--- /dev/null
+From stable+bounces-272251-greg=kroah.com@vger.kernel.org Mon Jul 6 16:30:06 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2026 10:10:57 -0400
+Subject: apparmor: advertise the tcp fast open fix is applied
+To: stable@vger.kernel.org
+Cc: John Johansen <john.johansen@canonical.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260706141057.2348305-1-sashal@kernel.org>
+
+From: John Johansen <john.johansen@canonical.com>
+
+[ Upstream commit 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 ]
+
+The fix for tcp-fast-open ensures that the connect permission is being
+mediated correctly but it didn't add an artifact to the feature set to
+advertise the fix is available. Add an artifact so that the test suite
+can identify if the fix has not been properly applied or a new
+unexpected regression has occurred.
+
+Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/apparmor/net.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/apparmor/net.c
++++ b/security/apparmor/net.c
+@@ -21,6 +21,7 @@
+
+ struct aa_sfs_entry aa_sfs_entry_network[] = {
+ AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK),
++ AA_SFS_FILE_BOOLEAN("tcp-fast-open", 1),
+ { }
+ };
+
--- /dev/null
+From stable+bounces-271964-greg=kroah.com@vger.kernel.org Sat Jul 4 14:31:24 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2026 08:31:04 -0400
+Subject: block: Avoid mounting the bdev pseudo-filesystem in userspace
+To: stable@vger.kernel.org
+Cc: Denis Arefev <arefev@swemel.ru>, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260704123104.731912-1-sashal@kernel.org>
+
+From: Denis Arefev <arefev@swemel.ru>
+
+[ Upstream commit f73aa66dffcb8e61e78f01b56163ec16a15d06d2 ]
+
+The bdev pseudo-filesystem is an internal kernel filesystem with which
+userspace should not interfere. Unregister it so that userspace cannot
+even attempt to mount it.
+
+This fixes a bug [1] that occurs when attempting to access files,
+because the system call move_mount() uses pointers declared in the
+inode_operations structure, which for the bdev pseudo-filesystem
+are always equal to 0. `inode->i_op = &empty_iops;`
+
+[1]
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor instruction fetch in kernel mode
+ #PF: error_code(0x0010) - not-present page
+ PGD 23380067 P4D 23380067 PUD 23381067 PMD 0
+ Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
+ CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+ RIP: 0010:0x0
+
+ Call Trace:
+ <TASK>
+ lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460
+ open_last_lookups fs/namei.c:3550 [inline]
+ path_openat+0x953/0x2700 fs/namei.c:3780
+ do_filp_open+0x1c5/0x410 fs/namei.c:3810
+ do_sys_openat2+0x171/0x4d0 fs/open.c:1318
+ do_sys_open fs/open.c:1334 [inline]
+ __do_sys_openat fs/open.c:1350 [inline]
+ __se_sys_openat fs/open.c:1345 [inline]
+ __x64_sys_openat+0x13c/0x1f0 fs/open.c:1345
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
+ entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/all/20131010004732.GJ13318@ZenIV.linux.org.uk/T/#
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://patch.msgid.link/20260521072857.5078-1-arefev@swemel.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bdev.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/block/bdev.c
++++ b/block/bdev.c
+@@ -478,16 +478,12 @@ EXPORT_SYMBOL_GPL(blockdev_superblock);
+
+ void __init bdev_cache_init(void)
+ {
+- int err;
+ static struct vfsmount *bd_mnt;
+
+ bdev_cachep = kmem_cache_create("bdev_cache", sizeof(struct bdev_inode),
+ 0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
+ SLAB_MEM_SPREAD|SLAB_ACCOUNT|SLAB_PANIC),
+ init_once);
+- err = register_filesystem(&bd_type);
+- if (err)
+- panic("Cannot register bdev pseudo-fs");
+ bd_mnt = kern_mount(&bd_type);
+ if (IS_ERR(bd_mnt))
+ panic("Cannot create bdev pseudo-fs");
--- /dev/null
+From stable+bounces-271756-greg=kroah.com@vger.kernel.org Fri Jul 3 14:52:53 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 08:33:23 -0400
+Subject: device property: initialize the remaining fields of fwnode_handle in fwnode_init()
+To: stable@vger.kernel.org
+Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>, Sakari Ailus <sakari.ailus@linux.intel.com>, "Rafael J. Wysocki (Intel)" <rafael@kernel.org>, Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Danilo Krummrich <dakr@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703123323.3944624-1-sashal@kernel.org>
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 7eba000621fff223dd7bab484d48918c7c77a307 ]
+
+If a firmware node is allocated on the stack (for instance: temporary
+software node whose life-time we control) or on the heap - but using a
+non-zeroing allocation function - and initialized using fwnode_init(),
+its secondary pointer will contain uninitialized memory which likely
+will be neither NULL nor IS_ERR() and so may end up being dereferenced
+(for example: in dev_to_swnode()). Set fwnode->secondary to NULL on
+initialization. While at it: initialize the remaining fields of struct
+fwnode_handle too just to be sure.
+
+Cc: stable@vger.kernel.org
+Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()")
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260511074927.9473-1-bartosz.golaszewski@oss.qualcomm.com
+[ Fix typo in commit message. - Danilo ]
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/fwnode.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/linux/fwnode.h
++++ b/include/linux/fwnode.h
+@@ -195,8 +195,10 @@ static inline void fwnode_init(struct fw
+ {
+ fwnode->secondary = NULL;
+ fwnode->ops = ops;
++ fwnode->dev = NULL;
+ INIT_LIST_HEAD(&fwnode->consumers);
+ INIT_LIST_HEAD(&fwnode->suppliers);
++ fwnode->flags = 0;
+ }
+
+ static inline void fwnode_set_flag(struct fwnode_handle *fwnode,
--- /dev/null
+From stable+bounces-271848-greg=kroah.com@vger.kernel.org Fri Jul 3 20:30:01 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 14:24:18 -0400
+Subject: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
+To: stable@vger.kernel.org
+Cc: Bryam Vargas <hexlabsecurity@proton.me>, Chao Yu <chao@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703182418.254897-1-sashal@kernel.org>
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]
+
+When the flexible_inline_xattr feature is enabled, do_read_inode() loads
+the on-disk i_inline_xattr_size unconditionally:
+
+ if (f2fs_sb_has_flexible_inline_xattr(sbi))
+ fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
+
+but sanity_check_inode() only range-checks it when the inode also has the
+FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
+data but not FI_INLINE_XATTR -- the normal layout for an inline
+directory -- therefore keeps a fully attacker-controlled
+i_inline_xattr_size from a crafted image.
+
+get_inline_xattr_addrs() returns that value with no flag gating, so it
+feeds the inode geometry:
+
+ MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)
+ NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
+ addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
+
+A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
+negative, so make_dentry_ptr_inline() sets d->max (int) to a negative
+value. The inline directory walk then compares an unsigned long bit_pos
+against that negative d->max, which is promoted to a huge unsigned bound,
+and reads far past the inline area:
+
+ while (bit_pos < d->max) /* fs/f2fs/dir.c */
+ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
+
+Mounting a crafted image and reading such a directory triggers an
+out-of-bounds read in f2fs_fill_dentries(); the same underflow also
+corrupts ADDRS_PER_INODE for regular files.
+
+Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
+flexible_inline_xattr feature is enabled -- i.e. whenever the value is
+loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE
+bound gated on inodes that actually carry an inline xattr, so legitimate
+inodes with i_inline_xattr_size == 0 are still accepted.
