6.18.42-rc1 review

This is the start of the stable review cycle for the 6.18.42 release. There are 675 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 01 Aug 2026 14:13:45 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.42-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.42-rc1

Nikunj A Dadhania <[email protected]>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

Koen Koning <[email protected]>
gpu: Fix uninitialized buddy for built-in drivers

Russell King (Oracle) <[email protected]>
net: stmmac: fix dwmac4 transmit performance regression

Gal Pressman <[email protected]>
net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query

Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Alice Ryhl <[email protected]>
rust: device: avoid trailing ; in printing macros

Miguel Ojeda <[email protected]>
rust: allow suspicious_runtime_symbol_definitions lint for Rust >= 1.98

SJ Park <[email protected]>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()

SJ Park <[email protected]>
mm/damon/core: validate ranges in damon_set_regions()

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Fix Hot-Join NACK

Guoniu Zhou <[email protected]>
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI

Marco Felsch <[email protected]>
pmdomain: imx93-blk-ctrl: convert to devm_* only

Haoxiang Li <[email protected]>
net: ipa: fix SMEM state handle leaks in SMP2P init

Bryam Vargas <[email protected]>
ata: libata-core: Reject an invalid concurrent positioning ranges count

Breno Leitao <[email protected]>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()

Breno Leitao <[email protected]>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c

Junrui Luo <[email protected]>
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

Michael Bommarito <[email protected]>
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

Shradha Gupta <[email protected]>
net: mana: Optimize irq affinity for low vcpu configs

Dexuan Cui <[email protected]>
net: mana: Validate the packet length reported by the NIC

Tony Luck <[email protected]>
fs/resctrl: Fix use-after-free during unmount

Tony Luck <[email protected]>
fs/resctrl: Move RMID initialization to first mount

Tony Luck <[email protected]>

    fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]

Tony Luck <[email protected]>
x86,fs/resctrl: Rename some L3 specific functions

Tony Luck <[email protected]>
x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain

Tony Luck <[email protected]>
fs/resctrl: Split L3 dependent parts out of __mon_event_count()

Guangshuo Li <[email protected]>
mmc: vub300: fix use-after-free on probe failure

Johan Hovold <[email protected]>
mmc: vub300: rename probe error labels

Ingo Blechschmidt <[email protected]>
dm: avoid leaking the caller's thread keyring via the table device file

Christian Brauner <[email protected]>
cred: add kernel_cred() helper

Doruk Tan Ozturk <[email protected]>
accel/amdxdna: reject command submission on devices without a submit op

Souvik Banerjee <[email protected]>
ovl: use linked upper dentry in copy-up tmpfile

Koichiro Den <[email protected]>
dmaengine: dw-edma-pcie: Reject devices without driver data

Krzysztof Kozlowski <[email protected]>
dmaengine: dw-edma: Fix confusing cleanup.h syntax

Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Mika Westerberg <[email protected]>

    thunderbolt: Remove XDomain from the bus without holding tb->lock

Mika Westerberg <[email protected]>
thunderbolt: Remove service debugfs entries during unregister

Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix fault in unaligned fixup

Pratyush Yadav (Google) <[email protected]>
kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES

Muchun Song <[email protected]>
mm/sparse-vmemmap: fix vmemmap accounting underflow

Tanmay Shah <[email protected]>
remoteproc: xlnx: Check remote core state

Terry Bowman <[email protected]>
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size

Dave Jiang <[email protected]>
cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c

Terry Bowman <[email protected]>
cxl/pci: Remove unnecessary CXL RCH handling helper functions

Terry Bowman <[email protected]>
cxl/pci: Remove unnecessary CXL Endpoint handling helper functions

Chuck Lever <[email protected]>
SUNRPC: Return an error from xdr_buf_to_bvec() on overflow

Chuck Lever <[email protected]>
SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists

Jeff Layton <[email protected]>
sunrpc: allocate a separate bvec array for socket sends

Mike Snitzer <[email protected]>
NFSD: pass nfsd_file to nfsd_iter_read()

Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP

Arunpravin Paneer Selvam <[email protected]>
gpu/buddy: bail out of try_harder when alignment cannot be honoured

Joel Fernandes <[email protected]>
gpu: Move DRM buddy allocator one level up (part two)

Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: remove net variable shadowing

Theodor Arsenij Larionov-Trichkine <[email protected]>
netfilter: nft_fib: reject fib expression on the netdev egress hook

Florian Westphal <[email protected]>
netfilter: nf_tables: remove register tracking infrastructure

Abel Vesa <[email protected]>
arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: correct RBR opp entry

Jason Wang <[email protected]>
VDUSE: avoid leaking information to userspace

Eugenio Pérez <[email protected]>
vduse: take out allocations from vduse_dev_alloc_coherent

Eugenio Pérez <[email protected]>
vduse: remove unused vaddr parameter of vduse_domain_free_coherent

Eugenio Pérez <[email protected]>
vduse: return internal vq group struct as map token

Darrick J. Wong <[email protected]>
xfs: don't replace the wrong part of the cow fork

Joanne Koong <[email protected]>
fuse-uring: fix race between registration and connection abortion

Ricardo Robaina <[email protected]>
audit: fix recursive locking deadlock in audit_dupe_exe()

Ricardo Robaina <[email protected]>
audit: use 'unsigned int' instead of 'unsigned'

Jeff Layton <[email protected]>
audit: widen ino fields to u64

Mickaël Salaün <[email protected]>
landlock: Account all audit data allocations to user space

Mickaël Salaün <[email protected]>
landlock: Fix formatting

Harry Wentland <[email protected]>
drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources

Eric Biggers <[email protected]>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

Namjae Jeon <[email protected]>
ksmbd: validate ACE size against SID sub-authorities

Namjae Jeon <[email protected]>
ksmbd: bound DACL dedup walk to copied ACEs

Wentao Guan <[email protected]>
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

Haofeng Li <[email protected]>
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512

Ming Lei <[email protected]>

    ublk: wait on ublk_dev_ready() instead of ub->completion

Jia Yao <[email protected]>
drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR

Mikulas Patocka <[email protected]>
dm-verity: fix buffer overflow in FEC calculation

Eric Biggers <[email protected]>
dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS

Eric Biggers <[email protected]>
dm-verity-fec: fix reading parity bytes split across blocks (take 3)

Eric Biggers <[email protected]>
dm-verity-fec: fix the size of dm_verity_fec_io::erasures

Jiayuan Chen <[email protected]>
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Christian König <[email protected]>
drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx

Yang Wang <[email protected]>
drm/amd/pm: fix smu13 power limit range calculation

Asad Kamal <[email protected]>
drm/amdgpu: fix aperture mapping leak

Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

Ce Sun <[email protected]>
drm/amdgpu: fix resource leak on ACP reset timeout

Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions

Luca Coelho <[email protected]>
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

Boyuan Zhang <[email protected]>
drm/amdgpu/vcn4: avoid rereading IB param length

Boyuan Zhang <[email protected]>
drm/amdgpu/vce: fix integer overflow in image size

Jakob Linke <[email protected]>
drm/amdgpu/soc24: reset dGPU if suspend got aborted

Alex Deucher <[email protected]>

    drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()

Boyuan Zhang <[email protected]>
drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection

Boyuan Zhang <[email protected]>
drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection

Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>

    drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()

Yang Wang <[email protected]>
drm/amd/pm: make pp_features read-only when scpm is enabled

Yang Wang <[email protected]>
drm/amd/pm: fix amdgpu_pm_info power display units

Ethan Nelson-Moore <[email protected]>
watchdog: s32g_wdt: remove incorrect options in watchdog_info struct

James Raphael Tiovalen <[email protected]>
vxlan: mdb: Fix source list corruption on a failed replace

Stefano Garzarella <[email protected]>
vsock/virtio: collapse receive queue under memory pressure

Daehyeon Ko <[email protected]>

    tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

Yuxiang Yang <[email protected]>
tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Yizhou Zhao <[email protected]>
tcp: initialize standalone TCP-AO response padding

Justin Lai <[email protected]>
rtase: Workaround for TX hang caused by hardware packet parsing

Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()

Shuvam Pandey <[email protected]>
ovpn: hold peer before scheduling keepalive work

Pavitra Jha <[email protected]>
ovpn: fix peer refcount leak in TCP error paths

Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow

Doruk Tan Ozturk <[email protected]>
mctp: serial: handle zero-length frames to prevent rx buffer overflow

Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag

Ibrahim Hashimov <[email protected]>
mac802154: hold an interface reference across the scan worker

Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust

Sergey Temerkhanov <[email protected]>
ice: use READ_ONCE() to access cached PHC time

Aleksandr Loktionov <[email protected]>
ice: reject out-of-range ptype in ice_parser_profile_init

Eddie Phillips <[email protected]>
gve: fix Rx queue stall on alloc failure

James Montgomery <[email protected]>
ksmbd: defer destroy_previous_session() until after NTLM authentication

Carl Johnson <[email protected]>
smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target

Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path

Christian Brauner <[email protected]>
super: fix emergency thaw deadlock on frozen block devices

Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Reset triggers at top level before instance loop

Paul Greenwalt <[email protected]>
ice: fix PTP Call Trace during PTP release

Sven Schnelle <[email protected]>
ptp: ptp_s390: Add missing facility check

Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links

Coia Prant <[email protected]>
net: pcs: xpcs: fix SGMII state reading

Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure

Shiming Cheng <[email protected]>
net: gro: fix double aggregation of flush-marked skbs

David Lee <[email protected]>

    net/x25: fix use-after-free in x25_kill_by_neigh()

Manjunath Patil <[email protected]>
net/mlx5e: Use sender devcom for MPV master-up

Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path

Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink

Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation

Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink

Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()

Markus Breitenberger <[email protected]>
net: stmmac: intel: skip SerDes reconfig when rate is unchanged

Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent

Zhang Yi <[email protected]>
iomap: fix out-of-bounds bitmap_set() with zero-length range

Yitang Yang <[email protected]>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths

Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access

Eric Biggers <[email protected]>
fscrypt: Add missing superblock check in find_or_insert_direct_key()

Amir Goldstein <[email protected]>
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

Chen Changcheng <[email protected]>
fs/super: fix emergency thaw double-unlock of s_umount

Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP

Chancel Liu <[email protected]>
ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP

Chancel Liu <[email protected]>
ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown

Shihuang Liu <[email protected]>
amt: fix use-after-free in AMT delayed works

Douya Le <[email protected]>
libceph: remove debugfs files before client teardown

Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode

Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors

Shuangpeng Bai <[email protected]>

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

Zhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup

Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()

Douya Le <[email protected]>
libceph: bound get_version reply decode to front len

Wentao Liang <[email protected]>
ceph: fix writeback_count leak in write_folio_nounlock()

WenTao Liang <[email protected]>
ceph: fix refcount leak in ceph_readdir()

Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

Max Kellermann <[email protected]>
ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*

Zhiling Zou <[email protected]>
sctp: close UDP tunnel sockets during netns teardown

Zhiling Zou <[email protected]>
sctp: avoid auth_enable sysctl UAF during netns teardown

Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing

Rik van Riel <[email protected]>
mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established

Breno Leitao <[email protected]>
mm/kmemleak: fix checksum computation for per-cpu objects

David Howells <[email protected]>
afs: Fix afs_edit_dir_remove() to get, not find, block 0

Geliang Tang <[email protected]>
mptcp: pm: userspace: fix use-after-free in get_local_id

Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present

Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join

Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"

Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

Dev Jain <[email protected]>
arm64: make huge_ptep_get handled unaligned addresses

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()

Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()

Masami Hiramatsu (Google) <[email protected]>
tracing: Fix union collision of module and refcnt for dynamic events

deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close

Steven Rostedt <[email protected]>

    tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

Usama Arif <[email protected]>
tracing: Fix context switch counter truncation

Xu Rao <[email protected]>
misc: nsm: pin the module while the device is open

Runyu Xiao <[email protected]>
misc: nsm: only unlock nsm_dev on post-lock error paths

Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak

Alexander Usyskin <[email protected]>
mei: bus: access mei_device under device_lock on cleanup

Ethan Nelson-Moore <[email protected]>
selftests: ntsync: correct CONFIG_NTSYNC name

Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback

Ben Hutchings <[email protected]>
uio_hv_generic: Bind to FCopy device by default

Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt

Nathan Chancellor <[email protected]>
x86/boot/compressed: Disable jump tables

Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

Rong Bao <[email protected]>
LoongArch: Retrieve CPU package ID from PPTT when available

Kanglong Wang <[email protected]>
LoongArch: Move jump_label_init() before parse_early_param()

Haoran Jiang <[email protected]>
LoongArch: Fix oops during single-step debugging

George Guo <[email protected]>
LoongArch: Fix address space mismatch in kexec command line lookup

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.99.0

Alexandre Courbot <[email protected]>
rust: allow clippy::unwrap_or_default globally

FUJITA Tomonori <[email protected]>
rust: time: fix as_micros_ceil() to round correctly for negative Delta

Alice Ryhl <[email protected]>
rust_binder: only print failure if error has source

Zixing Liu <[email protected]>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend

Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened

Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Protect UUID list traversal

MinJea Kim <[email protected]>
staging: rtl8723bs: fix inverted HT40 secondary channel offset

Moksh Panicker <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

Wentao Liang <[email protected]>
wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()

LiangCheng Wang <[email protected]>
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752

Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent

Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

Devin Wittmayer <[email protected]>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses

Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header

Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size

Norbert Szetei <[email protected]>
ALSA: timer: don't re-enter an instance callback that is still running

Norbert Szetei <[email protected]>
ALSA: timer: drain a slave's callback before its master detaches it

Kai Vehmanen <[email protected]>
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change

Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor

Nikita Maksimov <[email protected]>
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14

Johan Hovold <[email protected]>
media: vpif_capture: fix OF node reference imbalance

Guangshuo Li <[email protected]>
media: vivid: fix cleanup bugs in vivid_init()

Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps

Hans Verkuil <[email protected]>
media: vivid: add vivid_update_reduced_fps()

Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration

Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration

Benjamin Gaignard <[email protected]>
media: verisilicon: Export only needed pixels formats

Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write

Sakari Ailus <[email protected]>
media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely

Mirela Rabulea <[email protected]>
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()

Pengpeng Hou <[email protected]>
media: v4l2-ctrls: validate HEVC active reference counts

Sergey Shtylyov <[email protected]>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()

Myeonghun Pak <[email protected]>
media: ti: vpe: unwind v4l2 device registration on probe error

Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup

Dmitry Osipenko <[email protected]>
media: synopsys: hdmirx: Fix HPD lane hold time

Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure

Myeonghun Pak <[email protected]>
media: stm32: dcmi: unregister notifier on probe failure

Valery Borovsky <[email protected]>
media: stm32-dcmipp: Return queued buffers on start_streaming() failure

Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1

Tommaso Merciai <[email protected]>
media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used

Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure

Deepanshu Kartikey <[email protected]>

    media: rtl2832: fix use-after-free in rtl2832_remove()

Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID GEN3

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID GEN2

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID 680

Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure

Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix potential out-of-bounds issues

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe

David Carlier <[email protected]>
media: nuvoton: npcm-video: fix memory leaks in probe and remove

David Carlier <[email protected]>
media: nuvoton: npcm-video: fix error handling in npcm_video_init()

Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure

Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open

Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove

Dmitry Baryshkov <[email protected]>
media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ

Marco Nenciarini <[email protected]>
media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges

Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines

Martin Hecht <[email protected]>
media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup

Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime

Brandon Brnich <[email protected]>
media: chips-media: wave5: Move src_buf Removal to finish_encode

Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries

Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path

Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure

Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure

David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure

Ricardo Ribalda <[email protected]>
media: amlogic-c3: Add validations for ae and awb config

Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure

Maíra Canal <[email protected]>
drm/v3d: Reach the GMP through the hub registers on V3D 7.x

Matthew Brost <[email protected]>
drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

Linmao Li <[email protected]>
drm/vc4: Prevent shader BO mappings from becoming writable

Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size

Leo Li <[email protected]>
drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()

Linmao Li <[email protected]>
drm/vc4: Shut down BO cache timer before teardown

Leo Li <[email protected]>
drm/amd/display: Fix flip-done timeouts on mode1 reset

Zhu Lingshan <[email protected]>

    drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

Mario Limonciello <[email protected]>
drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge

Mario Limonciello <[email protected]>
drm/amd/display: Fix backlight max_brightness to match exported range

Alessandro Rinaldi <[email protected]>
drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05

Andriy Korud <[email protected]>
drm/amd/display: dce100: skip non-DP stream encoders for DP MST

Leo Li <[email protected]>
drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock

WenTao Liang <[email protected]>
drm/amd/display: set new_stream to NULL after release

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)

Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter

Mario Limonciello <[email protected]>
drm/amdgpu: Release VFCT ACPI table reference

Osama Abdelkader <[email protected]>
drm/panthor: return error on truncated firmware

Matthew Brost <[email protected]>
drm/ttm: Account for NULL and handle pages in ttm_pool_backup

Jason Macnak <[email protected]>
drm/virtio: Don't detach GEM from a non-created context

Alex Deucher <[email protected]>
drm/gfx10: Program DB_RING_CONTROL

Yang Wang <[email protected]>
drm/amd/pm: fix smu14 power limit range calculation

Jani Nikula <[email protected]>
drm/i915/mst: limit DP MST ESI service loop

Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU

Joonas Lahtinen <[email protected]>

    drm/i915/gem: Do not leak siblings[] on proto context error

Shahyan Soltani <[email protected]>
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

Kenneth Feng <[email protected]>
drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled

Jani Nikula <[email protected]>
drm/i915/bios: range check LFP Data Block panel_type2

Joonas Lahtinen <[email protected]>
drm/i915: Return NULL on error in active_instance

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

Jani Nikula <[email protected]>

    drm/i915/hdcp: check streams[] bounds before overflow

Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v

Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer

WenTao Liang <[email protected]>
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

Thomas Zimmermann <[email protected]>
drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips

Yongqiang Sun <[email protected]>
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

David Francis <[email protected]>
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

David Francis <[email protected]>
drm/amdkfd: Check bounds in allocate_event_notification_slot

David Francis <[email protected]>
drm/amdkfd: Use kvcalloc to allocate arrays

Icenowy Zheng <[email protected]>

    drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

Luigi Santivetti <[email protected]>
drm/imagination: fix error checking of pvr_vm_context_lookup()

Shuvam Pandey <[email protected]>
drm/imagination: Fix user array stride in pvr_set_uobj_array()

Brajesh Gupta <[email protected]>
drm/imagination: Fix double call to drm_sched_entity_fini()

Nitin Gote <[email protected]>
drm/xe: Hold a dma-buf reference for imported BOs

Matthew Brost <[email protected]>
drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds

Matthew Brost <[email protected]>
drm/xe: Return error on non-migratable faults requiring devmem

Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs

Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()

Joonas Lahtinen <[email protected]>
drm/i915/gem: Add missing nospec on parallel submit slot

Jani Nikula <[email protected]>
drm/displayid: fix Tiled Display Topology ID size

Thomas Zimmermann <[email protected]>
drm/sysfb: Return errno code from drm_sysfb_get_visible_size()

Thomas Zimmermann <[email protected]>
drm/sysfb: Avoid possible truncation with calculating visible size

Junrui Luo <[email protected]>
drm/nouveau: fix reversed error cleanup order in ucopy functions

Mario Limonciello <[email protected]>
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

Timur Kristóf <[email protected]>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT

Jiqian Chen <[email protected]>
drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2

Thomas Zimmermann <[email protected]>
drm/sysfb: Avoid truncating maximum stride

Thomas Zimmermann <[email protected]>
drm/sysfb: Do not page-align visible size of the framebuffer

Mario Limonciello <[email protected]>
drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older

Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)

Asad Kamal <[email protected]>
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Alessio Belle <[email protected]>
drm/imagination: Fit paired fragment job in the correct CCCB

Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

Vitor Soares <[email protected]>
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

Alessio Belle <[email protected]>
drm/imagination: Count paired job fence as dependency in prepare_job()

Chen Ni <[email protected]>
drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()

Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()

Tomi Valkeinen <[email protected]>
drm/tidss: Fix missing drm_bridge_add() call

Biju Das <[email protected]>
drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()

Biju Das <[email protected]>
drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

Lorenzo Bianconi <[email protected]>
net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()

Minhong He <[email protected]>
mctp: check register_netdevice_notifier() error in mctp_device_init()

Clark Wang <[email protected]>
ptp: netc: explicitly clear TMR_OFF during initialization

Cen Zhang (Microsoft) <[email protected]>
rds: tcp: unregister sysctl before tearing down listen socket

Nikola Z. Ivanov <[email protected]>
ipv6: Change allocation flags to match rcu_read_lock section requirements

Paul Greenwalt <[email protected]>
ice: prevent tstamp ring allocation for non-PF VSI types

Marcin Szycik <[email protected]>
ice: fix LAG recipe to profile association

Vincent Chen <[email protected]>
ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV

Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error

Hariprasad Kelam <[email protected]>
octeontx2-pf: tc: fix egress ratelimiting

Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation

Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes

Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule

Gal Pressman <[email protected]>
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

Gal Pressman <[email protected]>
net/mlx5: Refactor EEPROM query error handling to return status separately

Runyu Xiao <[email protected]>

    raw: annotate lockless match fields in raw_v4_match()

Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace

Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers

Eric Dumazet <[email protected]>
ppp: annotate data races in ppp_generic

Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

Suman Ghosh <[email protected]>
octeontx2-vf: set TC flower flag on MCAM entry allocation

Yun Zhou <[email protected]>
net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

vadik likholetov <[email protected]>
net: stmmac: enable the MAC on link up for all supported speeds

Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete

Nazim Amirul <[email protected]>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests

Nazim Amirul <[email protected]>
net: stmmac: xgmac: fix l4 filter port overwrite on register update

Russell King (Oracle) <[email protected]>
net: stmmac: cores: remove many xxx_SHIFT definitions

Rohan G Thomas <[email protected]>
net: stmmac: socfpga: Add hardware supported cross-timestamp

Rohan G Thomas <[email protected]>
net: stmmac: socfpga: Enable TBS support for Agilex5

Rohan G Thomas <[email protected]>
net: stmmac: socfpga: Agilex5 EMAC platform configuration

Russell King (Oracle) <[email protected]>
net: stmmac: remove xstats.pcs_* members

Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc

José Expósito <[email protected]>
drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem

Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation

Zhang Yi <[email protected]>
iomap: correct the range of a partial dirty clear

Shuicheng Lin <[email protected]>
drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()

Raag Jadav <[email protected]>
drm/xe/i2c: Allow per domain unique id

Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL

Michael Walle <[email protected]>
net: dpaa: fix mode setting

Eric Dumazet <[email protected]>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid

Michael Bommarito <[email protected]>
amt: make the head writable before rewriting the L2 header

Michael Bommarito <[email protected]>
amt: re-read skb header pointers after every pull

Amir Goldstein <[email protected]>
ovl: check access to copy_file_range source with src mounter creds

Christian Brauner <[email protected]>
ovl: port ovl_copyfile() to cred guard

Christian Brauner <[email protected]>
ovl: add override_creds cleanup guard extension for overlayfs

Christian Brauner <[email protected]>
cred: add scoped_with_kernel_creds()

Julian Braha <[email protected]>
drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER

Yichong Chen <[email protected]>
ovl: fix trusted xattr escape prefix matching

Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

Sean Wang <[email protected]>
wifi: mt76: mt7925: fix crash in reset link replay

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()

Lorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

Ruoyu Wang <[email protected]>
wifi: mt76: mt7915: guard HE capability lookups

Guangshuo Li <[email protected]>
wifi: mt76: mt7925: guard link STA in decap offload

Eric Dumazet <[email protected]>

    ppp: annotate concurrent dev->stats accesses

Qingfang Deng <[email protected]>
ppp: don't store tx skb in the fastpath

Qingfang Deng <[email protected]>
ppp: enable TX scatter-gather

Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit

Xiang Mei (Microsoft) <[email protected]>
nexthop: initialize extack in nh_res_bucket_migrate()

Xiang Mei (Microsoft) <[email protected]>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

Matthieu Baerts (NGI0) <[email protected]>
selftests: drv-net: increase timeout

Matthieu Baerts (NGI0) <[email protected]>
selftests: ovpn: increase timeout

Matthieu Baerts (NGI0) <[email protected]>
selftests: ovpn: add IPV6 and VETH configs

Matthieu Baerts (NGI0) <[email protected]>
selftests: openvswitch: add config file

Matthieu Baerts (NGI0) <[email protected]>
selftests: af_unix: add USER_NS config

Rishikesh Jethwani <[email protected]>
tls: device: push pending open record on splice EOF

Myeonghun Pak <[email protected]>
net: mctp i3c: clean up notifier and buses if driver register fails

Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()

Nikhil P. Rao <[email protected]>
pds_core: check for workqueue allocation failure

Nikhil P. Rao <[email protected]>
pds_core: fix auxiliary device add/del races

Nikhil P. Rao <[email protected]>
pds_core: order completion reads after the ownership check

Nikhil P. Rao <[email protected]>
pds_core: yield the CPU while waiting for the adminq to drain

Nikhil P. Rao <[email protected]>
pds_core: fix use-after-free on workqueue during remove

Nikhil P. Rao <[email protected]>
pds_core: fix deadlock between reset thread and remove

HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Chenguang Zhao <[email protected]>
net: txgbe: fix FDIR filter leak on remove

Kuniyuki Iwashima <[email protected]>
net: Call net_enable_timestamp() before failure in sk_clone().

Kuniyuki Iwashima <[email protected]>
soreuseport: Clear sk_reuseport_cb before failure in sk_clone().

Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

Steven Price <[email protected]>
arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()

Nikhil P. Rao <[email protected]>
pds_core: reject component parameter in legacy firmware update

Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save

Li RongQing <[email protected]>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map

HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer

Enrico Zanda <[email protected]>
vhost-net: fix TX stall when vhost owns virtio-net header

Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping

Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation

Xiang Mei <[email protected]>
wifi: mac80211: tear down new links on vif update error path

Guanghui Feng <[email protected]>
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

Wayen Yan <[email protected]>
net: airoha: Fix DMA direction for NPU mailbox buffer

Guangshuo Li <[email protected]>
dpaa2-eth: put MAC endpoint device on disconnect

Wayen Yan <[email protected]>
net: airoha: Fix potential use-after-free in airoha_ppe_deinit()

Guangshuo Li <[email protected]>
dpaa2-switch: put MAC endpoint device on disconnect

Xuanqiang Luo <[email protected]>
rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()

Zhixing Chen <[email protected]>
gtp: parse extension headers before reading inner protocol

Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries

Zhaolong Zhang <[email protected]>
bonding: fix devconf_all NULL dereference when IPv6 is disabled

David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister

Danielle Ratson <[email protected]>
netlink: specs: rt-link: convert bridge port flag attributes to u8

Michael Walle <[email protected]>
net: phy: marvell: fix return code

Pengpeng Hou <[email protected]>
Bluetooth: btusb: validate Realtek vendor event length

Daniel Golle <[email protected]>
regulator: mt6358: use regmap helper to read fixed LDO calibration

Pengpeng Hou <[email protected]>
hwmon: occ: validate poll response sensor blocks

Marco Baffo <[email protected]>
ovpn: use monotonic clock for peer keepalive timeouts

Marco Baffo <[email protected]>
ovpn: fix use after free in unlock_ovpn()

longlong yan <[email protected]>
selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()

Qing Ming <[email protected]>
ovpn: avoid putting unrelated P2P peer on socket release

Yichong Chen <[email protected]>
smb: client: validate DFS referral PathConsumed

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix EC read intervals

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC

Mostafa Saleh <[email protected]>
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()

Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

Shahar Tzarfati <[email protected]>
wifi: iwlwifi: mvm: fix read in wake packet notification handler

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list

Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: mvm: validate SAR GEO response payload size

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Use complete_all() to signal init_completion

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix potential probe() deadlock

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Don't use devres to unregister component

Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI

Guangshuo Li <[email protected]>
ALSA: hda: cs35l41: validate and free ACPI mute object

Chen-Yu Tsai <[email protected]>
ASoC: sun4i-codec: Set quirks.playback_only for H616 codec

Pengpeng Hou <[email protected]>
ASoC: tas2781: bound firmware description string parsing

Guanghui Yang <[email protected]>
btrfs: free mapping node on duplicate reloc root insert

Leo Martins <[email protected]>
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps

Dave Chen <[email protected]>
btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting

You-Kai Zheng <[email protected]>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8

Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path

Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler

Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly

Manivannan Sadhasivam <[email protected]>
wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET

Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET

Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

Wayen Yan <[email protected]>
watchdog: airoha: Prevent division by zero when clock frequency is zero

Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

Guenter Roeck <[email protected]>
hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

Edward Adam Davis <[email protected]>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop

Gaole Zhang <[email protected]>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

Daniel Borkmann <[email protected]>
selftests/bpf: Keep verifier_map_ptr exercising ops pointer access

KP Singh <[email protected]>
selftests/bpf: Adjust verifier_map_ptr for the map's excl field

Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits

Sasha Levin <[email protected]>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"

Xie Bo <[email protected]>
RISC-V: KVM: Serialize virtual interrupt pending state updates

Georgi Valkov <[email protected]>
wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware

Chia-Lin Kao (AceLan) <[email protected]>
usb: typec: ucsi: Add duplicate detection to nvidia registration path

Chia-Lin Kao (AceLan) <[email protected]>
usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware

Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling

Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits

Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291

Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix dev_printk() device

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure

Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure

Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()

Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative

Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key

Guangshuo Li <[email protected]>
usb: musb: omap2430: Do not put borrowed of_node in probe

Chia-Lin Kao (AceLan) <[email protected]>
usb: core: port: Deattach Type-C connector on component unbind

Huihui Huang <[email protected]>

    wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

Griffin Kroah-Hartman <[email protected]>
usb: core: sysfs: add lock to bos_descriptors_read()

Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie

Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback

Ivan Vecera <[email protected]>
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

Eric Dumazet <[email protected]>
tcp: fix TIME_WAIT socket reference leak on PSP policy failure

Lizhi Hou <[email protected]>
accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators

Vinod Govindapillai <[email protected]>
drm/i915/wm: clear the plane ddb_y entries on plane disable

Xiang Mei (Microsoft) <[email protected]>
ksmbd: validate compound request size before reading StructureSize2

Qihang <[email protected]>
ksmbd: pin conn during async oplock break notification

Daniele Ceraolo Spurio <[email protected]>
drm/xe/wopcm: fix WOPCM size for LNL+

Matthew Brost <[email protected]>
drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves

Satyanarayana K V P <[email protected]>
drm/xe/vf: Shadow buffer management for CCS read/write operations

Satyanarayana K V P <[email protected]>
drm/xe/sa: Shadow buffer support in the sub-allocator pool

Michał Winiarski <[email protected]>
drm/xe: Allow the caller to pass guc_buf_cache size

Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check

Mark Harris <[email protected]>
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()

Vasily Gorbik <[email protected]>
s390/checksum: Fix csum_partial() without vector facility

Linmao Li <[email protected]>
drm/panthor: Check debugfs GEM lock initialization

Michal Luczaj <[email protected]>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update

Shrikanth Hegde <[email protected]>
powerpc/vtime: Initialize starttime at boot for native accounting

Frederic Weisbecker <[email protected]>
powerpc/time: Prepare to stop elapsing in dynticks-idle

Rosen Penev <[email protected]>
powerpc/85xx: Add fsl,ifc to common device ids

Oliver Hartkopp <[email protected]>
can: raw: add locking for raw flags bitfield

Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol

Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate

Ruoyu Wang <[email protected]>
Bluetooth: hci_qca: Clear memdump state on invalid dump size

Pauli Virtanen <[email protected]>
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Pauli Virtanen <[email protected]>
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: extend conn_hash lookup critical sections

Cen Zhang <[email protected]>
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

Xiang Mei <[email protected]>
Bluetooth: qca: fix NVM tag length underflow in TLV parser

Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC

Karol Wachowski <[email protected]>
accel/ivpu: Fix wrong register read in LNL failure diagnostics

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts

Rosen Penev <[email protected]>

    ata: sata_dwc_460ex: use platform_get_irq()

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

David Jeffery <[email protected]>
scsi: core: wake eh reliably when using scsi_schedule_eh

Robert Mader <[email protected]>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()

Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path

Norbert Szetei <[email protected]>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Rafael J. Wysocki <[email protected]>
cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq

Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context

Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup

Charles Keepax <[email protected]>
ASoC: cs42l43: Correct report for forced microphone jack

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: disable MSI on resume in ACP PCI driver

Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop

Sebastian Ene <[email protected]>
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

Mostafa Saleh <[email protected]>
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance

Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup

Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

Zhao Li <[email protected]>
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc

Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data

Zhao Li <[email protected]>
wifi: nl80211: constrain MBSSID TX link ID range

Zhao Li <[email protected]>
wifi: nl80211: validate nested MBSSID IE blobs

Zhao Li <[email protected]>
wifi: cfg80211: derive S1G beacon TSF from S1G fields

Zhao Li <[email protected]>
wifi: nl80211: free RNR data on MBSSID mismatch

Peddolla Harshavardhan Reddy <[email protected]>
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

Maoyi Xie <[email protected]>
wifi: mac80211: defer link RX stats percpu free to RCU

Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()

Xiang Mei <[email protected]>
wifi: mac80211: fix fils_discovery double free on alloc failure

Xiang Mei <[email protected]>
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure

Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put

Christophe JAILLET <[email protected]>
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

Cen Zhang <[email protected]>
wifi: cfg80211: cancel sched scan results work on unregister

Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Xiang Mei (Microsoft) <[email protected]>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

Chen YanJun <[email protected]>
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

Cen Zhang <[email protected]>
xfrm: clear mode callbacks after failed mode setup

Aleksandrova Alyona <[email protected]>
RDMA/irdma: Prevent overflows in memory contiguity checks

Malaya Kumar Rout <[email protected]>
selftests/alsa: Fix memory leak in find_controls error path

Xue Lei <[email protected]>
mtd: fix double free and WARN_ON in add_mtd_device() error paths

Ruoyu Wang <[email protected]>
RDMA/siw: publish QP after initialization

Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup

Ruoyu Wang <[email protected]>
RDMA/mana_ib: initialize err for empty send WR lists

Ruoyu Wang <[email protected]>
RDMA/erdma: initialize ret for empty receive WR lists

Jacob Moroni <[email protected]>
RDMA/irdma: Prevent user-triggered null deref on QP create

Jacob Moroni <[email protected]>
RDMA/irdma: Remove redundant legacy_mode checks

Jacob Moroni <[email protected]>
RDMA/irdma: Prevent rereg_mr for non-mem regions

Jacob Moroni <[email protected]>
RDMA/umem: Add pinned revocable dmabuf import interface

Or Gerlitz <[email protected]>
RDMA/cma: Fix hardware address comparison length in netevent callback

Antony Antony <[email protected]>
xfrm: reject optional IPTFS templates in outbound policies

Tejun Heo <[email protected]>
sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()

John Stultz <[email protected]>

    sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next

Unnathi Chalicheemala <[email protected]>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

Boris Burkov <[email protected]>
btrfs: fallback to transaction csum tree on a commit root csum miss

Filipe Manana <[email protected]>
btrfs: use bool type for btrfs_path members used as booleans

Filipe Manana <[email protected]>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()

Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages

Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts

Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown

Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly

Seth Forshee <[email protected]>
firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits

Petr Wozniak <[email protected]>

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

Petr Wozniak <[email protected]>
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()

Eric Dumazet <[email protected]>
net: plumb drop reasons to __dev_queue_xmit()

Eric Dumazet <[email protected]>
net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT

Sumit Gupta <[email protected]>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234

Akhil R <[email protected]>
arm64: tegra: Remove fallback compatible for GPCDMA

Junxi Qian <[email protected]>
fuse: fix writeback array overflow when max_pages is one

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix logic error in packet reset

Seungjin Bae <[email protected]>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

Chuck Lever <[email protected]>
xprtrdma: Clear receive-side ownership pointers on release

Mikko Perttunen <[email protected]>
crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin

Mikko Perttunen <[email protected]>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

Oliver Hartkopp <[email protected]>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops

Oliver Hartkopp <[email protected]>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

Oliver Hartkopp <[email protected]>
can: bcm: fix stale rx/tx ops after device removal

Oliver Hartkopp <[email protected]>
can: bcm: add missing device refcount for CAN filter removal

Oliver Hartkopp <[email protected]>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies

Oliver Hartkopp <[email protected]>
can: bcm: extend bcm_tx_lock usage for data and timer updates

Oliver Hartkopp <[email protected]>
can: bcm: fix CAN frame rx/tx statistics

Oliver Hartkopp <[email protected]>
can: bcm: add locking when updating filter and timer values

Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload

Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Venkatesh Srinivas <[email protected]>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN

Sean Christopherson <[email protected]>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Heiko Carstens <[email protected]>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing

Peter Zijlstra <[email protected]>
seqlock: Allow KASAN to fail optimizing

Peter Zijlstra <[email protected]>
seqlock: Cure some more scoped_seqlock() optimization fails

Kiryl Shutsemau <[email protected]>
fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race

Ryosuke Yasuoka <[email protected]>
drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker

Brian Witte <[email protected]>
netfilter: nf_tables: revert commit_mutex usage in reset path

Brian Witte <[email protected]>
netfilter: nft_quota: use atomic64_xchg for reset

Brian Witte <[email protected]>
netfilter: nft_counter: serialize reset with spinlock

Daniel Borkmann <[email protected]>
selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs

Daniel Borkmann <[email protected]>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs

Guixiong Wei <[email protected]>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug

-------------

Diffstat:

