--- /dev/null
+From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Fri, 12 Jun 2026 10:21:09 -0400
+Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream.
+
+b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding
+conn ref") don't reset the chan->conn to NULL anymore making the bt#
+netdev not be remove once the last l2cap_chan_del is removed.
+
+Instead of restoring the original behavior this remove the logic of
+keeping the interface after the last channel is removed because it
+never worked as intended and the l2cap_chan_del always detach its
+l2cap_conn which results in always removing the channel anyway.
+
+Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/6lowpan.c | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -781,20 +781,10 @@ static void chan_close_cb(struct l2cap_c
+ struct lowpan_btle_dev *dev = NULL;
+ struct lowpan_peer *peer;
+ int err = -ENOENT;
+- bool last = false, remove = true;
++ bool last = false;
+
+ BT_DBG("chan %p conn %p", chan, chan->conn);
+
+- if (chan->conn && chan->conn->hcon) {
+- if (!is_bt_6lowpan(chan->conn->hcon))
+- return;
+-
+- /* If conn is set, then the netdev is also there and we should
+- * not remove it.
+- */
+- remove = false;
+- }
+-
+ spin_lock(&devices_lock);
+
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+@@ -821,10 +811,8 @@ static void chan_close_cb(struct l2cap_c
+
+ ifdown(dev->netdev);
+
+- if (remove) {
+- INIT_WORK(&entry->delete_netdev, delete_netdev);
+- schedule_work(&entry->delete_netdev);
+- }
++ INIT_WORK(&entry->delete_netdev, delete_netdev);
++ schedule_work(&entry->delete_netdev);
+ } else {
+ spin_unlock(&devices_lock);
+ }
--- /dev/null
+From 61f7a8f975456d7be21100ee0936389142b95a81 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 22 Jul 2024 11:27:05 +0200
+Subject: Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 61f7a8f975456d7be21100ee0936389142b95a81 upstream.
+
+The previous fix was incomplete as the link failure still persists
+with CONFIG_USB=m when the sdio or serial wrappers for btmtk.c
+are build-in:
+
+btmtk.c:(.text+0x468): undefined reference to `usb_alloc_urb'
+btmtk.c:(.text+0x488): undefined reference to `usb_free_urb'
+btmtk.c:(.text+0x500): undefined reference to `usb_anchor_urb'
+btmtk.c:(.text+0x50a): undefined reference to `usb_submit_urb'
+btmtk.c:(.text+0x92c): undefined reference to `usb_control_msg'
+btmtk.c:(.text+0xa92): undefined reference to `usb_unanchor_urb'
+btmtk.c:(.text+0x11e4): undefined reference to `usb_set_interface'
+btmtk.c:(.text+0x120a): undefined reference to `usb_kill_anchored_urbs'
+
+Disallow this configuration.
+
+Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/Kconfig
++++ b/drivers/bluetooth/Kconfig
+@@ -412,6 +412,7 @@ config BT_ATH3K
+ config BT_MTKSDIO
+ tristate "MediaTek HCI SDIO driver"
+ depends on MMC
++ depends on USB || !BT_HCIBTUSB_MTK
+ select BT_MTK
+ help
+ MediaTek Bluetooth HCI SDIO driver.
+@@ -424,6 +425,7 @@ config BT_MTKSDIO
+ config BT_MTKUART
+ tristate "MediaTek HCI UART driver"
+ depends on SERIAL_DEV_BUS
++ depends on USB || !BT_HCIBTUSB_MTK
+ select BT_MTK
+ help
+ MediaTek Bluetooth HCI UART driver.
--- /dev/null
+From 7a8c6fb21a7c913ddb99785b14914dab2f934fbd Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 22 Jul 2024 11:27:06 +0200
+Subject: Bluetooth: btmtk: remove #ifdef around declarations
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 7a8c6fb21a7c913ddb99785b14914dab2f934fbd upstream.