+
+Cc: stable@vger.kernel.org
+Fixes: 6afc662e68b5 ("f2fs: support flexible inline xattr size")
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/inode.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -242,14 +242,15 @@ static bool sanity_check_inode(struct in
+ return false;
+ }
+
+- if (f2fs_has_extra_attr(inode) &&
+- f2fs_sb_has_flexible_inline_xattr(sbi) &&
+- f2fs_has_inline_xattr(inode) &&
+- (!fi->i_inline_xattr_size ||
+- fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
++ if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
++ (fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE ||
++ (f2fs_has_inline_xattr(inode) &&
++ fi->i_inline_xattr_size <
++ sizeof(struct f2fs_xattr_header) / sizeof(__le32)))) {
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %zu",
++ f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %zu",
+ __func__, inode->i_ino, fi->i_inline_xattr_size,
++ sizeof(struct f2fs_xattr_header) / sizeof(__le32),
+ MAX_INLINE_XATTR_SIZE);
+ return false;
+ }
--- /dev/null
+From stable+bounces-271880-greg=kroah.com@vger.kernel.org Sat Jul 4 02:47:34 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 20:47:28 -0400
+Subject: f2fs: fix listxattr handling of corrupted xattr entries
+To: stable@vger.kernel.org
+Cc: Keshav Verma <iganschel@gmail.com>, stable@kernel.org, Chao Yu <chao@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260704004728.435151-1-sashal@kernel.org>
+
+From: Keshav Verma <iganschel@gmail.com>
+
+[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]
+
+Validate the xattr entry before reading its fields in f2fs_listxattr().
+Return -EFSCORRUPTED when the entry is outside the valid xattr storage
+area instead of returning a successful partial result.
+
+Fixes: 688078e7f36c ("f2fs: fix to avoid memory leakage in f2fs_listxattr")
+Cc: stable@kernel.org
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Keshav Verma <iganschel@gmail.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/xattr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -576,8 +576,7 @@ ssize_t f2fs_listxattr(struct dentry *de
+ last_base_addr = (void *)base_addr + XATTR_SIZE(inode);
+
+ list_for_each_xattr(entry, base_addr) {
+- const struct xattr_handler *handler =
+- f2fs_xattr_handler(entry->e_name_index);
++ const struct xattr_handler *handler;
+ const char *prefix;
+ size_t prefix_len;
+ size_t size;
+@@ -589,9 +588,11 @@ ssize_t f2fs_listxattr(struct dentry *de
+ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
+ f2fs_handle_error(F2FS_I_SB(inode),
+ ERROR_CORRUPTED_XATTR);
+- break;
++ error = -EFSCORRUPTED;
++ goto cleanup;
+ }
+
++ handler = f2fs_xattr_handler(entry->e_name_index);
+ if (!handler || (handler->list && !handler->list(dentry)))
+ continue;
+
--- /dev/null
+From stable+bounces-271860-greg=kroah.com@vger.kernel.org Fri Jul 3 21:00:38 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 15:00:30 -0400
+Subject: f2fs: fix potential deadlock in f2fs_balance_fs()
+To: stable@vger.kernel.org
+Cc: Ruipeng Qi <ruipengqi3@gmail.com>, Chao Yu <chao@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703190031.290388-1-sashal@kernel.org>
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]
+
+When the f2fs filesystem space is nearly exhausted, we encounter deadlock
+issues as below:
+
+INFO: task A:1890 blocked for more than 120 seconds.
+ Tainted: G O 6.12.41-g3fe07ddf05ab #1
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:A state:D stack:0 pid:1890 tgid:1626 ppid:1153 flags:0x00000204
+Call trace:
+ __switch_to+0xf4/0x158
+ __schedule+0x27c/0x908
+ schedule+0x3c/0x118
+ io_schedule+0x44/0x68
+ folio_wait_bit_common+0x174/0x370
+ folio_wait_bit+0x20/0x38
+ folio_wait_writeback+0x54/0xc8
+ truncate_inode_partial_folio+0x70/0x1e0
+ truncate_inode_pages_range+0x1b0/0x450
+ truncate_pagecache+0x54/0x88
+ f2fs_file_write_iter+0x3e8/0xb80
+ do_iter_readv_writev+0xf0/0x1e0
+ vfs_writev+0x138/0x2c8
+ do_writev+0x88/0x130
+ __arm64_sys_writev+0x28/0x40
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0xc8/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x30/0xf8
+ el0t_64_sync_handler+0x120/0x130
+ el0t_64_sync+0x190/0x198
+
+INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
+ Tainted: G O 6.12.41-g3fe07ddf05ab #1
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:kworker/u8:11 state:D stack:0 pid:2680853 tgid:2680853 ppid:2 flags:0x00000208
+Workqueue: writeback wb_workfn (flush-254:0)
+Call trace:
+ __switch_to+0xf4/0x158
+ __schedule+0x27c/0x908
+ schedule+0x3c/0x118
+ io_schedule+0x44/0x68
+ folio_wait_bit_common+0x174/0x370
+ __filemap_get_folio+0x214/0x348
+ pagecache_get_page+0x20/0x70
+ f2fs_get_read_data_page+0x150/0x3e8
+ f2fs_get_lock_data_page+0x2c/0x160
+ move_data_page+0x50/0x478
+ do_garbage_collect+0xd38/0x1528
+ f2fs_gc+0x240/0x7e0
+ f2fs_balance_fs+0x1a0/0x208
+ f2fs_write_single_data_page+0x6e4/0x730
+ f2fs_write_cache_pages+0x378/0x9b0
+ f2fs_write_data_pages+0x2e4/0x388
+ do_writepages+0x8c/0x2c8
+ __writeback_single_inode+0x4c/0x498
+ writeback_sb_inodes+0x234/0x4a8
+ __writeback_inodes_wb+0x58/0x118
+ wb_writeback+0x2f8/0x3c0
+ wb_workfn+0x2c4/0x508
+ process_one_work+0x180/0x408
+ worker_thread+0x258/0x368
+ kthread+0x118/0x128
+ ret_from_fork+0x10/0x200
+
+INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
+ Tainted: G O 6.12.41-g3fe07ddf05ab #1
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:kworker/u8:8 state:D stack:0 pid:2641297 tgid:2641297 ppid:2 flags:0x00000208
+Workqueue: writeback wb_workfn (flush-254:0)
+Call trace:
+ __switch_to+0xf4/0x158
+ __schedule+0x27c/0x908
+ rt_mutex_schedule+0x30/0x60
+ __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
+ rwbase_write_lock+0x24c/0x378
+ down_write+0x1c/0x30
+ f2fs_balance_fs+0x184/0x208
+ f2fs_write_inode+0xf4/0x328
+ __writeback_single_inode+0x370/0x498
+ writeback_sb_inodes+0x234/0x4a8
+ __writeback_inodes_wb+0x58/0x118
+ wb_writeback+0x2f8/0x3c0
+ wb_workfn+0x2c4/0x508
+ process_one_work+0x180/0x408
+ worker_thread+0x258/0x368
+ kthread+0x118/0x128
+ ret_from_fork+0x10/0x20
+
+INFO: task B:1902 blocked for more than 120 seconds.