 Documentation/gpu/drm-mm.rst                       |   10 +-
 Documentation/netlink/specs/rt-link.yaml           |   40 +-
 MAINTAINERS                                        |   13 +
 Makefile                                           |    9 +-
 arch/arm64/boot/dts/nvidia/tegra234.dtsi           |   24 +-
 arch/arm64/boot/dts/nvidia/tegra264.dtsi           |    2 +-
 arch/arm64/boot/dts/qcom/lemans.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sc7180.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sc7280.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |   12 +-
 arch/arm64/boot/dts/qcom/sc8280xp.dtsi             |   32 +-
 arch/arm64/boot/dts/qcom/sm6350.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sm8450.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |   77 +-
 arch/arm64/include/asm/esr.h                       |    2 +-
 arch/arm64/mm/hugetlbpage.c                        |    2 +-
 arch/loongarch/kernel/acpi.c                       |   27 +-
 arch/loongarch/kernel/kgdb.c                       |    3 +-
 arch/loongarch/kernel/machine_kexec.c              |    5 +-
 arch/loongarch/kernel/setup.c                      |    3 +-
 arch/loongarch/kernel/smp.c                        |    4 +-
 arch/powerpc/kernel/time.c                         |   43 +
 arch/powerpc/platforms/85xx/common.c               |    2 +
 arch/riscv/include/asm/kvm_host.h                  |   10 +-
 arch/riscv/kernel/sys_hwprobe.c                    |    1 +
 arch/riscv/kvm/aia.c                               |   35 +-
 arch/riscv/kvm/vcpu.c                              |   68 +-
 arch/riscv/kvm/vcpu_onereg.c                       |    8 +-
 arch/s390/lib/csum-partial.c                       |    2 +-
 arch/x86/boot/compressed/Makefile                  |    1 +
 arch/x86/kernel/cpu/resctrl/core.c                 |   32 +-
 arch/x86/kernel/cpu/resctrl/internal.h             |   18 +-
 arch/x86/kernel/cpu/resctrl/monitor.c              |   36 +-
 arch/x86/kvm/lapic.c                               |    2 +-
 arch/x86/kvm/mmu/mmu.c                             |   11 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |   10 +-
 arch/x86/kvm/svm/svm.c                             |    7 +-
 arch/x86/kvm/vmx/nested.c                          |   11 +-
 drivers/accel/amdxdna/amdxdna_ctx.c                |    8 +
 drivers/accel/ivpu/ivpu_hw_btrs.c                  |    2 +-
 drivers/android/binder/thread.rs                   |   14 +-
 drivers/ata/libata-core.c                          |   18 +
 drivers/ata/libata-scsi.c                          |    2 -
 drivers/ata/libata.h                               |    9 +
 drivers/ata/sata_dwc_460ex.c                       |   38 +-
 drivers/block/rbd.c                                |    7 +-
 drivers/block/ublk_drv.c                           |   52 +-
 drivers/bluetooth/btqca.c                          |    2 +-
 drivers/bluetooth/btusb.c                          |    4 +-
 drivers/bluetooth/hci_qca.c                        |    4 +
 drivers/cdrom/cdrom.c                              |    1 +
 drivers/comedi/drivers/comedi_parport.c            |   13 +-
 drivers/cpufreq/cpufreq.c                          |    3 +
 drivers/crypto/tegra/tegra-se-main.c               |    3 +-
 drivers/cxl/Kconfig                                |    4 +
 drivers/cxl/core/Makefile                          |    2 +-
 drivers/cxl/core/core.h                            |   31 +
 drivers/cxl/core/pci.c                             |  215 +---
 drivers/cxl/core/ras.c                             |  197 ++-
 drivers/cxl/core/trace.h                           |   24 +-
 drivers/cxl/cxl.h                                  |   22 +-
 drivers/cxl/cxlpci.h                               |   16 +
 drivers/dma-buf/udmabuf.c                          |    9 +-
 drivers/dma/dw-edma/dw-edma-pcie.c                 |    7 +-
 drivers/dma/sh/rz-dmac.c                           |   96 +-
 drivers/dpll/dpll_netlink.c                        |    3 +
 drivers/firewire/net.c                             |   37 +-
 drivers/firmware/arm_ffa/driver.c                  |   54 +-
 drivers/firmware/arm_scmi/notify.c                 |    6 +-
 drivers/firmware/stratix10-svc.c                   |   10 +-
 drivers/firmware/xilinx/zynqmp.c                   |    1 +
 drivers/gpu/Kconfig                                |   13 +
 drivers/gpu/Makefile                               |    4 +-
 drivers/gpu/buddy.c                                | 1347 ++++++++++++++++++++
 drivers/gpu/drm/Kconfig                            |    5 +-
 drivers/gpu/drm/Kconfig.debug                      |    1 -
 drivers/gpu/drm/Makefile                           |    1 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |   13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |   62 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |    6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |    6 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |   10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c            |    3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |   13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_res_cursor.h     |   12 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |   54 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |   58 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |   17 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   25 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c       |   79 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.h       |   20 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |   22 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |   13 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c             |   13 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |    3 -
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   49 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c            |   11 +-
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c           |    2 +-
 drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c           |    2 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c           |    4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |    4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |    4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c             |    4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c             |    4 +-
 drivers/gpu/drm/amd/amdgpu/soc24.c                 |   28 +
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |   15 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |   12 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |    6 +
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h  |    2 +
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |    3 +
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h              |    3 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |   24 +-
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c             |   23 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  374 +++---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c |   81 +-
 .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c   |    9 +-
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c   |    9 +-
 .../gpu/drm/amd/display/dc/link/link_detection.c   |    5 +-
 .../display/dc/resource/dce100/dce100_resource.c   |    7 +-
 .../amd/display/modules/info_packet/info_packet.c  |    2 -
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |   26 +-
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |    7 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |   11 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |   15 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c   |   28 +-
 drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c     |   11 +-
 drivers/gpu/drm/display/drm_dp_mst_topology.c      |   36 +-
 drivers/gpu/drm/drm_buddy.c                        | 1278 +------------------
 drivers/gpu/drm/drm_connector.c                    |   12 +-
 drivers/gpu/drm/drm_displayid_internal.h           |    2 +-
 drivers/gpu/drm/drm_gpusvm.c                       |    4 +-
 drivers/gpu/drm/drm_panel_backlight_quirks.c       |    9 +
 drivers/gpu/drm/i915/display/intel_bios.c          |   36 +-
 drivers/gpu/drm/i915/display/intel_dp.c            |    8 +-
 drivers/gpu/drm/i915/display/intel_hdcp.c          |   12 +-
 drivers/gpu/drm/i915/display/skl_watermark.c       |    2 +-
 drivers/gpu/drm/i915/gem/i915_gem_context.c        |   25 +-
 drivers/gpu/drm/i915/gem/i915_gem_ttm.c            |    3 +-
 drivers/gpu/drm/i915/gt/intel_engine_user.c        |    2 +-
 drivers/gpu/drm/i915/gt/selftest_gt_pm.c           |    8 +-
 drivers/gpu/drm/i915/i915_active.c                 |    7 +-
 drivers/gpu/drm/i915/i915_scatterlist.c            |   10 +-
 drivers/gpu/drm/i915/i915_ttm_buddy_manager.c      |   59 +-
 drivers/gpu/drm/i915/i915_ttm_buddy_manager.h      |    4 +-
 .../gpu/drm/i915/selftests/intel_memory_region.c   |   20 +-
 drivers/gpu/drm/imagination/pvr_context.c          |   22 +-
 drivers/gpu/drm/imagination/pvr_drv.c              |   13 +-
 drivers/gpu/drm/imagination/pvr_queue.c            |   65 +-
 drivers/gpu/drm/imagination/pvr_queue.h            |    2 +-
 drivers/gpu/drm/imagination/pvr_vm.c               |    2 +
 drivers/gpu/drm/nouveau/nouveau_exec.c             |    4 +-
 drivers/gpu/drm/nouveau/nouveau_uvmm.c             |    4 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c     |    1 +
 drivers/gpu/drm/panel/Kconfig                      |    1 +
 drivers/gpu/drm/panthor/panthor_device.c           |    5 +-
 drivers/gpu/drm/panthor/panthor_fw.c               |    1 +
 drivers/gpu/drm/radeon/r100.c                      |   13 +-
 drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c     |   18 +-
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c    |    2 +
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |    2 +
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h           |    2 +-
 drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c      |   13 +-
 drivers/gpu/drm/sysfb/efidrm.c                     |    7 +-
 drivers/gpu/drm/sysfb/vesadrm.c                    |    6 +-
 drivers/gpu/drm/tests/Makefile                     |    1 -
 drivers/gpu/drm/tests/drm_exec_test.c              |    2 -
 drivers/gpu/drm/tests/drm_gem_shmem_test.c         |   16 +-
 drivers/gpu/drm/tests/drm_mm_test.c                |    2 -
 drivers/gpu/drm/tidss/tidss_encoder.c              |    2 +
 drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c   |    4 +-
 drivers/gpu/drm/ttm/tests/ttm_mock_manager.c       |   18 +-
 drivers/gpu/drm/ttm/tests/ttm_mock_manager.h       |    4 +-
 drivers/gpu/drm/ttm/ttm_pool.c                     |   34 +-
 drivers/gpu/drm/v3d/v3d_gem.c                      |   12 +
 drivers/gpu/drm/vc4/vc4_bo.c                       |   12 +-
 drivers/gpu/drm/virtio/virtgpu_gem.c               |   14 +-
 drivers/gpu/drm/virtio/virtgpu_kms.c               |    5 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c                |    6 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c            |   22 +-
 drivers/gpu/drm/xe/xe_bo.c                         |   58 +-
 drivers/gpu/drm/xe/xe_bo.h                         |    3 +-
 drivers/gpu/drm/xe/xe_bo_types.h                   |    2 +
 drivers/gpu/drm/xe/xe_dma_buf.c                    |    2 +-
 drivers/gpu/drm/xe/xe_guc_buf.c                    |   44 +-
 drivers/gpu/drm/xe/xe_guc_buf.h                    |    1 +
 drivers/gpu/drm/xe/xe_i2c.c                        |    5 +-
 drivers/gpu/drm/xe/xe_migrate.c                    |   62 +-
 drivers/gpu/drm/xe/xe_migrate.h                    |    4 +
 drivers/gpu/drm/xe/xe_pt.c                         |   14 +-
 drivers/gpu/drm/xe/xe_res_cursor.h                 |   34 +-
 drivers/gpu/drm/xe/xe_sa.c                         |   67 +-
 drivers/gpu/drm/xe/xe_sa.h                         |   20 +-
 drivers/gpu/drm/xe/xe_sa_types.h                   |    3 +
 drivers/gpu/drm/xe/xe_sriov_vf_ccs.c               |   42 +-
 drivers/gpu/drm/xe/xe_sriov_vf_ccs.h               |    4 +-
 drivers/gpu/drm/xe/xe_svm.c                        |   18 +-
 drivers/gpu/drm/xe/xe_ttm_vram_mgr.c               |   71 +-
 drivers/gpu/drm/xe/xe_ttm_vram_mgr_types.h         |    4 +-
 drivers/gpu/drm/xe/xe_vm.c                         |   10 +-
 drivers/gpu/drm/xe/xe_wopcm.c                      |   15 +-
 drivers/gpu/host1x/bus.c                           |    4 +-
 drivers/gpu/tests/Makefile                         |    4 +
 .../drm_buddy_test.c => tests/gpu_buddy_test.c}    |  358 +++---
 .../{drm/lib/drm_random.c => tests/gpu_random.c}   |   18 +-
 .../{drm/lib/drm_random.h => tests/gpu_random.h}   |   18 +-
 drivers/hwmon/asus-ec-sensors.c                    |   18 +-
 drivers/hwmon/corsair-cpro.c                       |    1 +
 drivers/hwmon/corsair-psu.c                        |    1 +
 drivers/hwmon/gigabyte_waterforce.c                |    4 +-
 drivers/hwmon/nzxt-kraken3.c                       |    6 +-
 drivers/hwmon/nzxt-smart2.c                        |    2 +-
 drivers/hwmon/occ/common.c                         |   38 +-
 drivers/hwtracing/intel_th/core.c                  |   10 -
 drivers/hwtracing/intel_th/msu.c                   |    2 +
 drivers/i3c/master/mipi-i3c-hci/core.c             |   16 +-
 drivers/i3c/master/mipi-i3c-hci/hci.h              |    1 +
 drivers/infiniband/core/cma.c                      |    2 +-
 drivers/infiniband/core/mad.c                      |   30 +
 drivers/infiniband/core/umem_dmabuf.c              |   61 +
 drivers/infiniband/hw/erdma/erdma_qp.c             |    2 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |    2 +-
 drivers/infiniband/hw/irdma/uk.c                   |    9 +-
 drivers/infiniband/hw/irdma/user.h                 |    1 -
 drivers/infiniband/hw/irdma/verbs.c                |   33 +-
 drivers/infiniband/hw/mana/wr.c                    |    2 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |   44 +-
 drivers/input/misc/ims-pcu.c                       |   32 +-
 drivers/iommu/amd/init.c                           |    6 +
 drivers/iommu/amd/iommu.c                          |   22 +-
 drivers/iommu/intel/perf.c                         |    2 +-
 drivers/iommu/intel/svm.c                          |    2 +-
 drivers/md/dm-verity-fec.c                         |  110 +-
 drivers/md/dm-verity-fec.h                         |    6 +-
 drivers/md/dm.c                                    |   11 +-
 drivers/media/cec/platform/seco/seco-cec.c         |    6 +-
 drivers/media/common/videobuf2/videobuf2-core.c    |   12 +-
 drivers/media/dvb-frontends/rtl2832.c              |    4 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |   19 +-
 drivers/media/i2c/alvium-csi2.c                    |   21 +-
 drivers/media/i2c/imx219.c                         |    2 +-
 drivers/media/pci/cx23885/cx23885-core.c           |   14 +-
 drivers/media/pci/dm1105/dm1105.c                  |    1 +
 drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c   |   24 +-
 drivers/media/pci/saa7134/saa7134-video.c          |   25 +-
 .../media/platform/amlogic/c3/isp/c3-isp-params.c  |    4 +
 drivers/media/platform/aspeed/aspeed-video.c       |    1 +
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |   29 +-
 drivers/media/platform/marvell/cafe-driver.c       |    1 +
 drivers/media/platform/nuvoton/npcm-video.c        |   34 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-core.c    |    2 +
 .../media/platform/nxp/imx8-isi/imx8-isi-core.h    |   16 +
 .../platform/nxp/imx8-isi/imx8-isi-crossbar.c      |    1 +
 drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c  |    9 +-
 drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c |   11 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c    |   20 +-
 drivers/media/platform/qcom/camss/camss-csid-680.c |   30 +-
 .../media/platform/qcom/camss/camss-csid-gen2.c    |   47 +-
 .../media/platform/qcom/camss/camss-csid-gen3.c    |   28 +-
 drivers/media/platform/qcom/iris/iris_probe.c      |    6 +-
 .../platform/renesas/rzg2l-cru/rzg2l-cru-regs.h    |    1 +
 .../media/platform/renesas/rzg2l-cru/rzg2l-video.c |   17 +-
 drivers/media/platform/st/stm32/stm32-dcmi.c       |    1 +
 .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c         |    6 +-
 drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c |    6 +-
 .../media/platform/synopsys/hdmirx/snps_hdmirx.c   |    4 +-
 drivers/media/platform/ti/davinci/vpif_capture.c   |    2 +-
 drivers/media/platform/ti/vpe/vpe.c                |    3 +-
 drivers/media/platform/verisilicon/hantro_v4l2.c   |    6 +-
 drivers/media/radio/radio-si476x.c                 |    1 +
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |    4 +-
 drivers/media/test-drivers/vimc/vimc-core.c        |    1 +
 drivers/media/test-drivers/vivid/vivid-core.c      |    6 +-
 drivers/media/test-drivers/vivid/vivid-ctrls.c     |   15 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.c   |   38 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.h   |    1 +
 drivers/media/test-drivers/vivid/vivid-vid-out.c   |    6 +
 drivers/media/usb/airspy/airspy.c                  |    8 +-
 drivers/media/usb/cx231xx/cx231xx-cards.c          |   16 +-
 drivers/media/usb/msi2500/msi2500.c                |   32 +-
 drivers/media/usb/pwc/pwc-if.c                     |   13 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |   13 +
 drivers/media/v4l2-core/v4l2-ctrls-request.c       |   14 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |    6 +-
 drivers/media/v4l2-core/v4l2-subdev.c              |    4 +
 drivers/misc/mei/bus.c                             |   16 +-
 drivers/misc/nsm.c                                 |    3 +-
 drivers/mmc/host/vub300.c                          |   24 +-
 drivers/mtd/maps/vmu-flash.c                       |    8 +-
 drivers/mtd/mtdcore.c                              |   23 +-
 drivers/mtd/mtdswap.c                              |    5 +-
 drivers/mtd/nand/ecc-mtk.c                         |   16 +-
 drivers/net/amt.c                                  |  101 +-
 drivers/net/bonding/bond_main.c                    |    3 +-
 drivers/net/ethernet/airoha/airoha_eth.c           |    3 +-
 drivers/net/ethernet/airoha/airoha_npu.c           |    4 +-
 drivers/net/ethernet/airoha/airoha_ppe.c           |    1 +
 drivers/net/ethernet/amd/pds_core/adminq.c         |   12 +-
 drivers/net/ethernet/amd/pds_core/auxbus.c         |   17 +-
 drivers/net/ethernet/amd/pds_core/core.c           |   22 +-
 drivers/net/ethernet/amd/pds_core/devlink.c        |    6 +
 drivers/net/ethernet/amd/pds_core/main.c           |   14 +-
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |   11 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c   |    1 +
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |    1 +
 drivers/net/ethernet/freescale/fman/fman_dtsec.c   |   17 +-
 drivers/net/ethernet/google/gve/gve.h              |    3 +
 drivers/net/ethernet/google/gve/gve_rx_dqo.c       |   34 +
 drivers/net/ethernet/hisilicon/hip04_eth.c         |   11 +-
 drivers/net/ethernet/huawei/hinic/hinic_dev.h      |    2 -
 drivers/net/ethernet/huawei/hinic/hinic_ethtool.c  |   21 -
 drivers/net/ethernet/intel/ice/ice.h               |    3 +
 drivers/net/ethernet/intel/ice/ice_eswitch.c       |    3 -
 drivers/net/ethernet/intel/ice/ice_lag.c           |    2 +-
 drivers/net/ethernet/intel/ice/ice_parser.c        |    3 +
 drivers/net/ethernet/intel/ice/ice_ptp.c           |    7 +-
 drivers/net/ethernet/intel/ice/ice_sriov.c         |   14 +-
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |    3 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |    2 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |    1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c  |    9 +
 .../net/ethernet/marvell/octeontx2/af/rvu_rep.c    |    8 +
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |    1 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c   |   29 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |   15 +
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |   19 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |    4 +-
 .../ethernet/mellanox/mlx5/core/esw/acl/helper.c   |    2 +-
 .../net/ethernet/mellanox/mlx5/core/mlx5_core.h    |    4 +-
 drivers/net/ethernet/mellanox/mlx5/core/port.c     |   39 +-
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |   78 +-
 drivers/net/ethernet/microsoft/mana/mana_en.c      |   13 +
 .../ethernet/netronome/nfp/nfpcore/nfp_resource.c  |    3 +
 drivers/net/ethernet/realtek/rtase/rtase.h         |    8 +
 drivers/net/ethernet/realtek/rtase/rtase_main.c    |  197 +++
 drivers/net/ethernet/stmicro/stmmac/common.h       |    3 -
 drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c  |   31 +
 .../net/ethernet/stmicro/stmmac/dwmac-loongson.c   |    5 +-
 .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c    |  162 ++-
 drivers/net/ethernet/stmicro/stmmac/dwmac100.h     |    9 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac1000.h    |   16 +-
 .../net/ethernet/stmicro/stmmac/dwmac1000_core.c   |   49 +-
 .../net/ethernet/stmicro/stmmac/dwmac1000_dma.c    |   16 +-
 .../net/ethernet/stmicro/stmmac/dwmac100_core.c    |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c |    3 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4.h       |   49 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   53 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c   |   44 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h   |   16 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c   |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h    |   10 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c    |   10 +-
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h     |   34 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |   45 +-
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c |   75 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   92 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |   35 +
 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c    |    1 +
 drivers/net/geneve.c                               |    3 +
 drivers/net/gtp.c                                  |   17 +-
 drivers/net/ipa/ipa_smp2p.c                        |   30 +-
 drivers/net/mctp/mctp-i3c.c                        |   11 +-
 drivers/net/mctp/mctp-serial.c                     |    2 +-
 drivers/net/ovpn/io.c                              |    4 +-
 drivers/net/ovpn/peer.c                            |   16 +-
 drivers/net/ovpn/tcp.c                             |    6 +-
 drivers/net/pcs/pcs-xpcs.c                         |   34 +-
 drivers/net/phy/marvell.c                          |    2 +-
 drivers/net/ppp/ppp_generic.c                      |  239 ++--
 drivers/net/ppp/pppoe.c                            |    1 +
 drivers/net/slip/slip.c                            |    4 +
 drivers/net/vmxnet3/vmxnet3_drv.c                  |   22 +-
 drivers/net/vxlan/vxlan_core.c                     |    3 +
 drivers/net/vxlan/vxlan_mdb.c                      |   30 +-
 drivers/net/wan/wanxl.c                            |    3 +-
 drivers/net/wireless/ath/ath11k/ahb.c              |    1 +
 drivers/net/wireless/ath/ath11k/dp_rx.c            |    3 +
 drivers/net/wireless/ath/ath11k/pci.c              |    4 +
 drivers/net/wireless/ath/ath11k/qmi.c              |   11 +-
 drivers/net/wireless/ath/ath12k/pci.c              |    4 +
 drivers/net/wireless/ath/ath6kl/txrx.c             |   12 +-
 drivers/net/wireless/ath/ath6kl/wmi.c              |   20 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |    7 +-
 drivers/net/wireless/ath/carl9170/rx.c             |    7 +-
