRUPTED;
+			f2fs_put_page(page, 1);
+			goto out;
+		}
+
+		for (j = 0; j < entry_count; j++) {
 			nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
 			err = recover_orphan_inode(sbi, ino);
 			if (err) {

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bryam Vargas <[email protected]>

[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]

When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally:

	if (f2fs_sb_has_flexible_inline_xattr(sbi))
		fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);

but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image.

get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry:

MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size

A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area:

	while (bit_pos < d->max)		/* fs/f2fs/dir.c */
		... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...

Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files.

Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.

---
 fs/f2fs/inode.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

@@ -254,14 +254,15 @@ static bool sanity_check_inode(struct in
 		return false;
 	}
 
-	if (f2fs_has_extra_attr(inode) &&
-		f2fs_sb_has_flexible_inline_xattr(sbi) &&
-		f2fs_has_inline_xattr(inode) &&
-		(!fi->i_inline_xattr_size ||
-		fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
+	if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
+		(fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE ||
+		(f2fs_has_inline_xattr(inode) &&
+		fi->i_inline_xattr_size <
+			sizeof(struct f2fs_xattr_header) / sizeof(__le32)))) {
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %zu",
+		f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %zu",
 			  __func__, inode->i_ino, fi->i_inline_xattr_size,
+			  sizeof(struct f2fs_xattr_header) / sizeof(__le32),
 			  MAX_INLINE_XATTR_SIZE);
 		return false;
 	}

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruipeng Qi <[email protected]>

[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]

When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below:

INFO: task A:1890 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:A    state:D stack:0     pid:1890  tgid:1626  ppid:1153   flags:0x00000204
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 io_schedule+0x44/0x68
 folio_wait_bit_common+0x174/0x370
 folio_wait_bit+0x20/0x38
 folio_wait_writeback+0x54/0xc8
 truncate_inode_partial_folio+0x70/0x1e0
 truncate_inode_pages_range+0x1b0/0x450
 truncate_pagecache+0x54/0x88
 f2fs_file_write_iter+0x3e8/0xb80
 do_iter_readv_writev+0xf0/0x1e0
 vfs_writev+0x138/0x2c8
 do_writev+0x88/0x130
 __arm64_sys_writev+0x28/0x40
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11   state:D stack:0     pid:2680853 tgid:2680853 ppid:2      flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 io_schedule+0x44/0x68
 folio_wait_bit_common+0x174/0x370
 __filemap_get_folio+0x214/0x348
 pagecache_get_page+0x20/0x70
 f2fs_get_read_data_page+0x150/0x3e8
 f2fs_get_lock_data_page+0x2c/0x160
 move_data_page+0x50/0x478
 do_garbage_collect+0xd38/0x1528
 f2fs_gc+0x240/0x7e0
 f2fs_balance_fs+0x1a0/0x208
 f2fs_write_single_data_page+0x6e4/0x730
 f2fs_write_cache_pages+0x378/0x9b0
 f2fs_write_data_pages+0x2e4/0x388
 do_writepages+0x8c/0x2c8
 __writeback_single_inode+0x4c/0x498
 writeback_sb_inodes+0x234/0x4a8
 __writeback_inodes_wb+0x58/0x118
 wb_writeback+0x2f8/0x3c0
 wb_workfn+0x2c4/0x508
 process_one_work+0x180/0x408
 worker_thread+0x258/0x368
 kthread+0x118/0x128
 ret_from_fork+0x10/0x200

INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8    state:D stack:0     pid:2641297 tgid:2641297 ppid:2      flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 rt_mutex_schedule+0x30/0x60
 __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
 rwbase_write_lock+0x24c/0x378
 down_write+0x1c/0x30
 f2fs_balance_fs+0x184/0x208
 f2fs_write_inode+0xf4/0x328
 __writeback_single_inode+0x370/0x498
 writeback_sb_inodes+0x234/0x4a8
 __writeback_inodes_wb+0x58/0x118
 wb_writeback+0x2f8/0x3c0
 wb_workfn+0x2c4/0x508
 process_one_work+0x180/0x408
 worker_thread+0x258/0x368
 kthread+0x118/0x128
 ret_from_fork+0x10/0x20