+
+The caller of these functions in btusb.c is guarded with an
+if(IS_ENABLED()) style check, so dead code is left out, but the
+declarations are still needed at compile time:
+
+drivers/bluetooth/btusb.c: In function 'btusb_mtk_reset':
+drivers/bluetooth/btusb.c:2705:15: error: implicit declaration of function 'btmtk_usb_subsys_reset' [-Wimplicit-function-declaration]
+ 2705 | err = btmtk_usb_subsys_reset(hdev, btmtk_data->dev_id);
+ | ^~~~~~~~~~~~~~~~~~~~~~
+drivers/bluetooth/btusb.c: In function 'btusb_send_frame_mtk':
+drivers/bluetooth/btusb.c:2720:23: error: implicit declaration of function 'alloc_mtk_intr_urb' [-Wimplicit-function-declaration]
+ 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete);
+ | ^~~~~~~~~~~~~~~~~~
+drivers/bluetooth/btusb.c:2720:21: error: assignment to 'struct urb *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete);
+ | ^
+
+Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btmtk.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/bluetooth/btmtk.h
++++ b/drivers/bluetooth/btmtk.h
+@@ -189,13 +189,11 @@ int btmtk_process_coredump(struct hci_de
+ void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
+ u32 fw_flavor);
+
+-#if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK)
+ int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id);
+
+ int btmtk_usb_setup(struct hci_dev *hdev);
+
+ int btmtk_usb_shutdown(struct hci_dev *hdev);
+-#endif
+ #else
+
+ static inline int btmtk_set_bdaddr(struct hci_dev *hdev,
--- /dev/null
+From 59710a26a289ad4e7ef227d22063e964930928b0 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Mon, 30 Jun 2025 15:37:46 -0400
+Subject: Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 59710a26a289ad4e7ef227d22063e964930928b0 upstream.
+
+The check for destination to be BDADDR_ANY is no longer necessary with
+the introduction of BIS_LINK.
+
+Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/bluetooth/hci_core.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1339,8 +1339,7 @@ hci_conn_hash_lookup_big_state(struct hc
+ rcu_read_lock();
+
+ list_for_each_entry_rcu(c, &h->list, list) {
+- if (c->type != BIS_LINK || bacmp(&c->dst, BDADDR_ANY) ||
+- c->state != state)
++ if (c->type != BIS_LINK || c->state != state)
+ continue;
+
+ if (handle == c->iso_qos.bcast.big) {
--- /dev/null
+From 314d30b1508682e27c8a324096262c66f23455d9 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Thu, 3 Jul 2025 09:45:08 -0400
+Subject: Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 314d30b1508682e27c8a324096262c66f23455d9 upstream.
+
+BIS/PA connections do have their own cleanup proceedure which are
+performed by hci_conn_cleanup/bis_cleanup.
+
+Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_sync.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -5529,7 +5529,7 @@ static int hci_disconnect_sync(struct hc
+ {
+ struct hci_cp_disconnect cp;
+
+- if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) {
++ if (conn->type == BIS_LINK) {
+ /* This is a BIS connection, hci_conn_del will
+ * do the necessary cleanup.
+ */
--- /dev/null
+From f9e6da99fe49277979798a1c3b9790ae10aaa18a Mon Sep 17 00:00:00 2001
+From: Danilo Krummrich <dakr@kernel.org>
+Date: Mon, 25 May 2026 03:23:21 +0200
+Subject: driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
+
+From: Danilo Krummrich <dakr@kernel.org>
+
+commit f9e6da99fe49277979798a1c3b9790ae10aaa18a upstream.
+
+mod_delayed_work() takes jiffies, not seconds. Thus, restore the dropped
+conversion.
+
+While at it, fix incorrect indentation.
+
+Fixes: 1137838865bf ("driver core: Use mod_delayed_work to prevent lost deferred probe work")
+Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260525012340.3860581-1-dakr@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/dd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -327,7 +327,7 @@ void deferred_probe_extend_timeout(void)
+ * start a new one.