+ Tainted: G O 6.12.41-g3fe07ddf05ab #1
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:B state:D stack:0 pid:1902 tgid:1626 ppid:1153 flags:0x0000020c
+Call trace:
+ __switch_to+0xf4/0x158
+ __schedule+0x27c/0x908
+ rt_mutex_schedule+0x30/0x60
+ __rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
+ rwbase_write_lock+0x24c/0x378
+ down_write+0x1c/0x30
+ f2fs_balance_fs+0x184/0x208
+ f2fs_map_blocks+0x94c/0x1110
+ f2fs_file_write_iter+0x228/0xb80
+ do_iter_readv_writev+0xf0/0x1e0
+ vfs_writev+0x138/0x2c8
+ do_writev+0x88/0x130
+ __arm64_sys_writev+0x28/0x40
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0xc8/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x30/0xf8
+ el0t_64_sync_handler+0x120/0x130
+ el0t_64_sync+0x190/0x198
+
+INFO: task sync:2769849 blocked for more than 120 seconds.
+ Tainted: G O 6.12.41-g3fe07ddf05ab #1
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:sync state:D stack:0 pid:2769849 tgid:2769849 ppid:736 flags:0x0000020c
+Call trace:
+ __switch_to+0xf4/0x158
+ __schedule+0x27c/0x908
+ schedule+0x3c/0x118
+ wb_wait_for_completion+0xb0/0xe8
+ sync_inodes_sb+0xc8/0x2b0
+ sync_inodes_one_sb+0x24/0x38
+ iterate_supers+0xa8/0x138
+ ksys_sync+0x54/0xc8
+ __arm64_sys_sync+0x18/0x30
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0xc8/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x30/0xf8
+ el0t_64_sync_handler+0x120/0x130
+ el0t_64_sync+0x190/0x198
+
+The root cause is a potential deadlock between the following tasks:
+
+kworker/u8:11 Thread A
+- f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+ - folio_start_writeback(X)
+ - f2fs_outplace_write_data
+ - bio_add_folio(X)
+ - folio_unlock(X)
+ - truncate_inode_pages_range
+ - __filemap_get_folio(X, FGP_LOCK)
+ - truncate_inode_partial_folio(X)
+ - folio_wait_writeback(X)
+ - f2fs_balance_fs
+ - f2fs_gc
+ - do_garbage_collect
+ - move_data_page
+ - f2fs_get_lock_data_page
+ - __filemap_get_folio(X, FGP_LOCK)
+
+Both threads try to access folio X. Thread A holds the lock but waits
+for writeback, while kworker waits for the lock. This causes a deadlock.
+
+Other threads also enter D state, waiting for locks such as gc_lock and
+writepages.
+
+OPU/IPU DATA folio are all affected by this issue. To avoid such
+potential deadlocks, always commit these cached folios before
+triggering f2fs_gc() in f2fs_balance_fs().
+
+Suggested-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 29 +++++++++++++++++++++++++++++
+ fs/f2fs/f2fs.h | 1 +
+ fs/f2fs/segment.c | 8 ++++++++
+ 3 files changed, 38 insertions(+)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -913,6 +913,35 @@ void f2fs_submit_merged_ipu_write(struct
+ }
+ }
+
++void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi)
++{
++ struct bio_entry *be, *tmp;
++ struct f2fs_bio_info *io;
++ enum temp_type temp;
++
++ for (temp = HOT; temp < NR_TEMP_TYPE; temp++) {
++ LIST_HEAD(list);
++
++ io = sbi->write_io[DATA] + temp;
++
++ /* A lockless list_empty() check is safe here: any bios from
++ * other kworkers that we miss will be submitted by those
++ * kworkers accordingly.
++ */
++ if (list_empty(&io->bio_list))
++ continue;
++
++ f2fs_down_write(&io->bio_list_lock);
++ list_splice_init(&io->bio_list, &list);
++ f2fs_up_write(&io->bio_list_lock);
++
++ list_for_each_entry_safe(be, tmp, &list, list) {
++ __submit_bio(sbi, be->bio, DATA);
++ del_bio_entry(be);
++ }
++ }
++}
++
+ int f2fs_merge_page_bio(struct f2fs_io_info *fio)
+ {
+ struct bio *bio = *fio->bio;
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3782,6 +3782,7 @@ void f2fs_submit_merged_write_cond(struc
+ nid_t ino, enum page_type type);
+ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
+ struct bio **bio, struct page *page);
++void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi);
+ void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
+ int f2fs_submit_page_bio(struct f2fs_io_info *fio);
+ int f2fs_merge_page_bio(struct f2fs_io_info *fio);
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -425,6 +425,14 @@ void f2fs_balance_fs(struct f2fs_sb_info
+ .should_migrate_blocks = false,
+ .err_gc_skipped = false,
+ .nr_free_secs = 1 };
++
++ /*
++ * Submit all cached OPU/IPU DATA bios before triggering
++ * foreground GC to avoid potential deadlocks.
++ */
++ f2fs_submit_merged_write(sbi, DATA);
++ f2fs_submit_all_merged_ipu_writes(sbi);
++
+ f2fs_down_write(&sbi->gc_lock);
+ f2fs_gc(sbi, &gc_control);
+ }
--- /dev/null
+From stable+bounces-271861-greg=kroah.com@vger.kernel.org Fri Jul 3 21:00:38 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 15:00:31 -0400
+Subject: f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
+To: stable@vger.kernel.org
+Cc: Chao Yu <chao@kernel.org>, stable@kernel.org, Ruipeng Qi <ruipengqi3@gmail.com>, Chao Yu <chaseyu@google.com>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703190031.290388-2-sashal@kernel.org>
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8b4468ec023d0d1b4669dfb867588997cc03a06b ]
+
+When we mount device w/ gc_merge mount option, we may suffer below
+potential deadlock:
+
+Kworker GC trehad Truncator
+- f2fs_write_cache_pages
+ - f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+ - folio_start_writeback --- set writeback flag on folio
+ - f2fs_outplace_write_data
+ : cached folio in internal bio cache
+ - f2fs_balance_fs
+ - wake_up(gc_thread)
+ : wake up gc thread to run foreground GC
+ - finish_wait(fggc_wq)
+ : wait on the waitqueue --- wait on GC thread to finish the work
+ - truncate_inode_pages_range
+ - __filemap_get_folio(, FGP_LOCK) --- lock folio
+ - truncate_inode_partial_folio
+ - folio_wait_writeback --- wait on writeback being cleared
+ - do_garbage_collect
+ - move_data_page
+ - f2fs_get_lock_data_folio
+ - lock on folio --- blocked on folio's lock
+
+In order to avoid such deadlock, let's call below functions to commit
+cached bios in GC_MERGE path of f2fs_balance_fs() as the same as we did
+in NOGC_MERGE path.
+- f2fs_submit_merged_write(sbi, DATA);
+- f2fs_submit_all_merged_ipu_writes(sbi);
+
+Cc: stable@kernel.org
+Fixes: 351df4b20115 ("f2fs: add segment operations")
+Cc: Ruipeng Qi <ruipengqi3@gmail.com>
+Reported: Sandeep Dhavale <dhavale@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Chao Yu <chaseyu@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/segment.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -408,6 +408,13 @@ void f2fs_balance_fs(struct f2fs_sb_info
+ * dir/node pages without enough free segments.
+ */
+ if (has_not_enough_free_secs(sbi, 0, 0)) {
++ /*
++ * Submit all cached OPU/IPU DATA bios before triggering
++ * foreground GC to avoid potential deadlocks.
++ */
++ f2fs_submit_merged_write(sbi, DATA);
++ f2fs_submit_all_merged_ipu_writes(sbi);
++
+ if (test_opt(sbi, GC_MERGE) && sbi->gc_thread &&
+ sbi->gc_thread->f2fs_gc_task) {
+ DEFINE_WAIT(wait);
+@@ -426,13 +433,6 @@ void f2fs_balance_fs(struct f2fs_sb_info
+ .err_gc_skipped = false,
+ .nr_free_secs = 1 };
+
+- /*
+- * Submit all cached OPU/IPU DATA bios before triggering
+- * foreground GC to avoid potential deadlocks.
