--- /dev/null
+From 0307d16f3610eb29ad0b7529846de7d62fed60ca Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 18 Mar 2025 11:20:19 +0000
+Subject: afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
+
+From: David Howells <dhowells@redhat.com>
+
+commit 0307d16f3610eb29ad0b7529846de7d62fed60ca upstream.
+
+Fix afs_atcell_get_link() to check if the workstation cell is unset before
+doing the RCU pathwalk bit where we dereference that.
+
+Fixes: 823869e1e616 ("afs: Fix afs_atcell_get_link() to handle RCU pathwalk")
+Reported-by: syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/2481796.1742296819@warthog.procyon.org.uk
+Tested-by: syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/dynroot.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -209,6 +209,9 @@ static const char *afs_atcell_get_link(s
+ const char *name;
+ bool dotted = vnode->fid.vnode == 3;
+
++ if (!rcu_access_pointer(net->ws_cell))
++ return ERR_PTR(-ENOENT);
++
+ if (!dentry) {
+ /* We're in RCU-pathwalk. */
+ cell = rcu_dereference(net->ws_cell);
+@@ -220,9 +223,6 @@ static const char *afs_atcell_get_link(s
+ return name;
+ }
+
+- if (!rcu_access_pointer(net->ws_cell))
+- return ERR_PTR(-ENOENT);
+-
+ down_read(&net->cells_lock);
+
+ cell = rcu_dereference_protected(net->ws_cell, lockdep_is_held(&net->cells_lock));
--- /dev/null
+From a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 8 Apr 2025 21:46:29 +0100
+Subject: afs: Fix afs_dynroot_readdir() to not use the RCU read lock
+
+From: David Howells <dhowells@redhat.com>
+
+commit a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 upstream.
+
+afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
+emitting cell automount entries - but dir_emit() may write to a userspace
+buffer, thereby causing a fault to occur and waits to happen.
+
+Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.
+
+This can be triggered by enabling lockdep, preconfiguring a number of
+cells, doing "mount -t afs none /afs -o dyn" (or using the kafs-client
+package with afs.mount systemd unit enabled) and then doing "ls /afs".
+
+Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
+Reported-by: syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com
+Reported-by: syzbot+8245611446194a52150d@syzkaller.appspotmail.com
+Reported-by: syzbot+1aa62e6852a6ad1c7944@syzkaller.appspotmail.com
+Reported-by: syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/1638014.1744145189@warthog.procyon.org.uk
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/dynroot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -347,9 +347,9 @@ static int afs_dynroot_readdir(struct fi
+ }
+
+ if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
+- rcu_read_lock();
++ down_read(&net->cells_lock);
+ ret = afs_dynroot_readdir_cells(net, ctx);
+- rcu_read_unlock();
++ up_read(&net->cells_lock);
+ }
+ return ret;
+ }
--- /dev/null
+From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Fri, 12 Jun 2026 10:21:09 -0400
+Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream.
+
+b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding
+conn ref") don't reset the chan->conn to NULL anymore making the bt#
+netdev not be remove once the last l2cap_chan_del is removed.
+
+Instead of restoring the original behavior this remove the logic of
+keeping the interface after the last channel is removed because it
+never worked as intended and the l2cap_chan_del always detach its
+l2cap_conn which results in always removing the channel anyway.
+
+Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/6lowpan.c | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -781,20 +781,10 @@ static void chan_close_cb(struct l2cap_c
+ struct lowpan_btle_dev *dev = NULL;
+ struct lowpan_peer *peer;
+ int err = -ENOENT;
+- bool last = false, remove = true;
++ bool last = false;
+
+ BT_DBG("chan %p conn %p", chan, chan->conn);
+
+- if (chan->conn && chan->conn->hcon) {
+- if (!is_bt_6lowpan(chan->conn->hcon))
+- return;
+-
+- /* If conn is set, then the netdev is also there and we should
+- * not remove it.
+- */
+- remove = false;
+- }
+-
+ spin_lock(&devices_lock);
+
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+@@ -821,10 +811,8 @@ static void chan_close_cb(struct l2cap_c
+
+ ifdown(dev->netdev);
+
+- if (remove) {
+- INIT_WORK(&entry->delete_netdev, delete_netdev);
+- schedule_work(&entry->delete_netdev);
+- }
++ INIT_WORK(&entry->delete_netdev, delete_netdev);
++ schedule_work(&entry->delete_netdev);
+ } else {
+ spin_unlock(&devices_lock);
+ }
--- /dev/null
+From 59710a26a289ad4e7ef227d22063e964930928b0 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Mon, 30 Jun 2025 15:37:46 -0400
+Subject: Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 59710a26a289ad4e7ef227d22063e964930928b0 upstream.
+
+The check for destination to be BDADDR_ANY is no longer necessary with
+the introduction of BIS_LINK.
+
+Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/bluetooth/hci_core.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1367,8 +1367,7 @@ hci_conn_hash_lookup_big_state(struct hc
+ rcu_read_lock();
+
+ list_for_each_entry_rcu(c, &h->list, list) {
+- if (c->type != BIS_LINK || bacmp(&c->dst, BDADDR_ANY) ||
+- c->state != state)
++ if (c->type != BIS_LINK || c->state != state)
+ continue;
+
+ if (handle == c->iso_qos.bcast.big) {
--- /dev/null
+From 314d30b1508682e27c8a324096262c66f23455d9 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Thu, 3 Jul 2025 09:45:08 -0400
+Subject: Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 314d30b1508682e27c8a324096262c66f23455d9 upstream.
+
+BIS/PA connections do have their own cleanup proceedure which are
+performed by hci_conn_cleanup/bis_cleanup.
+
+Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_sync.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -5543,7 +5543,7 @@ static int hci_disconnect_sync(struct hc
+ {
+ struct hci_cp_disconnect cp;
+
+- if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) {
++ if (conn->type == BIS_LINK) {
+ /* This is a BIS connection, hci_conn_del will
+ * do the necessary cleanup.
+ */
--- /dev/null
+From 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 17 Mar 2026 11:54:01 -0400
+Subject: Bluetooth: L2CAP: Fix regressions caused by reusing ident
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream.
+
+This attempt to fix regressions caused by reusing ident which apparently
+is not handled well on certain stacks causing the stack to not respond to
+requests, so instead of simple returning the first unallocated id this
+stores the last used tx_ident and then attempt to use the next until all
+available ids are exausted and then cycle starting over to 1.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177
+Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Tested-by: Christian Eggers <ceggers@arri.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/bluetooth/l2cap.h | 1 +
+ net/bluetooth/l2cap_core.c | 29 ++++++++++++++++++++++++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+--- a/include/net/bluetooth/l2cap.h
++++ b/include/net/bluetooth/l2cap.h
+@@ -660,6 +660,7 @@ struct l2cap_conn {
+ struct sk_buff *rx_skb;
+ __u32 rx_len;
+ struct ida tx_ida;
++ __u8 tx_ident;
+
+ struct sk_buff_head pending_rx;
+ struct work_struct pending_rx_work;
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -958,16 +958,39 @@ int l2cap_chan_check_security(struct l2c
+
+ static int l2cap_get_ident(struct l2cap_conn *conn)
+ {
++ u8 max;
++ int ident;
++
+ /* LE link does not support tools like l2ping so use the full range */
+ if (conn->hcon->type == LE_LINK)
+- return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
+-
++ max = 255;
+ /* Get next available identificator.
+ * 1 - 128 are used by kernel.
+ * 129 - 199 are reserved.