+ */
+ if (mod_delayed_work(system_wq, &deferred_probe_timeout_work,
+- driver_deferred_probe_timeout))
++ secs_to_jiffies(driver_deferred_probe_timeout)))
+ pr_debug("Extended deferred probe timeout by %d secs\n",
+ driver_deferred_probe_timeout);
+ }
--- /dev/null
+From 557495bc879013c3d5e21d667e987e7ce3a514de Mon Sep 17 00:00:00 2001
+From: Danilo Krummrich <dakr@kernel.org>
+Date: Mon, 25 May 2026 03:23:22 +0200
+Subject: driver core: Guard deferred probe timeout extension with delayed_work_pending()
+
+From: Danilo Krummrich <dakr@kernel.org>
+
+commit 557495bc879013c3d5e21d667e987e7ce3a514de upstream.
+
+mod_delayed_work() unconditionally queues the work even when it wasn't
+previously pending, which can fire the timeout prematurely or restart it
+after it already fired. Add a delayed_work_pending() guard to restore
+the originally intended semantics.
+
+Premature firing calls fw_devlink_drivers_done() before all built-in
+drivers have registered, causing fw_devlink to prematurely relax device
+links for suppliers whose drivers haven't loaded yet.
+
+Fixes: 1137838865bf ("driver core: Use mod_delayed_work to prevent lost deferred probe work")
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260525012340.3860581-2-dakr@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/dd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -326,7 +326,8 @@ void deferred_probe_extend_timeout(void)
+ * If the work hasn't been queued yet or if the work expired, don't
+ * start a new one.
+ */
+- if (mod_delayed_work(system_wq, &deferred_probe_timeout_work,
++ if (delayed_work_pending(&deferred_probe_timeout_work) &&
++ mod_delayed_work(system_wq, &deferred_probe_timeout_work,
+ secs_to_jiffies(driver_deferred_probe_timeout)))
+ pr_debug("Extended deferred probe timeout by %d secs\n",
+ driver_deferred_probe_timeout);
--- /dev/null
+From bb2784d9ab49587ba4fbff37a319fff2924db289 Mon Sep 17 00:00:00 2001
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+Date: Thu, 30 Jan 2025 19:26:58 +0000
+Subject: jiffies: Cast to unsigned long in secs_to_jiffies() conversion
+
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+
+commit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream.
+
+While converting users of msecs_to_jiffies(), lkp reported that some range
+checks would always be true because of the mismatch between the implied int
+value of secs_to_jiffies() vs the unsigned long return value of the
+msecs_to_jiffies() calls it was replacing.
+
+Fix this by casting the secs_to_jiffies() input value to unsigned long.
+
+Fixes: b35108a51cf7ba ("jiffies: Define secs_to_jiffies()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com
+Closes: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/jiffies.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -534,7 +534,7 @@ static __always_inline unsigned long mse
+ *
+ * Return: jiffies value
+ */
+-#define secs_to_jiffies(_secs) ((_secs) * HZ)
++#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ)
+
+ extern unsigned long __usecs_to_jiffies(const unsigned int u);
+ #if !(USEC_PER_SEC % HZ)
--- /dev/null
+From b35108a51cf7bab58d7eace1267d7965978bcdb8 Mon Sep 17 00:00:00 2001
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+Date: Wed, 30 Oct 2024 17:47:35 +0000
+Subject: jiffies: Define secs_to_jiffies()
+
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+
+commit b35108a51cf7bab58d7eace1267d7965978bcdb8 upstream.
+
+secs_to_jiffies() is defined in hci_event.c and cannot be reused by
+other call sites. Hoist it into the core code to allow conversion of the
+~1150 usages of msecs_to_jiffies() that either:
+
+ - use a multiplier value of 1000 or equivalently MSEC_PER_SEC, or
+ - have timeouts that are denominated in seconds (i.e. end in 000)
+
+It's implemented as a macro to allow usage in static initializers.