+- */
+- f2fs_submit_merged_write(sbi, DATA);
+- f2fs_submit_all_merged_ipu_writes(sbi);
+-
+ f2fs_down_write(&sbi->gc_lock);
+ f2fs_gc(sbi, &gc_control);
+ }
--- /dev/null
+From stable+bounces-271792-greg=kroah.com@vger.kernel.org Fri Jul 3 16:04:09 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 10:02:51 -0400
+Subject: f2fs: keep atomic write retry from zeroing original data
+To: stable@vger.kernel.org
+Cc: Wenjie Qi <qwjhust@gmail.com>, stable@kernel.org, Wenjie Qi <qiwenjie@xiaomi.com>, Chao Yu <chao@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703140251.9905-1-sashal@kernel.org>
+
+From: Wenjie Qi <qwjhust@gmail.com>
+
+[ Upstream commit 6d874b65aadce56ac78f76129dbcfc2599b638f8 ]
+
+A partial atomic write reserves a block in the COW inode before reading the
+original data page for the untouched bytes in that page.
+
+If that read fails, write_begin returns an error but leaves the COW inode
+entry as NEW_ADDR. A retry of the same partial write then finds the COW
+entry, treats it as existing COW data, and f2fs_write_begin() zeroes the
+whole folio because blkaddr is NEW_ADDR.
+
+If the retry is committed, the bytes outside the retried write range are
+committed as zeroes instead of preserving the original file contents.
+
+Only use the COW inode as the read source when it already has a real data
+block. If the COW entry is still NEW_ADDR, treat it as a reservation to
+reuse: keep reading the old data from the original inode and avoid
+reserving or accounting the same atomic block again.
+
+Cc: stable@kernel.org
+Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
+Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -3561,6 +3561,7 @@ static int prepare_atomic_write_begin(st
+ pgoff_t index = page->index;
+ int err = 0;
+ block_t ori_blk_addr = NULL_ADDR;
++ bool cow_has_reserved_block = false;
+
+ /* If pos is beyond the end of file, reserve a new block in COW inode */
+ if ((pos & PAGE_MASK) >= i_size_read(inode))
+@@ -3570,8 +3571,10 @@ static int prepare_atomic_write_begin(st
+ err = __find_data_block(cow_inode, index, blk_addr);
+ if (err)
+ return err;
+- else if (*blk_addr != NULL_ADDR)
++ else if (__is_valid_data_blkaddr(*blk_addr))
+ return 0;
++ else if (*blk_addr == NEW_ADDR)
++ cow_has_reserved_block = true;
+
+ /* Look for the block in the original inode */
+ err = __find_data_block(inode, index, &ori_blk_addr);
+@@ -3580,10 +3583,13 @@ static int prepare_atomic_write_begin(st
+
+ reserve_block:
+ /* Finally, we should reserve a new block in COW inode for the update */
+- err = __reserve_data_block(cow_inode, index, blk_addr, node_changed);
+- if (err)
+- return err;
+- inc_atomic_write_cnt(inode);
++ if (!cow_has_reserved_block) {
++ err = __reserve_data_block(cow_inode, index, blk_addr,
++ node_changed);
++ if (err)
++ return err;
++ inc_atomic_write_cnt(inode);
++ }
+
+ if (ori_blk_addr != NULL_ADDR)
+ *blk_addr = ori_blk_addr;
--- /dev/null
+From stable+bounces-271800-greg=kroah.com@vger.kernel.org Fri Jul 3 16:22:58 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 10:19:11 -0400
+Subject: f2fs: validate orphan inode entry count
+To: stable@vger.kernel.org
+Cc: Wenjie Qi <qwjhust@gmail.com>, stable@kernel.org, Wenjie Qi <qiwenjie@xiaomi.com>, Chao Yu <chao@kernel.org>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260703141911.37544-1-sashal@kernel.org>
+
+From: Wenjie Qi <qwjhust@gmail.com>
+
+[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]
+
+f2fs_recover_orphan_inodes() trusts the orphan block entry_count when
+replaying orphan inodes from the checkpoint pack. A corrupted entry_count
+larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the
+ino[] array and interpret footer or following data as inode numbers.
+
+On a crafted image, mounting an unpatched kernel can drive orphan recovery
+into f2fs_bug_on() and panic the kernel. Validate entry_count before
+consuming entries so corrupted checkpoint data fails the mount with
+-EFSCORRUPTED and requests fsck instead.
+
+Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be
+recorded in the superblock s_errors[] field. This gives fsck a persistent
+hint even though mount-time orphan recovery failure may leave no chance to
+persist SBI_NEED_FSCK through a checkpoint.
+
+Cc: stable@kernel.org
+Fixes: 127e670abfa7 ("f2fs: add checkpoint operations")
+Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/checkpoint.c | 14 +++++++++++++-
+ include/linux/f2fs_fs.h | 3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -743,6 +743,7 @@ int f2fs_recover_orphan_inodes(struct f2
+ for (i = 0; i < orphan_blocks; i++) {
+ struct page *page;
+ struct f2fs_orphan_block *orphan_blk;
++ unsigned int entry_count;
+
+ page = f2fs_get_meta_page(sbi, start_blk + i);
+ if (IS_ERR(page)) {
+@@ -751,7 +752,18 @@ int f2fs_recover_orphan_inodes(struct f2
+ }
+
+ orphan_blk = (struct f2fs_orphan_block *)page_address(page);
+- for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
++ entry_count = le32_to_cpu(orphan_blk->entry_count);
++ if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
++ f2fs_err(sbi, "invalid orphan inode entry count %u",
++ entry_count);
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
++ err = -EFSCORRUPTED;
++ f2fs_put_page(page, 1);
++ goto out;
++ }
++
++ for (j = 0; j < entry_count; j++) {
+ nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
+
+ err = recover_orphan_inode(sbi, ino);
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -104,6 +104,9 @@ enum f2fs_error {
+ ERROR_INCONSISTENT_SIT,
+ ERROR_CORRUPTED_VERITY_XATTR,
+ ERROR_CORRUPTED_XATTR,
++ ERROR_INVALID_NODE_REFERENCE,
++ ERROR_INCONSISTENT_NAT,
++ ERROR_INCONSISTENT_ORPHAN,
+ ERROR_MAX,
+ };
+
--- /dev/null
+From stable+bounces-272061-greg=kroah.com@vger.kernel.org Sun Jul 5 16:02:35 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 10:00:55 -0400
+Subject: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
+To: stable@vger.kernel.org
+Cc: Mingyu Wang <25181214217@stu.xidian.edu.cn>, Thomas Zimmermann <tzimmermann@suse.de>, Helge Deller <deller@gmx.de>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705140055.1744629-1-sashal@kernel.org>
+
+From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
+
+[ Upstream commit 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 ]
+
+When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
+inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
+label to roll back the console state. However, the current rollback logic
+forgets to restore the `hi_font` state, leading to a severe state machine
+corruption.
+
+Earlier in the function, `set_vc_hi_font()` might be called to change
+`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
+subsequently fails, the `err_out` path restores `vc_font.charcount`
+but entirely skips rolling back the `vc_hi_font_mask` and the screen
+buffer.