+ * 200 - 254 are used by utilities like l2ping, etc.
+ */
+- return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
++ else
++ max = 128;
++
++ /* Allocate ident using min as last used + 1 (cyclic) */
++ ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
++ max, GFP_ATOMIC);
++ /* Force min 1 to start over */
++ if (ident <= 0) {
++ ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
++ if (ident <= 0) {
++ /* If all idents are in use, log an error, this is
++ * extremely unlikely to happen and would indicate a bug
++ * in the code that idents are not being freed properly.
++ */
++ BT_ERR("Unable to allocate ident: %d", ident);
++ return 0;
++ }
++ }
++
++ WRITE_ONCE(conn->tx_ident, ident);
++
++ return ident;
+ }
+
+ static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
--- /dev/null
+From 6e1930ece855a4c256f1c7e6632d634cfb9888b5 Mon Sep 17 00:00:00 2001
+From: Stig Hornang <stig@hornang.me>
+Date: Fri, 12 Jun 2026 16:38:18 +0200
+Subject: Bluetooth: L2CAP: fix tx ident leak for commands without a response
+
+From: Stig Hornang <stig@hornang.me>
+
+commit 6e1930ece855a4c256f1c7e6632d634cfb9888b5 upstream.
+
+Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding
+TX ident") changed ident allocation to use an IDA, releasing idents in
+l2cap_put_ident() when the matching response command is received.
+
+But identifiers allocated for commands that have no response defined
+are never released. In particular L2CAP_LE_CREDITS is sent repeatedly for
+the lifetime of an LE CoC channel, so a peer streaming data to the
+host exhausts the 1-255 ident range after 254 credit packets. From
+then on l2cap_get_ident() fails:
+
+ kernel: Bluetooth: Unable to allocate ident: -28
+
+and every subsequent L2CAP_LE_CREDITS packet is sent with ident 0,
+which is invalid (Core Spec, Vol 3, Part A, Section 4: "Signaling
+identifier 0x00 is an invalid identifier and shall never be used in
+any command"). Remote stacks that validate the ident drop these
+commands, never receive new credits, and the channel stalls
+permanently. With default socket buffers this happens after roughly 0.5 MB
+of received data (the exact amount depends on the socket receive buffer):
+
+ < ACL Data TX: Handle 2048 flags 0x00 dlen 12
+ LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4
+ Source CID: 64
+ Credits: 1
+
+Release the ident immediately after sending L2CAP_LE_CREDITS since no
+response will ever release it. Use a local variable instead of
+chan->ident so that an ident that an EXT_FLOWCTL channel may be waiting on
+(e.g. a pending reconfigure) is not overwritten by a credit packet.
+
+Also add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so
+idents allocated for outgoing L2CAP_LE_CONN_REQ commands are released
+when the response arrives.
+
+Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221629
+Assisted-by: Claude:claude-opus-4.8
+Assisted-by: Fable:5
+Signed-off-by: Stig Hornang <stig@hornang.me>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/l2cap_core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4857,6 +4857,7 @@ static void l2cap_put_ident(struct l2cap
+ case L2CAP_ECHO_RSP:
+ case L2CAP_INFO_RSP:
+ case L2CAP_CONN_PARAM_UPDATE_RSP:
++ case L2CAP_LE_CONN_RSP:
+ case L2CAP_ECRED_CONN_RSP:
+ case L2CAP_ECRED_RECONF_RSP:
+ /* The remote may send bogus ids that would make ida_free
+@@ -6755,6 +6756,7 @@ static void l2cap_chan_le_send_credits(s
+ struct l2cap_conn *conn = chan->conn;
+ struct l2cap_le_credits pkt;
+ u16 return_credits = l2cap_le_rx_credits(chan);
++ int ident;
+
+ if (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+ chan->mode != L2CAP_MODE_EXT_FLOWCTL)
+@@ -6772,9 +6774,18 @@ static void l2cap_chan_le_send_credits(s
+ pkt.cid = cpu_to_le16(chan->scid);
+ pkt.credits = cpu_to_le16(return_credits);
+
+- chan->ident = l2cap_get_ident(conn);
++ ident = l2cap_get_ident(conn);
++
++ l2cap_send_cmd(conn, ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
+
+- l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
++ /* L2CAP_LE_CREDITS has no response so the ident is never released by
++ * l2cap_put_ident() - release it right away, otherwise the tx_ida
++ * range is exhausted after 254 packets and from then on credits are
++ * sent with the invalid ident 0, which some remote stacks ignore,
++ * stalling the channel.
++ */
++ if (ident > 0)
++ ida_free(&conn->tx_ida, ident);
+ }
+
+ void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
--- /dev/null
+From 46834d90a9a13549264b9581067d8f746b4b36cc Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Sat, 6 Sep 2025 14:21:45 +0200
+Subject: crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit 46834d90a9a13549264b9581067d8f746b4b36cc upstream.
+
+When
+
+ 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown")
+
+moved the error messages dumping so that they don't need to be issued by
+the callers, it missed the case where __sev_firmware_shutdown() calls
+__sev_platform_shutdown_locked() with a NULL argument which leads to
+a NULL ptr deref on the shutdown path, during suspend to disk:
+
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: Oops: 0000 [#1] SMP NOPTI
+ CPU: 0 UID: 0 PID: 983 Comm: hib.sh Not tainted 6.17.0-rc4+ #1 PREEMPT(voluntary)
+ Hardware name: Supermicro Super Server/H12SSL-i, BIOS 2.5 09/08/2022
+ RIP: 0010:__sev_platform_shutdown_locked.cold+0x0/0x21 [ccp]
+
+That rIP is:
+
+ 00000000000006fd <__sev_platform_shutdown_locked.cold>:
+ 6fd: 8b 13 mov (%rbx),%edx
+ 6ff: 48 8b 7d 00 mov 0x0(%rbp),%rdi
+ 703: 89 c1 mov %eax,%ecx
+
+ Code: 74 05 31 ff 41 89 3f 49 8b 3e 89 ea 48 c7 c6 a0 8e 54 a0 41 bf 92 ff ff ff e8 e5 2e 09 e1 c6 05 2a d4 38 00 01 e9 26 af ff ff <8b> 13 48 8b 7d 00 89 c1 48 c7 c6 18 90 54 a0 89 44 24 04 e8 c1 2e
+ RSP: 0018:ffffc90005467d00 EFLAGS: 00010282
+ RAX: 00000000ffffff92 RBX: 0000000000000000 RCX: 0000000000000000
+ ^^^^^^^^^^^^^^^^
+and %rbx is nice and clean.
+
+ Call Trace:
+ <TASK>
+ __sev_firmware_shutdown.isra.0
+ sev_dev_destroy
+ psp_dev_destroy
+ sp_destroy
+ pci_device_shutdown
+ device_shutdown
+ kernel_power_off
+ hibernate.cold
+ state_store
+ kernfs_fop_write_iter
+ vfs_write
+ ksys_write
+ do_syscall_64
+ entry_SYSCALL_64_after_hwframe
+
+Pass in a pointer to the function-local error var in the caller.
+
+With that addressed, suspending the ccp shows the error properly at
+least:
+
+ ccp 0000:47:00.1: sev command 0x2 timed out, disabling PSP
+ ccp 0000:47:00.1: SEV: failed to SHUTDOWN error 0x0, rc -110
+ SEV-SNP: Leaking PFN range 0x146800-0x146a00
+ SEV-SNP: PFN 0x146800 unassigned, dumping non-zero entries in 2M PFN region: [0x146800 - 0x146a00]
+ ...