+
+This will also allow conversion of yet more sites that use (sec * HZ)
+directly, and improve their readability.
+
+Suggested-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Link: https://lore.kernel.org/all/20241030-open-coded-timeouts-v3-1-9ba123facf88@linux.microsoft.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/jiffies.h | 13 +++++++++++++
+ net/bluetooth/hci_event.c | 2 --
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -523,6 +523,19 @@ static __always_inline unsigned long mse
+ }
+ }
+
++/**
++ * secs_to_jiffies: - convert seconds to jiffies
++ * @_secs: time in seconds
++ *
++ * Conversion is done by simple multiplication with HZ
++ *
++ * secs_to_jiffies() is defined as a macro rather than a static inline
++ * function so it can be used in static initializers.
++ *
++ * Return: jiffies value
++ */
++#define secs_to_jiffies(_secs) ((_secs) * HZ)
++
+ extern unsigned long __usecs_to_jiffies(const unsigned int u);
+ #if !(USEC_PER_SEC % HZ)
+ static inline unsigned long _usecs_to_jiffies(const unsigned int u)
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -43,8 +43,6 @@
+ #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
+ "\x00\x00\x00\x00\x00\x00\x00\x00"
+
+-#define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
+-
+ /* Handle HCI Event packets */
+
+ static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
--- /dev/null
+From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001
+From: Gil Portnoy <dddhkts1@gmail.com>
+Date: Thu, 28 May 2026 00:00:00 +0000
+Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
+
+From: Gil Portnoy <dddhkts1@gmail.com>
+
+commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream.
+
+Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL
+before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard
+against a handle already being reconnected, but the check and the binding
+assignment are not atomic: both threads pass the guard, both call
+ksmbd_conn_get() on the same fp, and both eventually reach
+kfree(fp->owner.name) -- a double-free of the owner.name slab object.
+The double-bound ksmbd_file also causes a write-UAF on the 344-byte
+ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock
+after the object has been freed by the losing reconnect path.
+
+KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles):
+ BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308
+ BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150
+ Write of size 4 at offset 24 into freed ksmbd_file_cache object
+Five double-bind windows observed; 63 total KASAN reports triggered.
+
+Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the
+check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats
+fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before
+dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping
+refcount increment, safe under the rwlock. The rollback path on __open_id()
+failure also clears fp->conn/tcon under the lock so concurrent readers see
+a consistent state.
+
+Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak")
+Assisted-by: Henry (Claude):claude-opus-4
+Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/vfs_cache.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/smb/server/vfs_cache.c
++++ b/fs/smb/server/vfs_cache.c
+@@ -1191,19 +1191,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ struct ksmbd_lock *smb_lock;
+ unsigned int old_f_state;
+
++ write_lock(&global_ft.lock);
+ if (!fp->is_durable || fp->conn || fp->tcon) {
++ write_unlock(&global_ft.lock);
+ pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon);
+ return -EBADF;
+ }
+
+ if (has_file_id(fp->volatile_id)) {
++ write_unlock(&global_ft.lock);
+ pr_err("Still in use durable fd: %llu\n", fp->volatile_id);
+ return -EBADF;
+ }
+
+- old_f_state = fp->f_state;
+- fp->f_state = FP_NEW;
+-
+ /*
+ * Initialize fp's connection binding before publishing fp into the
+ * session's file table. If __open_id() is ordered first, a
+@@ -1214,11 +1214,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ */
+ fp->conn = ksmbd_conn_get(conn);
+ fp->tcon = work->tcon;
++ write_unlock(&global_ft.lock);
++
++ old_f_state = fp->f_state;
++ fp->f_state = FP_NEW;
+
+ __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
+ if (!has_file_id(fp->volatile_id)) {
++ write_lock(&global_ft.lock);
+ fp->conn = NULL;
+ fp->tcon = NULL;
++ write_unlock(&global_ft.lock);
+ ksmbd_conn_put(conn);
+ fp->f_state = old_f_state;
+ return -EBADF;
--- /dev/null
+From fcdf830ea634cf0ee6543b6cd6a4932f92464fc7 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Mon, 1 Jul 2024 14:39:49 +0200
+Subject: selftests/hid: ensure CKI can compile our new tests on old kernels
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit fcdf830ea634cf0ee6543b6cd6a4932f92464fc7 upstream.