 drivers/net/wireless/ath/carl9170/tx.c             |    2 +-
 drivers/net/wireless/atmel/at76c50x-usb.c          |    7 +-
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |    1 +
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |    2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |    8 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |    2 +-
 drivers/net/wireless/intel/ipw2x00/ipw2100.c       |    8 +-
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c       |    9 +-
 drivers/net/wireless/intel/iwlwifi/fw/regulatory.c |    2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |    3 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |   10 +
 drivers/net/wireless/intersil/p54/txrx.c           |    8 +
 drivers/net/wireless/marvell/libertas/firmware.c   |    1 +
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |   14 +-
 drivers/net/wireless/marvell/mwifiex/tdls.c        |    2 +-
 drivers/net/wireless/marvell/mwifiex/uap_event.c   |   24 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |    6 +
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |    2 +
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   18 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |   10 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   13 +-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |    3 +
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |    2 +
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   19 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |    5 +
 drivers/net/wireless/virtual/mac80211_hwsim.c      |    1 +
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |    8 +-
 drivers/platform/loongarch/loongson-laptop.c       |    1 +
 .../uncore-frequency/uncore-frequency-common.c     |    7 +-
 drivers/pmdomain/imx/imx93-blk-ctrl.c              |  126 +-
 drivers/ptp/ptp_netc.c                             |    1 +
 drivers/ptp/ptp_s390.c                             |    6 +-
 drivers/regulator/mt6358-regulator.c               |    2 +-
 drivers/remoteproc/xlnx_r5_remoteproc.c            |   50 +-
 drivers/scsi/hosts.c                               |    2 +
 drivers/scsi/scsi_error.c                          |   22 +-
 drivers/scsi/scsi_priv.h                           |    1 +
 drivers/staging/media/meson/vdec/vdec.c            |    4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |    6 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |    3 +
 drivers/staging/media/tegra-video/vi.c             |    4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |    9 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |    2 +-
 drivers/thunderbolt/debugfs.c                      |    2 +
 drivers/thunderbolt/domain.c                       |   30 +
 drivers/thunderbolt/icm.c                          |    5 +
 drivers/thunderbolt/switch.c                       |   14 +
 drivers/thunderbolt/tb.c                           |   59 +-
 drivers/thunderbolt/tb.h                           |    2 +
 drivers/thunderbolt/xdomain.c                      |  100 +-
 drivers/tty/serial/8250/8250_mid.c                 |   14 +-
 drivers/tty/serial/sc16is7xx.c                     |   12 +
 drivers/uio/uio_hv_generic.c                       |    8 +-
 drivers/usb/atm/ueagle-atm.c                       |   17 +
 drivers/usb/chipidea/core.c                        |    1 +
 drivers/usb/core/port.c                            |    2 +
 drivers/usb/core/sysfs.c                           |    8 +-
 drivers/usb/gadget/function/f_midi.c               |    1 +
 drivers/usb/gadget/function/f_ncm.c                |   17 +-
 drivers/usb/gadget/function/f_printer.c            |   23 +-
 drivers/usb/gadget/function/f_tcm.c                |  192 ++-
 drivers/usb/gadget/function/tcm.h                  |   13 +
 drivers/usb/gadget/function/uvc_v4l2.c             |    2 +
 drivers/usb/gadget/udc/bdc/bdc_core.c              |   20 +
 drivers/usb/gadget/udc/bdc/bdc_udc.c               |    7 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |   40 +-
 drivers/usb/gadget/udc/fsl_udc_core.c              |   93 +-
 drivers/usb/gadget/udc/fsl_usb2_udc.h              |    1 +
 drivers/usb/gadget/udc/snps_udc_core.c             |    1 -
 drivers/usb/host/xhci-pci.c                        |    1 +
 drivers/usb/host/xhci.c                            |   15 +-
 drivers/usb/host/xhci.h                            |    1 +
 drivers/usb/musb/omap2430.c                        |    2 -
 drivers/usb/serial/ftdi_sio.c                      |    2 +
 drivers/usb/serial/ftdi_sio_ids.h                  |    5 +
 drivers/usb/serial/io_edgeport.c                   |    3 +-
 drivers/usb/serial/keyspan_pda.c                   |   44 +-
 drivers/usb/serial/option.c                        |    1 +
 drivers/usb/storage/unusual_devs.h                 |    7 +
 drivers/usb/typec/ucsi/ucsi.c                      |  158 ++-
 drivers/vdpa/vdpa_user/iova_domain.c               |   29 +-
 drivers/vdpa/vdpa_user/iova_domain.h               |    8 +-
 drivers/vdpa/vdpa_user/vduse_dev.c                 |  112 +-
 drivers/vhost/net.c                                |    8 +-
 drivers/video/Kconfig                              |    1 +
 drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c      |    2 +-
 drivers/watchdog/airoha_wdt.c                      |    3 +
 drivers/watchdog/s32g_wdt.c                        |    3 +-
 drivers/watchdog/watchdog_pretimeout.c             |    2 +
 fs/afs/dir_edit.c                                  |    2 +-
 fs/binfmt_elf_fdpic.c                              |    4 +
 fs/binfmt_misc.c                                   |    5 +-
 fs/btrfs/backref.c                                 |   16 +-
 fs/btrfs/block-group.c                             |    8 +-
 fs/btrfs/ctree.c                                   |   28 +-
 fs/btrfs/ctree.h                                   |   16 +-
 fs/btrfs/defrag.c                                  |    4 +-
 fs/btrfs/dev-replace.c                             |    4 +-
 fs/btrfs/extent-tree.c                             |    8 +-
 fs/btrfs/extent_io.c                               |    4 +-
 fs/btrfs/extent_map.c                              |    4 +-
 fs/btrfs/file-item.c                               |   38 +-
 fs/btrfs/free-space-cache.c                        |    7 +-
 fs/btrfs/free-space-tree.c                         |    4 +-
 fs/btrfs/inode-item.c                              |    2 +-
 fs/btrfs/inode.c                                   |    4 +-
 fs/btrfs/qgroup.c                                  |    4 +-
 fs/btrfs/raid-stripe-tree.c                        |    4 +-
 fs/btrfs/relocation.c                              |   10 +-
 fs/btrfs/scrub.c                                   |   20 +-
 fs/btrfs/send.c                                    |   14 +-
 fs/btrfs/tree-log.c                                |   20 +-
 fs/btrfs/volumes.c                                 |    6 +-
 fs/btrfs/xattr.c                                   |    2 +-
 fs/ceph/addr.c                                     |    9 +
 fs/ceph/caps.c                                     |    1 +
 fs/ceph/dir.c                                      |    7 +-
 fs/ceph/ioctl.c                                    |    6 +
 fs/crypto/inline_crypt.c                           |   57 +-
 fs/crypto/keysetup_v1.c                            |    8 +-
 fs/exec.c                                          |    2 +-
 fs/f2fs/super.c                                    |   25 +-
 fs/fuse/dev_uring.c                                |   22 +-
 fs/fuse/file.c                                     |    5 +-
 fs/iomap/buffered-io.c                             |   34 +-
 fs/nfsd/nfs4xdr.c                                  |    8 +-
 fs/nfsd/vfs.c                                      |   15 +-
 fs/nfsd/vfs.h                                      |    2 +-
 fs/overlayfs/copy_up.c                             |   12 +-
 fs/overlayfs/file.c                                |   47 +-
 fs/overlayfs/overlayfs.h                           |    5 +
 fs/overlayfs/xattrs.c                              |    2 +-
 fs/posix_acl.c                                     |    7 +
 fs/proc/namespaces.c                               |    4 +-
 fs/proc/task_mmu.c                                 |   14 +-
 fs/resctrl/ctrlmondata.c                           |    6 +-
 fs/resctrl/internal.h                              |   22 +-
 fs/resctrl/monitor.c                               |  200 +--
 fs/resctrl/rdtgroup.c                              |   75 +-
 fs/smb/client/misc.c                               |   34 +-
 fs/smb/client/smb2file.c                           |   21 +
 fs/smb/client/smb2inode.c                          |   23 +-
 fs/smb/client/smb2ops.c                            |   25 +-
 fs/smb/server/oplock.c                             |    6 +-
 fs/smb/server/smb2misc.c                           |    5 +
 fs/smb/server/smb2pdu.c                            |    9 +-
 fs/smb/server/smbacl.c                             |   42 +-
 fs/super.c                                         |   34 +-
 fs/xfs/scrub/cow_repair.c                          |  203 +--
 fs/xfs/scrub/trace.h                               |   28 +-
 include/drm/drm_buddy.h                            |  165 +--
 include/drm/drm_connector.h                        |    6 +-
 include/drm/drm_utils.h                            |    1 +
 include/linux/arm_ffa.h                            |    2 +-
 include/linux/audit.h                              |    6 +-
 include/linux/audit_arch.h                         |   12 +-
 include/linux/bootconfig.h                         |    3 +
 include/linux/cred.h                               |   15 +
 include/linux/firmware/xlnx-zynqmp.h               |   13 +
 include/linux/fscrypt.h                            |   18 +-
 include/linux/gpu_buddy.h                          |  177 +++
 include/linux/mlx5/mlx5_ifc.h                      |   13 +-
 include/linux/resctrl.h                            |   28 +-
 include/linux/seqlock.h                            |   10 +-
 include/linux/sunrpc/svcsock.h                     |    3 +
 include/linux/sunrpc/xdr.h                         |   19 +-
 include/linux/virtio.h                             |    6 +-
 include/linux/vtime.h                              |    6 +
 include/media/v4l2-async.h                         |    4 +-
 include/media/videobuf2-core.h                     |    8 +-
 include/net/bluetooth/rfcomm.h                     |    3 +
 include/net/cfg80211.h                             |    2 +-
 include/net/dropreason-core.h                      |    3 +
 include/net/ip6_tunnel.h                           |    2 +-
 include/net/netfilter/nf_tables.h                  |   32 -
 include/net/netfilter/nft_fib.h                    |    2 -
 include/net/netfilter/nft_meta.h                   |    3 -
 include/net/sctp/structs.h                         |    3 +-
 include/net/tcp.h                                  |    2 +
 include/rdma/ib_umem.h                             |   19 +
 include/scsi/scsi_host.h                           |    3 +
 include/uapi/linux/btrfs.h                         |    2 +-
 init/Kconfig                                       |    3 +
 init/main.c                                        |   45 -
 io_uring/rw.c                                      |   42 +-
 kernel/audit.c                                     |    2 +-
 kernel/audit.h                                     |   32 +-
 kernel/audit_fsnotify.c                            |   36 +-
 kernel/audit_tree.c                                |    2 +-
 kernel/audit_watch.c                               |   35 +-
 kernel/auditfilter.c                               |   17 +-
 kernel/auditsc.c                                   |    6 +-
 kernel/bpf/verifier.c                              |   17 +
 kernel/kexec_handover.c                            |   32 +-
 kernel/sched/ext.c                                 |    9 +-
 kernel/trace/ftrace.c                              |   13 +
 kernel/trace/trace.c                               |    2 +-
 kernel/trace/trace_eprobe.c                        |    3 +-
 kernel/trace/trace_events.c                        |    4 +-
 kernel/trace/trace_mmiotrace.c                     |    4 +-
 kernel/trace/trace_probe.c                         |   13 +-
 lib/bootconfig.c                                   |   65 +
 lib/compat_audit.c                                 |   12 +-
 lib/rhashtable.c                                   |    1 +
 mm/damon/core.c                                    |   13 +
 mm/huge_memory.c                                   |   12 +-
 mm/kmemleak.c                                      |    7 +-
 mm/sparse.c                                        |   32 +-
 net/bluetooth/hci_sync.c                           |   55 +-
 net/bluetooth/mgmt.c                               |   86 +-
 net/bluetooth/rfcomm/core.c                        |   17 +
 net/bluetooth/rfcomm/tty.c                         |    7 +-
 net/bridge/br_netlink_tunnel.c                     |    3 +-
 net/bridge/br_private.h                            |    6 +-
 net/bridge/br_vlan.c                               |   10 +-
 net/bridge/br_vlan_options.c                       |    3 +-
 net/bridge/netfilter/nft_meta_bridge.c             |   20 -
 net/bridge/netfilter/nft_reject_bridge.c           |    1 -
 net/can/bcm.c                                      |  528 ++++++--
 net/can/j1939/transport.c                          |   18 +-
 net/can/raw.c                                      |   66 +-
 net/ceph/auth_x.c                                  |    9 +-
 net/ceph/ceph_common.c                             |    4 +-
 net/ceph/mon_client.c                              |    4 +-
 net/ceph/osdmap.c                                  |   12 +-
 net/core/dev.c                                     |  111 +-
 net/core/filter.c                                  |    6 +-
 net/core/gro.c                                     |    4 +-
 net/core/sock.c                                    |   10 +-
 net/core/sock_map.c                                |    2 +
 net/hsr/hsr_slave.c                                |    2 +
 net/ipv4/datagram.c                                |    4 +-
 net/ipv4/fib_trie.c                                |    2 +-
 net/ipv4/icmp.c                                    |   18 +-
 net/ipv4/ip_gre.c                                  |    4 +-
 net/ipv4/ip_tunnel_core.c                          |    2 +-
 net/ipv4/netfilter/nft_dup_ipv4.c                  |    1 -
 net/ipv4/netfilter/nft_fib_ipv4.c                  |    2 -
 net/ipv4/netfilter/nft_reject_ipv4.c               |    1 -
 net/ipv4/nexthop.c                                 |    2 +-
 net/ipv4/raw.c                                     |   23 +-
 net/ipv4/tcp_bpf.c                                 |    2 +-
 net/ipv4/tcp_input.c                               |   56 +-
 net/ipv4/tcp_ipv4.c                                |   14 +-
 net/ipv4/tcp_minisocks.c                           |   12 +-
 net/ipv6/ila/ila_common.c                          |   12 +
 net/ipv6/ip6_gre.c                                 |    4 +-
 net/ipv6/netfilter/nft_dup_ipv6.c                  |    1 -
 net/ipv6/netfilter/nft_fib_ipv6.c                  |    2 -
 net/ipv6/netfilter/nft_reject_ipv6.c               |    1 -
 net/ipv6/raw.c                                     |    2 +-
 net/ipv6/route.c                                   |    4 +-
 net/ipv6/tcp_ipv6.c                                |    8 +-
 net/ipv6/xfrm6_policy.c                            |    1 +
 net/iucv/af_iucv.c                                 |   21 +-
 net/mac80211/cfg.c                                 |   11 +-
 net/mac80211/iface.c                               |    8 +-
 net/mac80211/link.c                                |    4 +
 net/mac80211/mlme.c                                |    6 +-
 net/mac80211/rx.c                                  |    2 +
 net/mac80211/sta_info.c                            |   15 +-
 net/mac802154/llsec.c                              |    5 +
 net/mac802154/scan.c                               |   11 +
 net/mctp/device.c                                  |    4 +-
 net/mpls/af_mpls.c                                 |    3 +
 net/mptcp/options.c                                |   12 +-
 net/mptcp/pm_userspace.c                           |    7 +-
 net/mptcp/protocol.c                               |    1 +
 net/netfilter/nf_conntrack_sip.c                   |   10 +-
 net/netfilter/nf_tables_api.c                      |  315 +----
 net/netfilter/nft_bitwise.c                        |  104 --
 net/netfilter/nft_byteorder.c                      |   11 -
 net/netfilter/nft_cmp.c                            |    3 -
 net/netfilter/nft_compat.c                         |   10 -
 net/netfilter/nft_connlimit.c                      |    1 -
 net/netfilter/nft_counter.c                        |   21 +-
 net/netfilter/nft_ct.c                             |   46 -
 net/netfilter/nft_dup_netdev.c                     |    1 -
 net/netfilter/nft_dynset.c                         |    1 -
 net/netfilter/nft_exthdr.c                         |   34 -
 net/netfilter/nft_fib.c                            |   51 +-
 net/netfilter/nft_fib_inet.c                       |    1 -
 net/netfilter/nft_fib_netdev.c                     |   30 +-
 net/netfilter/nft_flow_offload.c                   |    1 -
 net/netfilter/nft_fwd_netdev.c                     |    2 -
 net/netfilter/nft_hash.c                           |   36 -
 net/netfilter/nft_immediate.c                      |   12 -
 net/netfilter/nft_last.c                           |    1 -
 net/netfilter/nft_limit.c                          |    2 -
 net/netfilter/nft_log.c                            |    1 -
 net/netfilter/nft_lookup.c                         |   12 -
 net/netfilter/nft_masq.c                           |    3 -
 net/netfilter/nft_meta.c                           |   45 -
 net/netfilter/nft_nat.c                            |    2 -
 net/netfilter/nft_numgen.c                         |   22 -
 net/netfilter/nft_objref.c                         |    2 -
 net/netfilter/nft_osf.c                            |   25 -
 net/netfilter/nft_payload.c                        |   47 -
 net/netfilter/nft_queue.c                          |    2 -
 net/netfilter/nft_quota.c                          |   14 +-
 net/netfilter/nft_range.c                          |    1 -
 net/netfilter/nft_redir.c                          |    3 -
 net/netfilter/nft_reject_inet.c                    |    1 -
 net/netfilter/nft_reject_netdev.c                  |    1 -
 net/netfilter/nft_rt.c                             |    1 -
 net/netfilter/nft_socket.c                         |   26 -
 net/netfilter/nft_synproxy.c                       |    1 -
 net/netfilter/nft_tproxy.c                         |    1 -
 net/netfilter/nft_tunnel.c                         |   26 -
 net/netfilter/nft_xfrm.c                           |   27 -
 net/openvswitch/actions.c                          |   19 +-
 net/openvswitch/datapath.c                         |   25 +-
 net/openvswitch/datapath.h                         |    2 +-
 net/openvswitch/vport.c                            |    2 +-
 net/packet/af_packet.c                             |    6 +-
 net/phonet/pep.c                                   |    2 +
 net/qrtr/af_qrtr.c                                 |    8 +
 net/qrtr/ns.c                                      |    4 +-
 net/rds/recv.c                                     |   15 +
 net/rds/tcp.c                                      |    4 +-
 net/rxrpc/ar-internal.h                            |    6 +-
 net/sched/act_tunnel_key.c                         |   14 +-
 net/sctp/auth.c                                    |    2 +-
 net/sctp/protocol.c                                |   21 +-
 net/sctp/sm_make_chunk.c                           |    6 +
 net/sctp/sm_statefuns.c                            |    2 +-
 net/sctp/stream.c                                  |    6 +-
 net/sctp/sysctl.c                                  |    9 +-
 net/sunrpc/svcsock.c                               |   69 +-
 net/sunrpc/xdr.c                                   |  210 ++-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |    4 +
 net/sunrpc/xprtrdma/verbs.c                        |   12 +-
 net/tipc/netlink.c                                 |    6 +-
 net/tipc/netlink_compat.c                          |    4 +
 net/tipc/socket.c                                  |    1 +
 net/tls/tls_device.c                               |    6 +-
 net/vmw_vsock/virtio_transport_common.c            |  165 ++-
 net/wireless/core.c                                |    4 +-
 net/wireless/core.h                                |    2 +-
 net/wireless/nl80211.c                             |   22 +-
 net/wireless/pmsr.c                                |   29 +-
 net/wireless/scan.c                                |   13 +-
 net/x25/af_x25.c                                   |    8 +-
 net/xfrm/xfrm_device.c                             |   12 +-
 net/xfrm/xfrm_iptfs.c                              |    1 +
 net/xfrm/xfrm_policy.c                             |    4 +-
 net/xfrm/xfrm_state.c                              |    7 +-
 net/xfrm/xfrm_user.c                               |    3 +-
 rust/bindings/lib.rs                               |    4 +
 rust/kernel/device.rs                              |   16 +-
 rust/kernel/time.rs                                |   11 +-
 rust/uapi/lib.rs                                   |    4 +
 security/landlock/domain.c                         |    8 +-
 security/landlock/domain.h                         |    5 +-
 security/landlock/ruleset.c                        |    7 +-
 sound/core/seq/seq_timer.c                         |   13 +-
 sound/core/timer.c                                 |   21 +-
 sound/hda/codecs/hdmi/hdmi.c                       |    3 +
 sound/hda/codecs/hdmi/hdmi_local.h                 |    9 +
 sound/hda/codecs/hdmi/intelhdmi.c                  |   36 +-
 sound/hda/codecs/realtek/alc269.c                  |    9 +
 sound/hda/codecs/side-codecs/cs35l41_hda.c         |   11 +-
 sound/soc/amd/ps/pci-ps.c                          |   33 +-
 sound/soc/codecs/bt-sco.c                          |   10 +-
 sound/soc/codecs/cs35l56-i2c.c                     |    4 +-
 sound/soc/codecs/cs35l56-spi.c                     |    4 +-
 sound/soc/codecs/cs35l56.c                         |   25 +-
 sound/soc/codecs/cs42l43-jack.c                    |    3 +-
 sound/soc/codecs/tas2562.c                         |    5 +-
 sound/soc/codecs/tas2781-fmwlib.c                  |   63 +-
 sound/soc/fsl/fsl_sai.c                            |   29 +-
 sound/soc/fsl/imx-card.c                           |   12 +-
 sound/soc/meson/aiu-fifo-spdif.c                   |    5 +
 sound/soc/sunxi/sun4i-codec.c                      |    1 +
 sound/usb/quirks.c                                 |    2 +
 tools/objtool/check.c                              |    1 +
 tools/testing/cxl/Kbuild                           |    2 +-
 tools/testing/selftests/alsa/mixer-test.c          |    1 +
 .../testing/selftests/bpf/progs/verifier_ld_ind.c  |  142 +++
 .../testing/selftests/bpf/progs/verifier_map_ptr.c |   36 +-
 tools/testing/selftests/drivers/net/settings       |    1 +
 tools/testing/selftests/drivers/ntsync/config      |    2 +-
 tools/testing/selftests/ftrace/ftracetest          |    1 +
 tools/testing/selftests/net/af_unix/config         |    1 +
 tools/testing/selftests/net/openvswitch/config     |   16 +
 tools/testing/selftests/net/ovpn/config            |    2 +
 tools/testing/selftests/net/ovpn/ovpn-cli.c        |    4 +-
 tools/testing/selftests/net/ovpn/settings          |    1 +
 776 files changed, 10812 insertions(+), 6601 deletions(-)