+ ccp 0000:47:00.1: SEV-SNP firmware shutdown failed, rc -16, error 0x0
+ ACPI: PM: Preparing to enter system sleep state S5
+ kvm: exiting hardware virtualization
+ reboot: Power down
+
+Btw, this driver is crying to be cleaned up to pass in a proper I/O
+struct which can be used to store information between the different
+functions, otherwise stuff like that will happen in the future again.
+
+Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown")
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: <stable@kernel.org>
+Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -2408,7 +2408,7 @@ static void __sev_firmware_shutdown(stru
+ {
+ int error;
+
+- __sev_platform_shutdown_locked(NULL);
++ __sev_platform_shutdown_locked(&error);
+
+ if (sev_es_tmr) {
+ /*
--- /dev/null
+From 9af6339a65426b0b4850b07ff3b6959497bfcac5 Mon Sep 17 00:00:00 2001
+From: Ashish Kalra <ashish.kalra@amd.com>
+Date: Wed, 9 Apr 2025 19:34:29 +0000
+Subject: crypto: ccp - Fix __sev_snp_shutdown_locked
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+commit 9af6339a65426b0b4850b07ff3b6959497bfcac5 upstream.
+
+Fix smatch warning:
+ drivers/crypto/ccp/sev-dev.c:1755 __sev_snp_shutdown_locked()
+ error: uninitialized symbol 'dfflush_error'.
+
+Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/linux-crypto/d9c2e79c-e26e-47b7-8243-ff6e7b101ec3@stanley.mountain/
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -1743,7 +1743,7 @@ static int __sev_snp_shutdown_locked(int
+ ret = __sev_do_cmd_locked(SEV_CMD_SNP_SHUTDOWN_EX, &data, error);
+ /* SHUTDOWN may require DF_FLUSH */
+ if (*error == SEV_RET_DFFLUSH_REQUIRED) {
+- int dfflush_error;
++ int dfflush_error = SEV_RET_NO_FW_CALL;
+
+ ret = __sev_do_cmd_locked(SEV_CMD_SNP_DF_FLUSH, NULL, &dfflush_error);
+ if (ret) {
--- /dev/null
+From 0fa766726c091ff0ec7d26874f6e4724d23ecb0e Mon Sep 17 00:00:00 2001
+From: Ashish Kalra <ashish.kalra@amd.com>
+Date: Wed, 28 May 2025 20:20:18 +0000
+Subject: crypto: ccp - Fix dereferencing uninitialized error pointer
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+commit 0fa766726c091ff0ec7d26874f6e4724d23ecb0e upstream.
+
+Fix below smatch warnings:
+drivers/crypto/ccp/sev-dev.c:1312 __sev_platform_init_locked()
+error: we previously assumed 'error' could be null
+
+Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202505071746.eWOx5QgC-lkp@intel.com/
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -1271,9 +1271,11 @@ static int __sev_platform_init_handle_in
+
+ static int __sev_platform_init_locked(int *error)
+ {
+- int rc, psp_ret = SEV_RET_NO_FW_CALL;
++ int rc, psp_ret, dfflush_error;
+ struct sev_device *sev;
+
++ psp_ret = dfflush_error = SEV_RET_NO_FW_CALL;
++
+ if (!psp_master || !psp_master->sev_data)
+ return -ENODEV;
+
+@@ -1315,10 +1317,10 @@ static int __sev_platform_init_locked(in
+
+ /* Prepare for first SEV guest launch after INIT */
+ wbinvd_on_all_cpus();
+- rc = __sev_do_cmd_locked(SEV_CMD_DF_FLUSH, NULL, error);
++ rc = __sev_do_cmd_locked(SEV_CMD_DF_FLUSH, NULL, &dfflush_error);
+ if (rc) {
+ dev_err(sev->dev, "SEV: DF_FLUSH failed %#x, rc %d\n",
+- *error, rc);
++ dfflush_error, rc);
+ return rc;
+ }
+
--- /dev/null
+From 5c52607c43c397b79a9852ce33fc61de58c3645c Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 4 Mar 2026 12:39:34 -0800
+Subject: crypto: ccp - Fix leaking the same page twice
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 5c52607c43c397b79a9852ce33fc61de58c3645c upstream.
+
+Commit 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is
+missed") fixed a case where SNP is left in INIT state if page reclaim
+fails. It removes the transition to the INIT state for this command and
+adjusts the page state management.
+
+While doing this, it added a call to snp_leak_pages() after a call to
+snp_reclaim_pages() failed. Since snp_reclaim_pages() already calls
+snp_leak_pages() internally on the pages it fails to reclaim, calling
+it again leaks the exact same page twice.
+
+Fix by removing the extra call to snp_leak_pages().
+
+The problem was found by an experimental code review agent based on
+gemini-3.1-pro while reviewing backports into v6.18.y.
+
+Assisted-by: Gemini:gemini-3.1-pro
+Fixes: 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is missed")
+Cc: Tycho Andersen (AMD) <tycho@kernel.org>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -2102,10 +2102,8 @@ static int sev_ioctl_do_snp_platform_sta
+ * in Firmware state on failure. Use snp_reclaim_pages() to
+ * transition either case back to Hypervisor-owned state.
+ */
+- if (snp_reclaim_pages(__pa(data), 1, true)) {
+- snp_leak_pages(__page_to_pfn(status_page), 1);
++ if (snp_reclaim_pages(__pa(data), 1, true))
+ return -EFAULT;
+- }
+ }
+
+ if (ret)
--- /dev/null
+From ab8b9fd39c45b7760093528cbef93e7353359d82 Mon Sep 17 00:00:00 2001
+From: Ashish Kalra <ashish.kalra@amd.com>
+Date: Mon, 16 Jun 2025 21:50:27 +0000
+Subject: crypto: ccp - Fix SNP panic notifier unregistration
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+commit ab8b9fd39c45b7760093528cbef93e7353359d82 upstream.
+
+Panic notifiers are invoked with RCU read lock held and when the
+SNP panic notifier tries to unregister itself from the panic
+notifier callback itself it causes a deadlock as notifier
+unregistration does RCU synchronization.
+
+Code flow for SNP panic notifier:
+snp_shutdown_on_panic() ->
+__sev_firmware_shutdown() ->
+__sev_snp_shutdown_locked() ->
+atomic_notifier_chain_unregister(.., &snp_panic_notifier)
+
+Fix SNP panic notifier to unregister itself during SNP shutdown
+only if panic is not in progress.
+
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: stable@vger.kernel.org
+Fixes: 19860c3274fb ("crypto: ccp - Register SNP panic notifier only if SNP is enabled")
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -1785,8 +1785,14 @@ static int __sev_snp_shutdown_locked(int
+ sev->snp_initialized = false;
+ dev_dbg(sev->dev, "SEV-SNP firmware shutdown\n");
+
+- atomic_notifier_chain_unregister(&panic_notifier_list,
+- &snp_panic_notifier);
++ /*
++ * __sev_snp_shutdown_locked() deadlocks when it tries to unregister
++ * itself during panic as the panic notifier is called with RCU read
++ * lock held and notifier unregistration does RCU synchronization.
++ */
++ if (!panic)
++ atomic_notifier_chain_unregister(&panic_notifier_list,
++ &snp_panic_notifier);
+
+ /* Reset TMR size back to default */
+ sev_es_tmr_size = SEV_TMR_SIZE;
--- /dev/null
+From d2e914a4a0d0f753dbae830264850d044026167c Mon Sep 17 00:00:00 2001
+From: Ivan Vecera <ivecera@redhat.com>
+Date: Fri, 10 Jul 2026 21:36:25 +0200
+Subject: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+commit d2e914a4a0d0f753dbae830264850d044026167c upstream.