+
+In the same way than commit ae7487d112cf ("selftests/hid: ensure we can
+compile the tests on kernels pre-6.3") we should expose struct hid_bpf_ops
+when it's not available in vmlinux.h.
+
+So unexpose an eventual struct hid_bpf_ops, include vmlinux.h, and
+re-export struct hid_bpf_ops.
+
+Fixes: d7696738d66b ("selftests/hid: convert the hid_bpf selftests with struct_ops")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202406270328.bscLN1IF-lkp@intel.com/
+Link: https://patch.msgid.link/20240701-fix-cki-v2-1-20564e2e1393@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/hid/progs/hid_bpf_helpers.h | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
++++ b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
+@@ -7,6 +7,7 @@
+
+ /* "undefine" structs and enums in vmlinux.h, because we "override" them below */
+ #define hid_bpf_ctx hid_bpf_ctx___not_used
++#define hid_bpf_ops hid_bpf_ops___not_used
+ #define hid_report_type hid_report_type___not_used
+ #define hid_class_request hid_class_request___not_used
+ #define hid_bpf_attach_flags hid_bpf_attach_flags___not_used
+@@ -24,6 +25,7 @@
+ #include "vmlinux.h"
+
+ #undef hid_bpf_ctx
++#undef hid_bpf_ops
+ #undef hid_report_type
+ #undef hid_class_request
+ #undef hid_bpf_attach_flags
+@@ -68,6 +70,20 @@ enum hid_class_request {
+ HID_REQ_SET_PROTOCOL = 0x0B,
+ };
+
++struct hid_bpf_ops {
++ int hid_id;
++ u32 flags;
++ struct list_head list;
++ int (*hid_device_event)(struct hid_bpf_ctx *ctx, enum hid_report_type report_type,
++ u64 source);
++ int (*hid_rdesc_fixup)(struct hid_bpf_ctx *ctx);
++ int (*hid_hw_request)(struct hid_bpf_ctx *ctx, unsigned char reportnum,
++ enum hid_report_type rtype, enum hid_class_request reqtype,
++ u64 source);
++ int (*hid_hw_output_report)(struct hid_bpf_ctx *ctx, u64 source);
++ struct hid_device *hdev;
++};
++
+ #ifndef BPF_F_BEFORE
+ #define BPF_F_BEFORE (1U << 3)
+ #endif
--- /dev/null
+From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 23 Jan 2026 10:37:49 -0800
+Subject: seqlock: fix scoped_seqlock_read kernel-doc
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit f88a31308db6a856229150039b0f56d59696ed31 upstream.
+
+Eliminate all kernel-doc warnings in seqlock.h:
+
+- correct the macro to have "()" immediately following the macro name
+- don't include the macro parameters in the short description (first line)
+- make the parameter names in the comments match the actual macro
+ parameter names.
+- use "::" for the Example
+
+WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment.
+ * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING:
+ Definition list ends without a blank line; unexpected unindent. [docutils]
+Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read'
+Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read'
+
+Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/seqlock.h | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -1357,15 +1357,14 @@ __scoped_seqlock_next(struct ss_tmp *sst
+ __scoped_seqlock_next(&_s, _seqlock, _target))
+
+ /**
+- * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+- * section without manual sequence
+- * counter handling or calls to other
+- * helpers
+- * @lock: pointer to seqlock_t protecting the data
+- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating
+- * the type of critical read section
++ * scoped_seqlock_read() - execute the read-side critical section
++ * without manual sequence counter handling
++ * or calls to other helpers
++ * @_seqlock: pointer to seqlock_t protecting the data
++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless}
++ * indicating the type of critical read section
+ *
+- * Example:
++ * Example::
+ *
+ * scoped_seqlock_read (&lock, ss_lock) {
+ * // read-side critical section
bluetooth-hci_sync-annotate-data-races-around-hdev-req_status.patch
bluetooth-hci_conn-fix-null-ptr-deref-in-hci_abort_conn.patch
kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch
+seqlock-fix-scoped_seqlock_read-kernel-doc.patch
+ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch
+bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch
+bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch
+bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch
+selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch
+bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch
+bluetooth-btmtk-remove-ifdef-around-declarations.patch
+xfs-fix-stupid-compiler-warning.patch
+writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch
+writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch
+jiffies-define-secs_to_jiffies.patch
+jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch
+driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch
+driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch
--- /dev/null
+From e90a6d668e26e00a72df2d09c173b563468f09c9 Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun@linux.alibaba.com>
+Date: Thu, 21 May 2026 17:50:15 +0800
+Subject: writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
+
+From: Baokun Li <libaokun@linux.alibaba.com>
+
+commit e90a6d668e26e00a72df2d09c173b563468f09c9 upstream.
+
+Commit e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when
+switching inodes") replaced the queue_rcu_work() based scheduling of
+inode wb switches with a plain queue_work(). Since then no switcher
+goes through call_rcu(), so rcu_barrier() in cgroup_writeback_umount()
+has no callbacks of its own to wait for. It still drains unrelated
+call_rcu() callbacks from other subsystems on busy systems, which
+incidentally slows umount down; drop it.
+
+Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
+Link: https://patch.msgid.link/20260521095016.2791354-3-libaokun@linux.alibaba.com
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fs-writeback.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -1191,11 +1191,6 @@ void cgroup_writeback_umount(void)
+ * will then drain it.
+ */
+ synchronize_rcu();
+- /*
+- * Use rcu_barrier() to wait for all pending callbacks to
+- * ensure that all in-flight wb switches are in the workqueue.
+- */
+- rcu_barrier();
+ flush_workqueue(isw_wq);
+ }
+ }
--- /dev/null
+From 6689f01d6740cf358932b3e97ee968c6099800d9 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 13 Apr 2026 11:36:19 +0200
+Subject: writeback: Fix use after free in inode_switch_wbs_work_fn()
+
+From: Jan Kara <jack@suse.cz>
+
+commit 6689f01d6740cf358932b3e97ee968c6099800d9 upstream.
+
+inode_switch_wbs_work_fn() has a loop like:
+
+ wb_get(new_wb);
+ while (1) {
+ list = llist_del_all(&new_wb->switch_wbs_ctxs);
+ /* Nothing to do? */
+ if (!list)
+ break;
+ ... process the items ...
+ }
+
+Now adding of items to the list looks like:
+
+wb_queue_isw()
+ if (llist_add(&isw->list, &wb->switch_wbs_ctxs))
+ queue_work(isw_wq, &wb->switch_work);
+
+Because inode_switch_wbs_work_fn() loops when processing isw items, it
+can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is
+empty. This is a problem because in that case wb can get freed (no isw
+items -> no wb reference) while the work is still pending causing
+use-after-free issues.
+
+We cannot just fix this by cancelling work when freeing wb because that
+could still trigger problematic 0 -> 1 transitions on wb refcount due to
+wb_get() in inode_switch_wbs_work_fn(). It could be all handled with
+more careful code but that seems unnecessarily complex so let's avoid
+that until it is proven that the looping actually brings practical
+benefit. Just remove the loop from inode_switch_wbs_work_fn() instead.