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guixiong Wei <[email protected]>

commit 6b63520ed14b17bbe9c2103debbd2152dde1fba3 upstream.

When the last CPU of a legacy uncore die goes offline, uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug re-add, uncore_freq_add_entry() still populates sysfs attributes before assigning the new control CPU. As a result, the current frequency read returns -ENXIO and current_freq_khz is omitted from the recreated sysfs group.

Assign control_cpu before the initial read paths and before create_attr_group() so sysfs recreation uses the new online CPU. If sysfs creation fails, restore control_cpu to -1 to keep the error path state consistent.

---
 .../x86/intel/uncore-frequency/uncore-frequency-common.c   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 65897fae17dfba..6091b617480ff6 100644
@@ -274,15 +274,20 @@ int uncore_freq_add_entry(struct uncore_data *data, int cpu)
 		sprintf(data->name, "package_%02d_die_%02d", data->package_id, data->die_id);
 	}
 
+	/*
+	 * Set the control CPU before any read path so entry recreation after CPU
+	 * hotplug can populate read-only attributes from the new online CPU.
+	 */
+	data->control_cpu = cpu;
 	uncore_read(data, &data->initial_min_freq_khz, UNCORE_INDEX_MIN_FREQ);
 	uncore_read(data, &data->initial_max_freq_khz, UNCORE_INDEX_MAX_FREQ);
 
 	ret = create_attr_group(data, data->name);
 	if (ret) {
+		data->control_cpu = -1;
 		if (data->domain_id != UNCORE_DOMAIN_ID_INVALID)
 			ida_free(&intel_uncore_ida, data->instance_id);
 	} else {
-		data->control_cpu = cpu;
 		data->valid = true;
 	}
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.

Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types.

The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed.

This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side.

[ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack() NULL-on-failure convention. ]

---
 kernel/bpf/verifier.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

index d1c51d812f3b66..463455180a8e35 100644
@@ -17402,6 +17402,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
 	mark_reg_unknown(env, regs, BPF_REG_0);
 	/* ld_abs load up to 32-bit skb data. */
 	regs[BPF_REG_0].subreg_def = env->insn_idx + 1;
+	/*
+	 * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0
+	 * which must be explored by the verifier when in a subprog.
+	 */
+	if (env->cur_state->curframe) {
+		struct bpf_verifier_state *branch;
+
+		mark_reg_scratched(env, BPF_REG_0);
+		branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+		if (!branch)
+			return -EFAULT;
+		mark_reg_known_zero(env, regs, BPF_REG_0);
+		err = prepare_func_exit(env, &env->insn_idx);
+		if (err)
+			return err;
+		env->insn_idx--;
+	}
 	return 0;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

commit e0fcb42bc6f41bab2895757d6610616b3820eff7 upstream.

Extend the verifier_ld_ind BPF selftests with subprogs containing ld_{abs,ind} and craft the test in a way where the invalid register read is rejected in the fixed case. Also add a success case each, and add additional coverage related to the BTF return type enforcement.

# LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind [...]

  #611/1   verifier_ld_ind/ld_ind: check calling conv, r1:OK
  #611/2   verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK
  #611/3   verifier_ld_ind/ld_ind: check calling conv, r2:OK
  #611/4   verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK
  #611/5   verifier_ld_ind/ld_ind: check calling conv, r3:OK
  #611/6   verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK
  #611/7   verifier_ld_ind/ld_ind: check calling conv, r4:OK
  #611/8   verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK
  #611/9   verifier_ld_ind/ld_ind: check calling conv, r5:OK
  #611/10  verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK
  #611/11  verifier_ld_ind/ld_ind: check calling conv, r7:OK
  #611/12  verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK
  #611/13  verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK
  #611/14  verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK
  #611/15  verifier_ld_ind/ld_abs: subprog with both paths safe:OK
  #611/16  verifier_ld_ind/ld_ind: subprog with both paths safe:OK
  #611/17  verifier_ld_ind/ld_abs: reject void return subprog:OK
  #611/18  verifier_ld_ind/ld_ind: reject void return subprog:OK
  #611     verifier_ld_ind:OK

Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED

---
 .../selftests/bpf/progs/verifier_ld_ind.c     | 142 ++++++++++++++++++
 1 file changed, 142 insertions(+)

index c925ba9a2e74c2..09e81b99eecb4e 100644
@@ -107,4 +107,146 @@ __naked void ind_check_calling_conv_r7(void)
 	: __clobber_all);
 }
 
+/*
+ * ld_{abs,ind} subprog that always sets r0=1 on the success path.
+ * bpf_gen_ld_abs() emits a hidden exit with r0=0 when the load helper
+ * fails. The verifier must model this failure return so that callers
+ * account for r0=0 as a possible return value.
+ */
+__naked __noinline __used
+static int ldabs_subprog(void)
+{
+	asm volatile (
+	"r6 = r1;"
+	".8byte %[ld_abs];"
+	"r0 = 1;"
+	"exit;"
+	:
+	: __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+	: __clobber_all);
+}
+
+__naked __noinline __used
+static int ldind_subprog(void)
+{
+	asm volatile (
+	"r6 = r1;"
+	"r7 = 0;"
+	".8byte %[ld_ind];"
+	"r0 = 1;"
+	"exit;"
+	:
+	: __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog early exit on ld_abs failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_abs_subprog_early_exit(void)
+{
+	asm volatile (
+	"call ldabs_subprog;"
+	"if r0 != 0 goto l_exit_%=;"
+	"r0 = r9;"
+	"l_exit_%=:"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog early exit on ld_ind failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_ind_subprog_early_exit(void)
+{
+	asm volatile (
+	"call ldind_subprog;"
+	"if r0 != 0 goto l_exit_%=;"
+	"r0 = r9;"
+	"l_exit_%=:"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog with both paths safe")
+__success
+__naked void ld_abs_subprog_both_paths_safe(void)
+{
+	asm volatile (
+	"call ldabs_subprog;"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog with both paths safe")
+__success
+__naked void ld_ind_subprog_both_paths_safe(void)
+{
+	asm volatile (
+	"call ldind_subprog;"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
+/*
+ * ld_{abs,ind} in subprogs require scalar (int) return type in BTF.
+ * A test with void return must be rejected.
+ */
+__naked __noinline __used
+static void ldabs_void_subprog(void)
+{
+	asm volatile (
+	"r6 = r1;"
+	".8byte %[ld_abs];"
+	"r0 = 1;"
+	"exit;"
+	:
+	: __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_abs_void_subprog_reject(void)
+{
+	asm volatile (
+	"call ldabs_void_subprog;"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
+__naked __noinline __used
+static void ldind_void_subprog(void)
+{
+	asm volatile (
+	"r6 = r1;"
+	"r7 = 0;"
+	".8byte %[ld_ind];"
+	"r0 = 1;"
+	"exit;"
+	:
+	: __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_ind_void_subprog_reject(void)
+{
+	asm volatile (
+	"call ldind_void_subprog;"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Witte <[email protected]>

[ Upstream commit 779c60a5190c42689534172f4b49e927c9959e4e ]

Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values.

The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them.

A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.

---
 net/netfilter/nft_counter.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

index 0d70325280cc57..169ae93688bcc5 100644
@@ -32,6 +32,9 @@ struct nft_counter_percpu_priv {
 
 static DEFINE_PER_CPU(struct u64_stats_sync, nft_counter_sync);
 
+/* control plane only: sync fetch+reset */
+static DEFINE_SPINLOCK(nft_counter_lock);
+
 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv,
 				       struct nft_regs *regs,
 				       const struct nft_pktinfo *pkt)

@@ -148,13 +151,25 @@ static void nft_counter_fetch(struct nft_counter_percpu_priv *priv,
 	}
 }
 
+static void nft_counter_fetch_and_reset(struct nft_counter_percpu_priv *priv,
+					struct nft_counter_tot *total)
+{
+	spin_lock(&nft_counter_lock);
+	nft_counter_fetch(priv, total);
+	nft_counter_reset(priv, total);
+	spin_unlock(&nft_counter_lock);
+}
+
 static int nft_counter_do_dump(struct sk_buff *skb,
 			       struct nft_counter_percpu_priv *priv,
 			       bool reset)
 {
 	struct nft_counter_tot total;
 
-	nft_counter_fetch(priv, &total);
+	if (unlikely(reset))
+		nft_counter_fetch_and_reset(priv, &total);
+	else
+		nft_counter_fetch(priv, &total);
 
 	if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
 			 NFTA_COUNTER_PAD) ||

@@ -162,9 +177,6 @@ static int nft_counter_do_dump(struct sk_buff *skb,
 			 NFTA_COUNTER_PAD))
 		goto nla_put_failure;
 
-	if (reset)
-		nft_counter_reset(priv, &total);
-
 	return 0;
 
 nla_put_failure:

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Witte <[email protected]>

[ Upstream commit 30c4d7fb59ac4c8d7fa7937df11eed10b368fa11 ]

Use atomic64_xchg() to atomically read and zero the consumed value on reset, which is simpler than the previous read+sub pattern and doesn't require lock serialization.

---
 net/netfilter/nft_quota.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

index df0798da2329b9..cb6c0e04ff6755 100644
@@ -140,11 +140,16 @@ static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
 	u64 consumed, consumed_cap, quota;
 	u32 flags = priv->flags;
 
-	/* Since we inconditionally increment consumed quota for each packet
+	/* Since we unconditionally increment consumed quota for each packet
 	 * that we see, don't go over the quota boundary in what we send to
 	 * userspace.
 	 */
-	consumed = atomic64_read(priv->consumed);
+	if (reset) {
+		consumed = atomic64_xchg(priv->consumed, 0);
+		clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
+	} else {
+		consumed = atomic64_read(priv->consumed);
+	}
 	quota = atomic64_read(&priv->quota);
 	if (consumed >= quota) {
 		consumed_cap = quota;

@@ -160,10 +165,6 @@ static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
 	    nla_put_be32(skb, NFTA_QUOTA_FLAGS, htonl(flags)))
 		goto nla_put_failure;
 
-	if (reset) {
-		atomic64_sub(consumed, priv->consumed);
-		clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
-	}
 	return 0;
 
 nla_put_failure:

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Witte <[email protected]>

[ Upstream commit 7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc ]

It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same time.

Previous patches made it safe to run individual reset handlers concurrently so commit_mutex is no longer required to prevent this.

---
 net/netfilter/nf_tables_api.c | 248 ++++++----------------------------
 1 file changed, 42 insertions(+), 206 deletions(-)

index 0842916c19f503..c82c16bd4257e4 100644
@@ -3908,23 +3908,6 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
 	return skb->len;
 }
 
-static int nf_tables_dumpreset_rules(struct sk_buff *skb,
-				     struct netlink_callback *cb)
-{
-	struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk));
-	int ret;
-
-	/* Mutex is held is to prevent that two concurrent dump-and-reset calls
-	 * do not underrun counters and quotas. The commit_mutex is used for
-	 * the lack a better lock, this is not transaction path.
-	 */
-	mutex_lock(&nft_net->commit_mutex);
-	ret = nf_tables_dump_rules(skb, cb);
-	mutex_unlock(&nft_net->commit_mutex);
-
-	return ret;
-}
-
 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
 {
 	struct nft_rule_dump_ctx *ctx = (void *)cb->ctx;

@@ -3944,16 +3927,10 @@ static int nf_tables_dump_rules_start(struct netlink_callback *cb)
 			return -ENOMEM;
 		}
 	}
-	return 0;
-}
-
-static int nf_tables_dumpreset_rules_start(struct netlink_callback *cb)
-{
-	struct nft_rule_dump_ctx *ctx = (void *)cb->ctx;
-
-	ctx->reset = true;
+	if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+		ctx->reset = true;
 
-	return nf_tables_dump_rules_start(cb);
+	return 0;
 }
 
 static int nf_tables_dump_rules_done(struct netlink_callback *cb)

@@ -4019,6 +3996,8 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
 	u32 portid = NETLINK_CB(skb).portid;
 	struct net *net = info->net;
 	struct sk_buff *skb2;
+	bool reset = false;
+	char *buf;
 
 	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {

@@ -4032,47 +4011,16 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
 		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
 	}
 
-	skb2 = nf_tables_getrule_single(portid, info, nla, false);
-	if (IS_ERR(skb2))
-		return PTR_ERR(skb2);
-
-	return nfnetlink_unicast(skb2, net, portid);
-}
-
-static int nf_tables_getrule_reset(struct sk_buff *skb,
-				   const struct nfnl_info *info,
-				   const struct nlattr * const nla[])
-{
-	struct nftables_pernet *nft_net = nft_pernet(info->net);
-	u32 portid = NETLINK_CB(skb).portid;
-	struct net *net = info->net;
-	struct sk_buff *skb2;
-	char *buf;
-
-	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct netlink_dump_control c = {
-			.start= nf_tables_dumpreset_rules_start,
-			.dump = nf_tables_dumpreset_rules,
-			.done = nf_tables_dump_rules_done,
-			.module = THIS_MODULE,
-			.data = (void *)nla,
-		};
-
-		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
-	}
-
-	if (!try_module_get(THIS_MODULE))
-		return -EINVAL;
-	rcu_read_unlock();
-	mutex_lock(&nft_net->commit_mutex);
-	skb2 = nf_tables_getrule_single(portid, info, nla, true);
-	mutex_unlock(&nft_net->commit_mutex);
-	rcu_read_lock();
-	module_put(THIS_MODULE);
+	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+		reset = true;
 
+	skb2 = nf_tables_getrule_single(portid, info, nla, reset);
 	if (IS_ERR(skb2))
 		return PTR_ERR(skb2);
 
+	if (!reset)
+		return nfnetlink_unicast(skb2, net, portid);
+
 	buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
 			nla_len(nla[NFTA_RULE_TABLE]),
 			(char *)nla_data(nla[NFTA_RULE_TABLE]),

@@ -6332,6 +6280,10 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 	nla_nest_end(skb, nest);
 	nlmsg_end(skb, nlh);
 
+	if (dump_ctx->reset && args.iter.count > args.iter.skip)
+		audit_log_nft_set_reset(table, cb->seq,
+					args.iter.count - args.iter.skip);
+
 	rcu_read_unlock();
 
 	if (args.iter.err && args.iter.err != -EMSGSIZE)

@@ -6347,26 +6299,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 	return -ENOSPC;
 }
 
-static int nf_tables_dumpreset_set(struct sk_buff *skb,
-				   struct netlink_callback *cb)
-{
-	struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk));
-	struct nft_set_dump_ctx *dump_ctx = cb->data;
-	int ret, skip = cb->args[0];
-
-	mutex_lock(&nft_net->commit_mutex);
-
-	ret = nf_tables_dump_set(skb, cb);
-
-	if (cb->args[0] > skip)
-		audit_log_nft_set_reset(dump_ctx->ctx.table, cb->seq,
-					cb->args[0] - skip);
-
-	mutex_unlock(&nft_net->commit_mutex);
-
-	return ret;
-}
-
 static int nf_tables_dump_set_start(struct netlink_callback *cb)
 {
 	struct nft_set_dump_ctx *dump_ctx = cb->data;