+
+When a dpll_pin is shared across multiple dpll_device instances and
+those devices are being unregistered (e.g. during driver module removal),
+a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().
+
+This happens under the following conditions:
+ - A pin is registered with two or more dpll devices (dpll_A, dpll_B)
+ - The pin has ref_sync pairs with other pins
+ - During unregistration of dpll_A's pins, a ref_sync partner pin is
+ unregistered first, removing it from dpll_A->pin_refs
+ - But since the partner pin is still registered with dpll_B, its
+ dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT
+ run and the partner stays in the pin's ref_sync_pins xarray
+ - When the pin itself is then unregistered from dpll_A, the delete
+ notification calls dpll_msg_add_pin_ref_sync() which finds the
+ partner in ref_sync_pins, passes dpll_pin_available() (partner is
+ still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,
+ partner) returns NULL because partner was already removed from
+ dpll_A->pin_refs
+ - The NULL priv pointer is passed to the driver's ref_sync_get
+ callback, which dereferences it
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000034
+ Oops: Oops: 0000 [#1] SMP NOPTI
+ RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]
+ Call Trace:
+ dpll_msg_add_pin_ref_sync+0xb8/0x200
+ dpll_cmd_pin_get_one+0x3b6/0x4b0
+ dpll_pin_event_send+0x72/0x140
+ __dpll_pin_unregister+0x5a/0x2b0
+ dpll_pin_unregister+0x49/0x70
+
+Fix this by skipping ref_sync pins whose priv pointer cannot be resolved
+for the current dpll device.
+
+Fixes: 58256a26bfb3 ("dpll: add reference sync get/set")
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dpll/dpll_netlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/dpll/dpll_netlink.c
++++ b/drivers/dpll/dpll_netlink.c
+@@ -424,6 +424,9 @@ dpll_msg_add_pin_ref_sync(struct sk_buff
+ if (!dpll_pin_available(ref_sync_pin))
+ continue;
+ ref_sync_pin_priv = dpll_pin_on_dpll_priv(dpll, ref_sync_pin);
++ /* Pin may have been unregistered from this dpll already */
++ if (!ref_sync_pin_priv)
++ continue;
+ if (WARN_ON(!ops->ref_sync_get))
+ return -EOPNOTSUPP;
+ ret = ops->ref_sync_get(pin, pin_priv, ref_sync_pin,
--- /dev/null
+From 40857194956dcaf3d2b66d6bd113d844c93bef54 Mon Sep 17 00:00:00 2001
+From: Mohammad Heib <mheib@redhat.com>
+Date: Sun, 28 Dec 2025 21:40:20 +0200
+Subject: i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
+
+From: Mohammad Heib <mheib@redhat.com>
+
+commit 40857194956dcaf3d2b66d6bd113d844c93bef54 upstream.
+
+The i40e driver calls udp_tunnel_get_rx_info() during i40e_open().
+This is redundant because UDP tunnel RX offload state is preserved
+across device down/up cycles. The udp_tunnel core handles
+synchronization automatically when required.
+
+Furthermore, recent changes in the udp_tunnel infrastructure require
+querying RX info while holding the udp_tunnel lock. Calling it
+directly from the ndo_open path violates this requirement,
+triggering the following lockdep warning:
+
+ Call Trace:
+ <TASK>
+ ? __udp_tunnel_nic_assert_locked+0x39/0x40 [udp_tunnel]
+ i40e_open+0x135/0x14f [i40e]
+ __dev_open+0x121/0x2e0
+ __dev_change_flags+0x227/0x270
+ dev_change_flags+0x3d/0xb0
+ devinet_ioctl+0x56f/0x860
+ sock_do_ioctl+0x7b/0x130
+ __x64_sys_ioctl+0x91/0xd0
+ do_syscall_64+0x90/0x170
+ ...
+ </TASK>
+
+Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from
+i40e_open() resolve the locking violation.
+
+Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -9110,7 +9110,6 @@ int i40e_open(struct net_device *netdev)
+ TCP_FLAG_FIN |
+ TCP_FLAG_CWR) >> 16);
+ wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
+- udp_tunnel_get_rx_info(netdev);
+
+ return 0;
+ }
--- /dev/null
+From 234e615bfece9e3e91c50fe49ab9e68ee37c791a Mon Sep 17 00:00:00 2001
+From: Mohammad Heib <mheib@redhat.com>
+Date: Sun, 28 Dec 2025 21:40:21 +0200
+Subject: ice: drop udp_tunnel_get_rx_info() call from ndo_open()
+
+From: Mohammad Heib <mheib@redhat.com>
+
+commit 234e615bfece9e3e91c50fe49ab9e68ee37c791a upstream.
+
+The ice driver calls udp_tunnel_get_rx_info() during ice_open_internal().
+This is redundant because UDP tunnel RX offload state is preserved
+across device down/up cycles. The udp_tunnel core handles
+synchronization automatically when required.
+
+Furthermore, recent changes in the udp_tunnel infrastructure require
+querying RX info while holding the udp_tunnel lock. Calling it
+directly from the ndo_open path violates this requirement,
+triggering the following lockdep warning:
+
+Call Trace:
+ <TASK>
+ ice_open_internal+0x253/0x350 [ice]
+ __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel]
+ __dev_open+0x2f5/0x880
+ __dev_change_flags+0x44c/0x660
+ netif_change_flags+0x80/0x160
+ devinet_ioctl+0xd21/0x15f0
+ inet_ioctl+0x311/0x350
+ sock_ioctl+0x114/0x220
+ __x64_sys_ioctl+0x131/0x1a0
+ ...
+ </TASK>
+
+Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from
+ice_open_internal() to resolve the locking violation
+
+Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -9574,9 +9574,6 @@ int ice_open_internal(struct net_device
+ netdev_err(netdev, "Failed to open VSI 0x%04X on switch 0x%04X\n",
+ vsi->vsi_num, vsi->vsw->sw_id);
+
+- /* Update existing tunnels information */
+- udp_tunnel_get_rx_info(netdev);
+-
+ return err;
+ }
+
--- /dev/null
+From bb2784d9ab49587ba4fbff37a319fff2924db289 Mon Sep 17 00:00:00 2001
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+Date: Thu, 30 Jan 2025 19:26:58 +0000
+Subject: jiffies: Cast to unsigned long in secs_to_jiffies() conversion
+
+From: Easwar Hariharan <eahariha@linux.microsoft.com>
+
+commit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream.
+
+While converting users of msecs_to_jiffies(), lkp reported that some range
+checks would always be true because of the mismatch between the implied int
+value of secs_to_jiffies() vs the unsigned long return value of the
+msecs_to_jiffies() calls it was replacing.
+
+Fix this by casting the secs_to_jiffies() input value to unsigned long.
+
+Fixes: b35108a51cf7ba ("jiffies: Define secs_to_jiffies()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com
+Closes: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/jiffies.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -537,7 +537,7 @@ static __always_inline unsigned long mse
+ *
+ * Return: jiffies value
+ */
+-#define secs_to_jiffies(_secs) ((_secs) * HZ)
++#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ)
+
+ extern unsigned long __usecs_to_jiffies(const unsigned int u);
+ #if !(USEC_PER_SEC % HZ)
--- /dev/null
+From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001
+From: Gil Portnoy <dddhkts1@gmail.com>
+Date: Thu, 28 May 2026 00:00:00 +0000
+Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
+
+From: Gil Portnoy <dddhkts1@gmail.com>
+
+commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream.