+
+This mismatch leaves the terminal in a desynchronized state. Because
+`vc_hi_font_mask` remains set, the VT subsystem will still accept
+character indices greater than 255 from userspace and write them to the
+screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
+then use these inflated indices to access the reverted, 256-character
+font array, leading to a deterministic out-of-bounds read and potential
+kernel memory disclosure.
+
+Fix this by adding the missing rollback logic for the `hi_font` mask
+and screen buffer in the error path.
+
+Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2415,6 +2415,7 @@ static int fbcon_do_set_font(struct vc_d
+ struct fbcon_display *p = &fb_display[vc->vc_num];
+ int resize, ret, old_userfont, old_width, old_height, old_charcount;
+ u8 *old_data = vc->vc_font.data;
++ unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
+
+ resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
+ vc->vc_font.data = (void *)(p->fontdata = data);
+@@ -2468,6 +2469,12 @@ err_out:
+ vc->vc_font.height = old_height;
+ vc->vc_font.charcount = old_charcount;
+
++ /* Restore the hi_font state and screen buffer */
++ if (old_hi_font_mask && !vc->vc_hi_font_mask)
++ set_vc_hi_font(vc, true);
++ else if (!old_hi_font_mask && vc->vc_hi_font_mask)
++ set_vc_hi_font(vc, false);
++
+ return ret;
+ }
+
--- /dev/null
+From stable+bounces-272050-greg=kroah.com@vger.kernel.org Sun Jul 5 15:48:19 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 09:47:58 -0400
+Subject: i2c: core: fix adapter debugfs creation
+To: stable@vger.kernel.org
+Cc: Johan Hovold <johan@kernel.org>, Wolfram Sang <wsa+renesas@sang-engineering.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705134759.1722831-4-sashal@kernel.org>
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 07d5fb537928aad4369aaff0cbae73ba38a719af ]
+
+Clients can be registered from bus notifier callbacks so the debugfs
+directory needs to be created before registering the adapter as clients
+use that directory as their debugfs parent.
+
+Move debugfs creation before adapter registration to avoid having
+clients create their debugfs directories in the debugfs root (which is
+also more likely to fail due to name collisions).
+
+Note that failure to allocate the adapter name must now be handled
+explicitly as debugfs_create_dir() cannot handle a NULL name (unlike
+device_add() which returns an error).
+
+Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
+Cc: stable@vger.kernel.org # 6.8
+Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1551,17 +1551,22 @@ static int i2c_register_adapter(struct i
+ goto out_list;
+ }
+
+- dev_set_name(&adap->dev, "i2c-%d", adap->nr);
++ res = dev_set_name(&adap->dev, "i2c-%d", adap->nr);
++ if (res)
++ goto err_remove_irq_domain;
++
+ adap->dev.bus = &i2c_bus_type;
+ adap->dev.type = &i2c_adapter_type;
+- res = device_register(&adap->dev);
++ device_initialize(&adap->dev);
++
++ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
++
++ res = device_add(&adap->dev);
+ if (res) {
+ pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
+- goto err_put_adap;
++ goto err_remove_debugfs;
+ }
+
+- adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+-
+ res = i2c_setup_smbus_alert(adap);
+ if (res)
+ goto out_reg;
+@@ -1602,13 +1607,13 @@ static int i2c_register_adapter(struct i
+
+ out_reg:
+ i2c_deregister_clients(adap);
+- debugfs_remove_recursive(adap->debugfs);
+ device_del(&adap->dev);
+-err_put_adap:
++err_remove_debugfs:
++ debugfs_remove_recursive(adap->debugfs);
+ init_completion(&adap->dev_released);
+ put_device(&adap->dev);
+ wait_for_completion(&adap->dev_released);
+-
++err_remove_irq_domain:
+ i2c_host_notify_irq_teardown(adap);
+ out_list:
+ mutex_lock(&core_lock);
--- /dev/null
+From stable+bounces-272051-greg=kroah.com@vger.kernel.org Sun Jul 5 15:48:24 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 09:47:59 -0400
+Subject: i2c: core: fix adapter registration race
+To: stable@vger.kernel.org
+Cc: Johan Hovold <johan@kernel.org>, Wolfram Sang <wsa+renesas@sang-engineering.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705134759.1722831-5-sashal@kernel.org>
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ba14d7cf2fe7284610a29854bdff22b2537d3ce6 ]
+
+Adapters can be looked up based on their id using i2c_get_adapter()
+which takes a reference to the embedded struct device.
+
+Make sure that the adapter (including its struct device) has been
+initialised before adding it to the IDR to avoid accessing uninitialised
+data which could, for example, lead to NULL-pointer dereferences or
+use-after-free.
+
+Note that the i2c-dev chardev, which is registered from a bus notifier,
+currently uses i2c_get_adapter() so the adapter needs to be added to the
+IDR before registration.
+
+Fixes: 6e13e6418418 ("i2c: Add i2c_add_numbered_adapter()")
+Cc: stable@vger.kernel.org # 2.6.22
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1561,6 +1561,10 @@ static int i2c_register_adapter(struct i
+
+ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+
++ mutex_lock(&core_lock);
++ idr_replace(&i2c_adapter_idr, adap, adap->nr);
++ mutex_unlock(&core_lock);
++
+ res = device_add(&adap->dev);
+ if (res) {
+ pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
+@@ -1634,7 +1638,7 @@ static int __i2c_add_numbered_adapter(st
+ int id;
+
+ mutex_lock(&core_lock);
+- id = idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1, GFP_KERNEL);
++ id = idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERNEL);
+ mutex_unlock(&core_lock);
+ if (WARN(id < 0, "couldn't get idr"))
+ return id == -ENOSPC ? -EBUSY : id;
+@@ -1670,7 +1674,7 @@ int i2c_add_adapter(struct i2c_adapter *
+ }
+
+ mutex_lock(&core_lock);
+- id = idr_alloc(&i2c_adapter_idr, adapter,
++ id = idr_alloc(&i2c_adapter_idr, NULL,
+ __i2c_first_dynamic_bus_num, 0, GFP_KERNEL);
+ mutex_unlock(&core_lock);
+ if (WARN(id < 0, "couldn't get idr"))
--- /dev/null
+From stable+bounces-272048-greg=kroah.com@vger.kernel.org Sun Jul 5 15:48:10 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 09:47:56 -0400
+Subject: i2c: core: fix hang on adapter registration failure
+To: stable@vger.kernel.org
+Cc: Johan Hovold <johan@kernel.org>, Phil Reid <preid@electromag.com.au>, Wolfram Sang <wsa+renesas@sang-engineering.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705134759.1722831-2-sashal@kernel.org>
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 3c7e164344e5bcf6f274bbf59a3274f5caad9bc1 ]
+
+Clients may be registered from bus notifier callbacks when the adapter
+is registered. On a subsequent error during registration, the adapter
+references taken by such clients prevent the wait for the references to
+be released from ever completing.
+
+Fix this by refactoring client deregistration and deregistering also on
+late adapter registration failures.