INFO: task B:1902 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:B     state:D stack:0     pid:1902  tgid:1626  ppid:1153   flags:0x0000020c
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 rt_mutex_schedule+0x30/0x60
 __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
 rwbase_write_lock+0x24c/0x378
 down_write+0x1c/0x30
 f2fs_balance_fs+0x184/0x208
 f2fs_map_blocks+0x94c/0x1110
 f2fs_file_write_iter+0x228/0xb80
 do_iter_readv_writev+0xf0/0x1e0
 vfs_writev+0x138/0x2c8
 do_writev+0x88/0x130
 __arm64_sys_writev+0x28/0x40
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

INFO: task sync:2769849 blocked for more than 120 seconds.
      Tainted: G           O       6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:sync            state:D stack:0     pid:2769849 tgid:2769849 ppid:736    flags:0x0000020c
Call trace:
 __switch_to+0xf4/0x158
 __schedule+0x27c/0x908
 schedule+0x3c/0x118
 wb_wait_for_completion+0xb0/0xe8
 sync_inodes_sb+0xc8/0x2b0
 sync_inodes_one_sb+0x24/0x38
 iterate_supers+0xa8/0x138
 ksys_sync+0x54/0xc8
 __arm64_sys_sync+0x18/0x30
 invoke_syscall+0x50/0x120
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x30/0xf8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198

The root cause is a potential deadlock between the following tasks:

kworker/u8:11 Thread A
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback(X)
- f2fs_outplace_write_data
- bio_add_folio(X)
- folio_unlock(X)
- truncate_inode_pages_range
- __filemap_get_folio(X, FGP_LOCK)
- truncate_inode_partial_folio(X)
- folio_wait_writeback(X)
- f2fs_balance_fs
- f2fs_gc
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_page
- __filemap_get_folio(X, FGP_LOCK)

Both threads try to access folio X. Thread A holds the lock but waits for writeback, while kworker waits for the lock. This causes a deadlock.

Other threads also enter D state, waiting for locks such as gc_lock and writepages.

OPU/IPU DATA folio are all affected by this issue. To avoid such potential deadlocks, always commit these cached folios before triggering f2fs_gc() in f2fs_balance_fs().

Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")

---
 fs/f2fs/data.c    |   29 +++++++++++++++++++++++++++++
 fs/f2fs/f2fs.h    |    1 +
 fs/f2fs/segment.c |    7 +++++++
 3 files changed, 37 insertions(+)

@@ -906,6 +906,35 @@ void f2fs_submit_merged_ipu_write(struct
 	}
 }
 
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi)
+{
+	struct bio_entry *be, *tmp;
+	struct f2fs_bio_info *io;
+	enum temp_type temp;
+
+	for (temp = HOT; temp < NR_TEMP_TYPE; temp++) {
+		LIST_HEAD(list);
+
+		io = sbi->write_io[DATA] + temp;
+
+		/* A lockless list_empty() check is safe here: any bios from
+		 * other kworkers that we miss will be submitted by those
+		 * kworkers accordingly.
+		 */
+		if (list_empty(&io->bio_list))
+			continue;
+
+		down_write(&io->bio_list_lock);
+		list_splice_init(&io->bio_list, &list);
+		up_write(&io->bio_list_lock);
+
+		list_for_each_entry_safe(be, tmp, &list, list) {
+			__submit_bio(sbi, be->bio, DATA);
+			del_bio_entry(be);
+		}
+	}
+}
+
 int f2fs_merge_page_bio(struct f2fs_io_info *fio)
 {
 	struct bio *bio = *fio->bio;

@@ -3475,6 +3475,7 @@ void f2fs_submit_merged_write_cond(struc
 				nid_t ino, enum page_type type);
 void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
 					struct bio **bio, struct page *page);
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi);
 void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
 int f2fs_submit_page_bio(struct f2fs_io_info *fio);
 int f2fs_merge_page_bio(struct f2fs_io_info *fio);