+
+Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL
+before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard
+against a handle already being reconnected, but the check and the binding
+assignment are not atomic: both threads pass the guard, both call
+ksmbd_conn_get() on the same fp, and both eventually reach
+kfree(fp->owner.name) -- a double-free of the owner.name slab object.
+The double-bound ksmbd_file also causes a write-UAF on the 344-byte
+ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock
+after the object has been freed by the losing reconnect path.
+
+KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles):
+ BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308
+ BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150
+ Write of size 4 at offset 24 into freed ksmbd_file_cache object
+Five double-bind windows observed; 63 total KASAN reports triggered.
+
+Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the
+check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats
+fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before
+dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping
+refcount increment, safe under the rwlock. The rollback path on __open_id()
+failure also clears fp->conn/tcon under the lock so concurrent readers see
+a consistent state.
+
+Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak")
+Assisted-by: Henry (Claude):claude-opus-4
+Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/vfs_cache.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/smb/server/vfs_cache.c
++++ b/fs/smb/server/vfs_cache.c
+@@ -1185,19 +1185,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ struct ksmbd_lock *smb_lock;
+ unsigned int old_f_state;
+
++ write_lock(&global_ft.lock);
+ if (!fp->is_durable || fp->conn || fp->tcon) {
++ write_unlock(&global_ft.lock);
+ pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon);
+ return -EBADF;
+ }
+
+ if (has_file_id(fp->volatile_id)) {
++ write_unlock(&global_ft.lock);
+ pr_err("Still in use durable fd: %llu\n", fp->volatile_id);
+ return -EBADF;
+ }
+
+- old_f_state = fp->f_state;
+- fp->f_state = FP_NEW;
+-
+ /*
+ * Initialize fp's connection binding before publishing fp into the
+ * session's file table. If __open_id() is ordered first, a
+@@ -1208,11 +1208,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ */
+ fp->conn = ksmbd_conn_get(conn);
+ fp->tcon = work->tcon;
++ write_unlock(&global_ft.lock);
++
++ old_f_state = fp->f_state;
++ fp->f_state = FP_NEW;
+
+ __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
+ if (!has_file_id(fp->volatile_id)) {
++ write_lock(&global_ft.lock);
+ fp->conn = NULL;
+ fp->tcon = NULL;
++ write_unlock(&global_ft.lock);
+ ksmbd_conn_put(conn);
+ fp->f_state = old_f_state;
+ return -EBADF;
--- /dev/null
+From 7d0da8f862340c5f42f0062b8560b8d0971a6ac4 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 7 Jan 2025 23:26:28 +0100
+Subject: net: airoha: Fix channel configuration for ETS Qdisc
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit 7d0da8f862340c5f42f0062b8560b8d0971a6ac4 upstream.
+
+Limit ETS QoS channel to AIROHA_NUM_QOS_CHANNELS in
+airoha_tc_setup_qdisc_ets() in order to align the configured channel to
+the value set in airoha_dev_select_queue().
+
+Fixes: 20bf7d07c956 ("net: airoha: Add sched ETS offload support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/20250107-airoha-ets-fix-chan-v1-1-97f66ed3a068@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -2798,11 +2798,14 @@ static int airoha_qdma_get_tx_ets_stats(
+ static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port,
+ struct tc_ets_qopt_offload *opt)
+ {
+- int channel = TC_H_MAJ(opt->handle) >> 16;
++ int channel;
+
+ if (opt->parent == TC_H_ROOT)
+ return -EINVAL;
+
++ channel = TC_H_MAJ(opt->handle) >> 16;
++ channel = channel % AIROHA_NUM_QOS_CHANNELS;
++
+ switch (opt->command) {
+ case TC_ETS_REPLACE:
+ return airoha_qdma_set_tx_ets_sched(port, channel, opt);
--- /dev/null
+From ba993e5ada1ddce7a71140dc85ef65bc2cd981bc Mon Sep 17 00:00:00 2001
+From: James Clark <james.clark@linaro.org>
+Date: Tue, 29 Oct 2024 14:37:33 +0000
+Subject: perf arm-spe: Use old behavior when opening old SPE files
+
+From: James Clark <james.clark@linaro.org>
+
+commit ba993e5ada1ddce7a71140dc85ef65bc2cd981bc upstream.
+
+Since the linked commit, we stopped interpreting data source if the
+perf.data file doesn't have the new metadata version. This means that
+perf c2c will show no samples in this case.
+
+Keep the old behavior so old files can be opened, but also still show
+the new warning that updating might improve the decoding.
+
+Also re-write the warning to be more concise and specific to a user.
+
+Fixes: ba5e7169e548 ("perf arm-spe: Use metadata to decide the data source feature")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Cc: Julio.Suarez@arm.com
+Cc: Kiel.Friedt@arm.com
+Cc: Ryan.Roberts@arm.com
+Cc: Will Deacon <will@kernel.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Besar Wicaksono <bwicaksono@nvidia.com>
+Cc: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20241029143734.291638-1-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/arm-spe.c | 50 ++++++++++++++++++++++------------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -655,37 +655,35 @@ static bool arm_spe__is_common_ds_encodi
+ u64 *metadata = NULL;
+ u64 midr = 0;
+
+- /*
+- * Metadata version 1 doesn't contain any info for MIDR.
+- * Simply return false in this case.
+- */
++ /* Metadata version 1 assumes all CPUs are the same (old behavior) */
+ if (spe->metadata_ver == 1) {
+- pr_warning_once("The data file contains metadata version 1, "
+- "which is absent the info for data source. "
+- "Please upgrade the tool to record data.\n");
+- return false;
+- }
+-
+- /* CPU ID is -1 for per-thread mode */
+- if (speq->cpu < 0) {
+- /*
+- * On the heterogeneous system, due to CPU ID is -1,
+- * cannot confirm the data source packet is supported.
+- */
+- if (!spe->is_homogeneous)
+- return false;
++ const char *cpuid;
+
+- /* In homogeneous system, simply use CPU0's metadata */
+- if (spe->metadata)
+- metadata = spe->metadata[0];
++ pr_warning_once("Old SPE metadata, re-record to improve decode accuracy\n");
++ cpuid = perf_env__cpuid(spe->session->evlist->env);
++ midr = strtol(cpuid, NULL, 16);
+ } else {
+- metadata = arm_spe__get_metadata_by_cpu(spe, speq->cpu);
+- }
++ /* CPU ID is -1 for per-thread mode */
++ if (speq->cpu < 0) {
++ /*
++ * On the heterogeneous system, due to CPU ID is -1,
++ * cannot confirm the data source packet is supported.
++ */
++ if (!spe->is_homogeneous)
++ return false;
++
++ /* In homogeneous system, simply use CPU0's metadata */
++ if (spe->metadata)
++ metadata = spe->metadata[0];
++ } else {
++ metadata = arm_spe__get_metadata_by_cpu(spe, speq->cpu);
++ }
+
+- if (!metadata)
+- return false;
++ if (!metadata)
++ return false;
+
+- midr = metadata[ARM_SPE_CPU_MIDR];
++ midr = metadata[ARM_SPE_CPU_MIDR];
++ }
+
+ is_in_cpu_list = is_midr_in_range_list(midr, common_ds_encoding_cpus);
+ if (is_in_cpu_list)
--- /dev/null
+From 0dc96cae063cbf9ebf6631b33b08e9ba02324248 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Thu, 18 Sep 2025 10:24:16 -0700
+Subject: perf build-id: Ensure snprintf string is empty when size is 0
+
+From: Ian Rogers <irogers@google.com>
+
+commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 upstream.