@@ -6613,8 +6545,13 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
 {
 	struct netlink_ext_ack *extack = info->extack;
 	struct nft_set_dump_ctx dump_ctx;
+	int rem, err = 0, nelems = 0;
+	struct net *net = info->net;
 	struct nlattr *attr;
-	int rem, err = 0;
+	bool reset = false;
+
+	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETSETELEM_RESET)
+		reset = true;
 
 	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {

@@ -6624,7 +6561,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
 			.module = THIS_MODULE,
 		};
 
-		err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false);
+		err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, reset);
 		if (err)
 			return err;
 

@@ -6635,75 +6572,21 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
 	if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
 		return -EINVAL;
 
-	err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false);
+	err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, reset);
 	if (err)
 		return err;
 
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, false);
-		if (err < 0) {
-			NL_SET_BAD_ATTR(extack, attr);
-			break;
-		}
-	}
-
-	return err;
-}
-
-static int nf_tables_getsetelem_reset(struct sk_buff *skb,
-				      const struct nfnl_info *info,
-				      const struct nlattr * const nla[])
-{
-	struct nftables_pernet *nft_net = nft_pernet(info->net);
-	struct netlink_ext_ack *extack = info->extack;
-	struct nft_set_dump_ctx dump_ctx;
-	int rem, err = 0, nelems = 0;
-	struct nlattr *attr;
-
-	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct netlink_dump_control c = {
-			.start = nf_tables_dump_set_start,
-			.dump = nf_tables_dumpreset_set,
-			.done = nf_tables_dump_set_done,
-			.module = THIS_MODULE,
-		};
-
-		err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true);
-		if (err)
-			return err;
-
-		c.data = &dump_ctx;
-		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
-	}
-
-	if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
-		return -EINVAL;
-
-	if (!try_module_get(THIS_MODULE))
-		return -EINVAL;
-	rcu_read_unlock();
-	mutex_lock(&nft_net->commit_mutex);
-	rcu_read_lock();
-
-	err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true);
-	if (err)
-		goto out_unlock;
-
-	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, true);
+		err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, reset);
 		if (err < 0) {
 			NL_SET_BAD_ATTR(extack, attr);
 			break;
 		}
 		nelems++;
 	}
-	audit_log_nft_set_reset(dump_ctx.ctx.table, nft_base_seq(info->net), nelems);
-
-out_unlock:
-	rcu_read_unlock();
-	mutex_unlock(&nft_net->commit_mutex);
-	rcu_read_lock();
-	module_put(THIS_MODULE);
+	if (reset)
+		audit_log_nft_set_reset(dump_ctx.ctx.table, nft_base_seq(net),
+					nelems);
 
 	return err;
 }

@@ -8567,19 +8450,6 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
 	return skb->len;
 }
 
-static int nf_tables_dumpreset_obj(struct sk_buff *skb,
-				   struct netlink_callback *cb)
-{
-	struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk));
-	int ret;
-
-	mutex_lock(&nft_net->commit_mutex);
-	ret = nf_tables_dump_obj(skb, cb);
-	mutex_unlock(&nft_net->commit_mutex);
-
-	return ret;
-}
-
 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
 {
 	struct nft_obj_dump_ctx *ctx = (void *)cb->ctx;

@@ -8596,16 +8466,10 @@ static int nf_tables_dump_obj_start(struct netlink_callback *cb)
 	if (nla[NFTA_OBJ_TYPE])
 		ctx->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
 
-	return 0;
-}
-
-static int nf_tables_dumpreset_obj_start(struct netlink_callback *cb)
-{
-	struct nft_obj_dump_ctx *ctx = (void *)cb->ctx;
-
-	ctx->reset = true;
+	if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
+		ctx->reset = true;
 
-	return nf_tables_dump_obj_start(cb);
+	return 0;
 }
 
 static int nf_tables_dump_obj_done(struct netlink_callback *cb)

@@ -8667,42 +8531,16 @@ nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,
 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
 			    const struct nlattr * const nla[])
 {
-	u32 portid = NETLINK_CB(skb).portid;
-	struct sk_buff *skb2;
-
-	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct netlink_dump_control c = {
-			.start = nf_tables_dump_obj_start,
-			.dump = nf_tables_dump_obj,
-			.done = nf_tables_dump_obj_done,
-			.module = THIS_MODULE,
-			.data = (void *)nla,
-		};
-
-		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
-	}
-
-	skb2 = nf_tables_getobj_single(portid, info, nla, false);
-	if (IS_ERR(skb2))
-		return PTR_ERR(skb2);
-
-	return nfnetlink_unicast(skb2, info->net, portid);
-}
-
-static int nf_tables_getobj_reset(struct sk_buff *skb,
-				  const struct nfnl_info *info,
-				  const struct nlattr * const nla[])
-{
-	struct nftables_pernet *nft_net = nft_pernet(info->net);
 	u32 portid = NETLINK_CB(skb).portid;
 	struct net *net = info->net;
 	struct sk_buff *skb2;
+	bool reset = false;
 	char *buf;
 
 	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
-			.start = nf_tables_dumpreset_obj_start,
-			.dump = nf_tables_dumpreset_obj,
+			.start = nf_tables_dump_obj_start,
+			.dump = nf_tables_dump_obj,
 			.done = nf_tables_dump_obj_done,
 			.module = THIS_MODULE,
 			.data = (void *)nla,

@@ -8711,18 +8549,16 @@ static int nf_tables_getobj_reset(struct sk_buff *skb,
 		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
 	}
 
-	if (!try_module_get(THIS_MODULE))
-		return -EINVAL;
-	rcu_read_unlock();
-	mutex_lock(&nft_net->commit_mutex);
-	skb2 = nf_tables_getobj_single(portid, info, nla, true);
-	mutex_unlock(&nft_net->commit_mutex);
-	rcu_read_lock();
-	module_put(THIS_MODULE);
+	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
+		reset = true;
 
+	skb2 = nf_tables_getobj_single(portid, info, nla, reset);
 	if (IS_ERR(skb2))
 		return PTR_ERR(skb2);
 
+	if (!reset)
+		return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
 	buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
 			nla_len(nla[NFTA_OBJ_TABLE]),
 			(char *)nla_data(nla[NFTA_OBJ_TABLE]),

@@ -10030,7 +9866,7 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
 		.policy		= nft_rule_policy,
 	},
 	[NFT_MSG_GETRULE_RESET] = {
-		.call		= nf_tables_getrule_reset,
+		.call		= nf_tables_getrule,
 		.type		= NFNL_CB_RCU,
 		.attr_count	= NFTA_RULE_MAX,
 		.policy		= nft_rule_policy,

@@ -10084,7 +9920,7 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
 		.policy		= nft_set_elem_list_policy,
 	},
 	[NFT_MSG_GETSETELEM_RESET] = {
-		.call		= nf_tables_getsetelem_reset,
+		.call		= nf_tables_getsetelem,
 		.type		= NFNL_CB_RCU,
 		.attr_count	= NFTA_SET_ELEM_LIST_MAX,
 		.policy		= nft_set_elem_list_policy,

@@ -10130,7 +9966,7 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
 		.policy		= nft_obj_policy,
 	},
 	[NFT_MSG_GETOBJ_RESET] = {
-		.call		= nf_tables_getobj_reset,
+		.call		= nf_tables_getobj,
 		.type		= NFNL_CB_RCU,
 		.attr_count	= NFTA_OBJ_MAX,
 		.policy		= nft_obj_policy,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ryosuke Yasuoka <[email protected]>

[ Upstream commit d1b894c5bbb3fee0012bd14356286dc2384e8213 ]

A probe-time deadlock can occur between the dequeue worker and drm_client_register(). During probe, drm_client_register() holds clientlist_mutex and calls the fbdev hotplug callback, which triggers an atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs() waiting for virtqueue space. The dequeue worker that would free that space calls virtio_gpu_cmd_get_display_info_cb(), which invokes drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting to acquire the same clientlist_mutex. Since wake_up() is only called after the resp_cb loop, the probe thread is never woken and both threads deadlock.

Fix this by removing the hotplug notification from virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info) is still updated synchronously in the callback.

For the init path, drm_client_register() already fires an initial hotplug when the client is registered, which picks up the connector state updated by display_info_cb.

For the runtime config_changed path, add a wait_event_timeout() in config_changed_work_func() so that display_info_cb updates the connector data before the hotplug notification is sent. Also replace drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since virtio-gpu never calls drm_kms_helper_poll_init() and thus drm_helper_hpd_irq_event() always returns false without doing anything.

---
 drivers/gpu/drm/virtio/virtgpu_kms.c | 5 ++++-
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 3 ---
 2 files changed, 4 insertions(+), 4 deletions(-)

index 1c15cbf326b78c..4a25347734fda4 100644
@@ -48,7 +48,10 @@ static void virtio_gpu_config_changed_work_func(struct work_struct *work)
 				virtio_gpu_cmd_get_edids(vgdev);
 			virtio_gpu_cmd_get_display_info(vgdev);
 			virtio_gpu_notify(vgdev);
-			drm_helper_hpd_irq_event(vgdev->ddev);
+			wait_event_timeout(vgdev->resp_wq,
+					   !vgdev->display_info_pending,
+					   5 * HZ);
+			drm_kms_helper_hotplug_event(vgdev->ddev);
 		}
 		events_clear |= VIRTIO_GPU_EVENT_DISPLAY;
 	}

index 8181b22b9b46a1..412384e16daea4 100644
@@ -839,9 +839,6 @@ static void virtio_gpu_cmd_get_display_info_cb(struct virtio_gpu_device *vgdev,
 	vgdev->display_info_pending = false;
 	spin_unlock(&vgdev->display_info_lock);
 	wake_up(&vgdev->resp_wq);
-
-	if (!drm_helper_hpd_irq_event(vgdev->ddev))
-		drm_kms_helper_hotplug_event(vgdev->ddev);
 }
 
 static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kiryl Shutsemau <[email protected]>

commit 04718f7c9290f95385f0dd328758753dc1c36dec upstream.

Patch series "userfaultfd/pagemap: pre-existing fixes".

These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up to v5 [1]. Per review feedback that fixes should not sit in the middle of a feature series, they are split out and sent on their own; the RWP series is reposted rebased on top of this.

All six were flagged by the Sashiko AI review of the RWP series and carry

independent of RWP, apply to mm-new directly, and carry Cc: stable@.

1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in
make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates when PAGEMAP_SCAN write-protects a hugetlb PTE.

2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range
against HPAGE_SIZE rather than the hstate page size, so it never write-protects gigantic hugetlb pages.

3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an
unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole() calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb vma lock for read, and hugetlb_change_protection() then takes it for write. Install the marker inline instead.

4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp
on a device-private PMD permission downgrade, silently losing the uffd-wp marker.

5: userfaultfd: must_wait() applies pte_write() to a locklessly read
PTE without checking pte_present(), so swap/migration entries decode random offset bits and a thread can stay parked on a stale fault.

6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to
mk_vma_flags() unconditionally, an out-of-bounds write into the single-word vma_flags_t on 32-bit. Build the mask from config-gated per-mode masks so an unavailable bit is never materialised.

This patch (of 6):

make_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by calling huge_ptep_modify_prot_commit() with a ptent snapshot that was fetched without the corresponding huge_ptep_modify_prot_start(). The start helper is what atomically clears the entry so the kernel-owned snapshot stays consistent until the commit; without it, the hardware may set Dirty or Accessed in the live PTE between the original read and the commit, and huge_ptep_modify_prot_commit() (whose generic implementation just calls set_huge_pte_at()) then writes the stale snapshot back over the live hardware bits, losing the update.

The non-hugetlb sibling make_uffd_wp_pte() does this correctly via ptep_modify_prot_start() / ptep_modify_prot_commit(). Mirror that pattern for the present-PTE branch. The migration case stays as-is -- migration entries are non-present, so there's no hardware update to race against.

[ kas: adapt to the pre-softleaf idiom; apply the
huge_ptep_modify_prot_start()/commit() fix to the present-PTE (!huge_pte_none()) branch ]

---
 fs/proc/task_mmu.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

index 38b9d47426ca99..858b11009c269e 100644
@@ -2485,15 +2485,19 @@ static void make_uffd_wp_huge_pte(struct vm_area_struct *vma,
 
 	psize = huge_page_size(hstate_vma(vma));
 
-	if (is_hugetlb_entry_migration(ptent))
+	if (is_hugetlb_entry_migration(ptent)) {
 		set_huge_pte_at(vma->vm_mm, addr, ptep,
 				pte_swp_mkuffd_wp(ptent), psize);
-	else if (!huge_pte_none(ptent))
-		huge_ptep_modify_prot_commit(vma, addr, ptep, ptent,
-					     huge_pte_mkuffd_wp(ptent));
-	else
+	} else if (!huge_pte_none(ptent)) {
+		pte_t old_pte, new_pte;
+
+		old_pte = huge_ptep_modify_prot_start(vma, addr, ptep);
+		new_pte = huge_pte_mkuffd_wp(old_pte);
+		huge_ptep_modify_prot_commit(vma, addr, ptep, old_pte, new_pte);
+	} else {
 		set_huge_pte_at(vma->vm_mm, addr, ptep,
 				make_pte_marker(PTE_MARKER_UFFD_WP), psize);
+	}
 }
 #endif /* CONFIG_HUGETLB_PAGE */
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email protected]>

commit 90dfeef1cd38dff19f8b3a752d13bfd79f0f7694 upstream.

Arnd reported an x86 randconfig using gcc-15 tripped over __scoped_seqlock_bug(). Turns out GCC chose not to inline the scoped_seqlock helper functions and as such was not able to optimize properly.

[ mingo: Clang fails the build too in some circumstances. ]

---
 include/linux/seqlock.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1224,7 +1224,7 @@ struct ss_tmp {
 	spinlock_t	*lock_irqsave;
 };
 
-static inline void __scoped_seqlock_cleanup(struct ss_tmp *sst)
+static __always_inline void __scoped_seqlock_cleanup(struct ss_tmp *sst)
 {
 	if (sst->lock)
 		spin_unlock(sst->lock);

@@ -1249,7 +1249,7 @@ static inline void __scoped_seqlock_bug(
 extern void __scoped_seqlock_bug(void);
 #endif
 
-static inline void
+static __always_inline void
 __scoped_seqlock_next(struct ss_tmp *sst, seqlock_t *lock, enum ss_state target)
 {
 	switch (sst->state) {

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email protected]>

commit b94d45b6bbb42571ec225d3be0e7457c8765a5b4 upstream.

Some KASAN builds are failing to properly optimize this code -- luckily we don't care about core quality for KASAN builds, so just exclude it.

---
 include/linux/seqlock.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -1234,11 +1234,14 @@ static __always_inline void __scoped_seq
 
 extern void __scoped_seqlock_invalid_target(void);
 
-#if defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000
+#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN)
 /*
  * For some reason some GCC-8 architectures (nios2, alpha) have trouble
  * determining that the ss_done state is impossible in __scoped_seqlock_next()
  * below.
+ *
+ * Similarly KASAN is known to confuse compilers enough to break this. But we
+ * don't care about code quality for KASAN builds anyway.
  */
 static inline void __scoped_seqlock_bug(void) { }
 #else

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit 88331c4ec23a28c1006ec532fa64763d4c695e90 upstream.

With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to inline and optimize __scoped_seqlock_bug() away on s390:

s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next':
/.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug'

Fix this by adding UBSAN_ALIGNMENT to the list of config options where a not inlined empty __scoped_seqlock_bug() is allowed.

---
 include/linux/seqlock.h |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -1234,14 +1234,15 @@ static __always_inline void __scoped_seq
 
 extern void __scoped_seqlock_invalid_target(void);
 
-#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN)
+#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || \
+	defined(CONFIG_KASAN) || defined(CONFIG_UBSAN_ALIGNMENT)
 /*
  * For some reason some GCC-8 architectures (nios2, alpha) have trouble
  * determining that the ss_done state is impossible in __scoped_seqlock_next()
  * below.
  *
- * Similarly KASAN is known to confuse compilers enough to break this. But we
- * don't care about code quality for KASAN builds anyway.
+ * Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough
+ * to break this. But we don't care about code quality for such builds anyway.
  */
 static inline void __scoped_seqlock_bug(void) { }
 #else

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email protected]>

commit 2abd5287f08319fa35764566b15c6e22cb1068db upstream.

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

---
 arch/x86/kvm/mmu/mmu.c         |    9 +++++----
 arch/x86/kvm/mmu/paging_tmpl.h |   10 ++++++----
 2 files changed, 11 insertions(+), 8 deletions(-)

@@ -4806,16 +4806,17 @@ static int direct_page_fault(struct kvm_
 	if (r != RET_PF_CONTINUE)
 		return r;
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
 
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = direct_map(vcpu, fault);
 
 out_unlock:

@@ -827,15 +827,17 @@ static int FNAME(page_fault)(struct kvm_
 	}
 #endif
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
+
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = FNAME(fetch)(vcpu, fault, &walker);
 
 out_unlock:

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Venkatesh Srinivas <[email protected]>

commit e800decd9c0ac4349bcd8f8f9b29fd21fe93165e upstream.

On Intel platforms with a VMX preemption timer and APICv, if a VMM calls KVM_GET_LAPIC before KVM_GET_MSRS to save the vCPU state, it is possible to lose a pending timer interrupt.

If the thread running these ioctls is migrated to another core after calling KVM_GET_LAPIC but before KVM_GET_MSRS and the guest is using their LAPIC timer in TSC-deadline mode, not only does the save LAPIC state not carry the pending interrupt, the TSCDEADLINE MSR will be zeroed.

After migration across CPUs, KVM_GET_MSRS calls vcpu_load, posting the interrupt and clearing the MSR:
vcpu_load() ->
kvm_arch_vcpu_load() ->

    kvm_lapic_restart_hv_timer() ->
      start_hv_timer() ->
        apic_timer_expired() ->
          kvm_apic_inject_pending_timer_irqs()
            . post interrupt into the LAPIC state
            . clear IA32_TSCDEADLINE

The saved LAPIC state will be missing the pending interrupt and the saved MSR will be zero. Oops.

Fix by only posting an interrupt when we're attempting to enter the guest (vcpu->wants_to_run == true), not for vcpu_load from other paths.

Message-ID: <[email protected]>

---
 arch/x86/kvm/lapic.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2065,7 +2065,7 @@ static void apic_timer_expired(struct kv
 	if (apic_lvtt_tscdeadline(apic) || ktimer->hv_timer_in_use)
 		ktimer->expired_tscdeadline = ktimer->tscdeadline;
 
-	if (!from_timer_fn && apic->apicv_active) {
+	if (!from_timer_fn && apic->apicv_active && vcpu->wants_to_run) {
 		WARN_ON(kvm_get_running_vcpu() != vcpu);
 		kvm_apic_inject_pending_timer_irqs(apic);
 		return;

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hyunwoo Kim <[email protected]>

commit 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 upstream.

free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.