@@ -513,6 +513,13 @@ void f2fs_balance_fs(struct f2fs_sb_info
 	 * dir/node pages without enough free segments.
 	 */
 	if (has_not_enough_free_secs(sbi, 0, 0)) {
+		/*
+		 * Submit all cached OPU/IPU DATA bios before triggering
+		 * foreground GC to avoid potential deadlocks.
+		 */
+		f2fs_submit_merged_write(sbi, DATA);
+		f2fs_submit_all_merged_ipu_writes(sbi);
+
 		down_write(&sbi->gc_lock);
 		f2fs_gc(sbi, false, false, false, NULL_SEGNO);
 	}

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Keshav Verma <[email protected]>

[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]

Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.

---
 fs/f2fs/xattr.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -575,8 +575,7 @@ ssize_t f2fs_listxattr(struct dentry *de
 	last_base_addr = (void *)base_addr + XATTR_SIZE(inode);
 
 	list_for_each_xattr(entry, base_addr) {
-		const struct xattr_handler *handler =
-			f2fs_xattr_handler(entry->e_name_index);
+		const struct xattr_handler *handler;
 		const char *prefix;
 		size_t prefix_len;
 		size_t size;

@@ -590,6 +589,7 @@ ssize_t f2fs_listxattr(struct dentry *de
 			goto cleanup;
 		}
 
+		handler = f2fs_xattr_handler(entry->e_name_index);
 		if (!handler || (handler->list && !handler->list(dentry)))
 			continue;
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Bommarito <[email protected]>

[ Upstream commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 ]

ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL.

A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists.

Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
  ff_layout_encode_layoutreturn+0x683/0x970
  nfs4_xdr_enc_layoutreturn+0x278/0x3a0
  Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

---
 fs/nfs/flexfilelayout/flexfilelayout.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -454,6 +454,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_
 		if (!p)
 			goto out_err_free;
 		fh_count = be32_to_cpup(p);
+		if (fh_count == 0) {
+			rc = -EINVAL;
+			goto out_err_free;
+		}
 
 		fls->mirror_array[i]->fh_versions =
 			kcalloc(fh_count, sizeof(struct nfs_fh),

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mingyu Wang <[email protected]>

[ Upstream commit 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 ]

When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the err_out label to roll back the console state. However, the current rollback logic forgets to restore the hi_font state, leading to a severe state machine corruption.

Earlier in the function, set_vc_hi_font() might be called to change vc->vc_hi_font_mask and mutate the screen buffer. If vc_resize() subsequently fails, the err_out path restores vc_font.charcount but entirely skips rolling back the vc_hi_font_mask and the screen buffer.

This mismatch leaves the terminal in a desynchronized state. Because vc_hi_font_mask remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., fbcon_putcs()) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure.

Fix this by adding the missing rollback logic for the hi_font mask and screen buffer in the error path.

---
 drivers/video/fbdev/core/fbcon.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -2426,6 +2426,7 @@ static int fbcon_do_set_font(struct vc_d
 	struct fbcon_display *p = &fb_display[vc->vc_num];
 	int resize, ret, old_userfont, old_width, old_height, old_charcount;
 	u8 *old_data = vc->vc_font.data;
+	unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
 
 	resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
 	vc->vc_font.data = (void *)(p->fontdata = data);

@@ -2479,6 +2480,12 @@ err_out:
 	vc->vc_font.height = old_height;
 	vc->vc_font.charcount = old_charcount;
 
+	/* Restore the hi_font state and screen buffer */
+	if (old_hi_font_mask && !vc->vc_hi_font_mask)
+		set_vc_hi_font(vc, true);
+	else if (!old_hi_font_mask && vc->vc_hi_font_mask)
+		set_vc_hi_font(vc, false);
+
 	return ret;
 }
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 8ce19524e4cc2462685f596a6402fbd8fb984ab2 ]

Make sure to tear down the host notify irq domain on adapter registration failure to avoid leaking it.

This issue was flagged by Sashiko when reviewing another adapter registration fix.

Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")

---
 drivers/i2c/i2c-core-base.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -1461,7 +1461,7 @@ static int i2c_register_adapter(struct i
 	res = device_register(&adap->dev);
 	if (res) {
 		pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
-		goto out_list;
+		goto err_remove_irq_domain;
 	}
 
 	res = of_i2c_setup_smbus_alert(adap);

@@ -1505,6 +1505,8 @@ out_reg:
 	init_completion(&adap->dev_released);
 	device_unregister(&adap->dev);
 	wait_for_completion(&adap->dev_released);
+err_remove_irq_domain:
+	i2c_host_notify_irq_teardown(adap);
 out_list:
 	mutex_lock(&core_lock);
 	idr_remove(&i2c_adapter_idr, adap->nr);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 3c7e164344e5bcf6f274bbf59a3274f5caad9bc1 ]

Clients may be registered from bus notifier callbacks when the adapter is registered. On a subsequent error during registration, the adapter references taken by such clients prevent the wait for the references to be released from ever completing.

Fix this by refactoring client deregistration and deregistering also on late adapter registration failures.

Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")

---
 drivers/i2c/i2c-core-base.c |   49 ++++++++++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 20 deletions(-)

@@ -61,6 +61,7 @@
 static DEFINE_MUTEX(core_lock);
 static DEFINE_IDR(i2c_adapter_idr);
 
+static void i2c_deregister_clients(struct i2c_adapter *adap);
 static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver);
 
 static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key);

@@ -1502,6 +1503,7 @@ static int i2c_register_adapter(struct i
 	return 0;
 
 out_reg:
+	i2c_deregister_clients(adap);
 	init_completion(&adap->dev_released);
 	device_unregister(&adap->dev);
 	wait_for_completion(&adap->dev_released);

@@ -1644,29 +1646,10 @@ static int __process_removed_adapter(str
 	return 0;
 }
 
-/**
- * i2c_del_adapter - unregister I2C adapter
- * @adap: the adapter being unregistered
- * Context: can sleep
- *
- * This unregisters an I2C adapter which was previously registered
- * by @i2c_add_adapter or @i2c_add_numbered_adapter.
- */
-void i2c_del_adapter(struct i2c_adapter *adap)
+static void i2c_deregister_clients(struct i2c_adapter *adap)
 {
-	struct i2c_adapter *found;
 	struct i2c_client *client, *next;
 
-	/* First make sure that this adapter was ever added */
-	mutex_lock(&core_lock);
-	found = idr_find(&i2c_adapter_idr, adap->nr);
-	mutex_unlock(&core_lock);
-	if (found != adap) {
-		pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
-		return;
-	}
-
-	i2c_acpi_remove_space_handler(adap);
 	/* Tell drivers about this removal */
 	mutex_lock(&core_lock);
 	bus_for_each_drv(&i2c_bus_type, NULL, adap,

@@ -1692,6 +1675,32 @@ void i2c_del_adapter(struct i2c_adapter
 	 * them up properly, so we give them a chance to do that first. */
 	device_for_each_child(&adap->dev, NULL, __unregister_client);
 	device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+}
+
+/**
+ * i2c_del_adapter - unregister I2C adapter
+ * @adap: the adapter being unregistered
+ * Context: can sleep
+ *
+ * This unregisters an I2C adapter which was previously registered
+ * by @i2c_add_adapter or @i2c_add_numbered_adapter.
+ */
+void i2c_del_adapter(struct i2c_adapter *adap)
+{
+	struct i2c_adapter *found;
+
+	/* First make sure that this adapter was ever added */
+	mutex_lock(&core_lock);
+	found = idr_find(&i2c_adapter_idr, adap->nr);
+	mutex_unlock(&core_lock);
+	if (found != adap) {
+		pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
+		return;
+	}
+
+	i2c_acpi_remove_space_handler(adap);
+
+	i2c_deregister_clients(adap);
 
 #ifdef CONFIG_I2C_COMPAT
 	class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

[ Upstream commit 2295d2bb101faa663fbc45fadbb3fec45f107441 ]

If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised.

Note that before the offending commit this would instead have resulted in a minor memory leak of the adapter name.