+
+The string result of build_id__snprintf() is unconditionally used in
+places like dsos__fprintf_buildid_cb(). If the build id has size 0 then
+this creates a use of uninitialized memory. Add null termination for the
+size 0 case.
+
+A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf
+tools: Initialize output buffer in build_id__sprintf") but lost in the
+transition to snprintf.
+
+Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/build-id.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/tools/perf/util/build-id.c
++++ b/tools/perf/util/build-id.c
+@@ -71,6 +71,13 @@ int build_id__snprintf(const struct buil
+ {
+ size_t offs = 0;
+
++ if (build_id->size == 0) {
++ /* Ensure bf is always \0 terminated. */
++ if (bf_size > 0)
++ bf[0] = '\0';
++ return 0;
++ }
++
+ for (size_t i = 0; i < build_id->size && offs < bf_size; ++i)
+ offs += snprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]);
+
--- /dev/null
+From 017bca78e4d72b1ff027d368c20a1b2c654edaf7 Mon Sep 17 00:00:00 2001
+From: Michael Petlan <mpetlan@redhat.com>
+Date: Wed, 20 May 2026 00:38:55 +0200
+Subject: perf build-id: Fix off-by-one bug when printing kernel/module build-id
+
+From: Michael Petlan <mpetlan@redhat.com>
+
+commit 017bca78e4d72b1ff027d368c20a1b2c654edaf7 upstream.
+
+When changing sprintf functions to snprintf, one byte got lost. Since
+snprintf ones do not handle the '\0' terminating character, the number
+of printed characters is 40, while sizeof(sbuild_id) is 41, including
+the terminating '\0' character.
+
+This makes the later check fail so that nothing is printed.
+
+Fix that.
+
+Before:
+
+ [Michael@Carbon ~]$ perf buildid-list -k
+ [Michael@Carbon ~]$
+
+After:
+
+ [Michael@Carbon ~]$ perf buildid-list -k
+ a527806324d543c4bc3ff2f9c9519d494fed5f68
+ [Michael@Carbon ~]$
+
+Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf")
+Signed-off-by: Michael Petlan <mpetlan@redhat.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-buildid-list.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/builtin-buildid-list.c
++++ b/tools/perf/builtin-buildid-list.c
+@@ -58,7 +58,7 @@ static int sysfs__fprintf_build_id(FILE
+ int ret;
+
+ ret = sysfs__snprintf_build_id("/", sbuild_id, sizeof(sbuild_id));
+- if (ret != sizeof(sbuild_id))
++ if (ret + 1 != sizeof(sbuild_id))
+ return ret < 0 ? ret : -EINVAL;
+
+ return fprintf(fp, "%s\n", sbuild_id);
+@@ -70,7 +70,7 @@ static int filename__fprintf_build_id(co
+ int ret;
+
+ ret = filename__snprintf_build_id(name, sbuild_id, sizeof(sbuild_id));
+- if (ret != sizeof(sbuild_id))
++ if (ret + 1 != sizeof(sbuild_id))
+ return ret < 0 ? ret : -EINVAL;
+
+ return fprintf(fp, "%s\n", sbuild_id);
--- /dev/null
+From ae15db3e9b639491007cc1e9e99638e4b6091781 Mon Sep 17 00:00:00 2001
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 14 Apr 2026 14:42:41 +0200
+Subject: perf callchain: Handle multiple address spaces
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+commit ae15db3e9b639491007cc1e9e99638e4b6091781 upstream.
+
+perf test 'perf inject to convert DWARF callchains to regular ones'
+fails on s390. It was introduced with commit 92ea788d2af4e65a ("perf
+inject: Add --convert-callchain option")
+
+The failure comes the difference in output. Without the inject script to
+convert DWARF the callchains is:
+
+ # perf record -F 999 --call-graph dwarf -- perf test -w noploop
+ # perf report -i perf.data --stdio --no-children -q \
+ --percent-limit=1 > /tmp/111
+ # cat /tmp/111
+ 99.30% perf-noploop perf [.] noploop
+ |
+ ---noploop
+ run_workload (inlined)
+ cmd_test
+ run_builtin (inlined)
+ handle_internal_command
+ run_argv (inlined)
+ main
+ __libc_start_call_main
+ __libc_start_main_impl (inlined)
+ _start
+ #
+
+With the inject script step the output is:
+
+ # perf inject -i perf.data --convert-callchain -o /tmp/perf-inject-1.out
+ # perf report -i /tmp/perf-inject-1.out --stdio --no-children -q \
+ --percent-limit=1 > /tmp/222
+ # cat /tmp/222
+ 99.40% perf-noploop perf [.] noploop
+ |
+ ---noploop
+ run_workload (inlined)
+ cmd_test
+ run_builtin (inlined)
+ handle_internal_command
+ run_argv (inlined)
+ main
+ _start
+ # diff /tmp/111 /tmp/222
+ 1c1
+ < 99.30% perf-noploop perf [.] noploop
+ ---
+ > 99.40% perf-noploop perf [.] noploop
+ 10,11d9
+ < __libc_start_call_main
+ < __libc_start_main_impl (inlined)
+ #
+
+The difference are the symbols __libc_start_call_main and
+__libc_start_main_impl.
+
+On x86_64, kernel and user space share a single virtual address space,
+with the kernel mapped to the upper end of memory. The instruction
+pointer value alone is sufficient to distinguish between user space and
+kernel space addresses.
+
+This is not true for s390, which uses separate address spaces for user
+and kernel.
+
+The same virtual address can be valid in both address spaces, so the
+instruction pointer value alone cannot determine whether an address
+belongs to the kernel or user space.
+
+Instead, perf must rely on the cpumode metadata derived from the
+processor status word (PSW) at sample time.
+
+In function perf_event__convert_sample_callchain() the first part
+copies a kernel callchain and context entries, if any.
+
+It then appends additional entries ignoring the address space
+architecture. Taking that into account, the symbols at addresses
+
+ 0x3ff970348cb __libc_start_call_main
+ 0x3ff970349c5 __libc_start_main_impl
+
+(located after the kernel address space on s390) are now included.
+
+Output before:
+
+ # perf test 83
+ 83: perf inject to convert DWARF callchains to regular ones : FAILED!
+
+Output after:
+ # perf test 83
+ 83: perf inject to convert DWARF callchains to regular ones : Ok
+
+Question to Namhyung:
+
+In function perf_event__convert_sample_callchain() just before the
+for() loop this patch modifies, the kernel callchain is copied,
+see this comment and the next 5 lines:
+
+ /* copy kernel callchain and context entries */
+
+Then why is machine__kernel_ip() needed in the for() loop, when
+the kernel entries have been copied just before the loop?
+
+Note: This patch was tested on x86_64 virtual machine and succeeded.
