--- /dev/null
+From stable+bounces-180845-greg=kroah.com@vger.kernel.org Mon Sep 22 01:15:58 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:15:50 -0400
+Subject: btrfs: tree-checker: fix the incorrect inode ref size check
+To: stable@vger.kernel.org
+Cc: Qu Wenruo <wqu@suse.com>, Johannes Thumshirn <johannes.thumshirn@wdc.com>, Filipe Manana <fdmanana@suse.com>, David Sterba <dsterba@suse.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921231550.3032338-1-sashal@kernel.org>
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 96fa515e70f3e4b98685ef8cac9d737fc62f10e1 ]
+
+[BUG]
+Inside check_inode_ref(), we need to make sure every structure,
+including the btrfs_inode_extref header, is covered by the item. But
+our code is incorrectly using "sizeof(iref)", where @iref is just a
+pointer.
+
+This means "sizeof(iref)" will always be "sizeof(void *)", which is much
+smaller than "sizeof(struct btrfs_inode_extref)".
+
+This will allow some bad inode extrefs to sneak in, defeating tree-checker.
+
+[FIX]
+Fix the typo by calling "sizeof(*iref)", which is the same as
+"sizeof(struct btrfs_inode_extref)", and will be the correct behavior we
+want.
+
+Fixes: 71bf92a9b877 ("btrfs: tree-checker: Add check for INODE_REF")
+CC: stable@vger.kernel.org # 6.1+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+[ Added unlikely() ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/tree-checker.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -1545,10 +1545,10 @@ static int check_inode_ref(struct extent
+ while (ptr < end) {
+ u16 namelen;
+
+- if (ptr + sizeof(iref) > end) {
++ if (unlikely(ptr + sizeof(*iref) > end)) {
+ inode_ref_err(leaf, slot,
+ "inode ref overflow, ptr %lu end %lu inode_ref_size %zu",
+- ptr, end, sizeof(iref));
++ ptr, end, sizeof(*iref));
+ return -EUCLEAN;
+ }
+
--- /dev/null
+From stable+bounces-180870-greg=kroah.com@vger.kernel.org Mon Sep 22 03:46:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 21:46:30 -0400
+Subject: mptcp: propagate shutdown to subflows when possible
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Mat Martineau <martineau@kernel.org>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922014630.3127747-1-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit f755be0b1ff429a2ecf709beeb1bcd7abc111c2b ]
+
+When the MPTCP DATA FIN have been ACKed, there is no more MPTCP related
+metadata to exchange, and all subflows can be safely shutdown.
+
+Before this patch, the subflows were actually terminated at 'close()'
+time. That's certainly fine most of the time, but not when the userspace
+'shutdown()' a connection, without close()ing it. When doing so, the
+subflows were staying in LAST_ACK state on one side -- and consequently
+in FIN_WAIT2 on the other side -- until the 'close()' of the MPTCP
+socket.
+
+Now, when the DATA FIN have been ACKed, all subflows are shutdown. A
+consequence of this is that the TCP 'FIN' flag can be set earlier now,
+but the end result is the same. This affects the packetdrill tests
+looking at the end of the MPTCP connections, but for a good reason.
+
+Note that tcp_shutdown() will check the subflow state, so no need to do
+that again before calling it.
+
+Fixes: 3721b9b64676 ("mptcp: Track received DATA_FIN sequence number and add related helpers")
+Cc: stable@vger.kernel.org
+Fixes: 16a9a9da1723 ("mptcp: Add helper to process acks of DATA_FIN")
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-1-d40e77cbbf02@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -326,6 +326,20 @@ static void mptcp_stop_timer(struct sock
+ mptcp_sk(sk)->timer_ival = 0;
+ }
+
++static void mptcp_shutdown_subflows(struct mptcp_sock *msk)
++{
++ struct mptcp_subflow_context *subflow;
++
++ mptcp_for_each_subflow(msk, subflow) {
++ struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
++ bool slow;
++
++ slow = lock_sock_fast(ssk);
++ tcp_shutdown(ssk, SEND_SHUTDOWN);
++ unlock_sock_fast(ssk, slow);
++ }
++}
++
+ static void mptcp_check_data_fin_ack(struct sock *sk)
+ {
+ struct mptcp_sock *msk = mptcp_sk(sk);
+@@ -348,6 +362,7 @@ static void mptcp_check_data_fin_ack(str
+ break;
+ case TCP_CLOSING:
+ case TCP_LAST_ACK:
++ mptcp_shutdown_subflows(msk);
+ inet_sk_state_store(sk, TCP_CLOSE);
+ sk->sk_state_change(sk);
+ break;
+@@ -430,6 +445,7 @@ static void mptcp_check_data_fin(struct
+ inet_sk_state_store(sk, TCP_CLOSING);
+ break;
+ case TCP_FIN_WAIT2:
++ mptcp_shutdown_subflows(msk);
+ inet_sk_state_store(sk, TCP_CLOSE);
+ // @@ Close subflows now?