+
+Fixes: f8756c67b3de ("i2c: core: call of_i2c_setup_smbus_alert in i2c_register_adapter")
+Cc: stable@vger.kernel.org # 4.15
+Cc: Phil Reid <preid@electromag.com.au>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 49 ++++++++++++++++++++++++++------------------
+ 1 file changed, 29 insertions(+), 20 deletions(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -62,6 +62,7 @@
+ static DEFINE_MUTEX(core_lock);
+ static DEFINE_IDR(i2c_adapter_idr);
+
++static void i2c_deregister_clients(struct i2c_adapter *adap);
+ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver);
+
+ static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key);
+@@ -1600,6 +1601,7 @@ static int i2c_register_adapter(struct i
+ return 0;
+
+ out_reg:
++ i2c_deregister_clients(adap);
+ debugfs_remove_recursive(adap->debugfs);
+ init_completion(&adap->dev_released);
+ device_unregister(&adap->dev);
+@@ -1743,29 +1745,10 @@ static int __process_removed_adapter(str
+ return 0;
+ }
+
+-/**
+- * i2c_del_adapter - unregister I2C adapter
+- * @adap: the adapter being unregistered
+- * Context: can sleep
+- *
+- * This unregisters an I2C adapter which was previously registered
+- * by @i2c_add_adapter or @i2c_add_numbered_adapter.
+- */
+-void i2c_del_adapter(struct i2c_adapter *adap)
++static void i2c_deregister_clients(struct i2c_adapter *adap)
+ {
+- struct i2c_adapter *found;
+ struct i2c_client *client, *next;
+
+- /* First make sure that this adapter was ever added */
+- mutex_lock(&core_lock);
+- found = idr_find(&i2c_adapter_idr, adap->nr);
+- mutex_unlock(&core_lock);
+- if (found != adap) {
+- pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
+- return;
+- }
+-
+- i2c_acpi_remove_space_handler(adap);
+ /* Tell drivers about this removal */
+ mutex_lock(&core_lock);
+ bus_for_each_drv(&i2c_bus_type, NULL, adap,
+@@ -1791,6 +1774,32 @@ void i2c_del_adapter(struct i2c_adapter
+ * them up properly, so we give them a chance to do that first. */
+ device_for_each_child(&adap->dev, NULL, __unregister_client);
+ device_for_each_child(&adap->dev, NULL, __unregister_dummy);
++}
++
++/**
++ * i2c_del_adapter - unregister I2C adapter
++ * @adap: the adapter being unregistered
++ * Context: can sleep
++ *
++ * This unregisters an I2C adapter which was previously registered
++ * by @i2c_add_adapter or @i2c_add_numbered_adapter.
++ */
++void i2c_del_adapter(struct i2c_adapter *adap)
++{
++ struct i2c_adapter *found;
++
++ /* First make sure that this adapter was ever added */
++ mutex_lock(&core_lock);
++ found = idr_find(&i2c_adapter_idr, adap->nr);
++ mutex_unlock(&core_lock);
++ if (found != adap) {
++ pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
++ return;
++ }
++
++ i2c_acpi_remove_space_handler(adap);
++
++ i2c_deregister_clients(adap);
+
+ #ifdef CONFIG_I2C_COMPAT
+ class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
--- /dev/null
+From stable+bounces-272047-greg=kroah.com@vger.kernel.org Sun Jul 5 15:48:07 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 09:47:55 -0400
+Subject: i2c: core: fix irq domain leak on adapter registration failure
+To: stable@vger.kernel.org
+Cc: Johan Hovold <johan@kernel.org>, Benjamin Tissoires <bentiss@kernel.org>, Wolfram Sang <wsa+renesas@sang-engineering.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705134759.1722831-1-sashal@kernel.org>
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 8ce19524e4cc2462685f596a6402fbd8fb984ab2 ]
+
+Make sure to tear down the host notify irq domain on adapter
+registration failure to avoid leaking it.
+
+This issue was flagged by Sashiko when reviewing another adapter
+registration fix.
+
+Fixes: 4d5538f5882a ("i2c: use an IRQ to report Host Notify events, not alert")
+Cc: stable@vger.kernel.org # 4.10
+Cc: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1556,7 +1556,7 @@ static int i2c_register_adapter(struct i
+ res = device_register(&adap->dev);
+ if (res) {
+ pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
+- goto out_list;
++ goto err_remove_irq_domain;
+ }
+
+ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+@@ -1604,6 +1604,8 @@ out_reg:
+ init_completion(&adap->dev_released);
+ device_unregister(&adap->dev);
+ wait_for_completion(&adap->dev_released);
++err_remove_irq_domain:
++ i2c_host_notify_irq_teardown(adap);
+ out_list:
+ mutex_lock(&core_lock);
+ idr_remove(&i2c_adapter_idr, adap->nr);
--- /dev/null
+From stable+bounces-272049-greg=kroah.com@vger.kernel.org Sun Jul 5 15:48:14 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 09:47:57 -0400
+Subject: i2c: core: fix NULL-deref on adapter registration failure
+To: stable@vger.kernel.org
+Cc: Johan Hovold <johan@kernel.org>, Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>, Wolfram Sang <wsa+renesas@sang-engineering.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705134759.1722831-3-sashal@kernel.org>
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 2295d2bb101faa663fbc45fadbb3fec45f107441 ]
+
+If adapter registration ever fails the release callback would trigger a
+NULL-pointer dereference as the completion struct has not been
+initialised.
+
+Note that before the offending commit this would instead have resulted
+in a minor memory leak of the adapter name.
+
+Fixes: 3f8c4f5e9a57 ("i2c: core: fix reference leak in i2c_register_adapter()")
+Cc: stable@vger.kernel.org
+Cc: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1557,7 +1557,7 @@ static int i2c_register_adapter(struct i
+ res = device_register(&adap->dev);
+ if (res) {
+ pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
+- goto err_remove_irq_domain;
++ goto err_put_adap;
+ }
+
+ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+@@ -1603,10 +1603,12 @@ static int i2c_register_adapter(struct i
+ out_reg:
+ i2c_deregister_clients(adap);
+ debugfs_remove_recursive(adap->debugfs);
++ device_del(&adap->dev);
++err_put_adap:
+ init_completion(&adap->dev_released);
+- device_unregister(&adap->dev);
++ put_device(&adap->dev);
+ wait_for_completion(&adap->dev_released);
+-err_remove_irq_domain:
++
+ i2c_host_notify_irq_teardown(adap);
+ out_list:
+ mutex_lock(&core_lock);
--- /dev/null
+From stable+bounces-271942-greg=kroah.com@vger.kernel.org Sat Jul 4 13:49:33 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2026 07:49:06 -0400
+Subject: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
+To: stable@vger.kernel.org
+Cc: Sean Christopherson <seanjc@google.com>, Paolo Bonzini <pbonzini@redhat.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260704114906.619565-1-sashal@kernel.org>
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit f1edbed787ba67988ed34e0132ca128b052b6ce8 ]
+
+Drop a BUG_ON() that has been reachable since it was first added, way back
+in 2009, and instead use get_unaligned() to perform potentially-unaligned
+accesses.
+
+For a given store, KVM x86's emulator tracks the entire value in the
+destination operand, x86_emulate_ctxt.dst. If the destination is memory,
+and the target splits multiple pages and/or is emulated MMIO, then KVM
+handles each fragment independently. E.g. on a page split starting at page
+offset 0xffc, KVM writes 4 bytes to the first page, then the remaining
+bytes to the second page, using ctxt->dst as the source for both (with
+appropriate offsets).
+
+If the destination splits a page *and* hits emulated MMIO on the second
+page, then KVM will complete the write to the first page, then emulate the
+MMIO access to the second page. If there is a datamatch-enabled ioeventfd
+at offset 0 of the second page, then KVM will process the remainder of the
+store as a potential ioeventfd signal.
+
+Putting it all together, if the guest emits a store that splits a page
+starting at page offset N, and the second page has a datamatch-enabled
+ioeventfd at offset 0, then KVM will check for datamatch using
+&dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being
+32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.