+
+Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/common.c | 4 +++-
+ tools/perf/builtin-inject.c | 3 ++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/arch/common.c
++++ b/tools/perf/arch/common.c
+@@ -237,5 +237,7 @@ int perf_env__lookup_objdump(struct perf
+ */
+ bool perf_env__single_address_space(struct perf_env *env)
+ {
+- return strcmp(perf_env__arch(env), "sparc");
++ const char *arch = perf_env__arch(env);
++
++ return strcmp(arch, "s390") && strcmp(arch, "sparc");
+ }
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -452,7 +452,8 @@ static int perf_event__convert_sample_ca
+
+ node = cursor->first;
+ for (k = 0; k < cursor->nr && i < PERF_MAX_STACK_DEPTH; k++) {
+- if (machine__kernel_ip(machine, node->ip))
++ if (machine->single_address_space &&
++ machine__kernel_ip(machine, node->ip))
+ /* kernel IPs were added already */;
+ else if (node->ms.sym && node->ms.sym->inlined)
+ /* we can't handle inlined callchains */;
--- /dev/null
+From e786a04b4a5461dd7e2829422314a5a6d5a664d9 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Thu, 22 Jan 2026 09:58:46 -0800
+Subject: perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
+
+From: Ian Rogers <irogers@google.com>
+
+commit e786a04b4a5461dd7e2829422314a5a6d5a664d9 upstream.
+
+On hybrid systems there is generally >1 event and a dummy event.
+
+The perf inject --convert-callchain option is failing to convert
+perf.data files on such systems reporting "--convert-callchain requires
+DWARF call graph."
+
+The failing event is the dummy event that doesn't need to be set up for
+samples.
+
+As such ignore this event when checking the evsels.
+
+Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-inject.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -2739,7 +2739,7 @@ int cmd_inject(int argc, const char **ar
+ }
+
+ evlist__for_each_entry(inject.session->evlist, evsel) {
+- if (!evsel__has_dwarf_callchain(evsel)) {
++ if (!evsel__has_dwarf_callchain(evsel) && !evsel__is_dummy_event(evsel)) {
+ pr_err("--convert-callchain requires DWARF call graph.\n");
+ goto out_delete;
+ }
--- /dev/null
+From 1293dacbbd43ab9848ac4655f6f2ba1dcc5a96ad Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@kernel.org>
+Date: Wed, 9 Apr 2025 10:35:31 -0300
+Subject: perf libunwind arm64: Fix missing close parens in an if statement
+
+From: Arnaldo Carvalho de Melo <acme@kernel.org>
+
+commit 1293dacbbd43ab9848ac4655f6f2ba1dcc5a96ad upstream.
+
+While testing building with libunwind (using LIBUNWIND=1) in various
+arches I noticed a problem on arm64, on an rpi5 system, a missing close
+parens in a change related to dso__data_get_fd() usage, fix it.
+
+Fixes: 5ac22c35aa8519f1 ("perf dso: Use lock annotations to fix asan deadlock")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: https://lore.kernel.org/r/Z_Z3o8KvB2i5c6ab@x1
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/unwind-libunwind-local.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/unwind-libunwind-local.c
++++ b/tools/perf/util/unwind-libunwind-local.c
+@@ -371,7 +371,7 @@ static int read_unwind_spec_debug_frame(
+ * has to be pointed by symsrc_filename
+ */
+ if (ofs == 0) {
+- if (dso__data_get_fd(dso, machine, &fd) {
++ if (dso__data_get_fd(dso, machine, &fd)) {
+ ofs = elf_section_offset(fd, ".debug_frame");
+ dso__data_put_fd(dso);
+ }
--- /dev/null
+From 35b16a7a2c4fc458304447128b86514ce9f70f3c Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 10 Mar 2026 13:59:51 -0400
+Subject: perf synthetic-events: Fix stale build ID in module MMAP2 records
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 35b16a7a2c4fc458304447128b86514ce9f70f3c upstream.
+
+perf_event__synthesize_modules() allocates a single union perf_event and
+reuses it across every kernel module callback.
+
+After the first module is processed, perf_record_mmap2__read_build_id()
+sets PERF_RECORD_MISC_MMAP_BUILD_ID in header.misc and writes that
+module's build ID into the event.
+
+On subsequent iterations the callback overwrites start, len, pid, and
+filename for the next module but never clears the stale build ID fields
+or the MMAP_BUILD_ID flag.
+
+When perf_record_mmap2__read_build_id() runs for the second module it
+sees the flag, reads the stale build ID into a dso_id, and
+__dso__improve_id() permanently poisons the DSO with the wrong build ID.
+
+Every module after the first therefore receives the first module's build
+ID in its MMAP2 record.
+
+On a system with the sunrpc and nfsd modules loaded, this causes perf
+script and perf report to show [unknown] for all module symbols.
+
+The latent bug has existed since commit d9f2ecbc5e47fca7 ("perf dso:
+Move build_id to dso_id") introduced the PERF_RECORD_MISC_MMAP_BUILD_ID
+check in perf_record_mmap2__read_build_id().
+
+Commit 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default")
+then exposed it to all users by making the MMAP2-with-build-ID path the
+default. Both commits were merged in the same series.
+
+Clear the MMAP_BUILD_ID flag and zero the build_id union before each
+call to perf_record_mmap2__read_build_id() so that every module starts
+with a clean slate.
+
+Fixes: d9f2ecbc5e47fca7 ("perf dso: Move build_id to dso_id")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/synthetic-events.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/tools/perf/util/synthetic-events.c
++++ b/tools/perf/util/synthetic-events.c
+@@ -702,6 +702,11 @@ static int perf_event__synthesize_module
+
+ memcpy(event->mmap2.filename, dso__long_name(dso), dso__long_name_len(dso) + 1);
+
++ /* Clear stale build ID from previous module iteration */
++ event->mmap2.header.misc &= ~PERF_RECORD_MISC_MMAP_BUILD_ID;
++ memset(event->mmap2.build_id, 0, sizeof(event->mmap2.build_id));
++ event->mmap2.build_id_size = 0;
++
+ perf_record_mmap2__read_build_id(&event->mmap2, args->machine, false);
+ } else {
+ size = PERF_ALIGN(dso__long_name_len(dso) + 1, sizeof(u64));
--- /dev/null
+From 9cb7e40d388d6c0e4677809c6b2950bc67fd8830 Mon Sep 17 00:00:00 2001
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+Date: Mon, 21 Oct 2024 11:32:28 -0700
+Subject: rtnetlink: Make per-netns RTNL dereference helpers to macro.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+commit 9cb7e40d388d6c0e4677809c6b2950bc67fd8830 upstream.
+
+When CONFIG_DEBUG_NET_SMALL_RTNL is off, rtnl_net_dereference() is the
+static inline wrapper of rtnl_dereference() returning a plain (void *)
+pointer to make sure net is always evaluated as requested in [0].
+
+But, it makes sparse complain [1] when the pointer has __rcu annotation:
+
+ net/ipv4/devinet.c:674:47: sparse: warning: incorrect type in argument 2 (different address spaces)
+ net/ipv4/devinet.c:674:47: sparse: expected void *p
+ net/ipv4/devinet.c:674:47: sparse: got struct in_ifaddr [noderef] __rcu *
+
+Also, if we evaluate net as (void *) in a macro, then the compiler
+in turn fails to build due to -Werror=unused-value.
+
+ #define rtnl_net_dereference(net, p) \
+ ({ \
+ (void *)net; \
+ rtnl_dereference(p); \
+ })
+
+ net/ipv4/devinet.c: In function ‘inet_rtm_deladdr’:
+ ./include/linux/rtnetlink.h:154:17: error: statement with no effect [-Werror=unused-value]
+ 154 | (void *)net; \
+ net/ipv4/devinet.c:674:21: note: in expansion of macro ‘rtnl_net_dereference’
+ 674 | (ifa = rtnl_net_dereference(net, *ifap)) != NULL;
+ | ^~~~~~~~~~~~~~~~~~~~
+
+Let's go back to the original simplest macro.