+ break;
--- /dev/null
+From stable+bounces-180855-greg=kroah.com@vger.kernel.org Mon Sep 22 01:46:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:46:29 -0400
+Subject: net: rfkill: gpio: add DT support
+To: stable@vger.kernel.org
+Cc: Philipp Zabel <p.zabel@pengutronix.de>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921234630.3087563-1-sashal@kernel.org>
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ]
+
+Allow probing rfkill-gpio via device tree. This hooks up the already
+existing support that was started in commit 262c91ee5e52 ("net:
+rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio"
+compatible, with the "name" and "type" properties renamed to "label"
+and "radio-type", respectively, in the device tree case.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -79,6 +79,8 @@ static int rfkill_gpio_probe(struct plat
+ {
+ struct rfkill_gpio_data *rfkill;
+ struct gpio_desc *gpio;
++ const char *name_property;
++ const char *type_property;
+ const char *type_name;
+ int ret;
+
+@@ -86,8 +88,15 @@ static int rfkill_gpio_probe(struct plat
+ if (!rfkill)
+ return -ENOMEM;
+
+- device_property_read_string(&pdev->dev, "name", &rfkill->name);
+- device_property_read_string(&pdev->dev, "type", &type_name);
++ if (dev_of_node(&pdev->dev)) {
++ name_property = "label";
++ type_property = "radio-type";
++ } else {
++ name_property = "name";
++ type_property = "type";
++ }
++ device_property_read_string(&pdev->dev, name_property, &rfkill->name);
++ device_property_read_string(&pdev->dev, type_property, &type_name);
+
+ if (!rfkill->name)
+ rfkill->name = dev_name(&pdev->dev);
+@@ -169,12 +178,19 @@ static const struct acpi_device_id rfkil
+ MODULE_DEVICE_TABLE(acpi, rfkill_acpi_match);
+ #endif
+
++static const struct of_device_id rfkill_of_match[] __maybe_unused = {
++ { .compatible = "rfkill-gpio", },
++ { },
++};
++MODULE_DEVICE_TABLE(of, rfkill_of_match);
++
+ static struct platform_driver rfkill_gpio_driver = {
+ .probe = rfkill_gpio_probe,
+ .remove = rfkill_gpio_remove,
+ .driver = {
+ .name = "rfkill_gpio",
+ .acpi_match_table = ACPI_PTR(rfkill_acpi_match),
++ .of_match_table = of_match_ptr(rfkill_of_match),
+ },
+ };
+
--- /dev/null
+From stable+bounces-180856-greg=kroah.com@vger.kernel.org Mon Sep 22 01:46:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:46:30 -0400
+Subject: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
+To: stable@vger.kernel.org
+Cc: Hans de Goede <hansg@kernel.org>, Heikki Krogerus <heikki.krogerus@linux.intel.com>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921234630.3087563-2-sashal@kernel.org>
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ]
+
+Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
+device property") rfkill_find_type() gets called with the possibly
+uninitialized "const char *type_name;" local variable.
+
+On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
+acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:
+
+ rfkill->type = (unsigned)id->driver_data;
+
+and there is no "type" property so device_property_read_string() will fail
+and leave type_name uninitialized, leading to a potential crash.
+
+rfkill_find_type() does accept a NULL pointer, fix the potential crash
+by initializing type_name to NULL.
+
+Note likely sofar this has not been caught because:
+
+1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
+2. The stack happened to contain NULL where type_name is stored
+
+Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property")
+Cc: stable@vger.kernel.org
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -78,10 +78,10 @@ static int rfkill_gpio_acpi_probe(struct
+ static int rfkill_gpio_probe(struct platform_device *pdev)
+ {
+ struct rfkill_gpio_data *rfkill;
+- struct gpio_desc *gpio;
++ const char *type_name = NULL;
+ const char *name_property;
+ const char *type_property;
+- const char *type_name;
++ struct gpio_desc *gpio;
+ int ret;
+
+ rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL);
phy-broadcom-ns-usb3-fix-wvoid-pointer-to-enum-cast-warning.patch
phy-use-device_get_match_data.patch
phy-ti-omap-usb2-fix-device-leak-at-unbind.patch
+net-rfkill-gpio-add-dt-support.patch
+net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch
+btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch
+mptcp-propagate-shutdown-to-subflows-when-possible.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