The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

---
 arch/x86/kvm/vmx/nested.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

@@ -333,6 +333,7 @@ static void nested_put_vmcs12_pages(stru
 static void free_nested(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	struct vmcs *shadow_vmcs;
 
 	if (WARN_ON_ONCE(vmx->loaded_vmcs != &vmx->vmcs01))
 		vmx_switch_vmcs(vcpu, &vmx->vmcs01);

@@ -350,9 +351,15 @@ static void free_nested(struct kvm_vcpu
 	vmx->nested.current_vmptr = INVALID_GPA;
 	if (enable_shadow_vmcs) {
 		vmx_disable_shadow_vmcs(vmx);
-		vmcs_clear(vmx->vmcs01.shadow_vmcs);
-		free_vmcs(vmx->vmcs01.shadow_vmcs);
+
+		/*
+		 * Keep the pointer visible until after VMCLEAR, so migration
+		 * can clear an active shadow VMCS on the old CPU.
+		 */
+		shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+		vmcs_clear(shadow_vmcs);
 		vmx->vmcs01.shadow_vmcs = NULL;
+		free_vmcs(shadow_vmcs);
 	}
 	kfree(vmx->nested.cached_vmcs12);
 	vmx->nested.cached_vmcs12 = NULL;

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Phil Rosenthal <[email protected]>

commit 52f2f7c30126037975389aa04d24c506a5177c35 upstream.

mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded.

If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free.

Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init():

1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.

KASAN reports:

  BUG: KASAN: slab-use-after-free in
  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
  ...
  kmem_cache_destroy+0x21/0x1d0
  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
  ...
  Allocated by task 16817:
  __kmem_cache_create_args+0x12c/0x3b0
  __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
  kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
  ...
  Freed by task 16820:
  kmem_cache_destroy+0x117/0x1d0
  kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]

Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe.

With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.

Message-ID: <[email protected]>

---
 arch/x86/kvm/mmu/mmu.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -7393,7 +7393,9 @@ void kvm_mmu_invalidate_mmio_sptes(struc
 static void mmu_destroy_caches(void)
 {
 	kmem_cache_destroy(pte_list_desc_cache);
+	pte_list_desc_cache = NULL;
 	kmem_cache_destroy(mmu_page_header_cache);
+	mmu_page_header_cache = NULL;
 }
 
 static void kvm_wake_nx_recovery_thread(struct kvm *kvm)

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit 749179c2e25b95d22499ed29096b3e02d6dfd2b4 upstream.

KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic.

Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock.

hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller.

Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent.

bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call.

Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx().

Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.

---
 net/can/bcm.c | 176 ++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 133 insertions(+), 43 deletions(-)

index a40519638a262b..cfc495106aac4d 100644
@@ -128,6 +128,7 @@ struct bcm_op {
 	struct sock *sk;
 	struct net_device *rx_reg_dev;
 	spinlock_t bcm_tx_lock; /* protect currframe/count in runtime updates */
+	spinlock_t bcm_rx_update_lock; /* protect filter/timer data updates */
 };
 
 struct bcm_sock {

@@ -292,21 +293,27 @@ static int bcm_proc_show(struct seq_file *m, void *v)
  * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
  *              of the given bcm tx op
  */
-static void bcm_can_tx(struct bcm_op *op)
+static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)
 {
 	struct sk_buff *skb;
 	struct net_device *dev;
-	struct canfd_frame *cf;
+	struct canfd_frame cframe;
+	bool cyclic = !cf;
+	unsigned int idx = 0;
 	int err;
 
 	/* no target device? => exit */
 	if (!op->ifindex)
 		return;
 
-	/* read currframe under lock protection */
-	spin_lock_bh(&op->bcm_tx_lock);
-	cf = op->frames + op->cfsiz * op->currframe;
-	spin_unlock_bh(&op->bcm_tx_lock);
+	if (cyclic) {
+		/* read currframe under lock protection */
+		spin_lock_bh(&op->bcm_tx_lock);
+		idx = op->currframe;
+		memcpy(&cframe, op->frames + op->cfsiz * idx, op->cfsiz);
+		cf = &cframe;
+		spin_unlock_bh(&op->bcm_tx_lock);
+	}
 
 	dev = dev_get_by_index(sock_net(op->sk), op->ifindex);
 	if (!dev) {

@@ -335,14 +342,20 @@ static void bcm_can_tx(struct bcm_op *op)
 	if (!err)
 		op->frames_abs++;
 
-	op->currframe++;
+	/* only advance the cyclic sequence if nothing reset currframe while
+	 * we were sending - a concurrent TX_RESET_MULTI_IDX means this
+	 * frame's bookkeeping belongs to a sequence that no longer exists
+	 */
+	if (!cyclic || op->currframe == idx) {
+		op->currframe++;
 
-	/* reached last frame? */
-	if (op->currframe >= op->nframes)
-		op->currframe = 0;
+		/* reached last frame? */
+		if (op->currframe >= op->nframes)
+			op->currframe = 0;
 
-	if (op->count > 0)
-		op->count--;
+		if (op->count > 0)
+			op->count--;
+	}
 
 	spin_unlock_bh(&op->bcm_tx_lock);
 out:

@@ -456,7 +469,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
 	struct bcm_msg_head msg_head;
 
 	if (op->kt_ival1 && (op->count > 0)) {
-		bcm_can_tx(op);
+		bcm_can_tx(op, NULL);
 		if (!op->count && (op->flags & TX_COUNTEVT)) {
 
 			/* create notification to user */

@@ -473,7 +486,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
 		}
 
 	} else if (op->kt_ival2) {
-		bcm_can_tx(op);
+		bcm_can_tx(op, NULL);
 	}
 
 	return bcm_tx_set_expiry(op, &op->timer) ?

@@ -617,6 +630,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
 	struct bcm_msg_head msg_head;
 
+	spin_lock_bh(&op->bcm_rx_update_lock);
+
 	/* if user wants to be informed, when cyclic CAN-Messages come back */
 	if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
 		/* clear received CAN frames to indicate 'nothing received' */

@@ -633,6 +648,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
 	msg_head.can_id  = op->can_id;
 	msg_head.nframes = 0;
 
+	spin_unlock_bh(&op->bcm_rx_update_lock);
+
 	bcm_send_to_user(op, &msg_head, NULL, 0);
 
 	return HRTIMER_NORESTART;

@@ -681,15 +698,26 @@ static int bcm_rx_thr_flush(struct bcm_op *op)
 static enum hrtimer_restart bcm_rx_thr_handler(struct hrtimer *hrtimer)
 {
 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer);
+	enum hrtimer_restart ret;
 
-	if (bcm_rx_thr_flush(op)) {
+	spin_lock_bh(&op->bcm_rx_update_lock);
+
+	/* kt_ival2 may have been concurrently cleared by bcm_rx_setup()
+	 * before it cancels this timer - never forward with a zero
+	 * interval in that case.
+	 */
+	if (bcm_rx_thr_flush(op) && op->kt_ival2) {
 		hrtimer_forward_now(hrtimer, op->kt_ival2);
-		return HRTIMER_RESTART;
+		ret = HRTIMER_RESTART;
 	} else {
 		/* rearm throttle handling */
 		op->kt_lastmsg = 0;
-		return HRTIMER_NORESTART;
+		ret = HRTIMER_NORESTART;
 	}
+
+	spin_unlock_bh(&op->bcm_rx_update_lock);
+
+	return ret;
 }
 
 /*

@@ -699,8 +727,10 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 {
 	struct bcm_op *op = (struct bcm_op *)data;
 	const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data;
+	struct canfd_frame rtrframe;
 	unsigned int i;
 	unsigned char traffic_flags;
+	bool rtr_frame;
 
 	if (op->can_id != rxframe->can_id)
 		return;

@@ -724,9 +754,18 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 	/* update statistics */
 	op->frames_abs++;
 
-	if (op->flags & RX_RTR_FRAME) {
+	/* snapshot the flag under lock: op->flags/op->frames may be updated
+	 * concurrently by bcm_rx_setup().
+	 */
+	spin_lock_bh(&op->bcm_rx_update_lock);
+	rtr_frame = op->flags & RX_RTR_FRAME;
+	if (rtr_frame)
+		memcpy(&rtrframe, op->frames, op->cfsiz);
+	spin_unlock_bh(&op->bcm_rx_update_lock);
+
+	if (rtr_frame) {
 		/* send reply for RTR-request (placed in op->frames[0]) */
-		bcm_can_tx(op);
+		bcm_can_tx(op, &rtrframe);
 		return;
 	}
 

@@ -738,6 +777,8 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 			traffic_flags |= RX_OWN;
 	}
 
+	spin_lock_bh(&op->bcm_rx_update_lock);
+
 	if (op->flags & RX_FILTER_ID) {
 		/* the easiest case */
 		bcm_rx_update_and_send(op, op->last_frames, rxframe,

@@ -773,6 +814,8 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 
 rx_starttimer:
 	bcm_rx_starttimer(op);
+
+	spin_unlock_bh(&op->bcm_rx_update_lock);
 }
 
 /*

@@ -1115,7 +1158,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		list_add_rcu(&op->list, &bo->tx_ops);
 
 	if (op->flags & TX_ANNOUNCE)
-		bcm_can_tx(op);
+		bcm_can_tx(op, NULL);
 
 	if (op->flags & STARTTIMER)
 		bcm_tx_start_timer(op);

@@ -1129,6 +1172,24 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	return err;
 }
 
+static void bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
+				   struct bcm_op *op, void *new_frames)
+{
+	/* funny feature in RX(!)_SETUP only for RTR-mode:
+	 * copy can_id into frame BUT without RTR-flag to
+	 * prevent a full-load-loopback-test ... ;-]
+	 * normalize this on the staged buffer, before it is
+	 * ever installed into op->frames.
+	 */
+	if (msg_head->flags & RX_RTR_FRAME) {
+		struct canfd_frame *frame0 = new_frames;
+
+		if ((msg_head->flags & TX_CP_CAN_ID) ||
+		    frame0->can_id == op->can_id)
+			frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
+	}
+}
+
 /*
  * bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg)
  */

@@ -1163,6 +1224,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	/* check the given can_id */
 	op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
 	if (op) {
+		void *new_frames = NULL;
+
 		/* update existing BCM operation */
 
 		/*

@@ -1174,19 +1237,48 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 			return -E2BIG;
 
 		if (msg_head->nframes) {
-			/* update CAN frames content */
-			err = memcpy_from_msg(op->frames, msg,
+			/* get new CAN frames content before locking */
+			new_frames = kmalloc(msg_head->nframes * op->cfsiz,
+					     GFP_KERNEL);
+			if (!new_frames)
+				return -ENOMEM;
+
+			err = memcpy_from_msg(new_frames, msg,
 					      msg_head->nframes * op->cfsiz);
-			if (err < 0)
+			if (err < 0) {
+				kfree(new_frames);
 				return err;
+			}
 
-			/* clear last_frames to indicate 'nothing received' */
-			memset(op->last_frames, 0, msg_head->nframes * op->cfsiz);
+			bcm_rx_setup_rtr_check(msg_head, op, new_frames);
 		}
 
+		spin_lock_bh(&op->bcm_rx_update_lock);
 		op->nframes = msg_head->nframes;
 		op->flags = msg_head->flags;
 
+		if (msg_head->nframes) {
+			/* update CAN frames content */
+			memcpy(op->frames, new_frames,
+			       msg_head->nframes * op->cfsiz);
+
+			/* clear last_frames to indicate 'nothing received' */
+			memset(op->last_frames, 0,
+			       msg_head->nframes * op->cfsiz);
+		}
+
+		if (msg_head->flags & SETTIMER) {
+			op->ival1 = msg_head->ival1;
+			op->ival2 = msg_head->ival2;
+			op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
+			op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+			op->kt_lastmsg = 0;
+		}
+		spin_unlock_bh(&op->bcm_rx_update_lock);
+
+		/* free temporary frames / kfree(NULL) is safe */
+		kfree(new_frames);
+
 		/* Only an update -> do not call can_rx_register() */
 		do_rx_register = 0;
 

@@ -1197,6 +1289,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 			return -ENOMEM;
 
 		spin_lock_init(&op->bcm_tx_lock);
+		spin_lock_init(&op->bcm_rx_update_lock);
 		op->can_id = msg_head->can_id;
 		op->nframes = msg_head->nframes;
 		op->cfsiz = CFSIZ(msg_head->flags);

@@ -1238,6 +1331,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 				kfree(op);
 				return err;
 			}
+
+			bcm_rx_setup_rtr_check(msg_head, op, op->frames);
 		}
 
 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */

@@ -1262,29 +1357,22 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	/* check flags */
 
 	if (op->flags & RX_RTR_FRAME) {
-		struct canfd_frame *frame0 = op->frames;
-
 		/* no timers in RTR-mode */
 		hrtimer_cancel(&op->thrtimer);
 		hrtimer_cancel(&op->timer);
-
-		/*
-		 * funny feature in RX(!)_SETUP only for RTR-mode:
-		 * copy can_id into frame BUT without RTR-flag to
-		 * prevent a full-load-loopback-test ... ;-]
-		 */
-		if ((op->flags & TX_CP_CAN_ID) ||
-		    (frame0->can_id == op->can_id))
-			frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
-
 	} else {
 		if (op->flags & SETTIMER) {
 
-			/* set timer value */
-			op->ival1 = msg_head->ival1;
-			op->ival2 = msg_head->ival2;
-			op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
-			op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+			/* set timers (locked) for newly created op */
+			if (do_rx_register) {
+				spin_lock_bh(&op->bcm_rx_update_lock);
+				op->ival1 = msg_head->ival1;
+				op->ival2 = msg_head->ival2;
+				op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
+				op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+				op->kt_lastmsg = 0;
+				spin_unlock_bh(&op->bcm_rx_update_lock);
+			}
 
 			/* disable an active timer due to zero value? */
 			if (!op->kt_ival1)

@@ -1294,9 +1382,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 			 * In any case cancel the throttle timer, flush
 			 * potentially blocked msgs and reset throttle handling
 			 */
-			op->kt_lastmsg = 0;
 			hrtimer_cancel(&op->thrtimer);
+
+			spin_lock_bh(&op->bcm_rx_update_lock);
 			bcm_rx_thr_flush(op);
+			spin_unlock_bh(&op->bcm_rx_update_lock);
 		}
 
 		if ((op->flags & STARTTIMER) && op->kt_ival1)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 upstream.

KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs.

Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint.

Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow.

As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths.

The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.

---
 net/can/bcm.c | 69 ++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 46 insertions(+), 23 deletions(-)

index cfc495106aac4d..1d4323cdf48a47 100644
@@ -111,7 +111,7 @@ struct bcm_op {
 	int ifindex;
 	canid_t can_id;
 	u32 flags;
-	unsigned long frames_abs, frames_filtered;
+	atomic_long_t frames_abs, frames_filtered;
 	struct bcm_timeval ival1, ival2;
 	struct hrtimer timer, thrtimer;
 	ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;

@@ -228,10 +228,13 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 
 	list_for_each_entry_rcu(op, &bo->rx_ops, list) {
 
-		unsigned long reduction;
+		long reduction, frames_filtered, frames_abs;
+
+		frames_filtered = atomic_long_read(&op->frames_filtered);
+		frames_abs = atomic_long_read(&op->frames_abs);
 
 		/* print only active entries & prevent division by zero */
-		if (!op->frames_abs)
+		if (!frames_abs)
 			continue;
 
 		seq_printf(m, "rx_op: %03X %-5s ", op->can_id,

@@ -253,9 +256,9 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 				   (long long)ktime_to_us(op->kt_ival2));
 
 		seq_printf(m, "# recv %ld (%ld) => reduction: ",
-			   op->frames_filtered, op->frames_abs);
+			   frames_filtered, frames_abs);
 
-		reduction = 100 - (op->frames_filtered * 100) / op->frames_abs;
+		reduction = 100 - (frames_filtered * 100) / frames_abs;
 
 		seq_printf(m, "%s%ld%%\n",
 			   (reduction == 100) ? "near " : "", reduction);

@@ -279,7 +282,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 			seq_printf(m, "t2=%lld ",
 				   (long long)ktime_to_us(op->kt_ival2));
 
-		seq_printf(m, "# sent %ld\n", op->frames_abs);
+		seq_printf(m, "# sent %ld\n",
+			   atomic_long_read(&op->frames_abs));
 	}
 	seq_putc(m, '\n');
 

@@ -289,6 +293,24 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 }
 #endif /* CONFIG_PROC_FS */
 
+static void bcm_update_rx_stats(struct bcm_op *op)
+{
+	/* prevent overflow of the reduction% calculation in bcm_proc_show() */
+	if (atomic_long_inc_return(&op->frames_abs) > LONG_MAX / 100) {
+		atomic_long_set(&op->frames_filtered, 0);
+		atomic_long_set(&op->frames_abs, 0);
+	}
+}
+
+static void bcm_update_tx_stats(struct bcm_op *op)
+{
+	/* tx_op has no reduction% calculation - use the full range and
+	 * just keep the displayed counter non-negative on overflow
+	 */
+	if (atomic_long_inc_return(&op->frames_abs) == LONG_MAX)
+		atomic_long_set(&op->frames_abs, 0);
+}
+
 /*
  * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
  *              of the given bcm tx op

@@ -340,7 +362,7 @@ static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)
 	spin_lock_bh(&op->bcm_tx_lock);
 
 	if (!err)
-		op->frames_abs++;
+		bcm_update_tx_stats(op);
 
 	/* only advance the cyclic sequence if nothing reset currframe while
 	 * we were sending - a concurrent TX_RESET_MULTI_IDX means this

@@ -500,12 +522,9 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data)
 {
 	struct bcm_msg_head head;
 
-	/* update statistics */
-	op->frames_filtered++;
-
-	/* prevent statistics overflow */
-	if (op->frames_filtered > ULONG_MAX/100)
-		op->frames_filtered = op->frames_abs = 0;
+	/* update statistics (frames_filtered <= frames_abs) */
+	if (atomic_long_read(&op->frames_abs))
+		atomic_long_inc(&op->frames_filtered);
 
 	/* this element is not throttled anymore */
 	data->flags &= ~RX_THR;

@@ -751,24 +770,30 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 	op->rx_stamp = skb->tstamp;
 	/* save originator for recvfrom() */
 	op->rx_ifindex = skb->dev->ifindex;
-	/* update statistics */
-	op->frames_abs++;
 
-	/* snapshot the flag under lock: op->flags/op->frames may be updated
-	 * concurrently by bcm_rx_setup().
-	 */
+	/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */
 	spin_lock_bh(&op->bcm_rx_update_lock);
+
 	rtr_frame = op->flags & RX_RTR_FRAME;
-	if (rtr_frame)
+	if (rtr_frame) {
+		bcm_update_rx_stats(op);
+		/* snapshot RTR content under lock */
 		memcpy(&rtrframe, op->frames, op->cfsiz);
-	spin_unlock_bh(&op->bcm_rx_update_lock);
+		spin_unlock_bh(&op->bcm_rx_update_lock);
 
-	if (rtr_frame) {
 		/* send reply for RTR-request (placed in op->frames[0]) */
 		bcm_can_tx(op, &rtrframe);
 		return;
 	}
 
+	/* update statistics in the same critical section as bcm_rx_changed()
+	 * below: frames_filtered must never be checked/incremented against a
+	 * frames_abs snapshot from a concurrent bcm_rx_handler() call on
+	 * another CPU for the same (wildcard) op, or frames_filtered can end
+	 * up larger than frames_abs.
+	 */
+	bcm_update_rx_stats(op);
+
 	/* compute flags to distinguish between own/local/remote CAN traffic */
 	traffic_flags = 0;
 	if (skb->sk) {

@@ -777,8 +802,6 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 			traffic_flags |= RX_OWN;
 	}
 
-	spin_lock_bh(&op->bcm_rx_update_lock);
-
 	if (op->flags & RX_FILTER_ID) {
 		/* the easiest case */
 		bcm_rx_update_and_send(op, op->last_frames, rxframe,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc upstream.

Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.

---
 net/can/bcm.c | 104 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 75 insertions(+), 29 deletions(-)

index 1d4323cdf48a47..d7f91afda3c85d 100644
@@ -127,7 +127,7 @@ struct bcm_op {
 	struct canfd_frame last_sframe;
 	struct sock *sk;
 	struct net_device *rx_reg_dev;
-	spinlock_t bcm_tx_lock; /* protect currframe/count in runtime updates */
+	spinlock_t bcm_tx_lock; /* protect tx data and timer updates */
 	spinlock_t bcm_rx_update_lock; /* protect filter/timer data updates */
 };
 

@@ -467,12 +467,18 @@ static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt)
 {
 	ktime_t ival;
 
+	spin_lock_bh(&op->bcm_tx_lock);
+
 	if (op->kt_ival1 && op->count)
 		ival = op->kt_ival1;
-	else if (op->kt_ival2)
+	else if (op->kt_ival2) {
 		ival = op->kt_ival2;
-	else
+	} else {
+		spin_unlock_bh(&op->bcm_tx_lock);
 		return false;
+	}
+
+	spin_unlock_bh(&op->bcm_tx_lock);
 
 	hrtimer_set_expires(hrt, ktime_add(ktime_get(), ival));
 	return true;

@@ -489,25 +495,47 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
 {
 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
 	struct bcm_msg_head msg_head;
+	bool tx_ival1, tx_ival2;
+
+	/* snapshot kt_ival1/kt_ival2/count under lock to avoid torn
+	 * ktime_t reads racing with concurrent bcm_tx_setup() updates
+	 */
+	spin_lock_bh(&op->bcm_tx_lock);
+	tx_ival1 = op->kt_ival1 && (op->count > 0);
+	tx_ival2 = !!op->kt_ival2;
+	spin_unlock_bh(&op->bcm_tx_lock);
+
+	if (tx_ival1) {
+		u32 flags, count;
+		struct bcm_timeval ival1, ival2;
 
-	if (op->kt_ival1 && (op->count > 0)) {
 		bcm_can_tx(op, NULL);
-		if (!op->count && (op->flags & TX_COUNTEVT)) {
 
+		/* snapshot variables under lock to avoid torn reads racing
+		 * with concurrent bcm_tx_setup() updates
+		 */
+		spin_lock_bh(&op->bcm_tx_lock);
+		flags = op->flags;
+		count = op->count;
+		ival1 = op->ival1;
+		ival2 = op->ival2;
+		spin_unlock_bh(&op->bcm_tx_lock);
+
+		if (!count && (flags & TX_COUNTEVT)) {
 			/* create notification to user */
 			memset(&msg_head, 0, sizeof(msg_head));
 			msg_head.opcode  = TX_EXPIRED;
-			msg_head.flags   = op->flags;
-			msg_head.count   = op->count;
-			msg_head.ival1   = op->ival1;
-			msg_head.ival2   = op->ival2;
+			msg_head.flags   = flags;
+			msg_head.count   = count;
+			msg_head.ival1   = ival1;
+			msg_head.ival2   = ival2;
 			msg_head.can_id  = op->can_id;
 			msg_head.nframes = 0;
 
 			bcm_send_to_user(op, &msg_head, NULL, 0);
 		}
 
-	} else if (op->kt_ival2) {
+	} else if (tx_ival2) {
 		bcm_can_tx(op, NULL);
 	}
 

@@ -1031,6 +1059,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	/* check the given can_id */
 	op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
 	if (op) {
+		void *new_frames;
+
 		/* update existing BCM operation */
 
 		/*

@@ -1041,11 +1071,23 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		if (msg_head->nframes > op->nframes)
 			return -E2BIG;
 
-		/* update CAN frames content */
+		/* get new CAN frames content into a staging buffer before
+		 * locking: validate and normalize the frames there so that
+		 * bcm_can_tx() / bcm_tx_timeout_handler() never observe a
+		 * partially updated or unvalidated frame in op->frames
+		 */
+		new_frames = kmalloc(msg_head->nframes * op->cfsiz, GFP_KERNEL);
+		if (!new_frames)
+			return -ENOMEM;
+
 		for (i = 0; i < msg_head->nframes; i++) {
 
-			cf = op->frames + op->cfsiz * i;
+			cf = new_frames + op->cfsiz * i;
 			err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
+			if (err < 0) {
+				kfree(new_frames);
+				return err;
+			}
 
 			if (op->flags & CAN_FD_FRAME) {
 				if (cf->len > 64)

@@ -1055,36 +1097,38 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 					err = -EINVAL;
 			}
 
-			if (err < 0)
+			if (err < 0) {
+				kfree(new_frames);
 				return err;
+			}
 
 			if (msg_head->flags & TX_CP_CAN_ID) {
 				/* copy can_id into frame */
 				cf->can_id = msg_head->can_id;
 			}
 		}
+
+		spin_lock_bh(&op->bcm_tx_lock);
+
+		/* update CAN frames content */
+		memcpy(op->frames, new_frames, msg_head->nframes * op->cfsiz);
+
 		op->flags = msg_head->flags;
 
-		/* only lock for unlikely count/nframes/currframe changes */
 		if (op->nframes != msg_head->nframes ||
-		    op->flags & TX_RESET_MULTI_IDX ||
-		    op->flags & SETTIMER) {
-
-			spin_lock_bh(&op->bcm_tx_lock);
+		    op->flags & TX_RESET_MULTI_IDX) {
+			/* potentially update changed nframes */
+			op->nframes = msg_head->nframes;
+			/* restart multiple frame transmission */
+			op->currframe = 0;
+		}
 
-			if (op->nframes != msg_head->nframes ||
-			    op->flags & TX_RESET_MULTI_IDX) {
-				/* potentially update changed nframes */
-				op->nframes = msg_head->nframes;
-				/* restart multiple frame transmission */
-				op->currframe = 0;
-			}
+		if (op->flags & SETTIMER)
+			op->count = msg_head->count;
 
-			if (op->flags & SETTIMER)
-				op->count = msg_head->count;
+		spin_unlock_bh(&op->bcm_tx_lock);
 
-			spin_unlock_bh(&op->bcm_tx_lock);
-		}
+		kfree(new_frames);
 
 	} else {
 		/* insert new BCM operation for the given can_id */

@@ -1160,10 +1204,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
 	if (op->flags & SETTIMER) {
 		/* set timer values */
+		spin_lock_bh(&op->bcm_tx_lock);
 		op->ival1 = msg_head->ival1;
 		op->ival2 = msg_head->ival2;
 		op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
 		op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+		spin_unlock_bh(&op->bcm_tx_lock);
 
 		/* disable an active timer due to zero values? */
 		if (!op->kt_ival1 && !op->kt_ival2)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit 62ec41f364648be79d54d94d0d240ee326948afd upstream.

bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.

---
 net/can/bcm.c | 59 +++++++++++++++++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 18 deletions(-)

index d7f91afda3c85d..2de64d7a99a216 100644
@@ -1241,22 +1241,37 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	return err;
 }
 
-static void bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
-				   struct bcm_op *op, void *new_frames)
+static int bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
+				  struct bcm_op *op, void *new_frames)
 {
+	struct canfd_frame *frame0 = new_frames;
+
+	if (!(msg_head->flags & RX_RTR_FRAME))
+		return 0;
+
+	/* this frame is sent out as-is by bcm_can_tx() whenever a matching
+	 * remote request is received, so validate its length the same way
+	 * bcm_tx_setup() validates TX_SETUP frames before installing it
+	 */
+	if (msg_head->flags & CAN_FD_FRAME) {
+		if (frame0->len > 64)
+			return -EINVAL;
+	} else {
+		if (frame0->len > 8)
+			return -EINVAL;
+	}
+
 	/* funny feature in RX(!)_SETUP only for RTR-mode:
 	 * copy can_id into frame BUT without RTR-flag to
 	 * prevent a full-load-loopback-test ... ;-]
 	 * normalize this on the staged buffer, before it is
 	 * ever installed into op->frames.
 	 */
-	if (msg_head->flags & RX_RTR_FRAME) {
-		struct canfd_frame *frame0 = new_frames;
+	if ((msg_head->flags & TX_CP_CAN_ID) ||
+	    frame0->can_id == op->can_id)
+		frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
 
-		if ((msg_head->flags & TX_CP_CAN_ID) ||
-		    frame0->can_id == op->can_id)
-			frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
-	}
+	return 0;
 }
 
 /*

@@ -1319,7 +1334,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 				return err;
 			}
 
-			bcm_rx_setup_rtr_check(msg_head, op, new_frames);
+			err = bcm_rx_setup_rtr_check(msg_head, op, new_frames);
+			if (err < 0) {
+				kfree(new_frames);
+				return err;
+			}
 		}
 
 		spin_lock_bh(&op->bcm_rx_update_lock);

@@ -1392,16 +1411,12 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		if (msg_head->nframes) {
 			err = memcpy_from_msg(op->frames, msg,
 					      msg_head->nframes * op->cfsiz);
-			if (err < 0) {
-				if (op->frames != &op->sframe)
-					kfree(op->frames);
-				if (op->last_frames != &op->last_sframe)
-					kfree(op->last_frames);
-				kfree(op);
-				return err;
-			}
+			if (err < 0)
+				goto free_op;
 
-			bcm_rx_setup_rtr_check(msg_head, op, op->frames);
+			err = bcm_rx_setup_rtr_check(msg_head, op, op->frames);
+			if (err < 0)
+				goto free_op;
 		}
 
 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */

@@ -1500,6 +1515,14 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	}
 
 	return msg_head->nframes * op->cfsiz + MHSIZ;
+
+free_op:
+	if (op->frames != &op->sframe)
+		kfree(op->frames);
+	if (op->last_frames != &op->last_sframe)
+		kfree(op->last_frames);
+	kfree(op);
+	return err;
 }
 
 /*

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit d59948293ea34b6337ce2b5febab8510de70048c upstream.

sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.

bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.

Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.

---
 net/can/bcm.c | 44 ++++++++++++++++++++++++--------------------
 1 file changed, 24 insertions(+), 20 deletions(-)

index 2de64d7a99a216..ca0dd2229f5b86 100644
@@ -932,6 +932,7 @@ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
 
 		/* mark as removed subscription */
 		op->rx_reg_dev = NULL;
+		dev_put(dev);
 	} else
 		printk(KERN_ERR "can-bcm: bcm_rx_unreg: registered device "
 		       "mismatch %p %p\n", op->rx_reg_dev, dev);

@@ -962,17 +963,14 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
 				 * Only remove subscriptions that had not
 				 * been removed due to NETDEV_UNREGISTER
 				 * in bcm_notifier()
+				 *
+				 * op->rx_reg_dev is a tracked reference taken
+				 * when the subscription was registered, so it
+				 * stays valid here even if a concurrent
+				 * NETDEV_UNREGISTER already unlisted the dev.
 				 */
-				if (op->rx_reg_dev) {
-					struct net_device *dev;
-
-					dev = dev_get_by_index(sock_net(op->sk),
-							       op->ifindex);
-					if (dev) {
-						bcm_rx_unreg(dev, op);
-						dev_put(dev);
-					}
-				}
+				if (op->rx_reg_dev)
+					bcm_rx_unreg(op->rx_reg_dev, op);
 			} else
 				can_rx_unregister(sock_net(op->sk), NULL,
 						  op->can_id,

@@ -1491,7 +1489,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 						      bcm_rx_handler, op,
 						      "bcm", sk);
 
-				op->rx_reg_dev = dev;
+				/* keep a reference so that a later
+				 * unregister can safely reach the device even
+				 * if a concurrent NETDEV_UNREGISTER has
+				 * already unlisted it by ifindex
+				 */
+				if (!err) {
+					op->rx_reg_dev = dev;
+					dev_hold(dev);
+				}
 				dev_put(dev);
 			} else {
 				/* the requested device is gone - do not

@@ -1864,16 +1870,14 @@ static int bcm_release(struct socket *sock)
 			 * Only remove subscriptions that had not
 			 * been removed due to NETDEV_UNREGISTER
 			 * in bcm_notifier()
+			 *
+			 * op->rx_reg_dev is a tracked reference taken
+			 * when the subscription was registered, so it
+			 * stays valid here even if a concurrent
+			 * NETDEV_UNREGISTER already unlisted the device.
 			 */
-			if (op->rx_reg_dev) {
-				struct net_device *dev;
-
-				dev = dev_get_by_index(net, op->ifindex);
-				if (dev) {
-					bcm_rx_unreg(dev, op);
-					dev_put(dev);
-				}
-			}
+			if (op->rx_reg_dev)
+				bcm_rx_unreg(op->rx_reg_dev, op);
 		} else
 			can_rx_unregister(net, NULL, op->can_id,
 					  REGMASK(op->can_id),

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit 3b762c0d950383ab7a002686c9136b9aa55d2d70 upstream.

RX: an RX_SETUP update(!) for an existing op skipped can_rx_register() unconditionally, even when a concurrent NETDEV_UNREGISTER had already torn down its registration (op->rx_reg_dev == NULL). This silently did not re-enable frame delivery for that updated filter. bcm_rx_setup() now re-registers in that case, while leaving rx_ops with ifindex = 0 (all CAN devices) which never carry a tracked rx_reg_dev registered as-is.

TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving tx_ops with an active cyclic transmission re-arming its hrtimer indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer prevents the runaway timer and any injection into a later reused ifindex, since nothing else calls bcm_can_tx() for the op until an explicit TX_SETUP update re-arms it.

Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops, the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup() always rejects ifindex 0, so clearing it would strand the op: neither a later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could ever find it again, since both require an exact ifindex match.

---
 net/can/bcm.c | 54 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 44 insertions(+), 10 deletions(-)

index ca0dd2229f5b86..8c138376591f37 100644
@@ -1281,6 +1281,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 	struct bcm_sock *bo = bcm_sk(sk);
 	struct bcm_op *op;
 	int do_rx_register;
+	int new_op = 0;
 	int err = 0;
 
 	if ((msg_head->flags & RX_FILTER_ID) || (!(msg_head->nframes))) {

@@ -1365,8 +1366,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		/* free temporary frames / kfree(NULL) is safe */
 		kfree(new_frames);
 
-		/* Only an update -> do not call can_rx_register() */
-		do_rx_register = 0;
+		/* Don't register a new CAN filter for the rx_op update unless
+		 * a concurrent NETDEV_UNREGISTER notifier already tore down
+		 * the previous registration. In this case the receiver needs
+		 * to be re-registered here so that this update doesn't
+		 * silently stop delivering frames for the given ifindex.
+		 * Ops with ifindex = 0 (all CAN interfaces) never carry a
+		 * tracked rx_reg_dev and stay registered as-is.
+		 */
+		do_rx_register = (ifindex && !op->rx_reg_dev) ? 1 : 0;
 
 	} else {
 		/* insert new BCM operation for the given can_id */

@@ -1433,6 +1441,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
 		/* call can_rx_register() */
 		do_rx_register = 1;
+		new_op = 1;
 
 	} /* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
 

@@ -1446,7 +1455,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		if (op->flags & SETTIMER) {
 
 			/* set timers (locked) for newly created op */
-			if (do_rx_register) {
+			if (new_op) {
 				spin_lock_bh(&op->bcm_rx_update_lock);
 				op->ival1 = msg_head->ival1;
 				op->ival2 = msg_head->ival2;

@@ -1476,7 +1485,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 				      HRTIMER_MODE_REL_SOFT);
 	}
 
-	/* now we can register for can_ids, if we added a new bcm_op */
+	/* now we can register for can_ids, if we added a new bcm_op
+	 * or need to re-register after a NETDEV_UNREGISTER tore down
+	 * the previous registration of an existing op
+	 */
 	if (do_rx_register) {
 		if (ifindex) {
 			struct net_device *dev;

@@ -1506,18 +1518,32 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 				err = -ENODEV;
 			}
 
-		} else
+		} else {
 			err = can_rx_register(sock_net(sk), NULL, op->can_id,
 					      REGMASK(op->can_id),
 					      bcm_rx_handler, op, "bcm", sk);
+		}
+
 		if (err) {
-			/* this bcm rx op is broken -> remove it */
-			bcm_remove_op(op);
+			/* newly created bcm rx op is broken -> remove it */
+			if (new_op) {
+				bcm_remove_op(op);
+				return err;
+			}
+
+			/* an existing op just stays unregistered.
+			 * Cancel op->timer and (defensively) op->thrtimer.
+			 * Other settings can't be reached until the next
+			 * successful RX_SETUP.
+			 */
+			hrtimer_cancel(&op->timer);
+			hrtimer_cancel(&op->thrtimer);
 			return err;
 		}
 
-		/* add this bcm_op to the list of the rx_ops */
-		list_add_rcu(&op->list, &bo->rx_ops);
+		/* add a new bcm_op to the list of the rx_ops */
+		if (new_op)
+			list_add_rcu(&op->list, &bo->rx_ops);
 	}
 
 	return msg_head->nframes * op->cfsiz + MHSIZ;

@@ -1733,11 +1759,19 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
 	case NETDEV_UNREGISTER:
 		lock_sock(sk);
 
-		/* remove device specific receive entries */
+		/* rx_ops: remove device specific receive entries */
 		list_for_each_entry(op, &bo->rx_ops, list)
 			if (op->rx_reg_dev == dev)
 				bcm_rx_unreg(dev, op);
 
+		/* tx_ops: stop device specific cyclic transmissions on the
+		 * vanishing ifindex. Cancelling the timer is enough to stop
+		 * cyclic bcm_can_tx() calls as there is no re-arming.
+		 */
+		list_for_each_entry(op, &bo->tx_ops, list)
+			if (op->ifindex == dev->ifindex)
+				hrtimer_cancel(&op->timer);
+
 		/* remove device reference, if this is our bound device */
 		if (bo->bound && bo->ifindex == dev->ifindex) {
 #if IS_ENABLED(CONFIG_PROC_FS)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 upstream.

For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices.

op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms.

Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison.

As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.

---
 net/can/bcm.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

index 8c138376591f37..079a6a801f42e3 100644
@@ -794,11 +794,6 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 	/* disable timeout */
 	hrtimer_cancel(&op->timer);
 
-	/* save rx timestamp */
-	op->rx_stamp = skb->tstamp;
-	/* save originator for recvfrom() */
-	op->rx_ifindex = skb->dev->ifindex;
-
 	/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */
 	spin_lock_bh(&op->bcm_rx_update_lock);
 

@@ -830,6 +825,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 			traffic_flags |= RX_OWN;
 	}
 
+	/* save rx timestamp and originator for recvfrom() under lock.
+	 * For an op subscribed on all interfaces (ifindex == 0)
+	 * bcm_rx_handler() can run concurrently on different CPUs so
+	 * the CAN content and the meta data must be bundled correctly.
+	 */
+	op->rx_stamp = skb->tstamp;
+	op->rx_ifindex = skb->dev->ifindex;
+
 	if (op->flags & RX_FILTER_ID) {
 		/* the easiest case */
 		bcm_rx_update_and_send(op, op->last_frames, rxframe,