+That way when wb_queue_isw() queues work, we are guaranteed we have
+added the first item to wb->switch_wbs_ctxs and nobody is going to
+remove it (and drop the wb reference it holds) until the queued work
+runs.
+
+Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")
+CC: stable@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fs-writeback.c | 36 +++++++++++++++++++-----------------
+ 1 file changed, 19 insertions(+), 17 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -535,28 +535,30 @@ void inode_switch_wbs_work_fn(struct wor
+ struct inode_switch_wbs_context *isw, *next_isw;
+ struct llist_node *list;
+
++ list = llist_del_all(&new_wb->switch_wbs_ctxs);
+ /*
+- * Grab out reference to wb so that it cannot get freed under us
++ * Nothing to do? That would be a problem as references held by isw
++ * items protect wb from freeing...
++ */
++ if (WARN_ON_ONCE(!list))
++ return;
++
++ /*
++ * Grab our reference to wb so that it cannot get freed under us
+ * after we process all the isw items.
+ */
+ wb_get(new_wb);
+- while (1) {
+- list = llist_del_all(&new_wb->switch_wbs_ctxs);
+- /* Nothing to do? */
+- if (!list)
+- break;
+- /*
+- * In addition to synchronizing among switchers, I_WB_SWITCH
+- * tells the RCU protected stat update paths to grab the i_page
+- * lock so that stat transfer can synchronize against them.
+- * Let's continue after I_WB_SWITCH is guaranteed to be
+- * visible.
+- */
+- synchronize_rcu();
++ /*
++ * In addition to synchronizing among switchers, I_WB_SWITCH
++ * tells the RCU protected stat update paths to grab the i_page
++ * lock so that stat transfer can synchronize against them.
++ * Let's continue after I_WB_SWITCH is guaranteed to be
++ * visible.
++ */
++ synchronize_rcu();
+
+- llist_for_each_entry_safe(isw, next_isw, list, list)
+- process_inode_switch_wbs(new_wb, isw);
+- }
++ llist_for_each_entry_safe(isw, next_isw, list, list)
++ process_inode_switch_wbs(new_wb, isw);
+ wb_put(new_wb);
+ }
+
--- /dev/null
+From f06725052098d7b1133ac3846d693c383dc427a2 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Thu, 4 Dec 2025 13:44:15 -0800
+Subject: xfs: fix stupid compiler warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Darrick J. Wong <djwong@kernel.org>
+
+commit f06725052098d7b1133ac3846d693c383dc427a2 upstream.
+
+gcc 14.2 warns about:
+
+xfs_attr_item.c: In function ‘xfs_attr_recover_work’:
+xfs_attr_item.c:785:9: warning: ‘ip’ may be used uninitialized [-Wmaybe-uninitialized]
+ 785 | xfs_trans_ijoin(tp, ip, 0);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~
+xfs_attr_item.c:740:42: note: ‘ip’ was declared here
+ 740 | struct xfs_inode *ip;
+ | ^~
+
+I think this is bogus since xfs_attri_recover_work either returns a real
+pointer having initialized ip or an ERR_PTR having not touched it, but
+the tools are smarter than me so let's just null-init the variable
+anyway.
+
+Cc: stable@vger.kernel.org # v6.8
+Fixes: e70fb328d52772 ("xfs: recreate work items when recovering intent items")
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_attr_item.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_attr_item.c
++++ b/fs/xfs/xfs_attr_item.c
+@@ -622,7 +622,7 @@ xfs_attr_recover_work(
+ struct xfs_attri_log_item *attrip = ATTRI_ITEM(lip);
+ struct xfs_attr_intent *attr;
+ struct xfs_mount *mp = lip->li_log->l_mp;
+- struct xfs_inode *ip;
++ struct xfs_inode *ip = NULL;
+ struct xfs_da_args *args;
+ struct xfs_trans *tp;
+ struct xfs_trans_res resv;
projects / thirdparty / kernel / stable-queue.git / commitdiff