+
+E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,
+all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()
+fires due to @val being 4-byte aligned, but not 8-byte aligned.
+
+ ------------[ cut here ]------------
+ kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
+ Oops: invalid opcode: 0000 [#1] SMP
+ CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+ RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
+ Call Trace:
+ <TASK>
+ __kvm_io_bus_write+0x85/0xb0 [kvm]
+ kvm_io_bus_write+0x53/0x80 [kvm]
+ vcpu_mmio_write+0x66/0xf0 [kvm]
+ emulator_read_write_onepage+0x12a/0x540 [kvm]
+ emulator_read_write+0x109/0x2b0 [kvm]
+ x86_emulate_insn+0x4f8/0xfb0 [kvm]
+ x86_emulate_instruction+0x181/0x790 [kvm]
+ kvm_mmu_page_fault+0x313/0x630 [kvm]
+ vmx_handle_exit+0x18a/0x590 [kvm_intel]
+ kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
+ kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
+ __x64_sys_ioctl+0x8a/0xd0
+ do_syscall_64+0xb7/0x890
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ RIP: 0033:0x7f19c931a9bf
+ </TASK>
+ Modules linked in: kvm_intel kvm irqbypass
+ ---[ end trace 0000000000000000 ]---
+
+In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM
+x86 doesn't perform alignment checks on "normal" memory accesses at CPL0.
+Sadly, C99 ruins all the fun; while the x86 architecture plays nice,
+dereferencing an unaligned pointer directly is undefined behavior in C,
+e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.
+
+Fixes: d34e6b175e61 ("KVM: add ioeventfd support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20260612225241.678509-1-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[ Adjusted context to use `#include <asm/unaligned.h>` since `linux/unaligned.h` doesn't exist in 6.6. ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/eventfd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -24,6 +24,7 @@
+ #include <linux/slab.h>
+ #include <linux/seqlock.h>
+ #include <linux/irqbypass.h>
++#include <asm/unaligned.h>
+ #include <trace/events/kvm.h>
+
+ #include <kvm/iodev.h>
+@@ -724,21 +725,18 @@ ioeventfd_in_range(struct _ioeventfd *p,
+ return true;
+
+ /* otherwise, we have to actually compare the data */
+-
+- BUG_ON(!IS_ALIGNED((unsigned long)val, len));
+-
+ switch (len) {
+ case 1:
+- _val = *(u8 *)val;
++ _val = get_unaligned((u8 *)val);
+ break;
+ case 2:
+- _val = *(u16 *)val;
++ _val = get_unaligned((u16 *)val);
+ break;
+ case 4:
+- _val = *(u32 *)val;
++ _val = get_unaligned((u32 *)val);
+ break;
+ case 8:
+- _val = *(u64 *)val;
++ _val = get_unaligned((u64 *)val);
+ break;
+ default:
+ return false;
--- /dev/null
+From stable+bounces-270551-greg=kroah.com@vger.kernel.org Thu Jul 2 17:12:42 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2026 11:11:04 -0400
+Subject: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
+To: stable@vger.kernel.org
+Cc: Maoyi Xie <maoyixie.tju@gmail.com>, Xiao Liang <shaw.leon@gmail.com>, Kuniyuki Iwashima <kuniyu@google.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260702151104.3512866-1-sashal@kernel.org>
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]
+
+A tunnel changelink() operates on at most two netns, dev_net(dev) and
+the tunnel link netns t->net. They differ once the device is created in
+or moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in
+net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is
+skipped when the link netns is dev_net(dev), where the rtnl path already
+checked it. The other patches in this series use the same helper.
+
+Gate ipgre_changelink() and erspan_changelink() with it, at the top of
+the op before any attribute is parsed, because the parsers update live
+tunnel fields first. ipgre_netlink_parms() sets t->collect_md before
+ip_tunnel_changelink() runs.
+
+Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in
+vti6_siocdevprivate().") added the same check on the ioctl path. This
+adds it on RTM_NEWLINK.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: b57708add314 ("gre: add x-netns support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/rtnetlink.h | 2 ++
+ net/core/rtnetlink.c | 8 ++++++++
+ net/ipv4/ip_gre.c | 6 ++++++
+ 3 files changed, 16 insertions(+)
+
+--- a/include/net/rtnetlink.h
++++ b/include/net/rtnetlink.h
+@@ -210,6 +210,8 @@ int rtnl_configure_link(struct net_devic
+ int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
+ struct netlink_ext_ack *exterr);
+ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
++bool rtnl_dev_link_net_capable(const struct net_device *dev,
++ const struct net *link_net);
+
+ #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2110,6 +2110,14 @@ struct net *rtnl_get_net_ns_capable(stru
+ }
+ EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
+
++bool rtnl_dev_link_net_capable(const struct net_device *dev,
++ const struct net *link_net)
++{
++ return net_eq(link_net, dev_net(dev)) ||
++ ns_capable(link_net->user_ns, CAP_NET_ADMIN);
++}
++EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
++
+ static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
+ bool strict_check, struct nlattr **tb,
+ struct netlink_ext_ack *extack)
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1406,6 +1406,9 @@ static int ipgre_changelink(struct net_d
+ struct ip_tunnel_parm p;
+ int err;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ err = ipgre_newlink_encap_setup(dev, data);
+ if (err)
+ return err;
+@@ -1435,6 +1438,9 @@ static int erspan_changelink(struct net_
+ struct ip_tunnel_parm p;
+ int err;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ err = ipgre_newlink_encap_setup(dev, data);
+ if (err)
+ return err;
--- /dev/null
+From stable+bounces-272092-greg=kroah.com@vger.kernel.org Sun Jul 5 21:06:33 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 15:06:24 -0400
+Subject: nfsd: Don't reset the write verifier on a commit EAGAIN
+To: stable@vger.kernel.org
+Cc: Trond Myklebust <trond.myklebust@hammerspace.com>, Jeff Layton <jlayton@kernel.org>, Chuck Lever <chuck.lever@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705190625.1988013-1-sashal@kernel.org>
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 1b2021bdeeca12364ad0fa7aac9ddba5cae964f3 ]
+
+If fsync() is returning EAGAIN, then we can assume that the filesystem
+being exported is something like NFS with the 'softerr' mount option
+enabled, and that it is just asking us to replay the fsync() operation
+at a later date.
+
+If we see an ESTALE, then ditto: the file is gone, so there is no danger
+of losing the error.
+
+For those cases, do not reset the write verifier. A write verifier
+change has a global effect, causing retransmission by all clients of
+all uncommitted unstable writes for all files, so it is worth
+mitigating where possible.
+
+Link: https://lore.kernel.org/linux-nfs/20230911184357.11739-1-trond.myklebust@hammerspace.com/
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Stable-dep-of: 2090b05803fa ("nfsd: reset write verifier on deferred writeback errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/vfs.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -334,6 +334,24 @@ out:
+ return err;
+ }
+
++static void
++commit_reset_write_verifier(struct nfsd_net *nn, struct svc_rqst *rqstp,
++ int err)
++{
++ switch (err) {
++ case -EAGAIN:
++ case -ESTALE:
++ /*
++ * Neither of these are the result of a problem with
++ * durable storage, so avoid a write verifier reset.
++ */
++ break;
++ default:
++ nfsd_reset_write_verifier(nn);
++ trace_nfsd_writeverf_reset(nn, rqstp, err);
++ }
++}
++
+ /*
+ * Commit metadata changes to stable storage.