+
+Note that checkpatch complains about this approach, but it's one-shot and
+less noisy than the other two.
+
+ WARNING: Argument 'net' is not used in function-like macro
+ #76: FILE: include/linux/rtnetlink.h:142:
+ +#define rtnl_net_dereference(net, p) \
+ + rtnl_dereference(p)
+
+Fixes: 844e5e7e656d ("rtnetlink: Add assertion helpers for per-netns RTNL.")
+Link: https://lore.kernel.org/netdev/20241004132145.7fd208e9@kernel.org/ [0]
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202410200325.SaEJmyZS-lkp@intel.com/ [1]
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/rtnetlink.h | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/include/linux/rtnetlink.h
++++ b/include/linux/rtnetlink.h
+@@ -146,21 +146,12 @@ static inline void ASSERT_RTNL_NET(struc
+ ASSERT_RTNL();
+ }
+
+-static inline void *rcu_dereference_rtnl_net(struct net *net, void *p)
+-{
+- return rcu_dereference_rtnl(p);
+-}
+-
+-static inline void *rtnl_net_dereference(struct net *net, void *p)
+-{
+- return rtnl_dereference(p);
+-}
+-
+-static inline void *rcu_replace_pointer_rtnl_net(struct net *net,
+- void *rp, void *p)
+-{
+- return rcu_replace_pointer_rtnl(rp, p);
+-}
++#define rcu_dereference_rtnl_net(net, p) \
++ rcu_dereference_rtnl(p)
++#define rtnl_net_dereference(net, p) \
++ rtnl_dereference(p)
++#define rcu_replace_pointer_rtnl_net(net, rp, p) \
++ rcu_replace_pointer_rtnl(rp, p)
+ #endif
+
+ static inline struct netdev_queue *dev_ingress_queue(struct net_device *dev)
--- /dev/null
+From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 23 Jan 2026 10:37:49 -0800
+Subject: seqlock: fix scoped_seqlock_read kernel-doc
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit f88a31308db6a856229150039b0f56d59696ed31 upstream.
+
+Eliminate all kernel-doc warnings in seqlock.h:
+
+- correct the macro to have "()" immediately following the macro name
+- don't include the macro parameters in the short description (first line)
+- make the parameter names in the comments match the actual macro
+ parameter names.
+- use "::" for the Example
+
+WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment.
+ * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING:
+ Definition list ends without a blank line; unexpected unindent. [docutils]
+Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read'
+Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read'
+
+Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/seqlock.h | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -1277,15 +1277,14 @@ __scoped_seqlock_next(struct ss_tmp *sst
+ __scoped_seqlock_next(&_s, _seqlock, _target))
+
+ /**
+- * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+- * section without manual sequence
+- * counter handling or calls to other
+- * helpers
+- * @lock: pointer to seqlock_t protecting the data
+- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating
+- * the type of critical read section
++ * scoped_seqlock_read() - execute the read-side critical section
++ * without manual sequence counter handling
++ * or calls to other helpers
++ * @_seqlock: pointer to seqlock_t protecting the data
++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless}
++ * indicating the type of critical read section
+ *
+- * Example:
++ * Example::
+ *
+ * scoped_seqlock_read (&lock, ss_lock) {
+ * // read-side critical section
bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
perf-x86-amd-brs-fix-kernel-address-leakage.patch
dibs-loopback-validate-offset-and-size-in-move_data.patch
+perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch
+seqlock-fix-scoped_seqlock_read-kernel-doc.patch
+perf-callchain-handle-multiple-address-spaces.patch
+ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch
+rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch
+perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch
+net-airoha-fix-channel-configuration-for-ets-qdisc.patch
+jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch
+afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch
+afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch
+perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch
+crypto-ccp-fix-__sev_snp_shutdown_locked.patch
+crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch
+crypto-ccp-fix-snp-panic-notifier-unregistration.patch
+udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch
+bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch
+bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch
+crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch
+perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch
+i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch
+ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch
+crypto-ccp-fix-leaking-the-same-page-twice.patch
+perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch
+bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
+bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch
+bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch
+dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch
+perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch
--- /dev/null
+From c9e78afa688afec528784b79bb02d513cdcd6527 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 23 Jun 2025 12:53:55 +0200
+Subject: udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit c9e78afa688afec528784b79bb02d513cdcd6527 upstream.
+
+While configuring a vxlan tunnel in a system with a i40e NIC driver, I
+observe the following deadlock:
+
+ WARNING: possible recursive locking detected
+ 6.16.0-rc2.net-next-6.16_92d87230d899+ #13 Tainted: G E
+ --------------------------------------------
+ kworker/u256:4/1125 is trying to acquire lock:
+ ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e
+
+ but task is already holding lock:
+ ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&utn->lock);
+ lock(&utn->lock);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 4 locks held by kworker/u256:4/1125:
+ #0: ffff8892910ca158 ((wq_completion)udp_tunnel_nic){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3213)
+ #1: ffffc900244efd30 ((work_completion)(&utn->work)){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3214)
+ #2: ffffffff9a14e290 (rtnl_mutex){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:737) udp_tunnel
+ #3: ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel
+
+ stack backtrace:
+ Hardware name: Dell Inc. PowerEdge R7525/0YHMCJ, BIOS 2.2.5 04/08/2021
+i
+ Call Trace:
+ <TASK>
+ dump_stack_lvl (/home/pabeni/net-next/lib/dump_stack.c:123)
+ print_deadlock_bug (/home/pabeni/net-next/kernel/locking/lockdep.c:3047)
+ validate_chain (/home/pabeni/net-next/kernel/locking/lockdep.c:3901)
+ __lock_acquire (/home/pabeni/net-next/kernel/locking/lockdep.c:5240)
+ lock_acquire.part.0 (/home/pabeni/net-next/kernel/locking/lockdep.c:473 /home/pabeni/net-next/kernel/locking/lockdep.c:5873)
+ __mutex_lock (/home/pabeni/net-next/kernel/locking/mutex.c:604 /home/pabeni/net-next/kernel/locking/mutex.c:747)
+ i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e
+ udp_tunnel_nic_device_sync_by_port (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:230 /home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:249) udp_tunnel
+ __udp_tunnel_nic_device_sync.part.0 (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:292) udp_tunnel
+ udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:742) udp_tunnel
+ process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3243)
+ worker_thread (/home/pabeni/net-next/kernel/workqueue.c:3315 /home/pabeni/net-next/kernel/workqueue.c:3402)
+ kthread (/home/pabeni/net-next/kernel/kthread.c:464)
+
+AFAICS all the existing callsites of udp_tunnel_nic_set_port_priv() are
+already under the utn lock scope, avoid (re-)acquiring it in such a
+function.
+
+Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/95a827621ec78c12d1564ec3209e549774f9657d.1750675978.git.pabeni@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/udp_tunnel.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/net/udp_tunnel.h
++++ b/include/net/udp_tunnel.h
+@@ -323,9 +323,8 @@ udp_tunnel_nic_set_port_priv(struct net_
+ unsigned int idx, u8 priv)
+ {
+ if (udp_tunnel_nic_ops) {
+- udp_tunnel_nic_ops->lock(dev);
++ udp_tunnel_nic_ops->assert_locked(dev);
+ udp_tunnel_nic_ops->set_port_priv(dev, table, idx, priv);
+- udp_tunnel_nic_ops->unlock(dev);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