+ */
+@@ -646,8 +664,7 @@ __be32 nfsd4_clone_file_range(struct svc
+ &nfsd4_get_cstate(rqstp)->current_fh,
+ dst_pos,
+ count, status);
+- nfsd_reset_write_verifier(nn);
+- trace_nfsd_writeverf_reset(nn, rqstp, status);
++ commit_reset_write_verifier(nn, rqstp, status);
+ ret = nfserrno(status);
+ }
+ }
+@@ -1126,8 +1143,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ host_err = vfs_iter_write(file, &iter, &pos, flags);
+ file_end_write(file);
+ if (host_err < 0) {
+- nfsd_reset_write_verifier(nn);
+- trace_nfsd_writeverf_reset(nn, rqstp, host_err);
++ commit_reset_write_verifier(nn, rqstp, host_err);
+ goto out_nfserr;
+ }
+ *cnt = host_err;
+@@ -1142,10 +1158,8 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+
+ if (stable && use_wgather) {
+ host_err = wait_for_concurrent_writes(file);
+- if (host_err < 0) {
+- nfsd_reset_write_verifier(nn);
+- trace_nfsd_writeverf_reset(nn, rqstp, host_err);
+- }
++ if (host_err < 0)
++ commit_reset_write_verifier(nn, rqstp, host_err);
+ }
+
+ out_nfserr:
+@@ -1284,8 +1298,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru
+ err = nfserr_notsupp;
+ break;
+ default:
+- nfsd_reset_write_verifier(nn);
+- trace_nfsd_writeverf_reset(nn, rqstp, err2);
++ commit_reset_write_verifier(nn, rqstp, err2);
+ err = nfserrno(err2);
+ }
+ } else
--- /dev/null
+From stable+bounces-272067-greg=kroah.com@vger.kernel.org Sun Jul 5 16:09:09 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2026 10:09:02 -0400
+Subject: NFSv4/flexfiles: reject zero filehandle version count
+To: stable@vger.kernel.org
+Cc: Michael Bommarito <michael.bommarito@gmail.com>, Anna Schumaker <anna.schumaker@hammerspace.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260705140902.1776411-1-sashal@kernel.org>
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+[ Upstream commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 ]
+
+ff_layout_alloc_lseg() decodes the filehandle-version array count
+from the flexfiles layout body. The value is used as the count for
+kzalloc_objs(), and the current code only rejects NULL.
+
+A zero count yields ZERO_SIZE_PTR, which can be stored in
+dss_info->fh_versions even though later flexfiles paths assume that at
+least one filehandle version exists.
+
+Reject fh_count == 0 before the allocation, matching the existing zero
+version_count validation in the flexfiles GETDEVICEINFO parser.
+
+A QEMU/KASAN run with a malformed flexfiles layout hit:
+
+ KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
+ RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
+ ff_layout_encode_layoutreturn+0x683/0x970
+ nfs4_xdr_enc_layoutreturn+0x278/0x3a0
+ Kernel panic - not syncing: Fatal exception
+
+The patched kernel rejects the malformed layout without KASAN/oops/panic,
+and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
+
+Cc: stable@vger.kernel.org
+Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -460,6 +460,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_
+ if (!p)
+ goto out_err_free;
+ fh_count = be32_to_cpup(p);
++ if (fh_count == 0) {
++ rc = -EINVAL;
++ goto out_err_free;
++ }
+
+ fls->mirror_array[i]->fh_versions =
+ kcalloc(fh_count, sizeof(struct nfs_fh),
--- /dev/null
+From stable+bounces-271972-greg=kroah.com@vger.kernel.org Sat Jul 4 15:40:33 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2026 09:40:26 -0400
+Subject: rpmsg: char: Fix use-after-free on probe error path
+To: stable@vger.kernel.org
+Cc: Yuho Choi <dbgh9129@gmail.com>, Mathieu Poirier <mathieu.poirier@linaro.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260704134026.903689-1-sashal@kernel.org>
+
+From: Yuho Choi <dbgh9129@gmail.com>
+
+[ Upstream commit 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b ]
+
+rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
+endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
+rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
+the default endpoint may still dispatch callbacks with the stale priv
+pointer.
+
+Avoid publishing eptdev through the default endpoint until
+rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
+pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
+updates can hit rpmsg_ept_flow_cb() in the same window, so make both
+callbacks return success when priv is NULL.
+
+Fixes: bc69d1066569 ("rpmsg: char: Introduce the "rpmsg-raw" channel")
+Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20260601183247.1962010-1-dbgh9129@gmail.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rpmsg/rpmsg_char.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/rpmsg/rpmsg_char.c
++++ b/drivers/rpmsg/rpmsg_char.c
+@@ -100,6 +100,9 @@ static int rpmsg_ept_cb(struct rpmsg_dev
+ struct rpmsg_eptdev *eptdev = priv;
+ struct sk_buff *skb;
+
++ if (!eptdev)
++ return 0;
++
+ skb = alloc_skb(len, GFP_ATOMIC);
+ if (!skb)
+ return -ENOMEM;
+@@ -448,6 +451,7 @@ static int rpmsg_chrdev_probe(struct rpm
+ struct rpmsg_channel_info chinfo;
+ struct rpmsg_eptdev *eptdev;
+ struct device *dev = &rpdev->dev;
++ int ret;
+
+ memcpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
+ chinfo.src = rpdev->src;
+@@ -460,13 +464,17 @@ static int rpmsg_chrdev_probe(struct rpm
+ /* Set the default_ept to the rpmsg device endpoint */
+ eptdev->default_ept = rpdev->ept;
+
++ ret = rpmsg_chrdev_eptdev_add(eptdev, chinfo);
++
++ if (ret)
++ return ret;
+ /*
+ * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context.
+- * Storedit in default_ept *priv field.
++ * Stored it in default_ept *priv field.
+ */
+ eptdev->default_ept->priv = eptdev;
+
+- return rpmsg_chrdev_eptdev_add(eptdev, chinfo);
++ return 0;
+ }
+
+ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch
slimbus-convert-to-platform-remove-callback-returnin.patch
slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch
+net-ip_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+device-property-initialize-the-remaining-fields-of-fwnode_handle-in-fwnode_init.patch
+f2fs-keep-atomic-write-retry-from-zeroing-original-data.patch
+f2fs-validate-orphan-inode-entry-count.patch
+f2fs-bound-i_inline_xattr_size-for-non-inline-xattr-inodes.patch
+f2fs-fix-potential-deadlock-in-f2fs_balance_fs.patch
+f2fs-fix-potential-deadlock-in-gc_merge-path-of-f2fs_balance_fs.patch
+f2fs-fix-listxattr-handling-of-corrupted-xattr-entries.patch
+kvm-replace-guest-triggerable-bug_on-in-ioeventfd-datamatch-with-get_unaligned.patch
+block-avoid-mounting-the-bdev-pseudo-filesystem-in-userspace.patch
+rpmsg-char-fix-use-after-free-on-probe-error-path.patch
+i2c-core-fix-irq-domain-leak-on-adapter-registration-failure.patch
+i2c-core-fix-hang-on-adapter-registration-failure.patch
+i2c-core-fix-null-deref-on-adapter-registration-failure.patch
+i2c-core-fix-adapter-debugfs-creation.patch
+i2c-core-fix-adapter-registration-race.patch
+fbdev-fbcon-fix-out-of-bounds-read-in-err_out-of-fbcon_do_set_font.patch
+nfsv4-flexfiles-reject-zero-filehandle-version-count.patch
+nfsd-don-t-reset-the-write-verifier-on-a-commit-eagain.patch
+apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
